Payment system

A method comprising:

• receiving, by a user device via a communication network, a first session key different from a Master Key from a remote entity, the first session key based on the Master Key stored at the remote entity, wherein the first session key is usable for a limited number of one or more transactions;
• in response to receiving the first session key, storing the first session key;
• in response to storing the first session key, provisioning a payment application in the user device with the first session key;
• receiving, at the payment application, a request for an application cryptogram, wherein the request is from a point-of-sale terminal;
• in response to the receiving the request for the application cryptogram, generating, by the payment application, the application cryptogram using the received first session key;
• transmitting, by the payment application, the generated application cryptogram to the point-of-sale terminal;
• receiving, by the user device via the communication network, a second session key from the remote entity, the second session key based on the Master Key stored at the remote entity, the second session key being different from the first session key and the Master Key;
• and
• storing, by the user device, the second session key.

A user device comprising:

• a processor;
• and
• a non-transitory computer readable medium comprising code, executable by the processor, for implementing operations including:
• receiving, by the user device via a communication network, a first session key different from a Master Key from a remote entity, the first session key based on the Master Key stored at the remote entity, wherein the first session key is usable for a limited number of one or more transactions;
• in response to receiving the first session key, storing the first session key;
• in response to storing the first session key, provisioning a payment application in the user device with the first session key;
• receiving, at the payment application, a request for an application cryptogram, wherein the request is from a point-of-sale terminal;
• in response to the receiving the request for the application cryptogram, generating, by the payment application, the application cryptogram based on the received first session key;
• transmitting, by the payment application, the generated application cryptogram to the point-of-sale terminal;
• receiving, by the user device via the communication network, a second session key from the remote entity, the second session key based on the Master Key stored at the remote entity, the second session key being different from the first session key and the Master Key;
• and
• storing, by the user device, the second session key.