SYSTEM AND METHOD FOR IDENTITY VERIFICATION ACROSS MOBILE APPLICATIONS

• US 20160036790A1
• Filed: 07/30/2015
• Published: 02/04/2016
• Est. Priority Date: 07/31/2014
• Status: Active Grant

• Current Assignee: Visa International Service Association (Visa, Inc.)
• Original Assignee: Visa International Service Association (Visa, Inc.)
• Inventors: Shastry, Vishwanath, Mayor, Shalini
• Granted Patent: US 10,484,345 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06Q 20/102 Bill distribution or payments
• CPC Class Codes: G06Q 20/32 using wireless devices
• CPC Class Codes: G06Q 20/322 Aspects of commerce using mobile devices [M-devices]
• CPC Class Codes: G06Q 20/3263 characterised by activation or deactivation of payment capabilities
• CPC Class Codes: G06Q 20/36 using electronic wallets or electronic money safes
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications

Abstract

Embodiments are directed to methods, apparatuses, computer readable media and systems for authenticating a user on a user device across multiple mobile applications. The identity of the user is validated by encoding and subsequently validating cryptographically encrypted data in a shared data store accessible by the mobile applications tied to the same entity. Specifically, the application leverages the authentication process of a trusted mobile application (e.g. a banking mobile application) to authenticate the same user on a untrusted mobile application (e.g. a merchant mobile application).

Claims

1. A method comprising:

receiving, at a server computer, user data associated with a user from a first mobile application;

determining, by the server computer, that the first mobile application is trusted;

authenticating, by the server computer, the user based on the user data;

sending, by the server computer, a cryptographic key to the first mobile application after authenticating the user, wherein an identity verification cryptogram is generated using the cryptographic key;

receiving, at the server computer, the user data associated with the user and the identity verification cryptogram from a second mobile application;

validating that the identity verification cryptogram is generated using the user data and the cryptographic key sent to the first mobile application; and

sending a token to the second mobile application upon validating the verification cryptogram.

2. The method of claim 1, wherein the user data includes a device identifier.

3. The method of claim 2, further comprising:

determining, using the device identifier, that the first mobile application and the second mobile application are stored on a same user device.

4. The method of claim 1, wherein the identity verification cryptogram is stored at a cloud storage system.

5. The method of claim 1, wherein the first mobile application and the second mobile application are stored on a user device of the user and the identity verification cryptogram is stored on a cloud storage system of an operating system provider of the user device.

6. The method of claim 1, further comprising:

sending another token to the first mobile application along with the cryptographic key.

7. The method of claim 1, further comprising:

sending another cryptographic key to the second mobile application along with the token.

8. A server computer comprising:

a processor; and

a computer readable medium coupled to the processor, the computer readable medium comprising code, executable by the processor, to implement a method comprising;

receiving user data associated with a user from a first mobile application;

determining that the first mobile application is trusted;

authenticating the user based on the user data;

sending a cryptographic key to the first mobile application after authenticating the user, wherein an identity verification cryptogram is generated using the cryptographic key;

receiving the user data associated with the user and the identity verification cryptogram from a second mobile application;

validating that the identity verification cryptogram is generated using the user data and the cryptographic key; and

sending a token to the second mobile application upon validating the verification cryptogram.

9. The server computer of claim 8, wherein the user data includes a device identifier.

10. The server computer of claim 9, wherein the method further comprises:

determining, using the device identifier, that the first mobile application and the second mobile application are stored on a same user device.

11. The server computer of claim 8, wherein the identity verification cryptogram is stored at a cloud storage system.

12. The server computer of claim 8, wherein the first mobile application and the second mobile application are stored on a user device of the user and the identity verification cryptogram is stored on a cloud storage system of an operating system provider of the user device.

13. The server computer of claim 8, wherein the method further comprises:

sending another token to the first mobile application along with the cryptographic key.

14. The server computer of claim 8, wherein the method further comprises:

sending another cryptographic key to the second mobile application along with the token.

15. A method comprising:

authenticating, by a first mobile application on a user device, a user on the user device;

sending, by the first mobile application on the user device, user data associated with the user to a server computer;

receiving, by the first mobile application on the user device, a cryptographic key from the server computer;

generating, by the first mobile application on the user device, an identity verification cryptogram using the cryptographic key;

storing, by the first mobile application on the user device, the cryptographic key on a cloud storage system of an operating system provider of the user device;

retrieving, by a second mobile application on the user device, the identity verification cryptogram from the cloud storage system;

sending, by the second mobile application on the user device, the user data associated with the user and the identity verification cryptogram to the server computer;

receiving, by the second mobile application on the user device, a token from the server computer; and

completing, by the second mobile application on the user device, a transaction with the token.

16. The method of claim 15, wherein the user data includes a device identifier.

17. The method of claim 15, further comprising:

receiving, by the first mobile application on the user device, another token along with the cryptographic key.

18. The method of claim 15, further comprising:

receiving, by the second mobile application on the user device, another cryptographic key along with the token, wherein the transaction is completed with the token and the another cryptographic key.