Identification and Verification for Provisioning Mobile Application

• US 20150356560A1
• Filed: 06/05/2015
• Published: 12/10/2015
• Est. Priority Date: 06/05/2014
• Status: Active Grant

• Current Assignee: Visa International Service Association (Visa, Inc.)
• Original Assignee: Visa International Service Association (Visa, Inc.)
• Inventors: Shastry, Vishwanath, Mayor, Shalini, Chen, Calvin
• Granted Patent: US 11,023,890 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06Q 20/38215 Use of certificates or encrypted proofs of transaction rights
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G06Q 20/405 Establishing or using transaction specific rules

Abstract

Embodiments are directed to the generation of a token associated with a status. The status of the token may affect how the token is treated and the types of restrictions placed on the token. The status of the token may indicate that the token is generated based on verification of secure user data. Alternatively, the status of the token may indicate that the token is generated based on insufficient user data and, as such, restrictions may be imposed on the token. The token requestor may be a mobile application, such as a merchant mobile application provisioned on a user device. In response to a token request from the merchant, the token provider issues tokens with varying status based on a confidence level. The status of the token may be indicated in terms of token assurance level.

Claims

1. A method comprising:

receiving, by a server computer, a first set of user information from at least one of a first mobile application or an authorizing server;

storing, by the server computer, the received first set of user information;

receiving, by the server computer, a request for a token from a second mobile application, the request comprising at least a second set of user information, wherein the second set of user information includes at least a portion of the first set of user information;

comparing the second set of user information with the first set of user information;

generating the token by the server computer based on the comparing; and

transmitting, by the server computer, the token to the second mobile application.

2. The method of claim 1, further comprising:

determining, by the server computer, a confidence level based on the comparing, wherein a status of the token is based at least in part on the confidence level.

3. The method of claim 2, wherein the status of the token is indicative of a level of restriction associated with the token.

4. The method of claim 2, further comprising:

changing the status of the token based at least in part on a transaction history provided by the second mobile application.

5. The method of claim 1, wherein the first set of information includes an authentication indicator generated by the authorizing server, wherein a status of the token is based at least in part on the authentication indicator.

6. The method of claim 1, further comprising:

receiving, from the authorizing server, an identity assertion as part of the first set of user information, wherein a status of the token is based at least in part on the identity assertion.

7. The method of claim 1, further comprising:

receiving, from the authorizing server, an indication of an XML-based security layer validation associated with a user of the second mobile application, wherein a status of the token is based at least in part on the XML-based security layer validation.

8. The method of claim 1, wherein the first mobile application and the second mobile application are stored on a same user device.

9. The method of claim 1, wherein the first mobile application is stored on a first user device and the second mobile application is stored on a second user device.

10. The method of claim 1, wherein:

the first set of user information includes one or more of a device identifier, an account number, an address, a zip code, a name, a username, a telephone number or an identity assertion, and

the second set of user information includes one or more of a device identifier, an account number, an address, a zip code, a name, a username, a telephone number, user credentials or a user authentication verification value.

11. A method comprising:

receiving, by a server computer, a request for a token from a mobile application, the request comprising identifying information associated with an account and a value assigned to a user of the account;

validating, by the server computer, the value assigned to the user of the account;

determining, by the server computer, a confidence level based on the validating;

generating the token by the server computer, wherein a status of the token is based at least in part on the confidence level, the status of the token being indicative of a level of restriction associated with the token; and

transmitting, by the server computer, the token to the mobile application.

12. The method of claim 11, wherein the value assigned to the user of the account includes a cryptogram assigned to a user device associated with the account.

13. The method of claim 11, wherein the value assigned to the user of the account includes a receipt code associated with a prior transaction carried out using the account.

14. A server computer comprising a processor and a computer readable medium comprising code, executable by the processor, for implementing a method comprising:

receiving, by a server computer, a first set of user information from at least one of a first mobile application or an authorizing server;

storing, by the server computer, the received first set of user information;

receiving, by the server computer, a request for a token from a second mobile application, the request comprising at least a second set of user information, wherein the second set of user information includes at least a portion of the first set of user information;

comparing the second set of user information with the first set of user information;

generating the token by the server computer based on the comparing; and

transmitting, by the server computer, the token to the second mobile application.

15. The server computer of claim 14, wherein the method further comprises:

determining, by the server computer, a confidence level based on the comparing, wherein a status of the token is based at least in part on the confidence level, the status of the token being indicative of a level of restriction associated with the token.

16. The server computer of claim 15, wherein the method further comprises:

changing the status of the token based at least in part on a transaction history provided by the second mobile application.

17. The server computer of claim 14, wherein the first set of information includes an authentication indicator generated by the authorizing server, wherein a status of the token is based at least in part on the authentication indicator.

18. The server computer of claim 17, wherein the authentication indicator includes an identity assertion or an indication of an XML-based security layer validation associated with a user of the second mobile application.

19. A server computer comprising a processor and a computer readable medium comprising code, executable by the processor, for implementing a method comprising:

receiving, by a server computer, a request for a token from a mobile application, the request comprising identifying information associated with an account and a value assigned to a user of the account;

validating, by the server computer, the value assigned to the user of the account;

determining, by the server computer, a confidence level based on the validating;

generating the token by the server computer, wherein a status of the token is based at least in part on the confidence level, the status of the token being indicative of a level of restriction associated with the token; and

transmitting, by the server computer, the token to the mobile application.

20. The server computer of claim 19, wherein the value assigned to the user of the account includes:

a cryptogram assigned to a user device associated with the account, or

a receipt code associated with a prior transaction carried out using the account.