System and method for identity verification across mobile applications

• US 10,484,345 B2
• Filed: 07/30/2015
• Issued: 11/19/2019
• Est. Priority Date: 07/31/2014
• Status: Active Grant

• Current Assignee: Visa International Service Association (Visa, Inc.)
• Original Assignee: Visa International Service Association (Visa, Inc.)
• Inventors: Shastry, Vishwanath, Mayor, Shalini
• Primary Examiner(s): Patel, Ashokkumar B
• Assistant Examiner(s): Carey, Forrest L
• Application Number:
  US14/813,997
• Publication Number:
  US 20160036790A1
• Time in Patent Office: 1,573 Days
• CPC Class Codes: G06Q 20/102 Bill distribution or payments
• CPC Class Codes: G06Q 20/32 using wireless devices
• CPC Class Codes: G06Q 20/322 Aspects of commerce using mobile devices [M-devices]
• CPC Class Codes: G06Q 20/3263 characterised by activation or deactivation of payment capabilities
• CPC Class Codes: G06Q 20/36 using electronic wallets or electronic money safes
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications

Abstract

Embodiments are directed to methods, apparatuses, computer readable media and systems for authenticating a user on a user device across multiple mobile applications. The identity of the user is validated by encoding and subsequently validating cryptographically encrypted data in a shared data store accessible by the mobile applications tied to the same entity. Specifically, the application leverages the authentication process of a trusted mobile application (e.g. a banking mobile application) to authenticate the same user on a untrusted mobile application (e.g. a merchant mobile application).

Claims

1. A method comprising:

receiving, at a server computer, user data associated with a user from a first mobile application;

determining, by the server computer, that the first mobile application is a trusted application provisioned in a secure execution environment of a mobile device by an issuer of an account;

authenticating, by the server computer, the user based on the user data;

sending, by the server computer, a first cryptographic key to the first mobile application after authenticating the user, wherein an identity verification cryptogram is generated by the first mobile application using the first cryptographic key;

receiving, at the server computer, the user data associated with the user and the identity verification cryptogram generated by the first mobile application from a second mobile application, wherein the first mobile application and the second mobile application are stored on the same mobile device of the user;

validating, by the server computer, that the identity verification cryptogram is generated using the user data and the first cryptographic key previously sent by the server computer to the first mobile application; and

sending, by the server computer, a token and a second cryptographic key to the second mobile application upon validating the identity verification cryptogram generated by the first mobile application, wherein the token represents account information of the account issued by the issuer, and wherein the second mobile application completes a transaction using the token and a transaction cryptogram generated by the second mobile application using the second cryptographic key.

2. The method of claim 1, wherein the user data includes a device identifier.

3. The method of claim 2, further comprising:

determining, using the device identifier, that the first mobile application and the second mobile application are stored on the same mobile device.

4. The method of claim 1, wherein the identity verification cryptogram is stored at a cloud storage system.

5. The method of claim 1, wherein the identity verification cryptogram is stored on a cloud storage system of an operating system provider of the mobile device.

6. The method of claim 1, further comprising:

sending another token to the first mobile application along with the first cryptographic key.

7. A system comprising:

a mobile device storing a first mobile application and a second mobile application; and

a server computer including;

a processor; and

a computer readable medium coupled to the processor, the computer readable medium comprising code, when executed by the processor, causes the processor to;

receive user data associated with a user from the first mobile application;

determine that the first mobile application is a trusted application provisioned in a secure execution environment of the mobile device by an issuer of an account;

authenticate the user based on the user data;

send a first cryptographic key to the first mobile application after authenticating the user, wherein an identity verification cryptogram is generated by the first mobile application using the first cryptographic key;

receive the user data associated with the user and the identity verification cryptogram generated by the first mobile application from the second mobile application;

validate that the identity verification cryptogram is generated using the user data and the first cryptographic key previously sent by the server computer to the first mobile application; and

send a token and a second cryptographic key to the second mobile application upon validating the identity verification cryptogram generated by the first mobile application, wherein the token represents account information of the account issued by the issuer,

wherein the second mobile application completes a transaction using the token and a transaction cryptogram generated by the second mobile application using the second cryptographic key.

8. The system of claim 7, wherein the user data includes a device identifier.

9. The system of claim 8, wherein the code, when executed by the processor of the server computer, further causes the processor of the server computer to:

determine, using the device identifier, that the first mobile application and the second mobile application are stored on the same mobile device.

10. The system of claim 7, wherein the identity verification cryptogram is stored at a cloud storage system.

11. The system of claim 7, wherein the identity verification cryptogram is stored on a cloud storage system of an operating system provider of the mobile device.

12. The system of claim 7, wherein the code, when executed by the processor of the server computer, further causes the processor of the server computer to:

send another token to the first mobile application along with the first cryptographic key.

13. A method comprising:

authenticating, by a first mobile application on a user device, a user on the user device;

sending, by the first mobile application on the user device, user data associated with the user to a server computer, wherein the first mobile application is a trusted application provisioned in a secure execution environment of the user device by an issuer of an account;

receiving, by the first mobile application on the user device, a cryptographic key from the server computer;

generating, by the first mobile application on the user device, an identity verification cryptogram using the cryptographic key;

storing, by the first mobile application on the user device, the identity verification cryptogram on a cloud storage system of an operating system provider of the user device;

retrieving, by a second mobile application on the user device, the identity verification cryptogram generated by the first mobile application from the cloud storage system;

sending, by the second mobile application on the user device, the user data associated with the user and the identity verification cryptogram generated by the first mobile application to the server computer;

receiving, by the second mobile application on the user device, a token from the server computer, wherein the token represents account information of the account issued by the issuer; and

completing, by the second mobile application on the user device, a transaction with the token.

14. The method of claim 13, wherein the user data includes a device identifier.

15. The method of claim 13, further comprising:

receiving, by the first mobile application on the user device, another token along with the cryptographic key.

16. The method of claim 13, further comprising:

receiving, by the second mobile application on the user device, another cryptographic key along with the token, wherein the transaction is completed with the token and the another cryptographic key.

17. The method of claim 16, further comprising:

generating, by the second mobile application on the user device, a transaction cryptogram using the another cryptographic key; and

sending, by the second mobile application on the user device, the token and the transaction cryptogram to an access device to complete the transaction.