CPC G06Q 20/3829 (2013.01) [G06Q 20/322 (2013.01); G06Q 20/3278 (2013.01); G07F 7/127 (2013.01); H04L 9/083 (2013.01); H04L 9/3263 (2013.01); H04L 2209/56 (2013.01)] | 20 Claims |
1. A method comprising:
generating, by a server computer, a session key based on a Master Key;
transmitting, by the server computer, the session key to a user device comprising a payment application, the payment application having a first state wherein the payment application is enabled to conduct a payment transaction, and a second state, different to the first state, wherein the user device generates an application cryptogram on the basis of the received session key, and provides the application cryptogram to a terminal after the terminal sends a cryptogram request to the user device;
receiving, by the server computer, from the terminal, the application cryptogram in an authorization request for a transaction;
verifying, by the server computer, the application cryptogram by identifying the session key using the identified session key to verify the application cryptogram; and
responsive verifying the cryptogram, transmitting, by the server computer to the terminal, an authorization response.
|