Augmented reality information display and interaction via NFC based authentication

• US 11,062,098 B1
• Filed: 08/11/2020
• Issued: 07/13/2021
• Est. Priority Date: 08/11/2020
• Status: Active Grant

• Current Assignee: Capital One Services LLC (Capital One Financial Corporation)
• Original Assignee: Capital One Services LLC (Capital One Financial Corporation)
• Inventors: Bergeron, George, Yee, Bryant, Bulgakov, Mykhaylo
• Primary Examiner(s): Savusdiphol, Paultep
• Application Number:
  US16/990,300
• Time in Patent Office: 336 Days
• Field of Search: 235451, 235492
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 3/0484 for the control of specific functions or operations, e.g. selecting or manipulating an object, an image or a displayed text element, setting a parameter value or selecting a range
• CPC Class Codes: G06F 3/14 Digital output to display device ; Cooperation and interconnection of the display device with other functional units
• CPC Class Codes: G06K 7/10297 arrangements for handling protocols designed for non-contact record carriers such as RFIDs NFCs, e.g. ISO/IEC 14443 and 18092 cryptographic protocols H04L9/00; network security protocols H04L63/00; real-time communication protocols in data switching networks H04L65/00; network protocols for data switching network services H04L67/00
• CPC Class Codes: G06Q 40/02 Banking, e.g. interest calculation or account maintenance credit or loans G06Q40/03
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/0421 Anonymous communication, i.e. the party's identifiers are hidden from the other party or parties, e.g. using an anonymizer
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/47 using near field communication [NFC] or radio frequency identification [RFID] modules
• CPC Class Codes: H04W 12/61 Time-dependent

Abstract

Various embodiments are generally directed to improving card security by providing a user a contactless card with no sensitive card information, such as card number, card verification value, and expiration date, printed thereon, and displaying the sensitive card information relative to the card in augmented reality (AR) based on successful NFC-based user authentication. According to examples, the NFC-based user authentication may be performed by one-tapping or single tapping the contactless card to user mobile device. One or more portions of the sensitive card information may be obfuscated to further enhance card security. Moreover, the user can interact with AR elements including the sensitive card information to perform various actions.

Claims

1. An apparatus comprising:

a camera;

a near-field communication (NFC) reader;

memory to store instructions; and

one or more processors, coupled with the memory, operable to execute the instructions that, when executed, cause the one or more processors to;

detect a contactless card via the NFC reader, the contactless card being tapped to the apparatus by a user;

receive one or more cryptograms from the contactless card via NFC, wherein information in the one or more cryptograms is encrypted by the contactless card using a diversified key and the information includes at least a first customer identifier;

decrypt the information in the one or more cryptograms using the diversified key to obtain the first customer identifier;

determine whether the first customer identifier and a second customer identifier stored in memory match, and

determine, based on the determination that the first and second customer identifiers match, that user authentication is successful, the successful user authentication indicating that the contactless card is issued or authorized to the user; and

display, via an augmented reality (AR) interface, sensitive card information associated with a card on or adjacent to the card in AR when the card is detected by the camera.

2. The apparatus of claim 1, wherein the card detected by the camera is the contactless card or wherein the card detected by the camera is separate and distinct from the contactless card and issued or authorized to the user.

3. The apparatus of claim 1, wherein the diversified key is generated by providing a master key and a particular counter value to a cryptographic algorithm to obtain an output, the output being the diversified key.

4. The apparatus of claim 1, wherein the first customer identifier is a first unique alphanumeric identifier corresponding to contactless card being tapped to the apparatus and the second customer identifier is a second alphanumeric identifier corresponding to or associated with the user.

5. The apparatus of claim 1, wherein the sensitive card information includes at least a card number, a primary account number, a card verification value, and an expiration date and wherein one or more portions of the sensitive card information is obfuscated by one or more characters or symbols.

6. The apparatus of claim 5, wherein the one or more processors are further caused to:

receive a selection of the one or more obfuscated portions of the sensitive card information;

receive verification information, the verification information being a password or a personal identification number;

determine whether the verification information is correct; and

reveal, based on the determination that the verification information is correct, the selected one or more obfuscated portions of the sensitive card information; and

display, via the AR interface, the revealed portions in AR.

7. The apparatus of claim 5, wherein the one or more processors are further caused to:

display one or more callouts adjacent to the sensitive card information, the one or more callouts including information indicating that an AR element associated with the card information is selectable or interactable by the user to perform an action,

wherein the AR element is the sensitive card information superimposed on the card, and

wherein the action includes copying the sensitive information to a digital clipboard for use at a merchant website.

8. An apparatus comprising:

a camera;

a near-field communication (NFC) reader;

memory to store instructions; and

one or more processors, coupled with the memory, operable to execute the instructions that, when executed, cause the one or more processors to;

detect a contactless card via the NFC reader, the contactless card being tapped to the apparatus by a user;

receive one or more cryptograms from the contactless card via NFC, wherein information in the one or more cryptograms is encrypted by the contactless card using a diversified key and the information includes at least a first customer identifier;

send the one or more cryptograms including the first customer identifier to one or more remote computing devices, wherein the one or more remote computing devices performs at least the decryption of the information in the one or more cryptograms using the diversified key;

receive an indication or confirmation from the one or more remote computing devices that the user is authenticated or that the first customer identifier and a second customer identifier stored at the one or more computing devices or a database match;

determine, based on the indication or the confirmation from the remote computing devices, that user authentication is successful, the successful user authentication indicating that the contactless card is issued or authorized to the user; and

display, via an augmented reality (AR) interface, sensitive card information associated with a card on or adjacent to the card in AR when the card is detected by the camera.

9. The apparatus of claim 8, wherein the card detected by the camera is the contactless card or wherein the card detected by the camera is separate and distinct from the contactless card and issued or authorized to the user.

10. The apparatus of claim 8, wherein the diversified key is generated by providing a master key and a particular counter value to a cryptographic algorithm to obtain an output, the output being the diversified key.

11. The apparatus of claim 8, wherein the first customer identifier is a first unique alphanumeric identifier corresponding to contactless card being tapped to the apparatus and the second customer identifier is a second alphanumeric identifier corresponding to or associated with the user.

12. The apparatus of claim 8, wherein the sensitive card information includes at least a card number, a primary account number, a card verification value, and an expiration date and wherein one or more portions of the sensitive card information is obfuscated by one or more characters or symbols.

13. The apparatus of claim 12, wherein the one or more processors are further caused to:

receive a selection of the one or more obfuscated portions of the sensitive card information;

receive verification information, the verification information being a password or a personal identification number;

determine whether the verification information is correct; and

reveal, based on the determination that the verification information is correct, the selected one or more obfuscated portions of the sensitive card information; and

display, via the AR interface, the revealed portions in AR.

14. The apparatus of claim 12, wherein the one or more processors are further caused to:

display one or more callouts adjacent to the sensitive card information, the one or more callouts including information indicating that an AR element associated with the card information is selectable or interactable by the user to perform an action,

wherein the AR element is the sensitive card information superimposed on the card, and

wherein the action includes copying the sensitive information to a digital clipboard for use at a merchant website.

15. The apparatus of claim 8, wherein the one or more remote computing devices are backend authentication servers with access to the database and a plurality of authentication-based services.

16. A non-transitory computer-readable storage medium storing computer-readable program code executable by at least one processor to:

detect a contactless card via a near-field communication (NFC) reader, the contactless card being tapped to an apparatus by a user;

receive one or more cryptograms from the contactless card via NFC, wherein information in the one or more cryptograms is encrypted by the contactless card using a diversified key and the information includes at least a first customer identifier;

perform user authentication by;

(i) decrypting the information in the one or more cryptograms using the diversified key to obtain the first customer identifier and (ii) determining whether the first customer identifier and a second customer identifier stored in memory match, or

(i) sending the one or more cryptograms including the first customer identifier to one or more remote computing devices, wherein the one or more remote computing devices performs at least the decryption of the information in the one or more cryptograms using the diversified key and (ii) receiving an indication or confirmation from the one or more remote computing devices that the user is authenticated or that the first customer identifier and a second customer identifier stored at the one or more computing devices or a database match; and

determine, based on the determination that the first and second customer identifiers match, that user authentication is successful, the successful user authentication indicating that the contactless card is issued or authorized to the user; and

display, via an augmented reality (AR) interface, sensitive card information associated with a card on or adjacent to the card in AR when the card is detected by the camera.

17. The non-transitory computer-readable storage medium of claim 16, wherein the card detected by the camera is the contactless card or wherein the card detected by the camera is separate and distinct from the contactless card and issued or authorized to the user.

18. The non-transitory computer-readable storage medium of claim 16, wherein the diversified key is generated by providing a master key and a particular counter value to a cryptographic algorithm to obtain an output, the output being the diversified key.

19. The non-transitory computer-readable storage medium of claim 16, wherein the first customer identifier is a first unique alphanumeric identifier corresponding to contactless card being tapped to the apparatus and the second customer identifier is a second alphanumeric identifier corresponding to or associated with the user.

20. The non-transitory computer-readable storage medium of claim 16, wherein the sensitive card information includes at least a card number, a primary account number, a card verification value, and an expiration date and wherein one or more portions of the sensitive card information is obfuscated by one or more characters or symbols.