SYSTEMS AND METHODS FOR INTELLIGENT STEP-UP FOR ACCESS CONTROL SYSTEMS
1. A computerized method to facilitate an interaction involving a user, the method comprising:
- determining that a user authentication is required to complete the interaction;
identifying at least a first verified device associated with the user; and
transmitting an authentication message to the at least first verified device.
Some embodiments may provide systems, methods and computer program code to method to facilitate an interaction involving a user which include determining that a user authentication is required to complete the interaction, identifying at least a first verified device associated with the user, and transmitting an authentication message to the at least first verified device.
- 1. A computerized method to facilitate an interaction involving a user, the method comprising:
determining that a user authentication is required to complete the interaction; identifying at least a first verified device associated with the user; and transmitting an authentication message to the at least first verified device.
- View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9)
- 10. A system to facilitate interactions, comprising:
a first communication port to exchange information associated with at least one of a merchant device and a user device; an issuer system, coupled to the first communication port, including a computer processor a memory storing instructions to cause the computer processor to; determine that a user authentication is required to complete the interaction; identify at least a first verified device associated with the user; and transmit an authentication message to the at least first verified device.
- View Dependent Claims (11, 12, 13, 14, 15, 16, 17, 18)
- 19. A non-tangible, computer-readable medium storing instructions, that, when executed by a processor, cause the processor to perform a method to conduct an interaction, the method comprising:
determining that a user authentication is required to complete the interaction; identifying at least a first verified device associated with the user; and transmitting an authentication message to the at least first verified device.
This application is based on and claims benefit of and priority to U.S. Provisional Patent Application Ser. No. 62/752,144 filed on Oct. 29, 2018, the contents of which are hereby incorporated in their entirety for all purposes.
Consumers increasingly are interacting remotely with merchants and other service providers. For example, remote payment transactions are very common. It is increasingly important that merchants and other participants in such remote transactions be able to accurately authenticate aspects of such remote transactions (for example, in a remote payment transaction, it is important to be able to authenticate that the consumer is the cardholder of the payment device to be used in the transaction). As more and more devices become “smart” devices capable of storing information and interacting with other devices and systems over communication networks such as the Internet, there is increasing demand for those devices to be capable of participating in interactions including payment transactions. However, it is difficult to authenticate or authorize these devices to validate that they are associated with a user.
It would be desirable to provide improved systems and methods to perform authentication in remote transactions.
According to some embodiments, systems, methods and computer program code are provided to facilitate an interaction involving a user which include determining that a user authentication is required to complete the interaction, identifying at least a first verified device associated with the user, and transmitting an authentication message to the at least first verified device. Pursuant to some embodiments, at least a second verified device associated with the user is identified, and information associated with the at least first and second verified devices is presented to the user. A selection from the user is received to identify which device is to be used to complete the interaction.
Pursuant to some embodiments, the interaction is a payment transaction involving the user and a merchant. In some embodiments, the process further includes receiving a payment authorization request from the merchant, the payment authorization request including information usable to identify a payment account associated with the user, and the identifying at least a first and a second verified device associated with the user includes identifying at least a first and a second verified device associated with the payment account associated with the user.
In some embodiments, the interaction is one to perform expedited verification of a user device and processing includes receiving a request from the user to register the user device as an at least second verified device associated with the user. In some embodiments, the interaction is a transaction involving the user and a service provider (such as, for example, a financial institution).
A technical effect of some embodiments of the invention is an improved and secure way to register devices to become authentication devices as well as to involve those authentication devices in transactions. With these and other advantages and features that will become hereinafter apparent, a more complete understanding of the nature of the invention can be obtained by referring to the following detailed description and to the drawings appended hereto.
In general, and for the purpose of introducing concepts of embodiments of the present disclosure, embodiments provide systems, methods and computer program code to method to facilitate an interaction involving a user which include determining that a user authentication is required to complete the interaction, identifying at least a first verified device associated with the user, and transmitting an authentication message to the at least first verified device. Pursuant to some embodiments, at least a second verified device associated with the user is identified, and information associated with the at least first and second verified devices is presented to the user. A selection from the user is received to identify which device is to be used to complete the interaction. Embodiments may be used in a number of different interaction environments. For example, embodiments may be used in financial transactions to provide an additional “step-up” level of user authentication. In many card-not-present or remote transactions, it is difficult to authenticate the user. Technologies such as MasterCard International Incorporated'"'"'s SecureCode provide an enhanced layer of authentication in certain remote transactions. Embodiments may be used in conjunction with such technologies to provide additional authentication as will be described further herein. In some embodiments, the present invention may be used to provide user authentication in other types of transactions as well.
In some embodiments, features of the present invention may be used in interactions to identify and verify new devices to be associated with a user. Further, features may be used in interactions to cause such new devices to be payment enabled. As more and more devices become accessible or connected with other devices (e.g., via the Internet) there is increasing demand for these devices to become payment enabled. Such devices may generally be referred to as “smart devices” and examples include smart appliances, automobiles, physical shopping carts, watches, exercise monitors, or the like. In general, as used herein, the term “smart device” or “device” refers to devices that are in communication with a payment network (e.g., via the Internet or the like) and that have a storage device capable of storing payment account information such as, for example, tokenized payment credentials. As used herein the term “token” or “tokenized payment credentials” or “token PAN” refers to a primary account number (“PAN”) tokenized using a tokenization system, such as the Mastercard Digital Enablement Service (“MDES”) offered by the assignee of the present application, a virtual card number (“VCN”) or a controlled payment number (“CPN”).
As used herein, devices which have been provisioned with an identified and verified “token” so that the device may be used as an authentication device may be referred to herein as “authentication devices” or “authentication wallets”. In some embodiments, existing devices may already be payment enabled and may function as authentication wallets. For example, a mobile phone may be equipped with a wallet (such as an Android Wallet) which has previously been authenticated and which has one or more tokens associated with it. Such devices may operate as authentication wallets in the system of the present invention. In particular, such devices may operate as authentication wallets because they have been properly authenticated and equipped with tokens and other cryptographic protections that can be relied on in transactions pursuant to the present invention. Other devices, as will be described further herein, may be made “authentication devices” using a registration approach described herein.
The present invention provides significant technical improvements to facilitate authentication in different interactions. The present invention is directed to more than a mere computer implementation of a routine or conventional activity previously known in the industry as it significantly advances the technical efficiency, access and/or accuracy of communications between devices by implementing a specific new method and system as defined herein. The present invention is a specific advancement in the area of electronic transactions by providing benefits in security, user experience, and reduced integration complexity and such advances are not merely a longstanding commercial practice.
The registration process begins at “1” where the user 102 interacts with the device 104 (either directly by interacting with an input and display of the device, or indirectly by pairing the device 104 with another device with an input and output device such as a mobile telephone, a personal computer or the like) to initiate a provisioning process. For example, the user may interact with a web page provided by an issuer 106 of a payment card issued to the user 102 to associate the payment card information with the device 104 (shown as the interaction at “2”). The interaction with the issuer 106 may include performing identification and verification (hereinafter, “ID&V”) of the user 102 to ensure that the user 102 is authorized to register the device 104. If the user 102 is properly identified and verified, the issuer 106 may instruct a tokenization service 108 to generate a token associating the device 104 with the payment account of the user 102. The tokenization service 108 may be, for example, the MDES service offered by the assignee of the present application or a similar service that provides tokenization services to issuers and their users. The issuer 106 may be implemented as several services acting on behalf of an issuer. For example, the issuer 106 may consist of one or more hosts as well as one or more access control systems (“ACS”) which operate together to provide the functions described herein.
The tokenization service 108 provides the token to the device 104 (at “3”) either directly or through the communication between the issuer 106 and the user 102. The tokenization service 108 stores information associating the token with an identifier of the payment account (such as the primary account number or “PAN” of a credit or debit card account). As depicted in
Some or all of the devices (including device 104, issuer 106, tokenization service 108 or the like) of the system 100 (as well as other devices described elsewhere herein) might be, for example, associated with a Personal Computer (“PC”), laptop computer, smartphone, an enterprise server, a server farm, and/or a database or similar storage devices. As discussed above, the device 104 may likely be a portable device such as a smart watch, an exercise monitor, or other mobile device. The device 104 may also be a device incorporated into an automobile, appliance or other system. As used herein, devices, including those associated with the system 100 and any other device described herein may exchange information via any communication network which may be one or more of a Local Area Network (“LAN”), a Metropolitan Area Network (“MAN”), a Wide Area Network (“WAN”), a proprietary network, a Public Switched Telephone Network (“PSTN”), a Wireless Application Protocol (“WAP”) network, a Bluetooth network, a wireless LAN network, and/or an Internet Protocol (“IP”) network such as the Internet, an intranet, or an extranet. Note that any devices described herein may communicate via one or more such communication networks. Note that the system 100 of
The merchant 210 typically has a contract with a financial institution (the “acquirer”) to accept payments using payment cards in a payment network or system. The acquirer (not shown in
Ideally, the user 202 selects an authentication device 204 which is currently in the user'"'"'s possession. The issuer 206, at “4” presents a challenge request to the user 202 through the selected authentication device 204. The user 202 interacts with the selected authentication device 204 (at “5”) to complete the challenge request. If the challenge request is completed correctly, the issuer 206 authorizes the payment transaction (assuming all other authorization parameters are satisfied) and an authorization response is transmitted to the merchant 210 to finalize the transaction. The result is a authentication approach which allows a user to employ one or more authentication devices or wallets that have previously been ID&V'"'"'d to conveniently authenticate themselves in transactions.
Embodiments may be used to easily create new authentication devices using an expedited ID&V process for new devices. Reference is now made to
The process begins at “1” where the user 302 interacts with the new device 312 (either directly by interacting with an input and display of the device 312, or indirectly by pairing the device 312 with another device with an input and output device such as a mobile telephone, a personal computer or the like) to initiate the expedited provisioning process. For example, the user 302 may interact with a web page provided by an issuer 306 of a payment card issued to the user 302 to associate the payment card PAN with the device 304 (shown as the interaction at “2”). Processing continues at “3” where the issuer 306 queries the tokenization service 308 to request a list of any previously ID&V′d devices. As described above in conjunction with
The result is an efficient and expedited approach to adding authentication devices for use by a user. The newly created device token for device 312 now allows the device 312 to be used in transactions as well as to be used as an authentication device for transactions involving the PAN. Multiple PANs may be associated with each device. In this manner, users may choose to ID&V a number of devices that are convenient to the user, ensuring that the user can complete transactions no matter where the user is located.
While some embodiments have been described as being used in conjunction with payment transactions, embodiments are not limited to such transactions. Reference is now made to
Embodiments may be used in conjunction with existing payment transaction flows to provide an additional level of authentication in certain transactions. For example, embodiments may be used in conjunction with so-called 3D Secure transactions (e.g., such as the MasterCard SecureCode transactions). Reference is now made to
In general, in the flow of
In the transaction flow 500, after the cardholder has interacted with the merchant to initiate a checkout with purchase information, and after a 3DS process has occurred, a “2: challenge request” may be issued which causes the ACS to determine whether the issuer of the payment card used by the cardholder uses the Authentication Service. If so, the ACS interacts with the Authentication Service to obtain a list of authenticators associated with the PAN of the payment card being used in the transaction (using messages 2.2 and 2.3). The ACS then returns the list of authenticators with HTML to the browser (at message 2.4). The cardholder selects an authenticator (in this example, the cardholder has an Android wallet registered as an authenticator device and selects that device). The identification of the selected authenticator is transmitted to the ACS at message 3.1, and the ACS causes an authentication request to be transmitted to the selected device at 3.1.1 (and further causing an authentication flow to occur which will be described further in
Reference is now made to
In a second embodiment (shown in
Reference is now made to
In the transaction flow shown in
The flow charts and transaction flows described herein do not imply a fixed order to the steps, and embodiments of the present invention may be practiced in any order that is practicable. Although some figures use numbers to indicate a sequence of steps, those steps are illustrative and may be practiced in any order that is practicable. Note that any of the methods described herein may be performed by hardware, software, or any combination of these approaches. For example, a computer-readable storage medium may store thereon instructions that when executed by a machine result in performance according to any of the embodiments described herein.
The embodiments described herein may be implemented using any number of different hardware configurations. Embodiments described herein may be implemented in hardware, in a computer program executed by a processor, in firmware, or in a combination of the above. A computer program may be embodied on a computer readable medium, such as a storage medium or storage device. For example, a computer program may reside in random access memory (“RAM”), flash memory, read-only memory (“ROM”), erasable programmable read-only memory (“EPROM”), electrically erasable programmable read-only memory (“EEPROM”), registers, hard disk, a removable disk, a compact disk read-only memory (“CD-ROM”), or any other form of storage medium known in the art.
A storage medium may be coupled to the processor such that the processor may read information from, and write information to, the storage medium. In an alternative, the storage medium may be integral to the processor. The processor and the storage medium may reside in an application specific integrated circuit (“ASIC”). In an alternative, the processor and the storage medium may reside as discrete components. For example,
The computing system 900 may include a computer system/server, which is operational with numerous other general-purpose or special purpose computing system environments or configurations. Examples of well-known computing systems, environments, and/or configurations that may be suitable for use as computing system 900 include, but are not limited to, personal computer systems, server computer systems, thin clients, thick clients, hand-held or laptop devices, tablets, smart phones, databases, multiprocessor systems, microprocessor-based systems, set top boxes, programmable consumer electronics, network PCs, minicomputer systems, mainframe computer systems, distributed cloud computing environments, databases, and the like, which may include any of the above systems or devices, and the like.
The computing system 900 may be described in the general context of computer system-executable instructions, such as program modules, being executed by a computer system. Generally, program modules may include routines, programs, objects, components, logic, data structures, and so on that perform particular tasks or implement particular abstract data types. The computing system 900 may be practiced in distributed cloud computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed cloud computing environment, program modules may be located in both local and remote computer system storage media including memory storage devices.
The storage device 940 may include a variety of computer system readable media. Such media may be any available media that is accessible by computer system/server, and it may include both volatile and non-volatile media, removable and non-removable media. System memory, in one embodiment, implements the flow diagrams of the other figures. The system memory can include computer system readable media in the form of volatile memory, such as random-access memory (RAM) and/or cache memory. As another example, storage device 940 can read and write to a non-removable, non-volatile magnetic media (not shown and typically called a “hard drive”). Although not shown, a magnetic disk drive for reading from and writing to a removable, non-volatile magnetic disk (e.g., a “floppy disk”), and an optical disk drive for reading from or writing to a removable, non-volatile optical disk such as a CD-ROM, DVD-ROM or other optical media can be provided. In such instances, each can be connected to the bus by one or more data media interfaces. As will be further depicted and described below, storage device 940 may include at least one program product having a set (e.g., at least one) of program modules that are configured to carry out the functions of various embodiments of the application.
As will be appreciated by one skilled in the art, aspects of the present application may be embodied as a system, method, or computer program product. Accordingly, aspects of the present application may take the form of an entirely hardware embodiment, an entirely software embodiment (including firmware, resident software, microcode, etc.) or an embodiment combining software and hardware aspects that may all generally be referred to herein as a “circuit,” “module” or “system.” Furthermore, aspects of the present application may take the form of a computer program product embodied in one or more computer readable medium(s) having computer readable program code embodied thereon.
Although not shown, the computing system 900 may also communicate with one or more external devices such as a keyboard, a pointing device, a display, etc.; one or more devices that enable a user to interact with computer system/server; and/or any devices (e.g., network card, modem, etc.) that enable computing system 900 to communicate with one or more other computing devices. Such communication can occur via I/O interfaces. Further, computing system 900 can communicate with one or more networks such as a local area network (LAN), a general wide area network (WAN), and/or a public network (e.g., the Internet) via network interface 910. As depicted, network interface 910 may also include a network adapter that communicates with the other components of computing system 900 via a bus. Although not shown, other hardware and/or software components could be used in conjunction with the computing system 900. Examples include, but are not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data archival storage systems, etc.
Pursuant to some embodiments, the computing system 900 may be a user device (e.g., such as a mobile phone, tablet computer, personal computer or the like) operated by a user to display from a merchant website during a purchase transaction involving the secure remote commerce system of the present invention.
As will be appreciated based on the foregoing specification, the above-described examples of the disclosure may be implemented using computer programming or engineering techniques including computer software, firmware, hardware or any combination or subset thereof. Any such resulting program, having computer-readable code, may be embodied or provided within one or more non-transitory computer-readable media, thereby making a computer program product, i.e., an article of manufacture, according to the discussed examples of the disclosure. For example, the non-transitory computer-readable media may be, but is not limited to, a fixed drive, diskette, optical disk, magnetic tape, flash memory, semiconductor memory such as read-only memory (ROM), and/or any transmitting/receiving medium such as the Internet, cloud storage, the internet of things, or other communication network or link. The article of manufacture containing the computer code may be made and/or used by executing the code directly from one medium, by copying the code from one medium to another medium, or by transmitting the code over a network.
The computer programs (also referred to as programs, software, software applications, “apps”, or code) may include machine instructions for a programmable processor and may be implemented in a high-level procedural and/or object-oriented programming language, and/or in assembly/machine language. As used herein, the terms “machine-readable medium” and “computer-readable medium” refer to any computer program product, apparatus, cloud storage, internet of things, and/or device (e.g., magnetic discs, optical disks, memory, programmable logic devices (PLDs)) used to provide machine instructions and/or data to a programmable processor, including a machine-readable medium that receives machine instructions as a machine-readable signal. The “machine-readable medium” and “computer-readable medium,” however, do not include transitory signals. The term “machine-readable signal” refers to any signal that may be used to provide machine instructions and/or any other kind of data to a programmable processor.
The following illustrates various additional embodiments of the invention. These do not constitute a definition of all possible embodiments, and those skilled in the art will understand that the present invention is applicable to many other embodiments. Further, although the following embodiments are briefly described for clarity, those skilled in the art will understand how to make any changes, if necessary, to the above-described apparatus and methods to accommodate these and other embodiments and applications.
A number of different authentication techniques may be used in conjunction with the present invention. For example, as discussed above, DSRP challenges may be used with desirable results. In other embodiments, which will be described by reference to
Pursuant to some embodiments, the list may include one or more FIDO authenticators associated with the PAN. If the user selects to use authentication device 1004 (which, in this example, is FIDO compatible device or wallet), the authentication layer 1022 requests the authentication from the FIDO server 1020 to authenticate the user 1002 using the selected authenticator on the selected device 1004. The FIDO server 1020 validates the response and returns the authentication results to the authentication layer 1022 which returns the response back to the issuer 1006 (or, in some embodiments, to an ACS or DS if one or both are standing in on behalf of the issuer).
The result is a system allowing enhanced authentication techniques to be used (including, for example, authentication techniques using the FIDO protocol) during transactions which require an enhanced authentication. In other embodiments, other authentication services may be utilized with similar desirable results. For example, embodiments may utilize biometric or other authentication techniques following NuDetect approaches as described at www.nudatasecurity.com. Although specific hardware and data configurations have been described herein, note that any number of other configurations may be provided in accordance with embodiments of the present invention (e.g., some of the information associated with the displays described herein might be implemented as a virtual or augmented reality display and/or the databases described herein may be combined or stored in external systems). Moreover, although embodiments have been described with respect to particular types of enterprise applications, embodiments may instead be associated with other types of applications in additional to and/or instead of the ones described herein (e.g., financial applications, medical applications, manufacturing applications, etc.). Similarly, although certain attributes were described in connection some embodiments herein, other types of attributes might be used instead.
The present invention has been described in terms of several embodiments solely for the purpose of illustration. Persons skilled in the art will recognize from this description that the invention is not limited to the embodiments described, but may be practiced with modifications and alterations limited only by the spirit and scope of the appended claims.