# US 2014/0156534 A1 · Method for securely storing and forwarding payment transactions

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2014/0156534 A1
- Document ID: US20140156534A1
- Status: Published application
- Kind: A1
- Application number: 13/736,447
- Filed: 2013-01-08
- Published: 2014-06-05
- Earliest claimed: 2012-12-05
- Inventors: Sam Quigley; Justin Cummins; Eric Bolton; Nathan McCauley; Alexey Klinichenko
- Web page: https://patentgrep.com/patent/US20140156534A1

## CPC

- G06Q 20/3829: {involving key management}
- G06Q 20/34: using cards, e.g. integrated circuit [IC] cards or magnetic cards
- G06Q 20/40: Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR

## Abstract

Method, systems, and apparatus for receiving transaction data for the payment transaction, where the transaction data includes at least card track data; encrypting the transaction data at the data processing apparatus using an encryption key of a cryptographic key pair to generate encrypted transaction data, where the cryptographic key pair includes the encryption key and a decryption key; storing a plurality of copies of the encrypted transaction data in a plurality of storage devices; receiving an instruction to submit the transaction data for processing; decrypting the encrypted transaction data using the decryption key; and submitting the transaction data for processing by an issuer.

## Claims

### Claim 1

A method of processing a payment transaction at data processing apparatus, comprising:
receiving transaction data for the payment transaction, where the transaction data includes at least card track data;
encrypting the transaction data at the data processing apparatus using an encryption key of a cryptographic key pair to generate encrypted transaction data, where the cryptographic key pair includes the encryption key and a decryption key;
storing a plurality of copies of the encrypted transaction data in a plurality of storage devices;
receiving an instruction to submit the transaction data for processing;
decrypting the encrypted transaction data using the decryption key; and
submitting the transaction data for processing by an issuer.

### Claim 2 (depends on 1)

The method of claim 1, further comprising:
receiving, from the issuer, an indication the encrypted transaction data has been processed; and
in response to receiving the indication, deleting the decryption key.

### Claim 3 (depends on 2)

The method of claim 2, further comprising purging the encrypted transaction data from the data processing apparatus.

### Claim 4 (depends on 1)

The method of claim 1, further comprising:
identifying transaction data that is encrypted by the encryption key;
determining the encryption key is not being used to encrypt new transactions;
determining the transaction data has been processed by the issuer;
decrypting the transaction data using the decryption key;
deleting the decryption key;
generating a new cryptographic key pair, where the new cryptographic key pair includes a new encryption key and a new decryption key; and
encrypting the decrypted transaction data using the new encryption key.

### Claim 5 (depends on 1)

The method of claim 1, where prior to the encrypting, generating the cryptographic key pair.

### Claim 6 (depends on 1)

The method of claim 1, where the transaction data includes data stored on a magnetic stripe of a card.

### Claim 7 (depends on 1)

The method of claim 1, where the transaction data includes data from a plurality of transactions.

### Claim 8 (depends on 1)

The method of claim 1, where the cryptographic key pair expires within a period of time.

### Claim 9 (depends on 1)

The method of claim 1, where the instruction is received periodically until the data processing apparatus receives the indication from the issuer.

### Claim 10 (depends on 1)

The method of claim 1, where each storage device is in a distinct geographic location.

### Claim 11 (depends on 1)

The method of claim 1, where the decryption key is stored in a hardware security module.

### Claim 12

A system comprising:
a processor; and
computer-readable medium coupled to the processor and having instructions stored thereon, which, when executed by the processor, cause the processor to perform operations comprising:
receiving transaction data for the payment transaction, where the transaction data includes at least card track data;
encrypting the transaction data at the data processing apparatus using an encryption key of a cryptographic key pair to generate encrypted transaction data, where the cryptographic key pair includes the encryption key and a decryption key;
storing a plurality of copies of the encrypted transaction data in a plurality of storage devices;
receiving an instruction to submit the transaction data for processing;
decrypting the encrypted transaction data using the decryption key; and
submitting the transaction data for processing to an issuer.

### Claim 13 (depends on 12)

The system of claim 12, further comprising:
receiving, from the issuer, an indication the encrypted transaction data has been processed; and
in response to receiving the indication, deleting the decryption key.

### Claim 14 (depends on 13)

The system of claim 13, further comprising purging the encrypted transaction data from the data processing apparatus.

### Claim 15 (depends on 12)

The system of claim 12, further comprising:
identifying transaction data that is encrypted by the encryption key;
determining the encryption key is not being used to encrypt new transactions;
determining the transaction data has been processed by the issuer;
decrypting the transaction data using the decryption key;
deleting the decryption key;
generating a new cryptographic key pair, where the new cryptographic key pair includes a new encryption key and a new decryption key; and
encrypting the decrypted transaction data using the new encryption key.

### Claim 16 (depends on 12)

The system of claim 12, where prior to the encrypting, generating the cryptographic key pair.

### Claim 17 (depends on 12)

The system of claim 12, where the transaction data includes data stored on a magnetic stripe of a card.

### Claim 18 (depends on 12)

The system of claim 12, where the transaction data includes data from a plurality of transactions.

### Claim 19 (depends on 12)

The system of claim 12, where the cryptographic key pair expires within a period of time.

### Claim 20 (depends on 12)

The system of claim 12, where the instruction is received periodically until the data processing apparatus receives the indication from the issuer.

### Claim 21 (depends on 12)

The system of claim 12, where each storage device is in a distinct geographic location.

### Claim 22 (depends on 12)

The system of claim 12, where the decryption key is stored in a hardware security module.

### Claim 23

A computer-readable medium having instructions stored thereon, which, when executed by a processor, cause the processor to perform operations comprising:
receiving transaction data for the payment transaction, where the transaction data includes at least card track data;
encrypting the transaction data at the data processing apparatus using an encryption key of a cryptographic key pair to generate encrypted transaction data, where the cryptographic key pair includes the encryption key and a decryption key;
storing a plurality of copies of the encrypted transaction data in a plurality of storage devices;
receiving an instruction to submit the transaction data for processing;
decrypting the encrypted transaction data using the decryption key; and
submitting the transaction data for processing to an issuer.

### Claim 24 (depends on 23)

The computer-readable medium of claim 23, further comprising:
receiving, from the issuer, an indication the encrypted transaction data has been processed; and
in response to receiving the indication, deleting the decryption key.

### Claim 25 (depends on 24)

The computer-readable medium of claim 24, further comprising purging the encrypted transaction data from the data processing apparatus.

### Claim 26 (depends on 23)

The computer-readable medium of claim 23, further comprising:
identifying transaction data that is encrypted by the encryption key;
determining the encryption key is not being used to encrypt new transactions;
determining the transaction data has been processed by the issuer;
decrypting the transaction data using the decryption key;
deleting the decryption key;
generating a new cryptographic key pair, where the new cryptographic key pair includes a new encryption key and a new decryption key; and
encrypting the decrypted transaction data using the new encryption key.

### Claim 27 (depends on 23)

The computer-readable medium of claim 23, where prior to the encrypting, generating the cryptographic key pair.

### Claim 28 (depends on 23)

The computer-readable medium of claim 23, where the transaction data includes data stored on a magnetic stripe of a card.

### Claim 29 (depends on 23)

The computer-readable medium of claim 23, where the transaction data includes data from a plurality of transactions.

### Claim 30 (depends on 23)

The computer-readable medium of claim 23, where the cryptographic key pair expires within a period of time.

### Claim 31 (depends on 23)

The computer-readable medium of claim 23, where the instruction is received periodically until the data processing apparatus receives the indication from the issuer.

### Claim 32 (depends on 23)

The computer-readable medium of claim 23, where each storage device is in a distinct geographic location.

### Claim 33 (depends on 23)

The computer-readable medium of claim 23, where the decryption key is stored in a hardware security module.