# US 2018/0025332 A1 · Transaction facilitation

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2018/0025332 A1
- Document ID: US20180025332A1
- Status: Published application
- Kind: A1
- Application number: 15/627,793
- Filed: 2017-06-20
- Published: 2018-01-25
- Earliest claimed: 2016-07-20
- Assignees: Mastercard Asia/Pacific Pte. Ltd.
- Applicants: MasterCard Asia/Pacific Pte. Ltd.
- Inventors: Donghao Huang; Naman Aggarwal; Kshama Jha; Yong How Chin; Jie Zhang; Dekai Zhang
- Web page: https://patentgrep.com/patent/US20180025332A1

## CPC

- G06Q 20/10: specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
- G06Q 20/027: {involving a payment switch or gateway}
- G06Q 20/322: {Aspects of commerce using mobile devices [M-devices]}
- G06Q 20/3223: {Realising banking transactions through M-devices}
- G06Q 20/325: {using wireless networks}
- G06Q 20/3672: {initialising or reloading thereof}
- G06Q 20/3674: {involving authentication}
- G06Q 20/3829: {involving key management}
- G06Q 20/40: Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
- H04L 9/0822: {using key encryption key}
- H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates}
- H04L 9/083: {involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]}
- H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords}
- H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)}
- H04L 9/3234: {involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853)}
- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- H04L 63/061: {for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838)}
- H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)}
- H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint}
- H04W 12/02: Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
- H04W 12/033: of the user plane, e.g. user's traffic
- H04W 12/041: Key generation or derivation
- H04W 12/0471: Key exchange
- H04W 12/062: Pre-authentication
- H04W 12/065: Continuous authentication
- H04W 12/068: {using credential vaults, e.g. password manager applications or one time password [OTP] applications}
- H04W 12/069: using certificates or pre-shared keys
- H04L 2209/56: Financial cryptography, e.g. electronic payment or e-cash
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

A system for facilitating a payment using a client application executed by a client device, the system including one or more processing devices in communication with the client device via a communications network, wherein the one or more processing devices execute processing device software that cause the one or more processing devices to communicate with the client application to establish a transaction session having a session access token and a session key, receive requests from the client application, at least some of the requests including the access token a payload encrypted at least in part using the session key, decrypt the payload at least in part using the session key, process the requests at least in part using the access token and in accordance the decrypted payload, to thereby allow at least one action to be performed, the at least one action forming part of a payment process and provide any required response to the client application.

## Claims

### Claim 1

A system for facilitating a payment using a client application executed by a client device, the system including one or more processing devices in communication with the client device via a communications network, wherein the one or more processing devices execute processing device software that cause the one or more processing devices to:
a) communicate with the client application to establish a transaction session having:
i) a session access token; and,
ii) a session key;
b) receive requests from the client application, at least some of the requests including the access token;
c) process the requests at least in part using the access token, to thereby allow at least one action to be performed, the at least one action forming part of a payment process; and,
d) provide any required response to the client application.

### Claim 2 (depends on 1)

A system according to claim 1, wherein the requests from the client application further including an encrypted payload, the payload being encrypted at least in part using the session key.

### Claim 3 (depends on 2)

A system according to claim 2, wherein the one or more processing devices execute processing device software that further cause the one or more processing devices to decrypt the payload at least in part using the session key.

### Claim 4 (depends on 1)

A system according to claim 1, wherein the one or more processing devices:
a) receive a request;
b) validate the access token associated with the request; and
c) selectively perform actions in accordance with an outcome of the validation.

### Claim 5 (depends on 1)

A system according to claim 1, wherein the one or more processing devices:
a) receive a session initiation request from the client application including:
i) a device identifier of the client device; and,
ii) a public session key generated by the client application;
b) generate an access token; and,
c) provide a session initiation response to the client application including a processing device public key and the access token.

### Claim 6 (depends on 5)

A system according to claim 5, wherein the one or more processing devices store session data including an indication of the device identifier and the access token, and wherein the one or more processing devices validate the access token by comparing at least one of the access token and the device identifier associated with a request to the session data.

### Claim 7 (depends on 5)

A system according to claim 5, wherein the one or more processing devices:
a) generate a refresh token; and,
b) provide a session initiation response including the refresh token,
wherein the client application:
c) determines if the access token has expired; and,
d) if the access token has expired, provides an access token request including a refresh token to the one or more processing devices, the one or more processing devices being responsive to the access token request to:
i) validate the refresh token;
ii) generate a new access token in accordance with an outcome of the validation; and,
iii) provide an access token response including the new access token to the client application.

### Claim 8 (depends on 1)

A system according to claim 1, wherein the one or more processing devices:
a) determine if authentication has been performed;
b) selectively perform actions depending on an outcome of the determination;
c) receive an authentication request, the authentication request being generated by the client application at least partially in accordance with authentication information provided by a user; and,
d) selectively perform authentication using the authentication request.

### Claim 9 (depends on 8)

A system according to claim 8, wherein the one or more processing devices perform authentication by comparing the authentication information to previously stored authentication information, and stores an indication of an authentication status associated with the access token.

### Claim 10 (depends on 8)

A system according to claim 8, wherein the one or more processing devices:
a) determine the access token associated with a request; and,
b) determine if authentication has been performed at least partially in accordance with an authentication status associated with the access token.

### Claim 11 (depends on 1)

A system according to claim 1, wherein the session key includes a public session and a private session key of a session key pair, the session key pair being generated for each transaction session by the client application.

### Claim 12 (depends on 11)

A system according to claim 11, wherein each payload is encrypted and decrypted using a one-time symmetric key derived using the session key,
each one-time symmetric key being generated using:
a) an initialisation vector; and,
b) at least one of:
i) a private session key and a processing device public key;
ii) a public session key and a processing device private key.

### Claim 13 (depends on 12)

A system according to claim 12, wherein the client application:
a) generates an initialisation vector;
b) generates a one-time symmetric key using the initialisation vector, the private session key and the processing device public key;
c) encrypts a payload using the symmetric key to generate an encrypted payload; and,
d) provides a request including the encrypted payload and the initialisation vector, and wherein the one or more processing devices are responsive to the request to:
i) generate the one-time symmetric key using the received initialisation vector, the public session key and the processing device private key; and,
ii) use the one-time symmetric key to decrypt the encrypted payload.

### Claim 14 (depends on 12)

A system according to claim 12, wherein the one or more processing devices:
a) generate an initialisation vector;
b) generate the one-time symmetric key using the initialisation vector, the public session key and the processing device private key;
c) encrypt a payload using the symmetric key to generate an encrypted payload; and,
d) provide a response including the encrypted payload and the initialisation vector, the client application being responsive to the response to:
i) generate the one-time symmetric key using the received initialisation vector, the private session key and the processing device public key; and,
ii) use the one-time symmetric key to decrypt the encrypted payload.

### Claim 15 (depends on 1)

A system according to claim 1, wherein the processing device software is middleware that interfaces with a payment system, and provides the client application with access to supported features of the payment system.

### Claim 16 (depends on 15)

A system according to claim 15, wherein the payment system is at least one of:
a) a payment gateway; and,
b) a payment system implemented by a payment service provider.

### Claim 17 (depends on 15)

A system according to claim 15, wherein the processing device software is an API to the payment system, and wherein the requests and responses correspond to API calls.

### Claim 18 (depends on 1)

A system according to claim 1, wherein the system is used for making peer-to-peer payments.

### Claim 19

A payment method for facilitating a payment using a client application executed by a client device and one or more processing devices in communication with the client device via a communications network, wherein the one or more processing devices execute processing device software, and wherein the method includes causing the one or more processing devices to:
a) communicate with the client application to establish a transaction session having:
i) a session access token; and,
ii) a session key;
b) receive requests from the client application, each request including
the access token;
c) process the requests to thereby allow at least one action to be performed in accordance with the requests, the at least one action including causing a payment to be performed; and,
d) provide any required response to the client application, each request including a payload encrypted at least in part using the session key.

### Claim 20 (depends on 19)

A payment method according to claim 19, wherein the requests from the client application further including an encrypted payload, the payload being encrypted at least in part using the session key.

### Claim 21 (depends on 20)

A payment method according to claim 20, further causing the one or more processing devices to decrypt the payload at least in part using the session key.