Limited-use keys and cryptograms

A method comprising:

• receiving, by a communication device from a computer system, a limited-use key (LUK) that is associated with one or more limited-use thresholds that limits usage of the LUK,
• receiving, by the communication device from the computer system, key index with the LUK, the key index including a counter value indicating a number of times that the LUK has been renewed in a predetermined time period and time information indicating when the LUK was generated, and wherein the computer system encrypts account information with a first encryption key to generate a second encryption key, and encrypts the key index with the second encryption key to generate the LUK;
• receiving, by the communication device from an access device, transaction data for a transaction;
• generating, by the communication device, a transaction cryptogram for the transaction by encrypting the transaction data with the LUK;
• and
• sending, by the communication device to the computer system, the transaction cryptogram and the key index to the access device to conduct the transaction, wherein the access device provides the transaction cryptogram and the key index to the computer system via an authorization request message, and wherein the computer system verifies that the transaction cryptogram was encrypted using the LUK by regenerating the transaction cryptogram using the key index, verifies that the LUK has not exceeded the one or more limited-use thresholds, and authorizes the transaction if the transaction cryptogram is verified and if the LUK has not exceeded the one or more limited-use thresholds.

A communication device comprising:

• one or more processors;
• and
• one or more memories storing computer-readable code, which when executed by the one or more processors, causes the communication device to perform operations including:
• receiving, from a computer system, a limited-use key (LUK) that is associated with one or more limited-use thresholds that limits usage of the LUK,
• receiving, from the computer system, key index with the LUK, the key index including a counter value indicating a number of times that the LUK has been renewed in a predetermined time period and time information indicating when the LUK was generated, and wherein the computer system encrypts account information with a first encryption key to generate a second encryption key, and encrypts the key index with the second encryption key to generate the LUK;
• receiving, from an access device, transaction data for a transaction;
• generating a transaction cryptogram for the transaction by encrypting the transaction data with the LUK;
• and
• sending, to the computer system, the transaction cryptogram and the key index to the access device to conduct the transaction, wherein the access device provides the transaction cryptogram and the key index to the computer system via an authorization request message, and wherein the computer system verifies that the transaction cryptogram was encrypted using the LUK by regenerating the transaction cryptogram using the key index, verifies that the LUK has not exceeded the one or more limited-use thresholds, and authorizes the transaction if the transaction cryptogram is verified and if the LUK has not exceeded the one or more limited-use thresholds.