# US 12,112,320 B2 · Method and system of authenticating a payment transaction using a user device > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,112,320 B2 - Document ID: US12112320B2 - Status: Granted - Kind: B2 - Application number: 18/377,057 - Filed: 2023-10-05 - Published: 2024-01-25 - Granted: 2024-10-08 - Earliest claimed: 2020-12-29 - Assignees: Visa International Service Association - Applicants: Visa International Service Association - Inventors: Rohit Sukhija; Pragathi M S; Hemanth Kumar Manoharan - Web page: https://patentgrep.com/patent/US12112320B2 ## CPC - G06Q 20/3821: {Electronic credentials} - G06Q 20/4014: {Identity check for transactions} - G06Q 20/227: {characterised in that multiple accounts are available, e.g. to the payer} - G06Q 20/3226: {Use of secure elements separate from M-devices} - G06Q 20/3229: {Use of the SIM of a M-device as secure element} - G06Q 20/326: {Payment applications installed on the mobile devices} - G06Q 20/38215: {Use of certificates or encrypted proofs of transaction rights} - G06Q 20/3823: {combining multiple encryption tools for a transaction} - G06Q 20/3829: {involving key management} - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR ## Abstract A method and system for authenticating a payment transaction. The method includes receiving a request for verifying a phone number associated with a Subscriber Identification Module card from a merchant application installed in the user device. Further, obtaining a first key from at least one of a server associated with a manufacturer of the user device and a network server. Furthermore, generating a first cryptogram based on at least one of the phone number and a unique identification value associated with the user device using the first key, wherein the first cryptogram is provided to the server associated with the manufacturer for verification. Upon verification of the first cryptogram, the method includes receiving a second cryptogram from the server associated with the manufacturer, wherein the merchant application provides the second cryptogram and payment transaction details to an issuer server for authentication of the payment transaction. ## Claims ### Claim 1 A computer-implemented method, comprising: receiving, by at least one server, a request for a key from a user device in response to the user device receiving a request for verifying a phone number associated with a Subscriber Identification Module (SIM) card in the user device from a merchant application of the user device, the request for verifying the phone number being received by the user device in response to a selection of a payment card of a plurality of payment cards stored in the merchant application for a payment transaction between a user of the user device and a merchant associated with the merchant application; communicating, by the at least one server, the key to the user device in response to receiving the request for the key, wherein communicating the key comprises one of: communicating a first key to the user device, the first key generated by the at least one server in real-time using one or more cryptographic techniques, wherein the key comprises the first key; communicating a second key to the user device, the second key generated by the at least one server and stored in a memory associated with the user device during manufacturing of the user device, wherein the key comprises the second key; or communicating the request for the key to at least one other server, receiving a third key from the at least one other server, and communicating the third key to the user device, wherein the at least one other server generated the third key in real-time using the one or more cryptographic techniques, wherein the key comprises the third key; receiving, by the at least one server, a first cryptogram generated based on the phone number using the key and a safety attestation certificate indicating integrity of the user device from the user device; verifying, by the at least one server, the first cryptogram and the safety attestation certificate; and communicating, by the at least one server, a second cryptogram to the user device, wherein the second cryptogram and payment transaction details are provided by the merchant application to an issuer server for authentication of the payment transaction. ### Claim 2 (depends on 1) The method of claim 1, wherein the first cryptogram is generated based on one or more encryption techniques using at least one of the phone number and a unique identification value associated with the user device and the first key. ### Claim 3 (depends on 1) The method of claim 1, wherein receiving the first cryptogram triggers the at least one server to decrypt the first cryptogram using the key and one or more decryption techniques corresponding to one or more encryption techniques used to generate the first cryptogram and to validate the phone number and a unique identification value associated with the user device based on user information stored in a database corresponding to the at least one server. ### Claim 4 (depends on 1) The method of claim 1, wherein the second cryptogram is generated by the at least one server using a further key based on at least one of the phone number and a unique identification value associated with the user device, wherein the further key is obtained from the at least one other server. ### Claim 5 (depends on 4) The method of claim 4, wherein the issuer server communicates an authentication response after authentication of the payment transaction, wherein the authentication of the payment transaction comprises: decrypting, by the issuer server, the second cryptogram using the further key, wherein the further key is obtained from the network server; validating, by the issuer server, the phone number associated with the user device based on payer information stored in a database associated with the issuer server; and communicating, by the issuer server, the authentication response based on a result of the validation. ### Claim 6 (depends on 1) The method of claim 1, wherein the second cryptogram and the payment transaction details are provided to the issuer server via at least one of the following: the at least one other server, a direct integration with the issuer server, an Access Control Server (ACS), a Merchant Plug-In (MPI) provider, or any combination thereof. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, wherein a unique identification value comprises at least an International Mobile Equipment Identity (IMEI) number associated with the user device. ### Claim 8 A system, comprising: at least one processor; and at least one non-transitory computer-readable medium comprising one or more instructions that, when executed by the at least one processor, cause the at least one processor to: receive a request for a key from a user device in response to the user device receiving a request for verifying a phone number associated with a Subscriber Identification Module (SIM) card in the user device from a merchant application of the user device, the request for verifying the phone number being received by the user device in response to a selection of a payment card of a plurality of payment cards stored in the merchant application for a payment transaction between a user of the user device and a merchant associated with the merchant application; communicate the key to the user device in response to receiving the request for the key, wherein, when communicating the key the one or more instructions cause the at least one processor to: communicate a first key to the user device, the first key generated in real-time using one or more cryptographic techniques, wherein the key comprises the first key; communicate a second key to the user device, the second key generated and stored in a memory associated with the user device during manufacturing of the user device, wherein the key comprises the second key; or communicate the request for the key to at least one server, receiving a third key from the at least one server, and communicating the third key to the user device, wherein the at least one server generated the third key in real-time using the one or more cryptographic techniques, wherein the key comprises the third key; receive a first cryptogram generated based on the phone number using the key and a safety attestation certificate indicating integrity of the user device from the user device; verify the first cryptogram and the safety attestation certificate; and communicate a second cryptogram to the user device, wherein the second cryptogram and payment transaction details are provided by the merchant application to an issuer server for authentication of the payment transaction. ### Claim 9 (depends on 8) The system of claim 8, wherein the first cryptogram is generated based on one or more encryption techniques using at least one of the phone number and a unique identification value associated with the user device and the first key. ### Claim 10 (depends on 8) The system of claim 8, wherein receiving the first cryptogram triggers decrypting of the first cryptogram using the key and one or more decryption techniques corresponding to one or more encryption techniques used to generate the first cryptogram and to validate the phone number and a unique identification value associated with the user device based on user information stored in a database. ### Claim 11 (depends on 8) The system of claim 8, wherein the second cryptogram is generated using a further key based on at least one of the phone number and a unique identification value associated with the user device, wherein the further key is obtained from the at least one server. ### Claim 12 (depends on 11) The system of claim 11, wherein the issuer server communicates an authentication response after authentication of the payment transaction, wherein, when authenticating the payment transaction, the one or more instructions cause the at least one processor to: decrypt the second cryptogram using the further key, wherein the further key is obtained from the network server; validate the phone number associated with the user device based on payer information stored in a database associated with the issuer server; and communicate the authentication response based on a result of the validation. ### Claim 13 (depends on 1, 8) The system of claim 8, The method of claim 1, wherein the second cryptogram and the payment transaction details are provided to the issuer server via at least one of the following: the at least one server, a direct integration with the issuer server, an Access Control Server (ACS), a Merchant Plug-In (MPI) provider, or any combination thereof. ### Claim 14 (depends on 8) The system of claim 8, wherein a unique identification value comprises at least an International Mobile Equipment Identity (IMEI) number associated with the user device. ### Claim 15 A computer program product comprising at least one non-transitory computer-readable medium comprising one or more instructions that, when executed by at least one processor, cause the at least one processor to: receive a request for a key from a user device in response to the user device receiving a request for verifying a phone number associated with a Subscriber Identification Module (SIM) card in the user device from a merchant application of the user device, the request for verifying the phone number being received by the user device in response to a selection of a payment card of a plurality of payment cards stored in the merchant application for a payment transaction between a user of the user device and a merchant associated with the merchant application; communicate the key to the user device in response to receiving the request for the key, wherein, when communicating the key the one or more instructions cause the at least one processor to: communicate a first key to the user device, the first key generated in real-time using one or more cryptographic techniques, wherein the key comprises the first key; communicate a second key to the user device, the second key generated and stored in a memory associated with the user device during manufacturing of the user device, wherein the key comprises the second key; or communicate the request for the key to at least one server, receiving a third key from the at least one server, and communicating the third key to the user device, wherein the at least one server generated the third key in real-time using the one or more cryptographic techniques, wherein the key comprises the third key; receive a first cryptogram generated based on the phone number using the key and a safety attestation certificate indicating integrity of the user device from the user device; verify the first cryptogram and the safety attestation certificate; and communicate a second cryptogram to the user device, wherein the second cryptogram and payment transaction details are provided by the merchant application to an issuer server for authentication of the payment transaction. ### Claim 16 (depends on 15) The computer program product of claim 15, wherein the first cryptogram is generated based on one or more encryption techniques using at least one of the phone number and a unique identification value associated with the user device and the first key. ### Claim 17 (depends on 15) The computer program product of claim 15, wherein receiving the first cryptogram triggers decrypting of the first cryptogram using the key and one or more decryption techniques corresponding to one or more encryption techniques used to generate the first cryptogram and to validate the phone number and a unique identification value associated with the user device based on user information stored in a database. ### Claim 18 (depends on 15) The computer program product of claim 15, wherein the second cryptogram is generated using a further key based on at least one of the phone number and a unique identification value associated with the user device, wherein the further key is obtained from the at least one server. ### Claim 19 (depends on 18) The computer program product of claim 18, wherein the issuer server communicates an authentication response after authentication of the payment transaction, wherein, when authenticating the payment transaction, the one or more instructions cause the at least one processor to: decrypt the second cryptogram using the further key, wherein the further key is obtained from the network server; validate the phone number associated with the user device based on payer information stored in a database associated with the issuer server; and communicate the authentication response based on a result of the validation. ### Claim 20 (depends on 15) The computer program product of claim 15, wherein the second cryptogram and the payment transaction details are provided to the issuer server via at least one of the following: the at least one server, a direct integration with the issuer server, an Access Control Server (ACS), a Merchant Plug-In (MPI) provider, or any combination thereof.