SECURING PAYMENT TRANSACTIONS WITH ROTATING APPLICATION TRANSACTION COUNTERS

摘要

An account management system creates a bundle of private application transaction counters (ATCs) and a bundle of corresponding public ATCs, and transmits them to a user device. The device receives a request for payment information from a merchant and processes the request without accessing a secure element processor on the device. The device calculates a security code using one of the bundle of private ATCs and a transaction number received from the merchant. The device transmits proxy account information, the calculated security code, and the corresponding public ATCs to the merchant. The merchant transmits a payment request to the account management system as the issuer of the proxy account information. The account management system retrieves the private ATC using the public ATC, and determines the validity of the security code by recomputing it. The account management system retrieves the financial account information and requests authorization from the issuer.

主权项

1. A computer-implemented method to process financial transactions, comprising:
receiving, by a computing device associated with a user, a request for payment information from a merchant computing system to process a payment transaction, the request for payment information comprising a request for payment account information and a merchant computing m transaction code; processing, by the computing device associated with the user, the request for payment information without accessing a secure element of the computing device associated with the user; generating, by the computing device associated with the user without accessing the secure element, a security code using the merchant computing system transaction code and a private application transaction counter; transmitting, by the computing device associated with the user and to the merchant computing system, a response to the request for payment information, wherein information in the response comprises payment account information, a public application transaction counter corresponding to the private application transaction counter, and the generated security code, and wherein the information is transmitted by the merchant computing system to an account management system for payment approval in a payment processing request; and receiving, by the computing device associated with the user, a notification of an approved payment transaction, the notification of the approved payment transaction indicating that the account management system confirmed the validity of the generated security code received in the payment processing request from the merchant computing system.