Retrieving hidden digital identifier

A method of providing access to securely held data is provided. A user interacts with the service provider to obtain access to a service by using a device to provide a digital identifier to the service provider, without the digital identifier being made known to the user. At a later date the user wishes to retrieve securely stored data relating to their use of the service. However, because the user does not know the digital identifier, they are unable to identify themselves to the service provider using the digital identifier. The present disclosure provides a secure method for exchanging private identifiers, which allows the user to identify themselves to the service provider in order to gain access to securely stored data relating to the user's previous use of the service. The user can do this using the device on which the digital identifier is stored, or another device.

CROSS-REFERENCE TO RELATED APPLICATION

This application claims the benefit of, and priority to, European Patent Application No. 18204089.9 filed on Nov. 2, 2018. The entire disclosure of the above application is incorporated herein by reference.

FIELD

The present disclosure relates to a method and a system for providing access to securely stored data.

BACKGROUND

In computer implemented communication and data exchange processes, it is common for users and devices to identify themselves to other users and devices using digital identifiers. A digital identifier can be used to identify a user or device that has permission to access secure systems or data that are not open to the public. Similarly, digital identifiers can be used to identify users or devices that have permission to edit data held in secure systems. A device attempting to edit a database may, for example, be required to present a digital identifier before its proposed changes to the database are permitted.

Due to the potentially sensitive permissions granted by digital identifiers, it is important that the digital identifiers can be stored and transmitted securely without being obtained by malicious third parties. In certain systems, a digital identifier can be stored within a device and presented to outside systems without the identifier being known by the user of the device. For example, such an identifier may be transmitted in a near field communication (NFC) message. Though the user of the device may use the digital identifier to access outside systems and data, the process does not involve providing the digital identifier to the user. Security risks associated with the provision of the digital identifier to the user, such as a malicious third party nearby reading the identifier from a device screen over the user's shoulder, are thereby avoided.

While the direct transmission of a digital identifier stored on a device to an outside system without involving provision of the digital identifier to the device's user provides increased security, this does mean that the user is unable to identify themselves to the outside system when the electronic device is not in communication with it.

There is a need, therefore, for a method of providing a user with access to securely stored data, in a system where access to the data is granted in response to receipt of a digital identifier securely stored on a device, without the digital identifier being made known to the device's user.

SUMMARY

This section provides a general summary of the disclosure, and is not a comprehensive disclosure of its full scope or all of its features. Aspects and embodiments of the disclosure are set out in the accompanying claims.

According to a first aspect, there is provided a computer implemented method of providing access to securely stored data, the method comprising a server of a service provider: receiving, from a user device, one or more requests for services, each such request indicating the same digital identifier; securely storing, in an interactions database, a record of each requested service together with the digital identifier; at a later time, receiving, from a communications device, a request for a list of services provided to the user by the service provider, said request indicating user details which are available to the user but which were not indicated in any of the one or more requests for services; generating a special personal identifier number, ‘sPIN’, the sPIN indicating the user details and comprising a flag indicating that the sPIN indicates the user details; sending a request for the digital identifier to the network processor, the request comprising the sPIN; receiving, from the network processor, a response to the request for the digital identifier, said response comprising the sPIN and the digital identifier; responsive thereto, obtaining, from the interactions database, the record of each requested service associated with the digital identifier; and providing, to the communications device, the record of each requested service associated with the digital identifier.

The communications device can be the user device.

The digital identifier can be stored on the user device.

The digital identifier can be a payment token.

The sPIN can be in a format corresponding to that of a primary account number (PAN).

The sPIN can consist of nineteen digits.

The user details can indicate one or both of an account number and a sort code of an account associated with the digital identifier.

The flag can be a single digit.

The first six digits of the sPIN can identify an issuer of the account, and indicate the first two digits of the sort code; one of the remaining digits of the sPIN can be the flag; eight of the remaining digits of the sPIN can indicate the account number; and four of the remaining digits of the sPIN can indicate the last four digits of the sort code.

The flag can be a flag code corresponding to a code stored by the network processor and/or an issuer of an account associated with the digital identifier.

The first six digits of the sPIN can be the flag code, and identify an issuer of the account; one of the remaining digits of the sPIN can indicates the first two digits of the sort code; eight of the remaining digits of the sPIN can indicate the account number; and four of the remaining digits of the sPIN can indicate the last four digits of the sort code.

The first six digits of the sPIN can be the flag code, and identify an issuer of the account; the final digit of the flag code can indicate a digit of the sort code; five of the remaining digits of the sPIN can indicate the remainder of the sort code; and eight of the remaining digits of the sPIN can indicate the account number.

The method can further comprise, prior to receiving the request for the list of services provided to the user by the service provider: receiving, from a further user device, one or more further requests for services, each such request indicating a further digital identifier different to the digital identifier referred to above; and securely storing, in the interactions database, a record of each further requested service together with the further digital identifier; wherein the response to the request for the digital identifier further comprises the further digital identifier. The method can further comprise: responsive to receiving the response, obtaining, from the interactions database, the record of each further requested service associated with the further digital identifier; and providing, to the communications device, the record of each further requested service associated with the further digital identifier.

According to a second aspect there is provided a computer system configured to perform the method of the first aspect.

According to a third aspect there is provided a computer readable medium comprising instructions which, when executed by a processor, cause the method of the first aspect to be performed.

DETAILED DESCRIPTION

Embodiments will be described, by way of example only, with reference to the drawings. The description and specific examples included herein are intended for purposes of illustration only and are not intended to limit the scope of the present disclosure. The following description is presented to enable any person skilled in the art to make and use the system, and is provided in the context of a particular application. Various modifications to the disclosed embodiments will be readily apparent to those skilled in the art.

In the following, references to entities, such as service providers (including transit providers), acquirers, network processors and issuers, should be understood to refer to servers operated by those entities. For example, a message described as being forwarded from an acquirer to an issuer via a network processor is sent from the acquirer's server, to the network processor's server then on to the issuer's server.

The present disclosure provides a method of providing access to data held securely by a service provider. A user interacts with the service provider to obtain access to a service by using a device to provide a digital identifier to the service provider, without the digital identifier being made known to the user. At a later date the user wishes to retrieve securely stored data relating to their use of the service. However, because the user does not know the digital identifier, they are unable to identify themselves to the service provider using the digital identifier. The present disclosure provides a secure method for exchanging private identifiers, which allows the user to identify themselves to the service provider in order to gain access to securely stored data relating to the user's previous use of the service. The user can do this using the device on which the digital identifier is stored, or another device.

The method is illustrated below in the context of a transit system. It will be understood, however, that the principles discussed herein are applicable to a range of systems that require secure exchanges of data.

FIG.1illustrates part of a system suitable for use in the present method and demonstrates how elements of the system interact to securely generate, store and transmit data.

In particular, the below disclosure illustrates how the method can be used to allow a set of tokenized credentials to be used in a transit network configured to operate in accordance with a message exchange protocol in which an authorization response is provided to a service provider.

The system comprises a service provider100that is configured to interact with a user203such that at least part of the interaction is automated. For example, this may be through the user203tapping an entry device, such as a tokenized mobile payment device200, onto a dedicated reader, for example, on an entry gate, e.g., in order to gain access to a transit network. In this example, the service provider100is a transit provider, such as a rail and/or bus network operator. However, the method described below is applicable to a number of different systems. For example, the service provider could be a gymnasium, sports or entertainment venue or hotel room that requires identification upon entry, or a vending machine that accepts digital payments.

The service provider100comprises several elements that may be at the same location, or disposed in separate locations, including a server101, a communication node102and a database103, which can interact with each other as and when required. Processes described below that are performed by the service provider100should be understood as being controlled by the service provider server101.

A user203interacts with the service provider100using a device200configured for interaction with the service provider100. The device200stores a digital identifier211in a storage element210. The storage element210could, for example, be a local storage element of the device200, such as a secure element, a trusted execution environment or an area of device memory used by host card emulation software, or could be a remote storage element which the device200can communicate securely with, for example, as a means of cloud storage.

The device200is capable of transmitting the digital identifier211to the service provider100. In the present example, the digital identifier211can be used to make payments from an account to which the user203has access to the service provider100. For example, the device200may be a payment card comprising a radio frequency identification (RFID) tag or a mobile electronic device comprising a near field communication (NFC) element.

The digital identifier211allows the user to identify themselves to the service provider. The digital identifier211may, for example, be a payment token that can be used by the service provider100to initiate a payment from the user203to the service provider100, e.g., such that the user can be granted access to a transit network. In such an example, the payment token is linked to payment credentials that are known to the user203, such as an account number and sort code. In this example, the user203has opted to tokenize their account details, which has resulted in a payment token being provisioned onto their device200. Such payment tokens can be provided to electronic point of sale terminals in a similar way to the credentials stored on the chip of a plastic NFC card. Each payment token contains a set of card-like credentials that are unknown to the user203(i.e., the user203knows their account details, but not the token details).

The service provider100comprises a previous interaction database103that stores records of interactions between the user203and the service provider100. The previous interaction database103may be disposed in a single location or distributed across multiple locations. In the transit example, such previous interactions databases103may be used, for example, for the purposes of fare calculation in order that the user203may be charged the correct fare(s) for their journey(s) by billing the credentials221used to access the service provider100.

The user203provides the digital identifier211to the service provider100when accessing services provided by the service provider100. In the present example, when a user203attempts to access the transit network, the user203presents the digital identifier211to the service provider100by transmitting the digital identifier211from a communication node202of the device200to a communication node102of the service provider100. For example, the communication node202of the device200may be an RFID tag or an NFC element and the communication node102of the service provider100may respectively be an RFID reader or an NFC reader. For example, the digital identifier211may be passed as part of a contactless EMV transaction.

If the service provider100accepts the digital identifier211, the user203is allowed access to the transit network. For example, access to a train boarding area may be provided by opening a physical barrier. The communication node102of the service provider100could, for example, be located on such a barrier or gate. The service provider100may require that certain conditions are met before the user is provided access to the service: for example, the service provider100may check that the digital identifier211does not belong to a user that is banned from entering the system, or the service provider100may check that the digital identifier211can be validly used to initiate a payment to the service provider100.

After providing the user203with access to the transit service, the service provider100creates a data entry113in a previous interaction database103, for example, as illustrated inFIG.2. In some examples, the data entry113may be generated immediately upon providing access to the user203. In other examples, the data entry may be generated when the user203has finished using the service, or later, e.g., as part of a consolidated data batch for a predefined period of time, such as a day or a week.FIG.2shows an example of a previous interaction database103comprising a plurality of data entries113, each corresponding to a previous interaction between a user and a transit network. Each data entry record113comprises a digital identifier211and other information regarding the interaction. For example, the data entry113may comprise data indicating the time of initiation of the service (for example, the time the user203enters a train boarding area at an originating station), the time of completion of the service (for example, the time the user203exits a train boarding area at a destination station), a corresponding transaction amount, a start location and an end location.

The service provider100uses the digital identifier211to initiate a payment from the user203to the service provider100, as illustrated byFIG.3. To initiate the payment, the service provider100provides the digital identifier211and an indication of a payment amount to an acquiring financial institution (acquirer)300associated with the service provider100. The acquiring financial institution300sends a payment request message to a network processor400for forwarding to an issuing financial institution (issuer)500associated with the user203. The network processor400may form part of a payment processing network and may incorporate parts of several interlinked payment processing networks.

The payment may be initiated upon access to the service provider100being granted to the user203, or the payment may be initiated after the user203has finished using the transit service.

Alternatively, an authorization to commence a period of aggregation may occur soon after the user's entry to the transit network. In this example, the user203enters the transit network, providing their digital identifier211which is not on a list deemed unacceptable. The digital identifier211, along with the date, time and location of entry is sent to the service provider server101. The service provider server101determines whether the digital identifier211has recently had a good authorization. If not, a new authorization request is initiated by sending a message to the acquirer300, then on to the network processor400, and finally to the issuer500. If the issuer500approves the authorization request, then the service provider100starts to collect entry/exit taps representing journeys up to a value agreed with either the issuer500, network processor400, or acquirer300, in order to manage liability. Once that value limit is reached, the service provider100takes the necessary steps to clear and settle for the journeys consumed by the user203.

If the authorization request is declined by the issuer500, then the digital identifier211is added to a list to prevent further consumption of travel against that identifier211. The user203and/or the service provider100takes steps to recover any monies owed before removing the identifier211from the aforementioned list.

Whatever the timing and specific process used for authorization of a payment, at some point the digital identifier211must be translated into corresponding payment credentials221of a payment account. This can, for example, be done by the network processor400or the issuer500.

In an example where the network processor400converts the digital identifier211to payment credentials221, the network processor400may, for example, have access to a token database410comprising data indicating which payment credentials221are associated with given payment tokens. Alternatively, the network processor400may operate on the payment token according to a pre-determined algorithm in order to obtain the payment credentials221.

In this example, the network processor400sends a payment request message to the issuing institution500associated with the user203, where the payment request message comprises the payment credentials221associated with the user203. The issuer500processes the request and sends the response back to the network processor400. The network processor400then returns the issuer response to the acquirer300, which in turn relays it to the service provider100. The response to the transit operator100typically comprises information about whether the transaction was approved or declined.

The payment process may, for example, be an ISO 8583 0100 authorization request, a 20022 authorization request, a Faster Payment message or another kind of payment transaction.

After an interaction as described above, the relevant parties have access to the following information.

The user is aware of their payment credentials221(because the user had access to the payment credentials to begin with) but has not been provided with the digital identifier211.

The service provider100has access to the digital identifier211(which was provided by the device200when the user203accessed the transit network) and to information relating to the interaction between the user203and the transit network. This information is stored in the previous interaction database103. The service provider100has not been provided with the user's payment credentials221.

The network processor400and/or issuer500have access to the user's digital identifier211and linked payment credentials221(as, for example, retrieved from a tokenization database410or obtained using a pre-determined algorithm), but do not have access to details of the user's interactions with the service provider100.

The service provider100provides a service, e.g., an internet or telephone based service, that allows users203to access details of previous interactions. Users203may access this service through a communication device220, as shown inFIG.4. The communication device220may, for example, be a desktop computer, laptop computer, a mobile electronic device, such as a tablet or smartphone, a telephone, a terminal operated by the service provider100(e.g., a self-service ticket machine). The communication device220may, in some examples, be the same device as the device200used to provide the digital identifier211to the service provider100. The communication device may, for example, provide access to the service through a web browser or an application.

In order to access details of previous interactions, the user203must identify themselves to the service provider100. This allows the service provider100to obtain previous interaction data associated with the correct user and to ensure that private data is not being shared with unauthorised parties.

In the present scenario, where the service provider100is not provided with payment credentials known to the user203in response to a payment request (but is only provided with a digital identifier211), it is not possible for the user203to identify themselves to the service provider100to obtain the desired information.

The following steps, illustrated byFIG.4, provide a method of exchanging identification data that allows a user to identify themselves to a service provider100in order to access data relating to previous interactions between the user203and the service provider100.

The user203uses a communication device220to provide user details to the service provider100, e.g., via a user interface. The user details may be, for example, an account number and sort code or an IBAN that may be manually typed into text boxes provided in a web browser or mobile application. Data corresponding to user details and a request for a list of previous services provided to the user203by the service provider100are sent from the communication device220to the service provider100.

The service provider100then generates a special personal identifier number, ‘sPIN’, based on the user details. The sPIN comprises the data corresponding to the user details and a flag indicating to the network processor that the sPIN contains the user details. The sPIN may, for example, have the same number format as payment credentials for use in a four party card authorization process.

A request comprising the sPIN is then sent from the service provider100to the network processor400, via the acquirer300. The request may, for example, appear to the network processor400as an account status enquiry request. The request may, for example, be an ISO 8535 0100 request message.

The network processor400and the issuing institution500process the request and perform any necessary checks, including security checks. The network processor400determines from the flag that the sPIN contains the user details. The network processor400extracts the user details from the sPIN and uses the user details to obtain one or more digital identifiers211linked to the user details. (More than one digital identifier may be linked to a single set of user details if those user details have been digitized multiple times. For example, a single bank account could be digitized onto both a smartphone and a smartwatch, or into multiple digital wallets on the same device.) This is the reverse of the process described above during a payment request in which the network processor400uses the digital identifier211to obtain user details. Alternatively, the network processor400can route the request to the issuer500, which then recognizes the flag and takes on the responsibility for the conversion.

The network processor400sends a response to the service provider100(via the acquirer300), the response comprising the sPIN and data corresponding to the one or more digital identifiers211. As a result of the response, the service provider100now has access to both the digital identifier(s)211(that is generally unknown by the user203) and the user details that are known by the user203. The service provider100may then edit the entries in the previous interaction database103to include the user details in all data entries that are associated with the digital identifier(s)211.

The service provider100then obtains a list of previous interactions between the user203and the service provider100. In order to obtain the list of previous interactions, the service provider100searches the previous interaction database103for data entries comprising the digital identifier(s)211.

Finally, the service provider100provides to the user203a message comprising the list of previous interactions associated with the digital identifier(s)211. The message may be provided to a communication device220of the user203, and may, for example, be displayed to the user203using a display screen of the communication device220.

The above method allows the user203to identify themselves to the service provider (e.g., transit provider) while using pre-existing data exchange processes of a four party card payment authorization system.

FIG.5shows an example of an sPIN700that may be processed within existing payment processing systems. The sPIN comprises nineteen digits (which is typically the maximum length allowed for the PAN field in ISO 8583 messages) which may be treated by an issuing500or acquiring300institution as though it were a normal credit card or debit card payment number. In the example ofFIG.5, the first six digits702of the sPIN700correspond to the bank identification number (BIN) that allows the network processor400to identify the issuing institution500to which the request message comprising the sPIN700should be forwarded. The seventh digit701is a flag which indicates to the network processor400that the sPIN700comprises user details. The eighth to fifteenth digits703indicate the account number of the user203and the sixteenth to nineteenth digits704indicate the last four digits of the sort code of the corresponding account. Since existing payment processing conventions require that a one-to-one mapping exists between the BIN of a user's issuing institution and the first two digits of a user's sort code, the network processor400is able to determine the initial two digits of the sort code using the BIN by referring to a lookup table. The eighth to the nineteenth digits together correspond to the user details when combined with the first two digits of the sort code as determined from the BIN.

FIG.6shows an alternative example on a nineteen digit sPIN800. Similarly to the example ofFIG.5, the first six digits802are the BIN, the eighth to fifteenth digits803are the account number and the sixteenth to nineteenth digits804are the last four digits of the sort code. However, in this case the BIN in a dedicated flag BIN, which the network processor400or the issuer500can identify in a look-up table. In this example, the seventh digit801indicates the first two digits of the sort code.

FIG.7shows a further alternative example of an sPIN900. Similarly to the example ofFIG.6, the BIN in this case is a dedicated flag BIN. In this example, the BIN902and sort codes904are chosen in advance such that the last digit of the BIN902is the same as the first digit of the sort code904. Thus, the six digit BIN902, the six digit sort code904, and the eight digit account number903can be included in a nineteen digit sPIN900by using a single digit to represent both the final digit of the BIN and the first digit of the sort code.

For sPINs to be processed, it may be necessary to turn off certain security and/or data integrity checks (such as, Luhn check digit validation) usually implemented by a network processor400.

FIG.8is a flowchart illustrating the steps of an example method performed by a server of a service provider, such as transit provider server101.

At step S1the service provider receives, from a user device, a request for a service, the request indicating a digital identifier. At step S2the service provider securely stores, in an interactions database, a record of the requested service together with the digital identifier. These steps may optionally be repeated one or more times if multiple services are requested using the same digital identifier.

At a later time, at step S3the service provider server receives from a communications device a request for a list of services provided to the user by the service provider, said request indicating user details which are available to the user but which were not indicated in any of the one or more requests for services.

The service provider server then generates a special personal identifier number (sPIN) at step S4, the sPIN indicating the user details and comprising a flag indicating to a network processor that the sPIN indicates the user details. At step S5the service provider server sends a request for the digital identifier to the network processor, the request comprising the sPIN.

At step S6, the service provider server receives, from the network processor, a response to the request for the digital identifier, said response comprising the sPIN and the digital identifier. In response to this, at step S7the service provider server obtains, from the interactions database, the record of each requested service associated with the digital identifier. Finally, at step S8the service provider server provides, to the communications device, the record of each requested service associated with the digital identifier.

In addition, where this application has listed the steps of a method or procedure in a specific order, it could be possible, or even expedient in certain circumstances, to change the order in which some steps are performed, and it is intended that the particular steps of the method or procedure claims set forth herein not be construed as being order-specific unless such order specificity is expressly stated in the claim. That is, the operations/steps may be performed in any order, unless otherwise specified, and embodiments may include additional or fewer operations/steps than those disclosed herein. It is further contemplated that executing or performing a particular operation/step before, contemporaneously with, or after another operation is in accordance with the described embodiments.

The methods described herein may be encoded as executable instructions embodied in a computer readable medium, including, without limitation, non-transitory computer-readable storage, a storage device, and/or a memory device. Such instructions, when executed by a processor (or one or more computers, processors, and/or other devices) cause the processor (the one or more computers, processors, and/or other devices) to perform at least a portion of the methods described herein. A non-transitory computer-readable storage medium includes, but is not limited to, volatile memory, non-volatile memory, magnetic and optical storage devices such as disk drives, magnetic tape, CDs (compact discs), DVDs (digital versatile discs), or other media that are capable of storing code and/or data.

The methods and processes can also be partially or fully embodied in hardware modules or apparatuses or firmware, so that when the hardware modules or apparatuses are activated, they perform the associated methods and processes. The methods and processes can be embodied using a combination of code, data, and hardware modules or apparatuses.

Examples of processing systems, environments, and/or configurations that may be suitable for use with the embodiments described herein include, but are not limited to, embedded computer devices, personal computers, server computers (specific or cloud (virtual) servers), hand-held or laptop devices, multiprocessor systems, microprocessor-based systems, set top boxes, programmable consumer electronics, mobile telephones, network PCs, minicomputers, mainframe computers, distributed computing environments that include any of the above systems or devices, and the like. Hardware modules or apparatuses described in this disclosure include, but are not limited to, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), dedicated or shared processors, and/or other hardware modules or apparatuses.

Receivers and transmitters as described herein may be standalone or may be comprised in transceivers. User input devices can include, without limitation, microphones, buttons, keypads, touchscreens, touchpads, trackballs, joysticks and mice. User output devices can include, without limitation, speakers, graphical user interfaces, indicator lights and refreshable braille displays. User interface devices can comprise one or more user input devices, one or more user output devices, or both.

With that said, and as described, it should be appreciated that one or more aspects of the present disclosure transform a general-purpose computing device into a special-purpose computing device (or computer) when configured to perform the functions, methods, and/or processes described herein. In connection therewith, in various embodiments, computer-executable instructions (or code) may be stored in memory of such computing device for execution by a processor to cause the processor to perform one or more of the functions, methods, and/or processes described herein, such that the memory is a physical, tangible, and non-transitory computer readable storage media. Such instructions often improve the efficiencies and/or performance of the processor that is performing one or more of the various operations herein. It should be appreciated that the memory may include a variety of different memories, each implemented in one or more of the operations or processes described herein. What's more, a computing device as used herein may include a single computing device or multiple computing devices.

It is also noted that none of the elements recited in the claims herein are intended to be a means-plus-function element within the meaning of 35 U.S.C. § 112(f) unless an element is expressly recited using the phrase “means for,” or in the case of a method claim using the phrases “operation for” or “step for.”