Multi-factor authentication providing a credential via a contactless card for secure messaging

• US 10,757,574 B1
• Filed: 12/26/2019
• Issued: 08/25/2020
• Est. Priority Date: 12/26/2019
• Status: Active Grant

• Current Assignee: Capital One Services LLC (Capital One Financial Corporation)
• Original Assignee: Capital One Services LLC (Capital One Financial Corporation)
• Inventors: Rule, Jeffrey, Osborn, Kevin
• Primary Examiner(s): Doan, Kiet M
• Application Number:
  US16/727,162
• Time in Patent Office: 243 Days
• Field of Search: 705 71, 705 44, 705 261, 705 35, 705 268, 705 1427, 703189, 380270, 340 561, 340 56, 713168, 713183
• CPC Class Codes: G06Q 20/3255 using mobile network messaging services for payment, e.g. SMS
• CPC Class Codes: G06Q 20/3278 RFID or NFC payments by means of M-devices
• CPC Class Codes: G06Q 20/352 Contactless payments by cards
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/0846 using time-dependent-passwords, e.g. periodically changing passwords
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 4/14 Short messaging services, e.g. short message services [SMS] or unstructured supplementary service data [USSD]
• CPC Class Codes: H04W 4/80 Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication

Abstract

Exemplary embodiments may use a contactless card as a secondary form of authentication in a multi-factor authentication for a secure messaging service. The recipient party of a request to initiate a messaging service session (such as a server computing device) may be programmed to use the phone number of the originating device to look up records regarding an identity of a party and their associated phone number as a primary credential and then may require an authentication credential originating from the contactless card as a secondary credential for the initiating party. In some instances, the credential originating from the contactless card is a onetime password that is valid only for a period of time. The recipient party determines whether the onetime password is valid. If both credentials are valid, a secure messaging session may be initiated with the initiating party.

Claims

1. A computing device implemented method, comprising:

receiving a message at a computing device from a Short Message Service (SMS) capable device have an associated phone number, wherein the message indicates a desire to initiate an SMS session and wherein the message includes a secure component;

decrypting the secure component to obtain a hash of at least a onetime password and an account identifier;

extracting the onetime password and the account identifier;

determining if the onetime password is valid;

determining what account is associated with the account identifier;

accessing what phone number is connected with the determined account;

determining if the associated phone number is a matching phone number that matches the phone number connected with the account;

where the password is valid and the associated phone number is a matching phone number, initiating a secure SMS session by sending an SMS message to the SMS capable device; and

where the password is not valid and/or the associated password is not a matching phone number, rejecting initiation of the secure SMS session with the SMS capable device;

wherein the computing device maintains a counter and wherein the computing device uses a value of the counter in determining whether a password has expired; and

wherein the counter maintained by the computing device is in synch with a counter maintained by the contactless card.

2. The method of claim 1, wherein the decrypting uses a symmetric decryption algorithm.

3. The method of claim 1, further comprising:

checking a geolocation of the SMS-capable device; and

using the geolocation as another authentication factor in determining whether or not to initiate the secure SMS session.

4. The method of claim 1, wherein the receiving the message comprises receiving an SMS message.

5. The method of claim 1, further comprising where the secure SMS session is initiated, using a chatbot to participate in the secure SMS session.

6. The method of claim 1, wherein the onetime password is a time-based password.

7. A Short Message Service (SMS) capable device-implemented method, comprising:

receiving a cryptographically secure onetime password from a contactless card at the SMS capable device via a near field communication, wherein;

the cryptographically secure onetime password comprises an encrypted hash of at least the onetime password and an account identifier,

the onetime password is encrypted by a symmetric encryption algorithm, and

the onetime password is valid for only a set period of time;

sending a message from the SMS capable device to a party to request initiation of a secure SMS session, wherein the message includes the cryptographically secure onetime password and wherein the SMS capable device has an associated phone number; and

where the password is valid and where the phone number of the SMS capable device is associated with an account identified by the account identifier, receiving an SMS message from the party at the SMS capable device;

wherein the sending the message from the SMS capable device comprises one of sending the message to a website for the party or sending the message directly to the party.

8. The method of claim 7, wherein the sending the message from the SMS capable device comprises sending an initial SMS message.

9. The method of claim 7, further comprising sending geolocation information from the SMS capable device to the party.

10. The method of claim 7, wherein the SMS message is received from a chatbot.

11. A method performed by a contactless card, comprising:

initiating a near field communication (NFC) session with a computing device;

as part of the NFC session,

communicating with an application program running on the computing device;

passing at least a onetime password and an account identifier through a hash function to create a hash value;

encrypting the hash value;

passing the encrypted hash value to the application running on the computing device; and

prompting the application to send a message to a remote computing device to initiate a messaging session with the remote computing device where the message includes the encrypted hash value as evidence of an identity of a party that wishes to initiate the messaging session;

wherein the onetime password is a time-based password;

wherein the contactless card maintains a counter and a value of the counter is used in creating the encrypted hash value;

where the value of the counter is passed through the hash function; and

wherein the value of the counter is passed through the hash function along with the onetime password and the account identifier.

12. The method of claim 11, wherein the onetime password is valid only for a set period of time.

13. The method of claim 11, wherein the NFC session is initiated responsive to tapping the contactless card on a card reader in the computing device.