WO2018096559A1 - System and method for translation and authentication of secure pin and sensitive data - Google Patents

Abstract

The embodiments herein discloses a system and method for a secure electronic transaction is provided. The system enables the chip in the card to generate ARQC and a cryptogram based on card data / instrument identification and PIN block or user secret key or actual user identification. The generated ARQC and the cryptogram are sent to the issuer bank terminal or central issuer of the instrument or associating agency of user for authentication of the card data / instrument identification and PIN block or user secret key for authorizing a transaction or identification session. The issuer bank terminal is configured to generate ARQC and a cryptogram based on stored card data / instrument identification and PIN block or user secret key. The cryptogram generated at the issuer bank terminal are compared with the cryptogram received from the card to authenticate the card data and PIN block for authorizing a transaction.

Description

SYSTEM AND METHOD FOR TRANSLATION AND AUTHENTICATION OF

SECURE PIN AND SENSITIVE DATA

CROSS-REFERENCETO RELATED APPLICATION

[0001] The embodiments herein claims the priority of the Indian Provisional Patent Application with the serial number 201641028600 and entitled, "SYSTEM AND METHOD FOR TRANSLATION AND AUTHENTICATION OF SECURE PIN AND SENSITIVE DATA" filed on August 22, 2016 and subsequently postdated to November 22, 2016 and the contents of which are included entirely as reference herein.

BACKGROUND

Technical Field

[0002] The embodiments herein are generally related to a field of electronic transactions. The embodiments herein are particularly related to a system and method for authentication of card data and pin in secure electronic transactions. The embodiments herein are more particularly related to a system and method for translation and authentication of secure PIN and sensitive data through cryptogram.

Description of the Related Art

[0003] As the world is currently interested in cash free transactions, the security of a cashless transaction remains a big concern. Therefore the industry and financial regulators are keen on encouraging secure plastic and secure online transactions to find an option or alternative to cash banking. These methods are beneficial to all types of financial systems in terms of cash audit, taxation and to curb unaudited cash problem.

[0004] An authorization and authentication of transactions in an open network is always challenging task. The chances of stealing and hacking credentials are higher. In order to handle these situations, the banks and financial industries have come up with preset procedures and specifications to allow the banks to issue plastic cards and to perform authentication and authorization processes securely.

[0005] The technology used in the plastic cards is a magnetic stripe and a chip card technology. Magnetic card has a data written on the magnetic strip, and the magnetic card data is exposed by any card reader and is easily cloned. The hacking of data and cloning of data is lead to a problem of identifying whether the magnetic card data is retrieved from the card issued by the bank or from a cloned card data or virtual data. To mitigate this, a consortium formed by financial network providers named EMV Co. has proposed a usage of chip cards which authenticates itself to the issuer bank with less or no chance of fraudulent activity in card authentication.

[0006] The banks have to face one more issue in the authentication or identification of a signature of a person or card holder / customer, especially in cases, in which the card is stolen and used to complete a transaction at merchant's place/terminal. There are many cases where the stolen card is used to complete a transaction at merchant's end. Hence an identification of the customer is done by comparing the signature of the customer on the charge slip with that of the signature present on the card. This method has led to a forgery of customer signature at times. To overcome the forgery, the banks have come up with PIN entry at merchant terminal.

[0007] With the advent of this, banks has resolved customer identification problem. As the merchant terminal is not under secure area and the data transmitted is also not in a secure form, a security threat is identified in the form of PIN stealing using possible methods thereby creating a new issue altogether. To mitigate this, an organization called PCI is formed for assigning strict compliance/standards to the terminals, and servers which are used in handling card data and PIN. [0008] Hence the industry have proposed encryption of PIN blocks at source, thereby providing stringent compliance process to be taken care by the Acquirer Bank and Terminal manufacturer. This compliance process includes, secure Key injection into the terminal and then translating and handling the Keys which are used by the acquirer bank in encrypting PIN blocks. To eradicate replay attacks, the banks follow key rotation or change for every settlement or every 24 hours, whichever is earlier.

[0009] Hence there is a need for a system and method for a secure electronic transaction and secure user authentication and authorization with simple process and avoiding any possible security flaws at multiple points. Further, there is a need for a system and method for secure electronic transactions. Yet there is a need for a system and method for secure PIN and sensitive data translation and authentication. Yet there is a need for a system and method for authenticating user PIN by the issuer payment system without following a complex and less secure method of key rotation and key management by acquirer or third party financial organization/establishment. Yet there is a need for a system and method for concatenating an encrypted PIN Block to Authorization Request Cryptogram (ARQC) for a secure electronic transaction and secure user authentication and authorization. Yet there is a need for a system and method for generating ARQC, which is a cryptogram generated by the card (ICC) for identifying and securely authenticating card transaction by the issuer. Yet there is a need for a system and method for enabling an issuer bank to authenticate both secure card data and PIN data with a single command and without any security flaw and a plurality of PIN translations. Yet there is a need for a system to avoid brute force attack in getting the data sequence or pattern and tracing back to the key which is used for encrypting or coding the secret / sensitive data. [0010] The above-mentioned shortcomings, disadvantages and problems are addressed herein and which will be understood by reading and studying the following specification.

OBJECTIVES OF THE EMB ODIEMNTS HEREIN

[0011] A primary object of the embodiments herein is to provide a system and method for a secure electronic transaction and secure user authentication and authorization with simple process thereby avoiding any possible security flaws at a plurality of points or stakeholders such as merchant terminal, acquirer bank, etc.

[0012] Another object of the embodiments herein is to provide a system and method for secure electronic transactions.

[0013] Yet another object of the embodiments herein is to provide a system and method for secure PIN and sensitive data translation and authentication.

[0014] Yet another object of the embodiments herein is to provide a system and method for authenticating user PIN by the issuer payment system without following a complex and less secure method of key rotation and key management by acquirer or third party financial organization/establishment.

[0015] Yet another object of the embodiments herein is to provide a system and method for concatenating an encrypted PIN Block to ARQC for a secure electronic transaction and secure user authentication and authorization.

[0016] Yet another object of the embodiments herein is to provide a system and method for generating ARQC, which is a cryptogram generated by the card (ICC) for identifying and securely authenticating card transaction by the issuer.

[0017] Yet another object of the embodiments herein is to provide a system and method for enabling an issuer bank to authenticate both secure card data and PIN data with a single command and without any security flaw and a plurality of PIN translations. [0018] Yet another object of the embodiments herein is to provide a system and method for enabling a fast and efficient electronic transaction.

[0019] Yet another objective of the embodiments herein is to provide a system and method for eradicating human snooping and security flaw of different uncontrolled facilities/systems in which the key is injected/used.

[0020] Yet another object of the embodiments herein is to provide a system and method for using a secure method for encrypting sensitive data in a transaction flow.

[0021] Yet another object of the embodiments herein is to provide a system and method for offering a cost effective solution with in-built and independent secure and safe method.

[0022] Yet another object of the embodiments herein is to provide a system and method to encrypt sensitive data in a safer and simpler way using a key management process.

[0023] Yet another object of the embodiments herein is to provide a system and method for authenticating PIN block by both the card and/or issuer bank as well.

[0024] Yet another object of the embodiments herein is to provide a system and method to protect and guard transportation of sensitive data (PIN block) with a high level security encryption standard which is also used and accepted by the industry.

[0025] Yet another objective of the embodiments herein is to provide a system and method which is backward compatible and works on all existing financial / payment / security centric systems.

[0026] Yet another object of the embodiments herein is to provide a system and method to prevent a replay and / or brute force attack in an electronic transaction.

[0027] Yet another object of the embodiments herein is to provide a system and method to translate a PIN by using existing eco system without a knowledge of the parties or stack-holders involved in between the card issued and issuer processing systems. [0028] Yet another object of the embodiments herein is to provide a system and method to enable an issuer bank to authenticate both the card data and PIN data with one command and without any security flaw thereby avoiding multiple PIN translations across the system which is open to security flaw.

[0029] Yet another object of the embodiments herein is to provide a system and method to find an alternative to the present day complex Key management which is used for translating PIN blocks at each point / switch / server.

[0030] Yet another object of the embodiments herein is to provide a system and method to deal with EMV contact and contactless cards or any other system where security of authorization or identification is vital.

[0031] Yet another object of the embodiments herein is to develop a system and method to provide an enhanced security in using industry best practice to encrypt PIN block at issuing card, like DUKPT/MK-SK or any other industry best standard in encryption.

[0032] Yet another object of the embodiments herein is to develop a system and method to avoid brute force attack and also secure the data replay as the system is intended to use in the open environment.

[0033] Yet another object of the embodiments herein is to develop a system and method to kill the card, when the number of attacks in securing the sensitive data reaches a preset threshold level.

[0034] These and other objects and advantages of the embodiments herein will become readily apparent from the following detailed description taken in conjunction with the accompanying drawings. SUMMARY

[0035] The embodiments herein provide a system and method for secure electronic transaction. The system comprises a terminal device/merchant terminal configured for receiving one or more PIN details for Customer Verification Method (CVM) from a user via a keypad or an input device associated with the terminal device. The terminal device is further configured for encrypting the received PIN input from the user using one or more encryption algorithms. The system also comprises a chip card/integrated circuit card (ICC) communicatively coupled with the terminal device. The chip card is configured for accepting and translating the encrypted PIN from the terminal device. The chip card comprises a transaction counter configured for incrementing for every transaction attempt performed by the user. The chip card is configured for encrypting the translated PIN with Derived Unique Key Per Transaction (DUKPT) key based on transaction counter value present in the card as a Key Serial Number (KSN). The chip card is further configured for concatenating the encrypted PIN block to an Authorization Request Cryptogram (ARQC) to generate a Proprietary Authentication Data (PAD)/authorization request comprising of the ARQC and the PIN block. The chip card is further configured for transmitting the ARQC over a secure channel. The system further comprises an authentication terminal device configured for accepting the transmitted ARQC and for forwarding the received ARQC over a secure communication channel and an acquirer terminal device/merchant bank device configured for receiving the ARQC from the authentication terminal device and for forwarding the received ARQC through a network provider system for authentication and payment. The system still further comprises a card issuer bank device configured for receiving the ARQC from the acquirer terminal device and for authenticating the chip card and the transaction by generating an ARQC with the stored card data and by comparing the generated ARQC with the ARQC received from the chip card reading terminal. The card issuer bank device is further configured for validating both PIN block and the chip card generated ARQC/cryptogram and for informing the validation state back to the user via the card issuer bank device.

[0036] According to one embodiment herein, the chip card is further configured for counting the number of transaction attempts with no valid server response using the transaction counter. The chip card is further configured for de-activating when the number of invalid server responses is equal to or more than a preset threshold value to protect the system from brute-force attacks. The transaction counter is reset every time after a successful transaction is completed or carried out.

[0037] According to one embodiment herein, the system is further configured for activating a barred card or unusable card and for making the card usable on lock with a user secure script run on the chip card after the authentication or identification of issuer by chip card.

[0038] According to one embodiment herein, the one or more encryption algorithms used for PIN block encryption comprises Derived Unique Key Per Transaction algorithm (DUKPT (ATC as IKSN)) or MK-SK algorithm.

[0039] According to one embodiment herein, the Proprietary Authentication Data (PAD)/authorization is generated by concatenating the encrypted PIN block to an Authorization Request Cryptogram (ARQC) using a XOR function.

[0040] According to one embodiment herein, the chip card is a contact or contactless Near Field Communication (NFC) card or a smart card.

[0041] According to one embodiment herein, the system is configured for translating the PIN by using existing eco system without the knowledge of one or more parties involved between the card issued and issuer processing system. [0042] According to one embodiment herein, a method for secure electronic transaction is provided. The method comprises the steps of inserting a chip card or tapping a chip card in a terminal device or merchant terminal. The chip card data is read by the terminal device with CVM (Customer Verification Method) as off-line PIN. The PIN block is passed to the chip card from the terminal device when PIN is entered by a card holder and the PIN block is encrypted by the chip card using one or more encryption algorithms. An ARQC is concatenated with the encrypted PIN block as Proprietary Authentication Data and the concatenated ARQC is transmitted over a secure channel using the chip card. The transmitted ARQC is received and the received ARQC is forwarded over a secure channel using an authentication terminal device. The ARQC is received from the acquirer terminal device. The chip card and the transaction are authenticated by generating an ARQC with the stored card data and comparing the generated ARQC with the ARQC received from the chip card reading terminal using a card issuer bank device. Both the PIN block and the chip card generated ARQC/cryptogram are validated. The validation status or the result of validation process is sent back to the user via card issuer bank device.

[0043] According to one embodiment herein, the method further comprises counting the number of transaction attempts without any valid server responses using a transaction counter and resetting the transaction counter every time after a successful transaction is done or carried out.

[0044] According to one embodiment herein, the method further comprises deactivating the chip card when the number of invalid server responses or the number of transaction attempts without any valid server responses is equal to or more than a preset threshold value to protect the system from brute-force attacks. [0045] According to one embodiment herein, a computer implemented method, comprising instructions stored on a non-transitory computer readable storage medium and executed on a computing device provided with a hardware processor and memory, for a secure electronic transaction is provided. The method comprises the steps of inserting a chip card or tapping a chip card in a terminal device or merchant terminal. The chip card data is read by the terminal device with CVM (Customer Verification Method) as off-line PIN. The PIN block is passed to the chip card from the terminal device when PIN is entered by a card holder and the PIN block is encrypted by the chip card using one or more encryption algorithms. An ARQC is concatenated with the encrypted PIN block as Proprietary Authentication Data and the concatenated ARQC is transmitted over a secure channel using the chip card. The transmitted ARQC is received and the received ARQC is forwarded over a secure channel using an authentication terminal device. The ARQC is received from the acquirer terminal device. The chip card and the transaction are authenticated by generating an ARQC with the stored card data and comparing the generated ARQC with the ARQC received from the chip card reading terminal using a card issuer bank device. Both the PIN block and the chip card generated ARQC/cryptogram are validated. The validation status or the result of validation process is sent back to the user via card issuer bank device.

[0046] According to one embodiment herein, the method further comprises counting the number of transaction attempts without any valid server responses using a transaction counter and resetting the transaction counter every time after a successful transaction is done or carried out.

[0047] According to one embodiment herein, the method further comprises deactivating the chip card when the number of invalid server responses or the number of transaction attempts without any valid server responses is equal to or more than a preset threshold value to protect the system from brute-force attacks. [0048] According to one embodiment herein, an article of manufacture comprising a computer readable storage medium recorded with or stored with instructions for execution on a computing device provided with a hardware processor and memory, for a secure electronic transaction is provided. The stored instructions are executed on a computing device provided with a hardware processor and memory, and configured for carrying out or performing or executing a method for a secure electronic transaction by inserting or the article of manufacture into the computing device or by connecting a player device loaded with the article of manufacture. The method comprises the steps of receiving a chip card or tapping a chip card in a terminal device or merchant terminal. The chip card data is read by the terminal device with CVM (Customer Verification Method) as off-line PIN. The PIN block is passed to the chip card from the terminal device when PIN is entered by a card holder and the PIN block is encrypted by the chip card using one or more encryption algorithms. An ARQC is concatenated with the encrypted PIN block as Proprietary Authentication Data and the concatenated ARQC is transmitted over a secure channel using the chip card. The transmitted ARQC is received and the received ARQC is forwarded over a secure channel using an authentication terminal device. The ARQC is received from the acquirer terminal device. The chip card and the transaction are authenticated by generating an ARQC with the stored card data and comparing the generated ARQC with the ARQC received from the chip card reading terminal using a card issuer bank device. Both the PIN block and the chip card generated ARQC/cryptogram are validated. The validation status or the result of validation process is sent back to the user via card issuer bank device.

[0049] According to one embodiment herein, the method further comprises counting the number of transaction attempts without any valid server responses using a transaction counter and resetting the transaction counter every time after a successful transaction is done or carried out. [0050] According to one embodiment herein, the method further comprises deactivating the chip card when the number of invalid server responses or the number of transaction attempts without any valid server responses is equal to or more than a preset threshold value to protect the system from brute-force attacks.

[0051] The embodiments herein provide a system and method for secure electronic transaction. The system includes end to end transaction eco system comprising card issued by the issuer bank, any PCI and EMV approved terminal, payments server or host and financial network providers.

[0052] According to one embodiment herein, the system for a secure electronic transaction using a card comprises a terminal for reading an EMV card data, an acquirer bank server, the network providers and a card issuer bank.

[0053] According to one embodiment herein, the card is a Near Field Communication (NFC) card or a smart card or any other similar eco system.

[0054] According to one embodiment herein, the card data is unique for the card and strictly in compliance with EMV Co. standards or any other specific standards which is used in the system and works on all EMV Co. or any other specific system certified/ complied terminals.

[0055] According to one embodiment herein, the system is configured to introduce changes to current eco system to match backward or existing system compatibility.

[0056] According to one embodiment herein, the system is configured to introduce no changes to the current eco system which is maintained by third party players.

[0057] According to one embodiment herein, the system is configured to provide changes in the card processing, for validating PIN by the issuer without an intervention of acquirer or middle system like network or financial switch or any similar server. [0058] According to one embodiment herein, the issuer is defined as the one who issues card or any instrument or tool and has association with consumer or card holder or user. Further the acquirer is defined as the one who has issued terminal or has association with merchant or terminal holder.

[0059] According to one embodiment herein, the system and method introduces changes to the present day card processing which is allowed by EMV Co. The changes are done internally to the card and Issuer processing system (server).

[0060] According to one embodiment herein, the system and method eliminates the need for PIN translation at a plurality of payment servers such as servers of acquirer bank, third party partner system, network provider system, etc. The system is configured to translate PIN by using existing eco system without the knowledge of parties involved between the card issued and issuer processing systems.

[0061] According to one embodiment herein, the system and method provides an alternative technique to the present day complex key management which is used for translating PIN blocks.

[0062] According to one embodiment herein, the system and method deals with only EMV contact and contactless card or any such (similar) systems.

[0063] According to one embodiment herein, the system and method introduces industry best practice to encrypt PIN block at issuing card, like DUKPT/MK-SK or any other data encryption standard for enhanced security.

[0064] According to one embodiment herein, the system and method involves using the present day offline PIN (clear or enciphered) concept. The method involves enabling the card holder to enter his secret identifier or his PIN into the terminal and the terminal is configured to transfer the entered secret identifier/PIN to the card in turn. Then card is configured to perform encryption by extracting PIN Block. In case of MK-SK, PIN is encrypted with current Key and in case of DUKPT, PIN is encrypted based on current key with ATC (Application Transaction Counter - Tag 9F36 maintained by ICC in case of EMV Co. complied card or any other counter) and IPEK to generate current Key and PIN block is encrypted with the key. In case of any other scheme such system is used.

[0065] According to one embodiment herein, encrypted PIN Block is concatenated to ARQC as per CI. 8.2.2. of Book 2 Security and Key management of EMV Co. Version 4.3. The ARQC is used as Proprietary Authentication Data (PAD) which is used as a length of 8 Bytes.

[0066] According to one embodiment herein, the method is used for generation of ARQC, which is a cryptogram generated by the card (ICC) to identify and securely authenticate card transaction by the issuer.

[0067] According to one embodiment herein, the issuer authenticates both card data and PIN data in one command with no security flaw thereby avoiding multiple PIN translations across the system is open to security flaw.

[0068] According to one embodiment herein, a system is provided for secure translation and authentication of card data and PIN data in a secure transaction process. The system comprises a terminal device or merchant terminal for receiving a chip card or tapping of a chip card or any physical contact. The card data is read by the terminal device with Card Verification Method as offline PIN. The terminal device is configured to pass the PIN block to ICC (Card) upon PIN entry by a Card holder. The ICC (Card) is configured to encrypt the PIN block using DUKPT (ATC/counter as IKSN) or MK-SK method. The ICC (Card) is configured to generate/prepare ARQC, using encrypted PIN block as Proprietary Authentication Data and a cryptogram is generated. The ICC (Card) is configured to send the generated ARQC to an authentication terminal device. The authentication terminal device is configured to forward the received ARQC from the ICC (Card) to an acquirer terminal device. The acquirer terminal device is configured to forward the received ARQC to a card issuer bank device through a network provider system for authentication and payment. The card issuer bank device is configured to authenticate the card and the transaction by generating an ARQC with the stored card data and by comparing the generated ARQC with the ARQC received from the card reading terminal. The Card Issuer bank terminal is configured to calculate and generate ARQC in the same method followed by the ICC (card) in calculating and generating the ARQC. The Card Issuer bank terminal is configured to authorize the received ARQC by comparing the received ARQC with the generated ARQC. The Card Issuer bank terminal is configured to validate both PIN block and the card generated cryptogram. The card receiver terminal is configured to notify/give issuer bank decision generated based on authorization. The IC chip in the card is loaded with an algorithm for encrypting PIN block and generating the ARQC.

[0069] According to one embodiment herein, a system and a method for a secure electronic transaction are provided. The system includes a card issued by the bank or any financial agency, a terminal (with no changes and manufactured and maintained by any third party agency or bank), a network provider (like VISA, Mastercard, etc.,) and an issuer payments processing machine.

[0070] According to one embodiment herein, the system of the embodiments herein is a payment system or a system for payments with secure element used in conjunction with mobile phone, personal computer and the like. The typical credit card transaction involves the card holder making use of the NFC enabled device or EVM card for transacting with the terminal. The terminal is configured to process the card and transaction information and request an authorization from the acquiring bank or any financial agency. The acquiring bank terminal device is configured to forward the request to the issuer bank terminal device which in turn is configured to forward the authorization request to credit card network typically. The credit card network device is configured to send the request to the card issuer bank terminal device. The card issuer bank terminal device is configured to approve or decline the transaction based on multiple factors (validity, valid authorization request etc.) stored securely. The credit card network device is configured to forward the card issuer bank authorization response to the acquiring bank terminal device via the issuer bank terminal device. The acquiring bank terminal or any financial agency terminal is configured to store the transaction information for later processing like payment settlement. Further, the bank terminal device is configured to forward the response to the card terminal device and the terminal device is configured to continue and complete the transaction accordingly.

[0071] According to one embodiment herein, the system for a secure electronic transaction using an EMV Co., or any other regulatory/guided body/consortium approved and complied card which uses chip card technology or contactless (NFC) technology.

[0072] According to one embodiment herein, the system is also configured to handle any brute force attack or replay attack to the instrument. There is always a possibility of such attack, as the system is intended to use in the open environment. Any person intended to break the system is able to attack the system with a brute force to get the sensitive data by observing a pattern of encryption by making all input data which is used to calculate algorithm in a non-random manner. To avoid such actions, the system is configure to have a counter to register and store the number of brute force attempts made at any instant/time period. The system is configured to count such actions (actions without issuer authentication in response to ARQC generated by the ICC). The system is further configured to deactivate the card or bar the card operation or kill the card or make the card non usable or prevent the card from generating ARQC, when the total number of counts is equal to or more than a preset threshold value. The system is also configured to activate the barred card or unusable card and make the card usable on lock with the user secure scripts run on the ICC after the authentication or identification of issuer by ICC. The counter is reset every time a successful transaction is done or carried out.

[0073] To prevent brute force attacks, in asking the card to generate a series of cryptograms, the card is configured to wait for the Issuer Authority (IA) response. When a response is not received within a time period, due to a malicious brute force attack, the counter is incremented by one count.

[0074] These and other aspects of the embodiments herein will be better appreciated and understood when considered in conjunction with the following description and the accompanying drawings. It should be understood, however, that the following descriptions, while indicating the preferred embodiments and numerous specific details thereof, are given by way of an illustration and not of a limitation. Many changes and modifications may be made within the scope of the embodiments herein without departing from the spirit thereof, and the embodiments herein include all such modifications.

BRIEF DESCRIPTION OF THE DRAWINGS

[0075] The other objects, features and advantages will occur to those skilled in the art from the following description of the preferred embodiment and the accompanying drawings in which:

[0076] FIG.1 illustrates a block diagram of a system for secure electronic transaction, according to one embodiment herein.

[0077] FIG.2 illustrates a flowchart explaining a method of secure electronic transaction, according to one embodiment herein.

[0078] FIG.3 illustrates a table indicating the mandatory data used for cryptogram generation, according to one embodiment herein. [0079] Although the specific features of the embodiments herein are shown in some drawings and not in others. This is done for convenience only as each feature may be combined with any or all of the other features in accordance with the embodiments herein.

DETAILED DESCRIPTION OF THE EMBODIMENTS HEREIN

[0080] In the following detailed description, a reference is made to the accompanying drawings that form a part hereof, and in which the specific embodiments that may be practiced is shown by way of illustration. These embodiments are described in sufficient detail to enable those skilled in the art to practice the embodiments and it is to be understood that the logical, mechanical and other changes may be made without departing from the scope of the embodiments. The following detailed description is therefore not to be taken in a limiting sense.

[0081] The embodiments herein provide a system and method for secure electronic transaction. The system comprises a terminal device/merchant terminal configured for receiving one or more PIN details for Customer Verification Method (CVM) from a user via a keypad or an input device associated with the terminal device. The terminal device is further configured for encrypting the received PIN input from the user using one or more encryption algorithms. The system also comprises a chip card/integrated circuit card (ICC) communicatively coupled with the terminal device. The chip card is configured for accepting and translating the encrypted PIN from the terminal device. The chip card comprises a transaction counter configured for incrementing for every transaction attempt performed by the user. The chip card is configured for encrypting the translated PIN with Derived Unique Key Per Transaction (DUKPT) key based on transaction counter value present in the card as a Key Serial Number (KSN). The chip card is further configured for concatenating the encrypted PIN block to an Authorization Request Cryptogram (ARQC) to generate a Proprietary Authentication Data (PAD)/authorization request comprising of the ARQC and the PIN block. The chip card is further configured for transmitting the ARQC over a secure channel. The system further comprises an authentication terminal device configured for accepting the transmitted ARQC and for forwarding the received ARQC over a secure communication channel and an acquirer terminal device/merchant bank device configured for receiving the ARQC from the authentication terminal device and for forwarding the received ARQC through a network provider system for authentication and payment. The system still further comprises a card issuer bank device configured for receiving the ARQC from the acquirer terminal device and for authenticating the chip card and the transaction by generating an ARQC with the stored card data and by comparing the generated ARQC with the ARQC received from the chip card reading terminal. The card issuer bank device is further configured for validating both PIN block and the chip card generated ARQC/cryptogram and for informing the validation state back to the user via the card issuer bank device.

[0082] According to one embodiment herein, the chip card is further configured for counting the number of transaction attempts with no valid server response using the transaction counter. The chip card is further configured for de-activating when the number of invalid server responses is equal to or more than a preset threshold value to protect the system from brute-force attacks. The transaction counter is reset every time after a successful transaction is completed or carried out.

[0083] According to one embodiment herein, the system is further configured for activating a barred card or unusable card and for making the card usable on lock with a user secure script run on the chip card after the authentication or identification of issuer by chip card. [0084] According to one embodiment herein, the one or more encryption algorithms used for PIN block encryption comprises Derived Unique Key Per Transaction algorithm (DUKPT (ATC as IKSN)) or MK-SK algorithm.

[0085] According to one embodiment herein, the Proprietary Authentication Data (PAD)/authorization is generated by concatenating the encrypted PIN block to an Authorization Request Cryptogram (ARQC) using a XOR function.

[0086] According to one embodiment herein, the chip card is a contact or contactless Near Field Communication (NFC) card or a smart card.

[0087] According to one embodiment herein, the system is configured for translating the PIN by using existing eco system without the knowledge of one or more parties involved between the card issued and issuer processing system.

[0088] According to one embodiment herein, a method for secure electronic transaction is provided. The method comprises the steps of inserting a chip card or tapping a chip card in a terminal device or merchant terminal. The chip card data is read by the terminal device with CVM (Customer Verification Method) as off-line PIN. The PIN block is passed to the chip card from the terminal device when PIN is entered by a card holder and the PIN block is encrypted by the chip card using one or more encryption algorithms. An ARQC is concatenated with the encrypted PIN block as Proprietary Authentication Data and the concatenated ARQC is transmitted over a secure channel using the chip card. The transmitted ARQC is received and the received ARQC is forwarded over a secure channel using an authentication terminal device. The ARQC is received from the acquirer terminal device. The chip card and the transaction are authenticated by generating an ARQC with the stored card data and comparing the generated ARQC with the ARQC received from the chip card reading terminal using a card issuer bank device. Both the PIN block and the chip card generated ARQC/cryptogram are validated. The validation status or the result of validation process is sent back to the user via card issuer bank device.

[0089] According to one embodiment herein, the method further comprises counting the number of transaction attempts without any valid server responses using a transaction counter and resetting the transaction counter every time after a successful transaction is done or carried out.

[0090] According to one embodiment herein, the method further comprises deactivating the chip card when the number of invalid server responses or the number of transaction attempts without any valid server responses is equal to or more than a preset threshold value to protect the system from brute-force attacks.

[0091] According to one embodiment herein, a computer implemented method, comprising instructions stored on a non-transitory computer readable storage medium and executed on a computing device provided with a hardware processor and memory, for a secure electronic transaction is provided. The method comprises the steps of inserting a chip card or tapping a chip card in a terminal device or merchant terminal. The chip card data is read by the terminal device with CVM (Customer Verification Method) as off-line PIN. The PIN block is passed to the chip card from the terminal device when PIN is entered by a card holder and the PIN block is encrypted by the chip card using one or more encryption algorithms. An ARQC is concatenated with the encrypted PIN block as Proprietary Authentication Data and the concatenated ARQC is transmitted over a secure channel using the chip card. The transmitted ARQC is received and the received ARQC is forwarded over a secure channel using an authentication terminal device. The ARQC is received from the acquirer terminal device. The chip card and the transaction are authenticated by generating an ARQC with the stored card data and comparing the generated ARQC with the ARQC received from the chip card reading terminal using a card issuer bank device. Both the PIN block and the chip card generated ARQC/cryptogram are validated. The validation status or the result of validation process is sent back to the user via card issuer bank device.

[0092] According to one embodiment herein, the method further comprises counting the number of transaction attempts without any valid server responses using a transaction counter and resetting the transaction counter every time after a successful transaction is done or carried out.

[0093] According to one embodiment herein, the method further comprises deactivating the chip card when the number of invalid server responses or the number of transaction attempts without any valid server responses is equal to or more than a preset threshold value to protect the system from brute-force attacks.

[0094] According to one embodiment herein, an article of manufacture comprising a computer readable storage medium recorded with or stored with instructions for execution on a computing device provided with a hardware processor and memory, for a secure electronic transaction is provided. The stored instructions are executed on a computing device provided with a hardware processor and memory, and configured for carrying out or performing or executing a method for a secure electronic transaction by inserting or the article of manufacture into the computing device or by connecting a player device loaded with the article of manufacture. The method comprises the steps of receiving a chip card or tapping a chip card in a terminal device or merchant terminal. The chip card data is read by the terminal device with CVM (Customer Verification Method) as off-line PIN. The PIN block is passed to the chip card from the terminal device when PIN is entered by a card holder and the PIN block is encrypted by the chip card using one or more encryption algorithms. An ARQC is concatenated with the encrypted PIN block as Proprietary Authentication Data and the concatenated ARQC is transmitted over a secure channel using the chip card. The transmitted ARQC is received and the received ARQC is forwarded over a secure channel using an authentication terminal device. The ARQC is received from the acquirer terminal device. The chip card and the transaction are authenticated by generating an ARQC with the stored card data and comparing the generated ARQC with the ARQC received from the chip card reading terminal using a card issuer bank device. Both the PIN block and the chip card generated ARQC/cryptogram are validated. The validation status or the result of validation process is sent back to the user via card issuer bank device.

[0095] According to one embodiment herein, the method further comprises counting the number of transaction attempts without any valid server responses using a transaction counter and resetting the transaction counter every time after a successful transaction is done or carried out.

[0096] According to one embodiment herein, the method further comprises deactivating the chip card when the number of invalid server responses or the number of transaction attempts without any valid server responses is equal to or more than a preset threshold value to protect the system from brute-force attacks.

[0097] The embodiments herein provide a system and method for secure electronic transaction. The system includes end to end transaction eco system comprising card issued by the issuer bank, any PCI and EMV approved terminal, payments server or host and financial network providers or specific infrastructure.

[0098] According to one embodiment herein, the system for a secure electronic transaction using a card comprises a terminal for reading an EMV card data, an acquirer bank server, the network providers and a card issuer bank.

[0099] According to one embodiment herein, the card is a Near Field Communication (NFC) card or a smart card or any other instrument which is used for authentication or authorization and has/interfaces with secure element. [00100] According to one embodiment herein, the card data is unique for the card and strictly in compliance with EMV Co. standards or any other specific standards which is used in the system and works on all EMV Co. or any other specific system certified/ complied terminals.

[00101] According to one embodiment herein, the system is configured to introduce changes to current eco system to match backward or existing system compatibility.

[00102] According to one embodiment herein, the system is configured to introduce no changes to the current eco system which is maintained by third party players.

[00103] According to one embodiment herein, the system is configured to provide changes in the card processing, for validating PIN by the issuer without an intervention of acquirer or middle system like network or financial switch or any similar server.

[00104] According to one embodiment herein, the issuer is defined as the one who issues card or any instrument or tool and has association with consumer or card holder or user. Further the acquirer is defined as the one who has issued terminal or has association with merchant or terminal holder.

[00105] According to one embodiment herein, the system and method introduces changes to the present day card processing which is allowed by EMV Co. The changes are done internally to the card and Issuer processing system (server).

[00106] According to one embodiment herein, the system and method eliminates the need for PIN translation at a plurality of payment servers such as servers of acquirer bank, third party partner system, network provider system, etc. The system is configured to translate PIN by using existing eco system without the knowledge of parties involved between the card issued and issuer processing systems. [00107] According to one embodiment herein, the system and method provides an alternative technique to the present day complex key management which is used for translating PIN blocks.

[00108] According to one embodiment herein, the system and method deals with only EMV contact and contactless card or any such (similar) systems.

[00109] According to one embodiment herein, the system and method introduces industry best practice to encrypt PIN block at issuing card, like DUKPT/MK-SK or any other data encryption standard for enhanced security.

[00110] According to one embodiment herein, the system and method involves using the present day offline PIN (clear or enciphered) concept. The method involves enabling the card holder to enter his secret identifier or his PIN into the terminal and the terminal is configured to transfer the entered secret identifier/PIN to the card in turn. Then card is configured to perform encryption by extracting PIN Block. In case of MK-SK, PIN is encrypted with current Key and in case of DUKPT, PIN is encrypted based on current key with ATC (Application Transaction Counter - Tag 9F36 maintained by ICC in case of EMV Co. complied card or any other counter) and IPEK to generate current Key and PIN block is encrypted with the key. In case of any other scheme such system is used.

[00111] According to one embodiment herein, encrypted PIN Block is concatenated to ARQC as per CI. 8.2.2. of Book 2 Security and Key management of EMV Co. Version 4.3. The ARQC is used as Proprietary Authentication Data (PAD) which is used as a length of 8 Bytes.

[00112] According to one embodiment herein, the method is used for generation of ARQC, which is a cryptogram generated by the card (ICC) to identify and securely authenticate card transaction by the issuer. [00113] According to one embodiment herein, the issuer authenticates both card data and PIN data in one command with no security flaw thereby avoiding multiple PIN translations across the system is open to security flaw.

[00114] According to one embodiment herein, a system is provided for secure translation and authentication of card data and PIN data in a secure transaction process. The system comprises a terminal device or merchant terminal for receiving a chip card or tapping of a chip card or any physical contact. The card data is read by the terminal device with Card Verification Method as offline PIN. The terminal device is configured to pass the PIN block to ICC (Card) upon PIN entry by a Card holder. The ICC (Card) is configured to encrypt the PIN block using DUKPT (ATC/counter as IKSN) or MK-SK method. The ICC (Card) is configured to generate/prepare ARQC, using encrypted PIN block as Proprietary Authentication Data and a cryptogram is generated. The Proprietary Authentication Data (PAD)/authorization is generated by concatenating the encrypted PIN block to an Authorization Request Cryptogram (ARQC) using a XOR function. ARQC, which is Authorization request will have Cryptogram and PIN block in it The ICC (Card) is configured to send the generated ARQC to an authentication terminal device. The authentication terminal device is configured to forward the received ARQC from the ICC (Card) to an acquirer terminal device. The acquirer terminal device is configured to forward the received ARQC to a card issuer bank device through a network provider system for authentication and payment. The card issuer bank device is configured to authenticate the card and the transaction by generating an ARQC with the stored card data and by comparing the generated ARQC with the ARQC received from the card reading terminal. The Card Issuer bank terminal is configured to calculate and generate ARQC in the same method followed by the ICC (card) in calculating and generating the ARQC. [00115] According to one embodiment herein, the card issuer bank device uses DUKPT algorithm which has Base Derived key (BDK) and derives card key which is Initial Pin Encryption Key (IPEK) with BDK and card number as the input elements. For every card transaction, transaction counter is incremented and session key or Transaction Pin Key (TPK) is derived. The same algorithm is followed in the bank server as well where BDK (is stored in the server), card number and transaction counter (as part of pay load to server from the card) are present.

[00116] The Card Issuer bank terminal is configured to authorize the received ARQC by comparing the received ARQC with the generated ARQC. The Card Issuer bank terminal is configured to validate both PIN block and the card generated cryptogram. The card receiver terminal is configured to notify /give issuer bank decision generated based on authorization. The IC chip in the card is loaded with an algorithm for encrypting PIN block and generating the ARQC.

[00117] According to one embodiment herein, a system and a method for a secure electronic transaction are provided. The system includes a card issued by the bank or any financial agency, terminal (with no changes and manufactured and maintained by any third party agency or bank), network provider (like VISA, Mastercard, etc.,) issuer payments processing machine.

[00118] According to one embodiment herein, the system of the embodiments herein is a payment system or a system for payments with secure element used in conjunction with mobile phone, personal computer and the like. The typical credit card transaction involves the card holder making use of the NFC enabled device or EVM card for transacting with the terminal. The terminal is configured to process the card and transaction information and request an authorization from the acquiring bank or any financial agency. The acquiring bank terminal device is configured to forward the request to the issuer bank terminal device which in turn is configured to forward the authorization request to credit card network typically. The credit card network device is configured to send the request to the card issuer bank terminal device. The card issuer bank terminal device is configured to approve or decline the transaction based on multiple factors (validity, valid authorization request etc.) stored securely. The credit card network device is configured to forward the card issuer bank authorization response to the acquiring bank terminal device via the issuer bank terminal device. The acquiring bank terminal or any financial agency terminal is configured to store the transaction information for later processing like payment settlement. Further, the bank terminal device is configured to forward the response to the card terminal device and the terminal device is configured to continue and complete the transaction accordingly.

[00119] According to one embodiment herein, the system for a secure electronic transaction using an EMV Co., or any other regulatory/guided body/consortium approved and complied card which uses chip card technology or contactless (NFC) technology.

[00120] According to one embodiment herein, the system is also configured to handle any brute force attack or replay attack to the instrument. There is always a possibility of such attack, as the system is intended to use in the open environment. Any person intended to break the system is able to attack the system with a brute force to get the sensitive data by observing a pattern of encryption by making all input data which is used to calculate algorithm in a non-random manner. To avoid such actions, the system is configure to have a counter to register and store the number of brute force attempts made at any instant/time period. The system is configured to count such actions (actions without issuer authentication in response to ARQC generated by the ICC). The system is further configured to deactivate the card or bar the card operation or kill the card or make the card non usable or prevent the card from generating ARQC, when the total number of counts is equal to or more than a preset threshold value. The system is also configured to activate the barred card or unusable card and make the card usable on lock with the user secure scripts run on the ICC after the authentication or identification of issuer by ICC. The counter is reset every time a successful transaction is done or carried out.

[00121] According to one embodiment herein, as part of security process a finite counter value is recommended. When the counter value overflows, card gets updated with different IPEK using encrypted issuer scripts that run as per EMV standards. Thus, usual procedure to update card remotely by the issuer bank through any authorized terminal or reader is followed.

[00122] According to one embodiment herein, to prevent brute force attacks, in asking the card to generate a series of cryptograms, the card is configured to wait for the Issuer Authority (IA) response. When a response is not received within a time period, due to a malicious brute force attack, the counter is incremented by one count.

[00123] According to one embodiment herein, cryptogram which is generated as part of EMV based transaction takes into consideration of data elements as per 8.1.1. of EMV_4.3_Book 2

[00124] According to one embodiment herein the system is configured to also ask for PIN or secret key of user for validation. It has different Card or user verification methods. Usually, online PIN which is entered in the terminal and packed it with encryption keys present on the terminal or reader. Keys to encrypt can be exchanged by the terminal associated bank and not by the card or user relationship bank. Offline PIN or secret key can be verified by the card itself. But this is not a viable process for updating PIN or secret key by the user easily without running scripts on the card itself by the bank. [00125] According to one embodiment herein, packed and encrypted PIN or user key is translated at Bank HSM which owns the reader or terminal. Translated PIN is then encrypted with the Network or card associated bank. Then associated bank verifies it and takes a decision on authenticity.

[00126] According to one embodiment herein, at the time of Cryptogram generation, in addition to data elements as per 8.1.1. Of EMV_4.3_Book2, card is configured to take PIN or user secret key into account also.

[00127] According to one embodiment herein, the system and method is configured to use encrypted offline PIN as card verification method.

[00128] According to one embodiment herein, the existing card readers or terminals are configured to capture PIN or user secret key on pin pad and then send PIN in encrypted form to card. The card is then configured to then translate PIN and then encrypts it with DUKPT key based on transaction counter present in the card as KSN. Encrypted PIN is then XORed with the cryptogram generated in usual process. ARQC, which is Authorization request is configured to have Cryptogram and PIN block in it. With this process there is no need of PIN translation of at a bank which owns a terminal and then PIN is never opened in clear in any of the HSM.

[00129] According to one embodiment herein, Cryptogram (ARQC) is forwarded to the issuer bank or card associated bank and then issuer bank is configured to create same cryptogram with same operation and then compare with the received ARQC. On successful matching, the transaction is approved. The advantage with this procedure is no PIN translation in a system which is not owned or governed by the card issuing bank. Thus no form of security breach or compromise can ever happen. [00130] According to one embodiment herein, issuer server usually has the same algorithm of that of the card and it is like a mirror. While determining keys, it uses DUKPT algorithm which has Base Derived key (BDK) and then it derives card key which is Initial Pin Encryption Key (IPEK) with BDK and card number as the input elements. Then for every card transaction - counter which increments every transaction increments and derives session key or Transaction Pin Key (TPK). The same algorithm is followed in the bank server as well where BDK (is stored in the server), card number and transaction counter (as part of pay load to server from the card) are present.

[00131] According to one embodiment herein, it is highly recommended to use finite counter value usually as part of security process and if the counter value overflows card should get updated with different IPEK using encrypted issuer scripts that can run as per EMV standards. This is usual procedure to update card remotely by the issuer bank through any authorized terminal or reader.

[00132] According to one embodiment herein, the ARPC is handled in par with current system, no change in this is required. But ARPC is also generated by the issuer in response to the ARQC received by the issuer from the card.

[00133] According to one embodiment herein, authentication terminal is the terminal or reader which is designed as per EMV Co. standards and PCI guidelines.

[00134] According to one embodiment herein, the main aim of this solution or idea is not to change any part of existing terminals in the filed which are working at as per EMV Co. guidelines.

[00135] According to one embodiment herein, not only the EMV Co system, but also any electronic device which acts as a transport to send confidential or secret key from a device which is connected to it can use same logic. This will make sure the machine which is used to transport does not interfere in the security of the secret key. [00136] FIG. 1 illustrates a block diagram of a system for secure electronic transaction, according to one embodiment herein. With respect to FIG. 1, the system 100 comprises a terminal device 102 or merchant terminal 103 for receiving a chip card or tapping of a chip card through a mobile computing device 101. The card data is read by the terminal device 102 with CVM as offline PIN. The terminal device 102 is configured to passes the PIN block to ICC (Card) upon PIN entry by a Card holder. The ICC (Card) is configured to encrypt the PIN block using DUKPT (ATC as IKSN) or MK-SK method. The ICC (Card) is configured to generate/prepare ARQC, using encrypted PIN block as Proprietary Authentication Data and a cryptogram is generated. The ICC (Card) is configured to send the generated ARQC to an authentication terminal device 104. The authentication terminal device 104 is configured to forward the received ARQC from the ICC (Card) to an acquirer terminal device 105. The acquirer terminal device 105 is configured to forward the received ARQC to a card issuer bank device 107 through a network provider system 106 for authentication and payment. The card issuer bank device 107 is configured to authenticate the card and the transaction by generating an ARQC with the stored card data and by comparing the generated ARQC with the ARQC received from the card reading terminal. The Card Issuer bank terminal 107 is configured to calculate and generate ARQC in the same method followed by the ICC (card) in calculating and generating the ARQC. The Card Issuer bank terminal 107 is configured to authorize the received ARQC by comparing the received ARQC with the generated ARQC. The Card Issuer bank terminal 107 is configured to validate both PIN block and the card generated cryptogram. The card data receiver terminal 103 is configured to notify/give issuer bank decision generated based on authorization. The IC chip in the card is loaded with an algorithm for encrypting the PIN block and generating the ARQC. [00137] According to one embodiment herein, the system is also configured to handle any brute force attack or replay attack to the instrument. There is always a possibility of such attack, as the system is intended to use in the open environment. Any person intended to break the system is able to attack the system with a brute force to get the sensitive data by observing a pattern of encryption by making all input data which is used to calculate algorithm in a non-random manner. To avoid such actions, the system is configure to have a counter to register and store the number of brute force attempts made at any instant/time period. The system is configured to count such actions (actions without issuer authentication in response to ARQC generated by the ICC). The system is further configured to deactivate the card or bar the card operation or kill the card or make the card non usable or prevent the card from generating ARQC, when the total number of counts is equal to or more than a preset threshold value. The system is also configured to activate the barred card or unusable card and make the card usable on lock with the user secure scripts run on the ICC after the authentication or identification of issuer by ICC. The counter is reset every time a successful transaction is done or carried out.

[00138] To prevent brute force attacks, in asking the card to generate a series of cryptograms, the card is configured to wait for the Issuer Authority (IA) response. When a response is not received within a time period, due to a malicious brute force attack, the counter is incremented by one count.

[00139] FIG. 2 illustrates a flowchart explaining a process of secure electronic transaction, according to one embodiment herein. With respect to FIG. 2, the method is provided for secure translation and authentication of card data and PIN data in a secure transaction process. The method comprises inserting a chip card or tapping a chip card in a card terminal device or merchant terminal (202). The card holder is requested to enter PIN as per CVM (204). The card data is read by the terminal device with CVM as off-line PIN (206). The PIN block is passed to ICC (Card) from the terminal device when PIN is entered by a Card holder (208). The PIN block is encrypted by the ICC (Card) using DUKPT (ATC as IKSN) or MK-SK method (210). The ARQC is generated/prepared by the ICC (Card), using encrypted PIN block as Proprietary Authentication Data and a cryptogram is generated (212). The generated ARQC is sent to an authentication terminal device from the ICC (Card) (214). The received ARQC from the ICC (Card) is forwarded to an acquirer terminal device by the authentication terminal device. The received ARQC is forwarded to a card issuer bank device from the acquirer terminal device through a network provider system for authentication and payment (216). The card data and the transaction are authenticated by the card issuer bank device by generating an ARQC with the stored card data and by comparing the generated ARQC with the ARQC received from the card reading terminal. The ARQC is calculated and generated at the Card Issuer bank terminal in the same method followed by the ICC (card) in calculating and generating the ARQC. The received ARQC is authorized and authenticated at the Card Issuer bank terminal by comparing the received ARQC with the generated ARQC (218). Both the PIN block and the card generated cryptogram are validated at the Card Issuer bank terminal (220). The issuer bank decision generated based on authorization is notified to the user by the card receiver terminal (222).

[00140] According to one embodiment herein, the method is also provided to handle any brute force attack or replay attack to the instrument. There is always a possibility of such attack, as the system is intended to use in the open environment. Any person intended to break the system is able to attack the system with a brute force to get the sensitive data by observing a pattern of encryption by making all input data which is used to calculate algorithm in a non-random manner. To avoid such actions, a counter is provided to register and store the number of brute force attempts made at any instant/time period. The counter is configured to count such actions (actions without issuer authentication in response to ARQC generated by the ICC). The card is deactivated or barred from use or the card is killed or the card is made non-usable or prevented from generating ARQC, when the total number of counts is equal to or more than a preset threshold value. The barred card or unusable card is activated again and the card is made usable on lock with the user secure scripts run on the ICC after the authentication or identification of issuer by ICC. The counter is reset every time a successful transaction is done or carried out.

[00141] To prevent brute force attacks, in asking the card to generate a series of cryptograms, the card is configured to wait for the Issuer Authority (IA) response. When a response is not received within a time period, due to a malicious brute force attack, the counter is incremented by one count.

[00142] FIG. 3 illustrates a table indicating the mandatory data used for cryptogram generation, according to one embodiment herein. With respect to FIG. 3, the mandatory data used for cryptogram generation comprises value and the source.

[00143] The embodiments herein provide a system and method for a secure electronic transaction / authentication. The system and method provides a technique for a fast and an efficient electronic transaction / authentication. The system provides a secure and efficient technique without leaving any security flaw and process flaw. The system provides a technique to make use of existing terminal / system without any change in the existing system. The same process or system is applied to any of the sensitive data present in the system.

[00144] The embodiments herein provide a system and method for secure authentication of any system with a secure element. The system is not only EMV compliant but also works with any electronic device which acts as a transport to send confidential or secret key from a device connected to it and uses same logic. [00145] The system is also configured to handle any brute force attack or replay attack to the instrument. The system is configured to deactivate the card or bar the card operation or kill the card or make the card non usable or prevent the card from generating ARQC, when the total number of counts is equal to or more than a preset threshold value. The system is also configured to activate the barred card or unusable card and make the card usable on lock with the user secure scripts run on the ICC after the authentication or identification of issuer by ICC.

[00146] The foregoing description of the specific embodiments herein will so fully reveal the general nature of the embodiments herein that others can, by applying current knowledge, readily modify and/or adapt for various applications such specific embodiments herein without departing from the generic concept, and, therefore, such adaptations and modifications should and are intended to be comprehended within the meaning and range of equivalents of the disclosed embodiments.

[00147] It is to be understood that the phraseology or terminology employed herein is for the purpose of description and not of limitation. Therefore, while the embodiments herein have been described in terms of preferred embodiments, those skilled in the art will recognize that the embodiments herein can be practiced with modifications. However, all such modifications are deemed to be within the scope of the claims.

[00148] Although the embodiments herein are described with various specific embodiments, it will be obvious for a person skilled in the art to practice the embodiments herein with modifications.

Claims

CLAIMS What is claimed is:

1. A system for secure electronic transaction, the system comprising:

a terminal device/merchant terminal configured for receiving one or more PIN details for Customer Verification Method (CVM) from a user via a keypad or an input device associated with the terminal device, and wherein the terminal device is further configured for encrypting the received PIN input from the user using one or more encryption algorithms;

a chip card/integrated circuit card (ICC) communicatively coupled with the terminal device, and wherein the chip card is configured for accepting and translating the encrypted PIN from the terminal device, and wherein the chip card comprises a transaction counter, and wherein the transaction is configured for incrementing a count for every transaction attempt performed by the user, and wherein the chip card is configured for encrypting the translated PIN with Derived Unique Key Per Transaction (DUKPT) key based on transaction counter value present in the card as a Key Serial Number (KSN), and wherein the chip card is further configured for concatenating the encrypted PIN block to an Authorization Request Cryptogram (ARQC) to generate an Proprietary Authentication Data (PAD)/authorization request comprising of the ARQC and the PIN block, and wherein the chip card is further configured for transmitting the ARQC over a secure channel;

an authentication terminal device configured for accepting the transmitted ARQC and for forwarding the received ARQC over a secure communication channel;

an acquirer terminal device/merchant bank device configured for receiving the ARQC from the authentication terminal device and for forwarding the received ARQC through a network provider system for authentication and payment; and a card issuer bank device configured for receiving the ARQC from the acquirer terminal device and for authenticating the chip card and the transaction by generating an ARQC with the stored card data and by comparing the generated ARQC with the ARQC received from the chip card reading terminal, and wherein the card issuer bank device is further configured for validating both PIN block and the chip card generated ARQC/cryptogram and for informing the validation state back to the user via the card issuer bank device.

2. The system according to claim 1, wherein the chip card is further configured for counting a number of transaction attempts without any valid server responses using the transaction counter, and wherein the chip card is further configured for de-activating when the number of invalid server responses or the number of transaction attempts without any valid server responses is equal to or more than a preset threshold value to protect the system from brute-force attacks, and wherein the transaction counter is reset every time after a successful transaction is done or carried out.

3. The system according to claim 1, wherein the system is further configured for activating a barred card or unusable card and for making the card usable on lock with a user secure script run on the chip card after the authentication or identification of issuer by chip card.

4. The system according to claim 1, wherein the one or more encryption algorithms used for PIN block encryption comprise Derived Unique Key Per Transaction algorithm (DUKPT (ATC as IKSN)) or MK-SK algorithm.

5. The system according to claim 1, wherein the Proprietary Authentication Data (PAD)/authorization is generated by concatenating the encrypted PIN block to an Authorization Request Cryptogram (ARQC) using a XOR function.

6. The system according to claim 1, wherein the chip card is a contact or contactless Near Field Communication (NFC) card or a smart card.

7. The system according to claim 1, wherein the system is configured for translating the PIN by using existing eco system without the knowledge of one or more parties involved between the card issued and issuer processing system.

8. An automated method for secure electronic transaction, the method comprising the steps of:

inserting a chip card or tapping a chip card in a terminal device or merchant terminal, and wherein the chip card data is read by the terminal device with CVM (Customer Verification Method) as off-line PIN;

passing the PIN block to the chip card from the terminal device when PIN is entered by a card holder and encrypting the PIN block by the chip card using one or more encryption algorithms;

concatenating an ARQC with the encrypted PIN block as Proprietary Authentication Data and transmitting the ARQC over a secure channel using the chip card;

accepting the transmitted ARQC and forwarding the received ARQC over a secure channel using an authentication terminal device;

receiving the ARQC from the acquirer terminal device and authenticating the chip card and the transaction by generating an ARQC with the stored card data and comparing the generated ARQC with the ARQC received from the chip card reading terminal using a card issuer bank device; and

validating both PIN block and the chip card generated ARQC/cryptogram and informing the validation state back to the user via card issuer bank device.

9. The method according to claim 8, wherein the method further comprises counting the number of transaction attempts with no valid server response using a transaction counter and resetting the transaction counter every time a successful transaction is done or carried out.

10. The method according to claim 8, wherein the method further comprises de-activating the chip card when the number of invalid server response is equal to or more than a preset threshold value to protect the system from brute-force attacks.