Authentication of access request of a device and protecting confidential information

• US 10,523,441 B2
• Filed: 12/15/2016
• Issued: 12/31/2019
• Est. Priority Date: 12/15/2015
• Status: Active Grant

• Current Assignee: Visa International Service Association (Visa, Inc.)
• Original Assignee: Visa International Service Association (Visa, Inc.)
• Inventors: Lingappa, Phaneendra Ramaseshu
• Primary Examiner(s): Do, Khang
• Application Number:
  US15/381,000
• Publication Number:
  US 20170171183A1
• Time in Patent Office: 1,111 Days
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: H04L 2463/121 Timestamp
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 9/3066 involving algebraic varieties, e.g. elliptic or hyper-elliptic curves
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

The systems and methods described herein enable an application on a user device to securely request access to a resource for an order using a selected credential routine. The application can receive order data and a signature based on the order data from an access device. The application can include an interface for selecting a particular credential routine from a plurality of credential routines that can be used to obtain the credential for accessing the resource. Instead of requesting access to the resource via the access device, the application can communicate with an authentication server that can verify the signature based on the order data and obtain authorization of the credential. Thus, the application can select a credential routine and credential for accessing a resource through secure communications with the authentication server.

Claims

1. A method for requesting access to a resource, comprising:

receiving, by an application executing on a user device, order data and a signature based on the order data, the order data and the signature being received from an access device, the order data being for an order made via the access device to a request computer, wherein the signature is generated by the request computer using the order data, a shared secret key, and a second fingerprint of the access device, wherein the shared secret key is shared between the request computer and an authentication server;

obtaining, by the application, a selection of a credential routine from a plurality of credential routines installed on the user device, wherein each of the plurality of credential routines have access to a different stored credential corresponding to a different service for obtaining access to the resource;

requesting, by the application, a stored credential from the selected credential routine;

obtaining, by the application, the stored credential from the credential routine installed on the user device; and

sending, by the application to the authentication server, an access request including the order data, the signature, and the stored credential, the access request being a request for access to the resource, wherein the authentication server stores a first fingerprint of the access device received during a registration process with the access device, generates a second signature using the order data, the first fingerprint of the access device, and the shared secret key, compares the second signature to the signature received from the application, verifies the signature based on the comparison to the second signature, and provides a response to the access request based on the verifying of the signature.

2. The method of claim 1, further comprising:

obtaining, by the application, a first geolocation of the user device;

obtaining, by the application, a second geolocation of the access device; and

determining, by the application, that the first geolocation and the second geolocation are within a predetermined range, wherein the sending of the access request is based on the determination that the first geolocation and the second geolocation are within the predetermined range.

3. The method of claim 1, further comprising:

generating, by the application, a user interface for selecting at least one of the plurality of credential routines;

displaying, by the user device, the user interface; and

receiving, by the user device, an input to the user interface, wherein the obtaining of the selection of the credential routine is based on the input.

4. The method of claim 1, further comprising:

obtaining, by the application, a first fingerprint of the user device; and

obtaining, by the application, a first geolocation of the user device,

wherein the access request further includes the first fingerprint and the first geolocation, and

wherein the response to the access request is further based on the first fingerprint and the first geolocation.

5. The method of claim 1, wherein the order data includes at least one of an access device identifier of the access device, a request computer identifier that identifies the request computer, an order identifier that identifies the order, an order amount value, an access geolocation of the access device, and a timestamp, and wherein the signature includes a hash value that is based on at least one of an access device identifier of the access device, a request computer identifier that identifies the request computer, an order identifier that identifies the order, an order amount value, an access geolocation of the access device, a timestamp, and an access device fingerprint.

6. The method of claim 1, further comprising receiving, by the user device, a cleartext message including the order data and the signature, wherein the user device receives the cleartext message via a bluetooth message, a short message service message, or a quick response code.

7. A method for authenticating an access request, comprising:

receiving, by an authentication server, a first fingerprint of an access device during a registration process with the access device;

storing, by the authentication server, the first fingerprint of the access device;

storing, by the authentication server, a shared secret key that is shared with a request computer;

receiving, by the authentication server from an application of a user device, an access request including order data, a signature based on the order data, and a credential, wherein the order data is for an order made via the access device to the request computer, wherein the signature is generated by the request computer using the order data, the shared secret key and a second fingerprint of the access device, wherein the credential is stored on the user device, the credential being obtained from a credential routine installed on the user device;

generating, by the authentication server, a second signature using the order data, the first fingerprint of the access device, and the shared secret key;

comparing, by the authentication server, the second signature to the signature received from the application;

verifying, by the authentication server, the signature using the order data and the shared secret key that is stored at the authentication server, the verifying of the signature is based on the comparison of the second signature to the signature received from the application;

obtaining, by the authentication server, authorization of the access request based on the verifying of the signature; and

sending, by the authentication server to the application, a response to the access request based on the verifying of the signature and the obtaining of the authorization.

8. The method of claim 7, further comprising sending the shared secret key to the request computer, wherein the shared secret key used for the verifying of the signature is the same as the shared secret key sent to the request computer.

9. The method of claim 7, further comprising:

obtaining, by the authentication server, a first geolocation of an access device from the order data;

obtaining, by the authentication server, a second geolocation of the access device that is stored at the authentication server; and

determining, by the authentication server, that the first geolocation and the second geolocation are within a predetermined range, wherein the response is based on the determination that the first geolocation and the second geolocation are within the predetermined range.

10. The method of claim 7, further comprising sending, by the authentication server, the order data and the credential to an authorization server, wherein the obtaining of the authorization of the access request comprises obtaining the authorization from the authorization server.

11. The method of claim 7, further comprising:

receiving, by the authentication server, a confirmation request from the request computer, the confirmation request requesting an authorization response that indicates whether the access request was authorized; and

sending, by the authentication server, the authorization response to the request computer, the authorization response indicating that the access request is authorized.

12. A user device, comprising:

a computer readable storage medium storing a plurality of instructions; and

one or more processors for executing the instructions stored on the computer readable storage medium to;

receive, by an application, order data and a signature based on the order data, the order data and the signature being received from an access device, the order data being for an order made via the access device to a request computer, wherein the signature is generated by the request computer using the order data, a shared secret key, and a second fingerprint of the access device, wherein the shared secret key is shared between the request computer and an authentication server;

obtain, by the application, a selection of a credential routine from a plurality of credential routines installed on the user device, wherein each of the plurality of credential routines have access to a different stored credential corresponding to a different service for obtaining access to a resource;

request, by the application, a stored credential from the selected credential routine;

obtain, by the application, the stored credential from the credential routine installed on the user device; and

sending, by the application to the authentication server, an access request including the order data, the signature, and the stored credential, the access request being a request for access to the resource, wherein the access request causes the authentication server to store a first fingerprint of the access device received during a registration process with the access device, generate a second signature using the order data, the first fingerprint of the access device, and the shared secret key, compare the second signature to the signature received from the application, verify the signature based on the comparison to the second signature, and provide a response to the access request based on the verifying of the signature.

13. The user device of claim 12, wherein the instructions further cause the one or more processors to:

obtain, by the application, a first geolocation of the user device;

obtain, by the application, a second geolocation of the access device; and

determine, by the application, that the first geolocation and the second geolocation are within a predetermined range, wherein the sending of the access request is based on the determination that the first geolocation and the second geolocation are within the predetermined range.

14. The user device of claim 12, wherein the instructions further cause the one or more processors to:

generating, by the application, a user interface for selecting at least one of the plurality of credential routines;

displaying, by the user device, the user interface; and

receiving, by the user device, an input to the user interface, wherein the obtaining of the selection of the credential routine is based on the input.

15. The user device of claim 12, wherein the instructions further cause the one or more processors to:

obtain, by the application, a first fingerprint of the user device; and

obtain, by the application, a first geolocation of the user device,

wherein the access request further includes the first fingerprint and the first geolocation, and

wherein the response to the access request is further based on the first fingerprint and the first geolocation.

16. The user device of claim 12, wherein the order data includes at least one of an access device identifier of the access device, a request computer identifier that identifies the request computer, an order identifier that identifies the order, an order amount value, an access geolocation of the access device, and a timestamp.

17. The user device of claim 12, wherein the signature includes a hash value that is based on at least one of an access device identifier of the access device, a request computer identifier that identifies the request computer, an order identifier that identifies the order, an order amount value, an access geolocation of the access device, a timestamp, and an access device fingerprint.

18. The user device of claim 12, wherein the instructions further cause the one or more processors to receive, by the user device, a cleartext message including the order data and the signature, wherein the user device receives the cleartext message via a bluetooth message, a short message service message, or a quick response code.