# US 2018/0026962 A1 · Tokenized account information with integrated authentication

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2018/0026962 A1
- Document ID: US20180026962A1
- Status: Published application
- Kind: A1
- Application number: 15/218,927
- Filed: 2016-07-25
- Published: 2018-01-25
- Earliest claimed: 2016-07-25
- Assignees: CA, Inc.
- Applicants: CA, Inc.
- Inventors: Mohammed Mujeeb Kaladgi; Jameel Ahmed Kaladgi; Mohammad Faiz Usmani; Ruqiya Nikhat Kaladgi; Junaid Ahmed Jameel
- Web page: https://patentgrep.com/patent/US20180026962A1

## CPC

- H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)}
- G06F 21/30: Authentication, i.e. establishing the identity or authorisation of security principals
- G06F 21/335: {for accessing specific resources, e.g. using Kerberos tickets}
- G06F 21/43: wireless channels
- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- H04L 63/0435: {wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06)}
- H04L 63/061: {for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838)}
- H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)}
- H04L 63/0838: {using one-time-passwords}
- H04L 63/0846: {using time-dependent-passwords, e.g. periodically changing passwords}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Techniques are disclosed relating to tokenized account information with integrated authentication. In some embodiments, a shared secret key is used for tokenization and authentication. In some embodiments, a payment device stores an encrypted version of the secret key and decrypts the secret key based on a user-provided password. In some embodiments, the payment device uses the secret key and a moving factor to generate a limited-use password. In some embodiments, the payment device uses the limited-use password to modify a first identifier of an account of the user. In some embodiments, the authentication system retrieves a stored version of the secret key and a copy of the account number using a second identifier. In some embodiments, the authentication system generates the limited-use password based on the stored secret key and a moving factor, de-tokenizes the modified first identifier, and compares the result with the retrieved copy of the account number.

## Claims

### Claim 1

An apparatus, comprising:
one or more processing elements; and
one or more memories having program instructions stored thereon that are executable by the one or more processing elements to:
access first and second identifiers associated with an account of a user;
decrypt, using a password, a first instance of a secret key, wherein the first instance of the secret key is encrypted;
generate, based on the secret key and a current time of day, a limited-use password;
generate, using the limited-use password, a modified version of the first identifier; and
transmit the modified first identifier and the second identifier to a transaction processing system configured to:
retrieve, using the second identifier, a second instance of the secret key and a copy of the first identifier;
use the second instance of the secret key to reconstruct the first identifier from the modified first identifier; and
authenticate a transaction of the user based on a comparison of the reconstructed first identifier to the retrieved copy of the first identifier.

### Claim 2 (depends on 1)

The apparatus of claim 1, wherein the first identifier is an account number of a transaction instrument and wherein the second identifier is another identifier of the transaction instrument.

### Claim 3 (depends on 1)

The apparatus of claim 1, wherein the first instance of the secret key is encrypted such that attempted decryption using one or more invalid user passwords produces one or more corresponding invalid secret keys that are in the same format as a valid decryption of the secret key.

### Claim 4 (depends on 1)

The apparatus of claim 1, wherein to generate the modified version of the first identifier, program instructions are executable to perform an arithmetic operation that uses a portion of first identifier and the limited-use password as inputs and provides a modified portion of the first identifier as an output.

### Claim 5 (depends on 1)

The apparatus of claim 1, wherein the program instructions are further executable to generate the limited-use password using open authentication (OATH) techniques.

### Claim 6 (depends on 1)

The apparatus of claim 1, wherein the limited-use password is a one-time password.

### Claim 7 (depends on 1)

The apparatus of claim 1, wherein the apparatus is a point-of-sale device configured to receive the first and second identifiers and the first instance of the secret key from a mobile device of the user.

### Claim 8

A non-transitory computer-readable medium having instructions stored thereon that are executable by a computing device to perform operations comprising:
storing or receiving first and second identifiers associated with an account of a user;
decrypting, using a password, an encrypted first instance of a secret key;
generating, based on the secret key and a moving factor, a limited-use password;
generating, using the limited-use password, a modified version of the first identifier; and
transmitting the modified first identifier and the second identifier to a transaction processing system configured to:
retrieve, using the second identifier, a second instance of the secret key and a copy of the first identifier;
use the retrieved second instance of the secret key and the moving factor to reconstruct the first identifier from the modified first identifier; and
authenticate a transaction of the user based on a comparison of the reconstructed first identifier to the retrieved copy of the first identifier.

### Claim 9 (depends on 8)

The non-transitory computer-readable medium of claim 8, wherein the first identifier is an account number of a transaction instrument and wherein the second identifier is another identifier of the transaction instrument.

### Claim 10 (depends on 8)

The non-transitory computer-readable medium of claim 8, wherein the limited-use password is a one-time password.

### Claim 11 (depends on 8)

The non-transitory computer-readable medium of claim 8, wherein the first instance of the secret key is encrypted using cryptographic camouflage such that attempted decryption using one or more invalid user passwords produces one or more corresponding invalid secret keys that are in the same format as a valid decryption of the secret key.

### Claim 12 (depends on 8)

The non-transitory computer-readable medium of claim 8, wherein generating the modified version of the first identifier includes adding the limited-use password to a portion of the first identifier.

### Claim 13 (depends on 8)

The non-transitory computer-readable medium of claim 8, wherein the computing device is a point-of-sale device configured to communicate wirelessly with a mobile device of the user and receive the first instance of the secret key from the mobile device of the user.

### Claim 14

A method, comprising:
receiving, by a computing system, a modified first identifier and a second identifier associated with an account of a user, wherein the modified first identifier is generated by:
decrypting, using a password, an encrypted first instance of a secret key;
generating, based on the secret key and a current time of day, a first limited-use password; and
generating, using the limited-use password and the first identifier, the modified first identifier;
retrieving, by the computing system using the second identifier, a second instance of the secret key and a copy of the first identifier;
using, by the computing system, the retrieved second instance of the secret key to generate a second limited-use password and reconstruct the first identifier from the modified first identifier; and
authenticating, by the computing system, a transaction of the user based on a comparison of the reconstructed first identifier to the retrieved copy of the first identifier.

### Claim 15 (depends on 14)

The method of claim 14, further comprising:
determining whether to authorize the transaction based on account information associated with the first identifier.

### Claim 16 (depends on 14)

The method of claim 14, wherein the first instance of the secret key is encrypted such that attempted decryption using one or more invalid user passwords produces one or more corresponding invalid secret keys that are in the same format as a valid decryption of the secret key.

### Claim 17 (depends on 14)

The method of claim 14, wherein the computing system does not use other authentication information from the user to authenticate the transaction.

### Claim 18 (depends on 14)

The method of claim 14, wherein the limited-use password is generated using open authentication (OATH) techniques.

### Claim 19 (depends on 14)

The method of claim 14, wherein the second identifier is stored in a particular field of an iso8583 packet.

### Claim 20 (depends on 14)

The method of claim 14, wherein reconstructing the first identifier includes subtracting the second limited-use password from a portion of the modified first identifier.