# US 2022/0036348 A1 · Method and system for contactless transactions without user credentials

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2022/0036348 A1
- Document ID: US20220036348A1
- Status: Published application
- Kind: A1
- Application number: 17/451,699
- Filed: 2021-10-21
- Published: 2022-02-03
- Earliest claimed: 2016-04-21
- Assignees: Mastercard International Incorporated
- Applicants: Mastercard International Incorporated
- Inventors: Abhinava SRIVASTAVA; Sapankumar K. MANDLOI; Anthony LOPREIATO
- Web page: https://patentgrep.com/patent/US20220036348A1

## CPC

- G06Q 20/3829: {involving key management}
- G06Q 20/204: {comprising interface for record bearing medium or carrier for electronic funds transfer or payment credit}
- G06Q 20/3821: {Electronic credentials}
- G06Q 20/385: {using an alias or single-use codes}
- G06Q 20/4014: {Identity check for transactions}
- H04L 9/0819: {Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) (network architectures or network communication protocols for key distribution in a packet data network H04L63/062)}
- H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords}
- H04L 9/14: using a plurality of keys or algorithms
- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- H04L 63/067: {using one-time keys (cryptographic mechanisms or cryptographic arrangements for generation of one-time passwords H04L9/0863)}
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04W 12/033: of the user plane, e.g. user's traffic
- H04W 12/10: Integrity
- G06Q 20/321: {using wearable devices}
- G06Q 2220/00: Business processing using cryptography
- H04L 63/126: {the source of the received data}
- H04L 2209/56: Financial cryptography, e.g. electronic payment or e-cash
- H04L 2463/062: applying encryption of the keys
- H04W 12/04: Key management, e.g. using generic bootstrapping architecture [GBA]
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

A method for generation of an application cryptogram for use in a payment transaction includes: storing, in a first memory, a single use key associated with a transaction account; electronically transmitting the single use key to a processing server; receiving an encrypted session key and a server encryption key from the processing server; executing a first query to store the encrypted session key in the first memory and a second query to store the server encryption key in a second memory; decrypting the encrypted session key using the server encryption key; generating an application cryptogram based on the decrypted session key; and electronically transmitting the generated application cryptogram for use in a payment transaction.

## Claims

### Claim 1

A method for provisioning of a session key for use in generating an application cryptogram for use in a payment transaction, comprising:
storing, in an account database of a processing server, an account profile, wherein the account profile includes at least an account identifier and an account identification number;
receiving, by a receiving device of the processing server, a single use key and the account identifier from a computing device;
generating, by a generation module of the processing server, a session key based on at least the received single use key and the account identification number included in the account profile;
encrypting, by an encryption module of the processing server, the generated session key using a server encryption key; and
electronically transmitting, by a transmitting device of the processing server, at least the encrypted session key and the server encryption key to the computing device.

### Claim 2 (depends on 1)

The method of claim 1, further comprising:
receiving, by the receiving device of the processing server, a transaction message related to a payment transaction, wherein the transaction message includes at least a first application cryptogram;
generating, by the generation module of the processing server, a second application cryptogram based on the generated session key; and
verifying, by a verification module of the processing server, equivalence of the first application cryptogram and the second application cryptogram.

### Claim 3 (depends on 2)

The method of claim 2, further comprising:
electronically transmitting, by the transmitting device of the processing server, a result of the verification to a financial institution associated with the transaction account for use in authorization of the related payment transaction.

### Claim 4 (depends on 1)

The method of claim 1, further comprising:
receiving, by the receiving device of the processing server, an integrity check value from the computing device; and
verifying, by a verification module of the processing server, device integrity of the computing device based on the received integrity check value.

### Claim 5 (depends on 4)

The method of claim 4, wherein verification of the device integrity is performed prior to transmission of the encrypted session key and server encryption key to the computing device.

### Claim 6

A system for provisioning of a session key for use in generating an application cryptogram for use in a payment transaction, comprising:
an account database of a processing server configured to store an account profile, wherein the account profile includes at least an account identifier and an account identification number;
a receiving device of the processing server configured to receive a single use key and the account identifier from a computing device;
a generation module of the processing server configured to generate a session key based on at least the received single use key and the account identification number included in the account profile;
an encryption module of the processing server configured to encrypt the generated session key using a server encryption key; and
a transmitting device of the processing server configured to electronically transmit at least the encrypted session key and the server encryption key to the computing device.

### Claim 7 (depends on 6)

The system of claim 6, further comprising:
a verification module of the processing server, wherein
the receiving device of the processing server is further configured to receive a transaction message related to a payment transaction, wherein the transaction message includes at least a first application cryptogram;
the generation module of the processing server is further configured to generate a second application cryptogram based on the generated session key, and
the verification module of the processing server is configured to verify equivalence of the first application cryptogram and the second application cryptogram.

### Claim 8 (depends on 7)

The system of claim 7, wherein the transmitting device of the processing server is further configured to electronically transmit a result of the verification to a financial institution associated with the transaction account for use in authorization of the related payment transaction.

### Claim 9 (depends on 6)

The system of claim 6, further comprising:
a verification module of the processing server, wherein
the receiving device of the processing server is further configured to receive an integrity check value from the computing device, and
the verification module of the processing server is configured to verify device integrity of the computing device based on the received integrity check value.

### Claim 10 (depends on 9)

The system of claim 9, wherein verification of the device integrity is performed prior to transmission of the encrypted session key and server encryption key to the computing device.