US 11,704,649 B2
Contactless payment relay attack protection
Florent Hay, Laeken (BE); Eddy Van De Velde, Leuven (BE); and Patrick Mestre, Sart-Bernard (BE)
Assigned to MASTERCARD INTERNATIONAL INCORPORATED, Purchase, NY (US)
Filed by MASTERCARD INTERNATIONAL INCORPORATED, Purchase, NY (US)
Filed on Sep. 3, 2020, as Appl. No. 17/11,618.
Prior Publication US 2022/0067687 A1, Mar. 3, 2022
Int. Cl. G06Q 20/20 (2012.01); G06Q 20/34 (2012.01); G06Q 20/40 (2012.01); G06Q 20/38 (2012.01); G06F 11/34 (2006.01); G06F 11/30 (2006.01); G06N 20/00 (2019.01); H04W 12/122 (2021.01); G06Q 20/36 (2012.01); G06Q 20/32 (2012.01)
CPC G06Q 20/204 (2013.01) [G06F 11/3006 (2013.01); G06F 11/3419 (2013.01); G06N 20/00 (2019.01); G06Q 20/202 (2013.01); G06Q 20/3415 (2013.01); G06Q 20/3825 (2013.01); G06Q 20/3829 (2013.01); G06Q 20/4016 (2013.01); H04W 12/122 (2021.01); G06Q 20/3226 (2013.01); G06Q 20/352 (2013.01); G06Q 20/36 (2013.01); G06Q 2220/00 (2013.01)] 5 Claims
OG exemplary drawing
 
1. A point of sale (POS) terminal, comprising:
a processor;
memory;
a payment interface;
a network interface; and
instructions stored on the memory that when executed by the processor direct the POS terminal to:
transmit, via the payment interface to a payment device, a request for a reference processing time for a monetary transaction;
receive, via the payment interface from the payment device, the reference processing time;
calculate a measured processing time as an amount of time between transmitting the request for the reference processing time and receiving the reference processing time;
transmit, via the payment interface to the payment device, a request for an application cryptogram that includes the measured processing time and the reference processing time;
receive, via the payment interface from the payment device, the application cryptogram that includes the measured processing time and the reference processing time;
send, via the network interface to a protection server, an online authorization request including the application cryptogram that includes the measured processing time and the reference processing time; and
receive, via the network interface from the protection server, an online authorization response that indicates whether the transaction is authorized based on verification of the application cryptogram and a determination of fraud using the measured processing time and the reference processing time.