Abstract: There is disclosed a computer implemented method (300) of managing user accounts at a biometric database, the biometric database comprising biometric data of a user. The method comprises the steps of: receiving (301), at the biometric database, a message from a user device to suspend a user's account, the message comprising a cryptographic parameter; suspending (303) the user's account, the step of suspending comprising: encrypting (305), at the biometric database, biometric data of the user associated with the user's account using the cryptographic parameter; storing (307), the encrypted biometric data; and discarding (309), at the biometric database, the cryptographic parameter; and transmitting (311), from the biometric database, a message to the user device indicating that the user's account has been suspended.

Abstract: A method for trusted notifications comprises: receiving, at a first host having at least one trusted server, a request message from a sender computing device, the request message comprising a request identifier and instructions to: update, at a second host, a recipient account associated with a recipient computing device, and to make a corresponding update at the first host to a sender account associated with the sender computing device. The method further comprises authorizing, at the first host, the request message; updating the sender account; generating a secure message at the at least one trusted server, the secure message comprising the request identifier and an indication from the at least one trusted server that the update completed; and sending the secure message from the first host to the sender computing device. The secure message can be received at the sender computer device and conveyed to the recipient computing device.

Abstract: A transaction device is described. The device comprises storage configured to store a first data record comprising first value data and a unique identifier associated with one other device; communications circuitry configured to receive an identifier and second value data from a device; and control circuitry configured to compare the received identifier with the unique identifier and in the event of a positive comparison, the control circuitry is further configured to update the stored first value data in accordance with the exchanged second value data.

Abstract: A method for trusted notifications comprises: receiving, at a first host having at least one trusted server, a request message from a sender computing device, the request message comprising a request identifier and instructions to: update, at a second host, a recipient account associated with a recipient computing device, and to make a corresponding update at the first host to a sender account associated with the sender computing device. The method further comprises authorizing, at the first host, the request message; updating the sender account; generating a secure message at the at least one trusted server, the secure message comprising the request identifier and an indication from the at least one trusted server that the update completed; and sending the secure message from the first host to the sender computing device. The secure message can be received at the sender computer device and conveyed to the recipient computing device.

Abstract: A method for trusted notifications comprises: receiving, at a first host having at least one trusted server, a request message from a sender computing device, the request message comprising a request identifier and instructions to: update, at a second host, a recipient account associated with a recipient computing device, and to make a corresponding update at the first host to a sender account associated with the sender computing device. The method further comprises authorizing, at the first host, the request message; updating the sender account; generating a secure message at the at least one trusted server, the secure message comprising the request identifier and an indication from the at least one trusted server that the update completed; and sending the secure message from the first host to the sender computing device. The secure message can be received at the sender computer device and conveyed to the recipient computing device.

Abstract: The present disclosure relates to an access security system and method, for example for securing access to data, objects or locations. According to one aspect there is provided a computer-implemented access security method, the method comprising: receiving, at a processor, a first authentication credential from a near-field communication, ‘NFC’ reader; generating a one-time token, at the processor, in dependence on the first authentication credential, the one-time token being in a form which is capable of reproduction by a user; and outputting the one-time token via an interface for use as an authentication credential in an access procedure. Other aspects relate to a user device for implementing such a method, a computer program product for storing instructions which, when executed, cause such a method to be implemented, and a system in which such a method can be used.

Abstract: Trusted communication between a first computing device and a second computing device in a transaction process is established as follows. A communication channel is established between the first computing device and the second computing device. The first computing device provides a secure communication to the second computing device, this secure communication comprising cryptographic material encrypted by a first cryptographic method. The second computing device decrypts the secure communication using a key already available to it. The first and the second computing device then communicate where trusted communication is required by a second cryptographic method using the cryptographic material. A suitable first computing device and second computing device are also described.

Abstract: A transaction device is described. The device comprises storage configured to store a first data record comprising first value data and a unique identifier associated with one other device; communications circuitry configured to receive an identifier and second value data from a device; and control circuitry configured to compare the received identifier with the unique identifier and in the event of a positive comparison, the control circuitry is further configured to update the stored first value data in accordance with the exchanged second value data.

Abstract: The present disclosure relates to a computer-implemented method performed at a computing device for obtaining a service from a first device. The method comprises, at the computing device, establishing user credentials at a computing device and establishing a local communication with the first device and establishing with the first device a service identification for a service to be performed by the first device. The method further comprises sending request a message to a service platform to obtain approval of performance of the service. This message comprises the user credentials, a request for the service, and the service identification. The method further comprises receiving an approval message from the service platform comprising at least the service identification and signed on behalf of a service provider, and sending the signed approval message to the first device for validation in order to obtain a service.

Abstract: A method of establishing a secure channel for communication between a first computing device and a second computing device is described. The method uses an elliptic curve Diffie-Hellman protocol, wherein G is an elliptic curve generator point and the first computing device has a unique private key dc with a public key Qc=dc G certified by a party trusted by the second computing device. The first computing device generates (520) a blinding factor r and sends (540) a blinded public key R=r·Qc to the second computing device. The second computing device generates (510) an ephemeral private key dt and a corresponding ephemeral public key Qt=dt G and sends Qt to the first computing device. The first computing device generates (530) Kc=KDF(r dc·Qt) and the second computing device generates (550) Kt=KDF(dt·R), where KDF is a key derivation function used in both generation operations, to establish a secure channel between the first computing device and the second computing device.

Abstract: A method for trusted notifications comprises: receiving, at a first host having at least one trusted server, a request message from a sender computing device, the request message comprising a request identifier and instructions to: update, at a second host, a recipient account associated with a recipient computing device, and to make a corresponding update at the first host to a sender account associated with the sender computing device. The method further comprises authorizing, at the first host, the request message; updating the sender account; generating a secure message at the at least one trusted server, the secure message comprising the request identifier and an indication from the at least one trusted server that the update completed; and sending the secure message from the first host to the sender computing device. The secure message can be received at the sender computer device and conveyed to the recipient computing device.

Abstract: The present disclosure relates to an access security system and method, for example for securing access to data, objects or locations. According to one aspect there is provided a computer-implemented access security method, the method comprising: receiving, at a processor, a first authentication credential from a near-field communication, ‘NFC’ reader; generating a one-time token, at the processor, in dependence on the first authentication credential, the one-time token being in a form which is capable of reproduction by a user; and outputting the one-time token via an interface for use as an authentication credential in an access procedure. Other aspects relate to a user device for implementing such a method, a computer program product for storing instructions which, when executed, cause such a method to be implemented, and a system in which such a method can be used.

Abstract: A method of configuring a transaction device (102, 160) for use within a closed loop transaction system (12), the closed loop transaction system comprising a point-of-interaction terminal (24) for processing transactions with the transaction device, the method comprising: receiving an instruction to set a field within a device data store on the transaction device to use a predetermined currency code specified by the terminal; receiving, at the transaction device, a transaction amount available for transactions with the closed loop terminal system; storing (202) the transaction amount on the transaction device; receiving an unique identifier associated with the closed loop terminal system for use in transactions with the point-of-interaction terminal within the system; storing (206) the unique identifier on the transaction device.

Abstract: A method of establishing a secure channel for communication between a first computing device and a second computing device is described. The method uses an elliptic curve Diffie-Hellman protocol, wherein G is an elliptic curve generator point and the first computing device has a unique private key dc with a public key Qc=dc G certified by a party trusted by the second computing device. The first computing device generates (520) a blinding factor r and sends (540) a blinded public key R=r·Qc to the second computing device. The second computing device generates (510) an ephemeral private key dt and a corresponding ephemeral public key Qt=dt G and sends Qt to the first computing device. The first computing device generates (530) Kc=KDF (r dc·Qt) and the second computing device generates (550) Kt=KDF (dt·R), where KDF is a key derivation function used in both generation operations, to establish a secure channel between the first computing device and the second computing device.

Abstract: Systems and methods for verifying users in connection with transactions using payment devices, by which benefits are distributed, are disclosed. One exemplary method generally includes initiating a timer after power-up of a security chip by a terminal, capturing a biometric of a user, at a biometric sensor associated with the security chip, and comparing, by the security chip, the captured biometric to a reference biometric. When the time is unexpired, and the captured biometric matches the reference biometric, the method includes launching a biometric application, whereby the terminal appends a first account number to an authorization request for a transaction to the payment account, when the timer is expired, the method includes launching a standard payment application, whereby the terminal includes a second account number in an authorization request for a transaction to the payment account, the first account number is different than the second account number.

Abstract: One or more embodiments provide a system and method comprising receiving at a device a first token associated with a first account; executing a transaction; recording the executed transaction at each of the device and the first token, wherein the execution of the transaction is offline; and balancing the account associated with the first token per the transaction when the first token is online after the executed transaction. Numerous other aspects are provided.

Abstract: Secure establishment of a key associated with a first facility identifier is facilitated. The key is shared between a device and an operator of a first facility, via a public key management infrastructure of a payment system operating according to the payment standard, during a first transaction, substantially in accordance with the payment standard, between the device and the first facility. Controlling access to a first facility is facilitated, via the device, using the key associated with the first facility identifier, substantially without reference to an issuer of the device and substantially without use of asymmetric keys of the device, during a plurality of subsequent transactions, substantially in accordance with the payment standard, between the device and the first facility.

Abstract: A system and method for generating an authentication token which is used by an issuer associated with a integrated circuit card to authenticate a transaction. A personal card reader receives data, including an authentication cryptogram, from the integrated circuit card. The personal card reader uses the data received from the integrated circuit card to select one of at least two default bitmaps stored in a memory portion of the personal card reader. The personal card reader uses the selected default bitmap and the authentication cryptogram to build the authentication token.

Abstract: A system and method for generating an authentication token which is used by an issuer associated with a integrated circuit card to authenticate a transaction. A personal card reader receives data, including an authentication cryptogram, from the integrated circuit card. The personal card reader uses the data received from the integrated circuit card to select one of at least two default bitmaps stored in a memory portion of the personal card reader. The personal card reader uses the selected default bitmap and the authentication cryptogram to build the authentication token.

Abstract: Secure establishment of a key associated with a first facility identifier is facilitated. The key is shared between a device and an operator of a first facility, via a public key management infrastructure of a payment system operating according to the payment standard, during a first transaction, substantially in accordance with the payment standard, between the device and the first facility. Controlling access to a first facility is facilitated, via the device, using the key associated with the first facility identifier, substantially without reference to an issuer of the device and substantially without use of asymmetric keys of the device, during a plurality of subsequent transactions, substantially in accordance with the payment standard, between the device and the first facility.