Back to results
US 12,725,148 B2Granted
Techniques for securely communicating sensitive data
AssigneeVisa International Service Association
InventorsSimon Hurry, Christian Aabye
Life of this patent
Estimating the term…
Abstract
Systems and methods are disclosed for securely communicating sensitive such as an identifier. An encrypted value may be generated utilizing at least a portion of the identifier, a dynamic value, and an encryption key. An obfuscated identifier may be generated using at least a portion of the unencrypted identifier and a portion of the encrypted value. The obfuscated identifier and the encrypted value may be provided in a message to inhibit potential fraudsters from obtaining the identifier.
Claims16
A computer-implemented method, comprising:
- obtaining, by a device, a unique derivation key;
- obtaining, by the device, a dynamic value;
- concatenating an identifier and the dynamic value to generate a concatenated value;
- generating an encrypted identifier based on encrypting the concatenated value by inputting the unique derivation key and the identifier into an encryption algorithm, the identifier being a 16-digit primary account identifier;
- generating, by the device, an obfuscated identifier based at least in part on a portion of the identifier and a portion of the encrypted identifier, the obfuscated identifier maintaining routing information of the 16-digit primary account identifier;
- providing, by the device, the obfuscated identifier to an access device, causing the access device to populate a first data field of an authorization request message with the obfuscated identifier prior to transmitting the authorization request message to a central server computer, the first data field being previously associated with identifying primary account identifiers, wherein populating the first data field with the obfuscated identifier maintains the ability to utilize checksum algorithm-based error checking for the first data field;
- and
- providing, by the device, the encrypted identifier to the access device, causing the access device to populate a second data field of the authorization request message with the encrypted identifier prior to transmitting the authorization request message to the central server computer, wherein populating the second data field with the encrypted identifier instead of the first data field reduces an ability of a nefarious actor to identify the 16-digit primary account identifier from the authorization request message or to track the 16-digit primary account identifier across authorization request messages.
5 more elements
A computing device, comprising:
- one or more processors;
- and
- one or more memories storing computer-executable instructions, wherein executing the computer-executable instructions by the one or more processors, causes the computing device to:
- obtain a unique derivation key;
- obtain a dynamic value;
- concatenate an identifier and the dynamic value to generate a concatenated value;
- generate an encrypted identifier based on encrypting the concatenated value by inputting the unique derivation key and the identifier into an encryption algorithm, the identifier being a 16-digit primary account identifier;
- generate an obfuscated identifier based at least in part on a portion of the identifier and a portion of the encrypted identifier, the obfuscated identifier maintaining routing information of the 16-digit primary account identifier;
- provide the obfuscated identifier to an access device, causing the access device to populate a first data field of an authorization request message with the obfuscated identifier prior to transmitting the authorization request message to a central server computer, the first data field being previously associated with identifying primary account identifiers, wherein populating the first data field with the obfuscated identifier maintains the ability to utilize checksum algorithm-based error checking for the first data field;
- and
- provide the encrypted identifier to the access device, causing the access device to populate a second data field of the authorization request message with the encrypted identifier prior to transmitting the authorization request message to the central server computer, wherein populating the second data field with the encrypted identifier instead of the first data field reduces an ability of a nefarious actor to identify the 16-digit primary account identifier from the authorization request message or to track the 16-digit primary account identifier across authorization request messages.
8 more elements
Dependencies are inferred from the claim text.