Mastercard International Patente

There is provided a merchant computing device for processing a transaction between a cardholder computing device and the merchant computing device, the merchant computing device comprising: a processor; and a memory storing instructions that, when executed by the processor, cause the processor to: generate authorisation data comprising a merchant verification code; send the authorisation data to the cardholder computing device for generating an authorisation request for approval by an issuer associated with the cardholder; if the authorisation request is approved by the issuer, receive an authorisation approval comprising the authorisation data from the cardholder computing device, wherein the authorisation approval has been generated by the issuer; verify whether the authorisation data provided within the authorisation approval matches the generated authorisation data; in dependence on the match being obtained, complete the transaction. There is also provided a corresponding cardholder computing device for processing a transaction between the cardholder computing device and the merchant computing device.

A method of authorising a transaction using a payment network is described. A token for the transaction, associated with a payment account, is determined. At a node in the payment network, a succession of time steps are established. The transaction is performed, using the token. For this, a dynamic transaction credential is obtained from the node in the payment network. This dynamic transaction credential is determined by the time step in which the dynamic transaction credential is generated. The transaction is provided to the payment network for authorisation. The dynamic transaction credential is validated in the payment network by determining the time step in which the dynamic transaction credential was generated. Methods of validating such a credential are also described, in particular such that a plurality of candidate values for the credential can be evaluated in a single process. Computer systems adapted to perform such methods are also described.

Techniques are disclosed for processing service requests in a payment network. A receiving server that cannot process a service request identifies another server within the payment network that can process the service request based on some digits extracted from sensitive numerical data contained within the service request. The receiving server responds to the service request with a redirect message including an address of the server that can process the service request. The redirect message also includes a numerical range corresponding to service requests that the server can process. A merchant device stores the numerical range and address information in a lookup table such that future service requests can be routed according to the lookup table. Optionally, the redirect message is a HTTP 302 response, the sensitive numerical data is a PAN, the group of digits is a BIN or IIN and the numerical range is an account range.

The present invention provides a computer implemented method for detecting fraud using a fraud detection model. The method comprises identifying (501) a transaction from a plurality of transactions occurring over a payment network and receiving (503) details of a source account of the identified transaction. The method further comprises determining (505): a rate at which further transactions occur from the source account, total amount in refunds received by the source account within the predetermined time period, and a total amount in funds sent from the source account, all within a predetermined time period, calculating (509) a feature based on the determined factors and inputting (511), into a fraud detection model, the calculated feature to detect if the source account is associated with fraudulent activity.

A computer-implemented method is disclosed for effecting an electronic payment. The method involves a user device establishing a first communication channel with a merchant system comprising a plurality of merchant devices using a first wireless communication protocol. The user device and merchant system exchange ultra-wideband (UWB) capability data via the first communication channel to establish an UWB ranging session including the user device and the plurality of merchant devices. A proximate merchant device that is closest to the user device is determined using the UWB ranging session. An NFC channel or optical channel is established between the proximate merchant device and the user device, and a correlation identifier that uniquely identifies the user device is transmitted from the user device to the proximate merchant device via the NFC channel or optical channel. The user device transmits payment data either via the NFC channel/optical channel or via the first communication channel.

The present invention provides a computer implemented method for determining if a merchant account is associated with fraudulent activity. The method comprises receiving (601) data relating to a fraudulent merchant account, determining (603) a total amount in funds returned to one or more customer accounts due to one or more disputed transactions between the merchant account and the one or more customer accounts within a predetermined period of time, and a total amount in funds received by the merchant account within the predetermined period of time, and determining (605) a ratio of these two values. The method further comprises labelling (609) the ratio value as indicating that the merchant account is associated with fraudulent activity and inputting (611), into a machine learning model, the labelled ratio value to train the machine learning model to predict fraudulent activity based on the ratio.

The present invention relates to a computer implemented method to detect threats in a payment network using a threat detection algorithm by limiting the growth of a data tree, for use with a threat detection algorithm. The method comprises, receiving (1003) transaction data relating to a first transaction, and retrieving (1001) a data tree comprising a first node connected to a second node representing a second transaction, where the source account of the first transaction is the same as the destination account of the second transaction. The method further comprises determining (1005) a difference in time between the time of the second transaction and the time of the first transaction and determining (1007) a total number of accounts that have made a transaction with the source account of the first transaction. If the difference between the time of the second transaction and the time of the first transaction is less than a first predetermined length of time, and the total number of accounts to have made a transaction with the source account of the first transaction is less than a predetermined number of accounts, the data tree is updated (1009) to comprise a third node connected to the second node, the third node representing the destination account of the first transaction, and is inputted (1011) into a threat detection algorithm, to thereby detect threats in a payment network using the threat detection algorithm.

A computer-implemented method of establishing a secure token in a computing device of a cardholder having a secure computing environment and a general computing environment is described. A wallet service provider for the cardholder receives a request to tokenise a transaction credential for the cardholder for the cardholder computing device. The wallet service provider generates the secure token from the transaction credential according to a processing mechanism using an initialisation element. The wallet service provider then provisions the secure token to the secure computing environment of the computing device of the cardholder. A computing device adapted to perform such a method is also described.

A computer-implemented method of providing a transaction proof for a transaction is described. This is performed in a payment device. A payor credential for the transaction is established. This payor credential is provided as ciphertext input to a format preserving encryption mechanism having a cryptographic key and a tweak. Transaction details for the transaction are provided as the tweak. The output of the format preserving encryption mechanism is obtained as the transaction proof. A computing device adapted to perform such a method is also described.

There is provided a payment network biometric authentication service for challenge-response authentication of a cardholder during a payment transaction. The service comprises: one or more processors; a memory storing instructions that, when executed by the one or more processors, cause the one or more processors to: receive notification of a challenge-response authentication request; send an authentication enabler to a challenge-response authentication server of a merchant; receive a challenge request for challenge-response authentication of the cardholder using the authentication enabler; perform biometric authentication of the cardholder to generate an authentication result; send the authentication result to an issuer access control server to decide whether to proceed with the payment transaction based on the authentication result; and send the authentication result to the merchant to approve or decline the payment transaction based on the authentication result. There is further provided a computer-implemented method, wherein the method is performed at a payment network biometric authentication service, for challenge-response authentication of a cardholder during a payment transaction. There is further provided a computer-implemented method, wherein the method is performed at a payment network biometric authentication service, for registration of a passkey for biometric authentication of a cardholder during a payment transaction. Further provided are corresponding computer program products.

The present invention relates to a computer implemented method 500 for preventing a security threat in a computing network. The method comprises receiving 501 a data packet originating associated with an autonomous system number (ASN) and determining 503 if the ASN is in a list of stored ASNs, wherein the list of stored ASNs comprises ASNs each associated with a previous data packet received by the computer network. If the received ASN is not in the list, the method further comprises blocking (505) the received data packet from being sent to the destination IP address in the computer network.

A computer-implemented method is provided for providing proof for a digital transaction between a consumer and a merchant. The proof comprises sensitive data of one or both the consumer and the merchant. The method comprises determining a transaction type, and also determining security requirements for the determined transaction type. The proof is then prepared by one of a plurality of methods to meet the security requirements for the determined transaction type. A payment device adapted to perform such a method is also described.

A computer-implemented method of tokenisation is described. A first value for a data field is provided, which is determined in accordance with a set of data field rules. Some or all places in the data field of the first value are encrypted using format preserving encryption to provide an encrypted first token also complying with the set of data field rules. The encrypted first token is used in place of the first value in one or more operations associated with the data field. A computing device adapted to implement such a method is also described.

The present disclosure relates to methods for preventing tokenized payment fraud. The methods include receiving a second request from a user device to provision token credentials related to a funding account and provisioning second token credentials to the user device in response to the second request. The second token credentials include an account identifier, expiry data, and a token PAN sequence number that are identical to the account identifier, expiry data and token PAN sequence number of first token credentials. In one fraud prevention solution, a token cryptographic sequence number is stored in discretionary data provisioned to the user device. In a second fraud prevention solution, a token cryptographic sequence number is stored away from the user device.

Systems and methods are disclosed for bulk payment processing and for execution by a service provider system. One or more transaction files may be received from one or more financial institution systems, and the transaction file may be processed to determine a first set of instructions. This first set of instructions may then be sent to a settlement agent system, and a rejection message may be received in return that at least one instruction cannot be executed. In embodiments of the invention, this at least one instruction may be removed to give a second set of instructions which is automatically resent to the settlement agent system.

A method of authenticating, at an authentication server (14), a communications session between a user device (12) and a third party device (16), the method comprising: receiving a connection notification (30) from the third party device, the connection notification indicating the intention of the third party device to initiate a communications session with the user device by subsequently sending a session request (60) to the user device, the connection notification comprising a user identifier (32) and identification of a communications channel (26) that will be used for the communications session; retrieving a user profile (20) in dependence on the received user identifier, the user profile comprising a user device identifier; generating a communications identifier (38); sending, from the authentication server to the user device, a communications notification (40), the communications notification comprising data (34) relating to the communications channel that the third party device will use to connect to the user device, third party identification data (31) and the communications identifier; sending, to the third party device, the communications identifier (38) such that the third party device can include the communications identifier when initiating the communications session with the user device in order to indicate that the communications session is genuine

A computer-implemented method is disclosed for handling sensitive data in a network comprising multiple security zones. The method includes sharing a data cleansing ruleset among a plurality of servers that are each within a respective security zone and using a multi-party cryptographic protocol that each of the plurality of servers participates in, to obtain a shared secret. Each server individually cleanses a respective dataset containing sensitive data using the data cleansing ruleset and then hashes the resulting cleansed dataset with a hash function using the shared secret as a salt. This produces a resultant dataset containing hashed representations of the original sensitive data, meaning that the dataset produced by each server can be collated to form a composite dataset without breaching data security requirements. A data operation can then be performed on the composite dataset.

A method 400 of storing a trained model using a quantum system comprises receiving 404 at least one parameter set representative of the trained model, wherein the at least one parameter set comprises one or more parameters, generating 406 at least one entangled state based on the at least one parameter set and storing 408 the at least one entangled state in a quantum system. Measurement of the entangled state enables at least one parameter of the at least one parameter set to be determined.

Computer-implemented methods and systems are provided for securing digital signatures on a computational network to protect against unauthorised access, for example, by a quantum computer or similar system.

A method of payment for charging of a battery of a vehicle is described. A charging connection between the vehicle and a charging station is established. A communication channel between a vehicle payment module of the vehicle and a terminal module of the charging station is established over the charging connection. The method then comprises selecting, at the vehicle, a fleet card for payment and preparing a charging payment transaction, using the fleet card, for authentication. The charging payment transaction is then provided by the vehicle payment module, for authorisation to the terminal module of the charging station. The terminal module then provides the charging payment transaction to a transaction system for authorisation. The method further comprises providing at the vehicle a fleet card data structure for the selected fleet card. The fleet card data structure comprises a set of required data elements and is adapted to hold metadata for each of the required data elements and values for each of the required data elements. The fleet card data structure with the charging payment transaction is then provided by the vehicle to the transaction system for authorisation of the charging payment transaction, where the fleet card data structure is populated at a plurality of transaction stages from a plurality of data sources.

A method for generating a cryptographic promissory note for posting to a blockchain includes: receiving an authorization request for a payment transaction, the authorization request being a transaction message formatted based on one or more standards that includes a plurality of data elements including a first data element configured to store a blockchain address and a second data element configured to store a transaction amount; generating a promissory note including the transaction amount; digitally signing the generated promissory note with a private key; encrypting the signed promissory note with a symmetric key; wrapping the symmetric key with a public key corresponding to the private key and a public key associated with an acquirer involved in the payment transaction; and electronically transmitting a blockchain transaction to a blockchain network that includes the encrypted promissory note, each symmetric key, and the blockchain address.

A method of providing a shared service in a managed computing environment (30) is described. A connection to the shared service is provided in the managed computing environment (30), and a binding operation is also provided that allows a client application to bind to the connection to the shared service. On a client request to connect to the shared service, access is provided to the connection to the shared service in a discrete computing environment (38). This discrete computing environment comprises a first container (381) containing the connection to the shared service and a second container (382) configured for connection to the client application for accessing the instance of the shared service.

The present disclosure relates to a computer-implemented method (300), comprising: retrieving (302) data from a first dataset, wherein the first dataset comprises cross-border transaction data identifying transactions carried out using one or more payment cards, wherein the first dataset comprises data at a first level of time granularity; retrieving (304) data from a second dataset, wherein the second dataset comprises data identifying a total value of tourism-related transactions within a particular region, wherein the second dataset comprises data at a second level of time granularity that is lower than the first level of time granularity; and generating (306) a third dataset comprising data at the first level of time granularity by adjusting the data from the first dataset using the data from the second dataset.

A system for extracting structured data comprises a processor and a memory, wherein the processor processes documents from a provider, using a domain specific grammar structure for the provider and uses rules data based on the grammar structure for the processing and decomposition of a target data provided by the provider. The processing and decomposition of the target data extracts selected information from the target data on the basis of the rules, generates a results data for further processing and/or analysis. A corresponding method of structured data extraction is also disclosed.

The present invention relates to a computer implemented method 600 of effecting peer to peer payments between a payer account and a payee account. The method comprises receiving 601, from a payee device at a payer device associated with a payer account, a payment request message indicating a transaction amount, where the payer account includes tokens corresponding to a monetary value, and sending 603, from the payer device to the payee device, a message including one or more of the tokens together corresponding to a monetary value equal to the transaction amount. At a later point in time, the payer device connects 605 to a blockchain network server and sends 607 a message to record the sending of the one or more of the tokens on a blockchain ledger maintained by the blockchain network server.

The present disclosure relates to a method for linking consumer payment credentials. The method includes storing, in a database, a first account identifier and a second account identifier, wherein the first account identifier is linked to the second account identifier in the database; receiving a first presentment request, wherein the first presentment request includes a first merchant identifier and the first account identifier; receiving a subsequent first presentment request, wherein the subsequent first presentment request includes a second merchant identifier and the second account identifier; determining, via the database, the first account identifier and the second account identifier are linked; generating a transaction link identifier, wherein the transaction link identifier identifies a link between the first presentment request and the subsequent first presentment request; and sending the transaction link identifier to an acquirer

There is provided a mobile computing device for enabling a user to withdraw cash at a cash withdrawal device, the mobile computing device comprising: user input means for enabling the user to provide user input to the mobile computing device; a digital wallet comprising a tokenised payment application and an additional data extension; wherein the digital wallet is configured to generate a cash withdrawal request comprising cash withdrawal data based on the user input; wherein the tokenised payment application is configured to communicate with the cash withdrawal device to authenticate the cash withdrawal request; and wherein the additional data extension is configured to send the cash withdrawal data to the cash withdrawal device; wherein an issuer authorisation request can be generated for approval by an issuer associated with the user based on the cash withdrawal request, and wherein the cash withdrawal device is instructed to dispense cash based on approval of the issuer authorisation request. According to a second aspect of the present disclosure, there is provided a cash withdrawal device for enabling a user to withdraw cash using a mobile computing device.

A method of processing credentials in a distributed system comprising a plurality of credential processing nodes is described. Each of the plurality of credential processing nodes is adapted to perform credential processing in response to credential processing requests. Individual nodes may use at least a first credential processing type or a second credential processing type. The method has the following elements. It is established that a credential processing request is to be directed to a new credential processing node for the associated credential. It is determined whether stakeholders for the credential support the second credential processing type. It is also determined whether the new credential processing node supports the second credential processing type. If both the stakeholders for the credential and the new credential processing node support the second credential processing type, the new credential processing node processes the credential using the second credential processing type. Otherwise, the new credential processing node processes the credential using the first credential processing type. A corresponding distributed processing system adapted for the processing of credentials is also described.

Aspects of the present disclosure relate to a method for processing requests in a distributed computing system. The method comprises receiving from a requestor and at a first computing node of the distributed computing system, a processing request, where the processing request requires the use of a credential. The method further comprises determining, at the first computing node of the distributed computing system, that the processing request is to be performed at a second computing node of the distributed computing system, and establishing, at the first computing node of the distributed computing system, first and second routing information associated with performing the processing the request. The method then comprises routing the processing request and the second routing information to the second computing node of the distributed computing system, using the first routing information, and performing, at the second computing node of the distributed computing system, the processing request using the credential and the second routing information

Methods and systems for predicting an upcoming data point are disclosed. Method performed by a server system includes accessing a plurality of encoded features associated with each data point of a plurality of data points corresponding to an entity. Method includes generating a data point word representation for the entity based on the plurality of encoded features associated with each data point. The data point word representation includes one or more words. Method includes generating a data point sentence representation based on the one or more words associated with each data point. Method includes generating, by a Large Language Model (LLM), an upcoming data point representation in the data point sentence representation based on the data point sentence representation. Method includes decoding the upcoming data point representation to obtain one or more features associated with an upcoming data point based on the set of predefined language rules.

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …