CLOUD CARD APPLICATION PLATFORM

• US 20170118201A1
• Filed: 11/03/2014
• Published: 04/27/2017
• Est. Priority Date: 07/15/2014
• Status: Active Grant

• Current Assignee: Assa Abloy AB
• Original Assignee: Assa Abloy AB
• Inventors: HOYER, Philip, ROBINTON, Mark, LOVELOCK, Julian Eric
• Granted Patent: US 10,440,012 B2
• Time in Patent Office: Days
• CPC Class Codes: G06K 19/0723 the record carrier comprising an arrangement for non-contact communication, e.g. wireless communication circuits on transponder cards, non-contact smart cards or RFIDs
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications

Abstract

A cloud card application platform is provided. The cloud card application platform enables one or more card applications to be virtualized on at least one server that is available to mobile devices via a communication network, such as the Internet. The one or more card applications virtualized on the cloud card application platform are capable of being managed remotely by service providers that have deployed and developed the one or more applications.

Claims

1. A cloud card application platform, comprising:

a credential authentication module configured to authenticate a credential read by a user device, wherein the authentication is based on information provided from the credential to the user device;

an application/service selection module configured to provide a user of the user device with an option of selecting one or more applications for use with the credential read by the mobile device; and

a federation module configured to receive identification of a selected application from the application/service selection module and, in response thereto, federate at least one of a browser and application running on the user device to a Service Provider that is associated with the selected application.

2. The cloud card application platform of claim 1, further comprising:

a management module configured to enforce access permissions to one or more applications stored in the cloud card application platform for at least one of;

(i) a credential number, (ii) a group of credential numbers, (iii) a user identity, and (iv) a group of users.

3. The cloud card application platform of claim 1, further comprising a network interface that enables packet-based communications with the user device.

4. The cloud card application platform of claim 3, wherein the user device communicates with the cloud card application platform via at least one of HTTP and IP-based network protocols.

5. The cloud card application platform of claim 1, wherein the federation module generates a federation token in response to receiving the identification of the selected application, wherein the federation token federates via a browser of the user device to the Service Provider, and wherein the federation token provides a proof of authenticity as determined by the card authentication module to the Service Provider, thereby enabling the Service Provider to trust that the credential read by the user device has been authenticated.

6. The cloud card application platform of claim 5, wherein the federation token also provides data stored on the cloud card application platform that is associated with the selected application or the selected application for the specific credential that has been authenticated.

7. The cloud card application platform of claim 1, wherein the application is selected automatically by an application selector.

8. The cloud card application platform of claim 1, wherein the application is selected based on a user input received at the user device in response to the user of the user device being presented with an application selection dashboard by the application/service selection module.

9. The cloud card application platform of claim 1, wherein the card authentication module, application/service selection module, and federation module are stored on a non-transitory computer-readable media of at least one server and wherein a processor of the at least one server is configured to execute the card authentication module, application/service selection module, and federation module.

10. The cloud card application platform of claim 9, wherein at least some data for each of the one or more applications is also stored on the non-transitory computer-readable media of the at least one server.

11. The cloud card application platform of claim 10, further comprising:

an Application Programming Interface (API) that enables a Service Provider to manage an application stored on the at least one server.

12. The cloud card application platform of claim 1, wherein the credential authentication module is further configured to authenticate one or both of the user device and the user of the user device.

13. A server, comprising:

at least one processor; and

memory including at least one virtualized card application stored thereon, wherein the at least one virtualized credential application includes one or more files related to a credential application and the one or more files are associated with the credential application such that the server is enabled to provide the one or more files to a user device.

14. The server of claim 13, wherein the server is enabled to provide the one or more files to the mobile device in response to the mobile device providing the server with at least one of a card and user identifier that is associated with the card application.

15. The server of claim 14, wherein the server further comprises a web interface that enables communications with the mobile device.

16. The server of claim 13, wherein the memory further includes an authentication module configured to authenticate at least one of the mobile device and a card that is associated with the card application.

17. The server of claim 13, wherein the memory further includes an application selector that at least one of:

(i) automatically selects a card application and the associated one or more files in the event that the card application is dedicated to a single mobile device;

(ii) present the mobile device with a list of applications available to the mobile device; and

(iii) a combination of (i) and (ii).

18. A method, comprising:

receiving, at a server implementing a cloud card application platform, at least one message from a browser of a mobile device, the at least one message including a Universal Resource Locator (URL) corresponding to provided to the mobile device to a card read by the mobile device as well as a Tag Authentication Cryptogram (TAC) that indicates a unique read transaction occurred between the card and the mobile device;

authenticating, at the server implementing the cloud card application platform, a card number included in the URL and/or the TAC;

optionally identifying and authenticating the mobile device that read the card;

determining a number of applications stored on the cloud card application platform as a virtualized card application and associated with the read card and, in response thereto, performing at least one of the following;

(i) in the event that a single application is associated with the read card, automatically selecting the single application as a selected application; and

(ii) in the event that multiple applications are associated with the read card, providing a user of the mobile device with an option to select one of the multiple applications as the selected application;

identifying a Service Provider associated with the selected application;

federating the Service Provider by creating a federation token that includes an assertion to the Service Provider that proves authentication of the read card by the cloud card application; and

directing the mobile device to a URL hosted by the service provider.

19. (canceled)

20. (canceled)