Source: https://patents.google.com/patent/US10535068B2/en
Timestamp: 2020-04-06 09:45:34
Document Index: 750156583

Matched Legal Cases: ['Application No. 62', 'Application No. 62', 'Application No. 62', 'Application No. 62', 'Application No. 62', 'Application No. 62', 'Application No. 62', 'Application No. 62', 'Application No. 62', 'Application No. 62', 'Application No. 61', 'Application No. 61', 'Application No. 61', 'Application No. 62', 'Application No. 62', 'Application No. 61', 'Application No. 61', 'Application No. 61', 'Application No. 62']

US10535068B2 - Smart card multi-factor authentication device - Google Patents
Smart card multi-factor authentication device Download PDF
US10535068B2
US10535068B2 US15/661,493 US201715661493A US10535068B2 US 10535068 B2 US10535068 B2 US 10535068B2 US 201715661493 A US201715661493 A US 201715661493A US 10535068 B2 US10535068 B2 US 10535068B2
US15/661,493
US20180181958A1 (en
2016-12-28 Priority to US201662439585P priority Critical
2017-07-27 Application filed by Capital One Services LLC filed Critical Capital One Services LLC
2017-07-27 Assigned to CAPITAL ONE SERVICES LLC reassignment CAPITAL ONE SERVICES LLC ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: KELLY, KEVIN, LOCKE, Tyler
2017-07-27 Priority to US15/661,493 priority patent/US10535068B2/en
2018-06-28 Publication of US20180181958A1 publication Critical patent/US20180181958A1/en
2020-01-14 Publication of US10535068B2 publication Critical patent/US10535068B2/en
A dynamic transaction card may be paired with a user application executed on a user device card to facilitate multi-factor authentication of a user by utilizing the dynamic transaction card as a physical token. Various communication technologies may be utilized to create a connection between the dynamic transaction card and the user device application which may include wireless connections and physical connections. Validation information stored in a passive tag on the dynamic transaction card may be received by the user device application, which may evaluate the connection between the dynamic transaction card and the user device, log in credentials of the user, and user information stored in a digital security delivery storage to authenticate the user. This unique pairing of the dynamic transaction card and user device application may automatically facilitate a secure multi-factor authentication by utilizing the dynamic transaction card as a physical token.
The subject application claims the benefit of U.S. Provisional Patent Application No. 62/439,585, filed on Dec. 28, 2016, the contents of which are hereby incorporated by reference in their entireties.
The present disclosure relates to a dynamic transaction card, and systems and methods relating to the dynamic transaction card. A dynamic transaction card and a user device application provide a secure method of facilitating multi-factor authentication by utilizing the dynamic transaction card as a physical token.
Current systems and methods for authenticating a customer include requesting sensitive data from the customer, such as an account number, a transaction card number, a social security number, a mother's maiden name, a password, and/or other personal data. Because certain information may be known by fraudsters, “something you know” authentication techniques force obscure questions such as “What is your grandfather's middle name?” Also, if customers forget the answers to certain questions such as “Who was your favorite teacher?” the customer could be locked out of its user experience after repeated failed attempts. The knowledge based authentication therefore is limited by the customer's ability to select, retain and reproduce obscure responses. Also, current malware and phishing attacks are capable of acquiring such obscure information, including two-factor authentication responses when transmitted via a network. With increased travel and the nature of mobile devices, sensitive data may be requested via a telephone call in a public space thereby compromising the sensitive data when a customer responds orally via telephone. Current authentication processes therefore are not only burdensome for customers but also time-consuming and costly for companies providing customer service to these customers.
Various embodiments of the present disclosure provide a dynamic transaction card, systems supporting a dynamic transaction card, and methods for operating a dynamic transaction card. Specifically, a dynamic transaction card may be paired with a user application executed on a user device card to facilitate multi-factor authentication of a user by utilizing the dynamic transaction card as a physical token.
As referred to herein, a dynamic transaction card may be understood to be an active transaction card that may include a number of accounts that may be activated and/or deactivated by an account holder and/or account provider, data storage that may be updated to reflect real-time and/or on-demand account and/or transaction data, and/or display components to display the updated account and/or transaction data. A dynamic transaction card may be understood to be activated (e.g., turned on) and/or deactivated (e.g., turned off) based on input received at the dynamic transaction card as described herein.
A dynamic transaction card may be a smart card, which may be utilized as a physical token to facilitate multi-factor authentication. The dynamic transaction card may include a secure memory chip, a microprocessor, and an application processor that may store a dynamic transaction card application. The dynamic transaction card application when executed may cause the dynamic transaction card to receive a request from a user device application executed on a user device to authenticate a user when the user has logged in to the user device application. Various communication technologies may be utilized to create a connection between the dynamic transaction card and the user device application which may include wireless connections, which may include NFC, Bluetooth or BLE connections, as well as physical connections, which may include utilizing an external portable connection device, which may include a Universal Serial Bus (USB) dongle to connect the dynamic transaction card to the user device on which the user device application is executed.
The dynamic transaction card may store validation information in a passive tag, such as a passive NFC tag, and this validation information may be received by the user device application, and may be utilized with the connection between the dynamic transaction card and the user device, as described herein, log in credentials of the user wherein the user has logged in to the user device application, and user information stored in a digital security delivery storage to authenticate the user. The digital security delivery storage may store information about the user, including characteristics of dynamic transaction card, the user device and login information for the user for the user device application.
As such, this unique pairing of the dynamic transaction card and user device application may automatically facilitate a secure multi-factor authentication by utilizing the dynamic transaction card as a physical token.
FIG. 3 depicts an example card-device linking system according to embodiments of the disclosure; and
FIG. 4 depicts an example method for using a dynamic transaction card according to embodiments of the disclosure; and
The entire contents of the following applications are incorporated herein by reference: U.S. Patent Publication No. 2016-0307189, entitled “System, Method and Apparatus for a Dynamic Transaction Card” filed Apr. 14, 2016, which claims the benefit of U.S. Provisional Application No. 62/147,568 filed Apr. 14, 2015 and U.S. Provisional Application No. 62/720,669 filed Dec. 22, 2015; U.S. Patent Publication No. 2016-0307089, entitled “System, Method, and Apparatus for a Dynamic Transaction Card” filed Apr. 14, 2016, which claims the benefit of U.S. Provisional Application No. 62/270,669 filed Dec. 22, 2015 and U.S. Provisional Application No. 62/147,568 filed Apr. 14, 2015; U.S. Patent Publication No. 2016-0308371 entitled “Dynamic Transaction Card Power Management” filed Apr. 14, 2016, which claims the benefit of U.S. Provisional Application No. 62/147,568 filed Apr. 14, 2015, U.S. Provisional Application No. 62/266,324 filed Dec. 11, 2015, U.S. Provisional Application No. 62/270,307 filed Dec. 21, 2015, and U.S. Provisional Application No. 62/305,599 filed Mar. 9, 2016; U.S. Patent Publication No. 2016-0189143, entitled “A System, Method, and Apparatus for Locating a Bluetooth Enabled Transaction Card, filed Dec. 22, 2015, which claims the benefit of U.S. Provisional Application No. 62/095,190, filed on Dec. 22, 2014; U.S. Pat. No. 9,105,025, entitled, Enhanced Near Field Communications Attachment filed on May 29, 2014, which claims the benefit of U.S. Provisional Application No. 61/570,275 filed on Dec. 13, 2011 and U.S. Provisional Application No. 61/547,910 filed on Oct. 17, 2011; U.S. Patent Publication No. 2015-0032635, entitled “System and Method for Exchanging Data with Smart Cards” filed Jul. 23, 2014, which claims the benefit of U.S. Provisional Application No. 61/857,443 filed on Jul. 23, 2013; U.S. Patent Publication No. 2016-0307081, entitled “Dynamic Transaction Card with EMV Interface and Method of Manufacturing” filed Apr. 14, 2016, which claims the benefit of U.S. Provisional Application No. 62/270,648 filed Dec. 22, 2015 and U.S. Provisional Application No. 62/147,568 filed Apr. 14, 2015; U.S. Patent Publication No. 2014-0279231, entitled “System and Method for Providing Third Party Payments with Non-Integrated Merchants” filed Mar. 12, 2014, which claims the benefit of U.S. Provisional Application No. 61/778,776 filed Mar. 13, 2015; U.S. Patent Publication No. 2015-0094026, entitled “System and Method for Automatically Authenticating a Caller” filed Sep. 9, 2014, which claims the benefit of U.S. Provisional Application No. 61/875,251 filed Sep. 9, 2013; U.S. patent application Ser. No. 15/297,453 entitled “System and Method for Automatically Authenticating a Caller” filed Oct. 19, 2016, which is a continuation and claims the benefit of U.S. Patent Publication No. 2015-0094026, which claims the benefit of U.S. Provisional Application No. 61/875,251; and U.S. Patent Publication No. 2016-0078430, entitled “System and Method for Digital Authentication” filed Aug. 17, 2015, which claims the benefit of U.S. Provisional Application No. 62/037,710 filed Aug. 15, 2014.
The following description is intended to convey a thorough understanding of the embodiments described by providing a number of specific example embodiments and details involving a dynamic transaction card and systems and methods for using a dynamic transaction card to facilitate multi-factor authentication of a dynamic transaction card and a user device application by utilizing the dynamic transaction card as a physical token.
It should be appreciated, however, that the present disclosure is not limited to these specific embodiments and details, which are examples only. It is further understood that one possessing ordinary skill in the art, in light of known systems and methods, would appreciate the use of the invention for its intended purposes and benefits in any number of alternative embodiments, depending on specific design and other needs. A card including a EuroPay-MasterCard-Visa (EMV) standard chip, one form of a secure payment chip, is used as an example of a dynamic transaction card. A dynamic transaction card may include any type of transaction card that includes a microcontroller-enabled card used in any type of transaction, including, for example, debit cards, credit cards, pre-paid cards, cards used in transportation systems, membership programs, loyalty programs, hotel systems, and the like. A dynamic transaction card may include enhanced features, including hardware, software, and firmware, beyond the traditional features of a magnetic stripe or EMV card. The use of “mobile device” in the examples throughout this application is only by way of example. Any type of device capable of communicating with a dynamic transaction card may also be used, including, for example, personal computers, tablets, gaming systems, televisions, or any other device capable of communicating with a dynamic transaction card.
In various embodiments, providing the alerts, notifications, and/or other output on a dynamic transaction card could be provided with the assistance of a network environment, such as a cellular or Internet network. For example, a mobile device may request and/or receive data indicative of notifications, alerts, and/or output to be displayed on a dynamic transaction card from a financial institution system via a network. A mobile device may then relay the data via a network (e.g., a short range wireless communication network, NFC, Bluetooth, and/or the like) to the dynamic transaction card for storage and/or to activate, trigger, and/or output notifications and/or alerts.
User device 140 may be, for example, a mobile device, such as, for example, personal digital assistants (PDA), tablet computers and/or electronic readers (e.g., iPad, Kindle Fire, Playbook, Touchpad, etc.), wearable devices (e.g., Google Glass), laptop and/or desktop computers, telephony devices, smartphones, cameras, music playing devices (e.g., iPod, etc.), televisions, set-top-box devices, and the like.
Account provider system 130 and user device 140 also may include a network-enabled computer system and/or device. As referred to herein, a network-enabled computer system and/or device may include, but is not limited to: e.g., any computer device, or communications device including, e.g., a server, a network appliance, a personal computer (PC), a workstation, a mobile device, a phone, a handheld PC, a personal digital assistant (PDA), a thin client, a fat client, an Internet browser, or other device. The network-enabled computer systems may execute one or more software applications to, for example, receive data as input from an entity accessing the network-enabled computer system, process received data, transmit data over a network, and receive data over a network. For example, account provider system may include components such as those illustrated in FIG. 2.
Account provider system 130 and user device 140 may include at least one central processing unit (CPU), which may be configured to execute computer program instructions to perform various processes and methods. Account provider system 130 and user device 140, may include data storage, including for example, random access memory (RAM) and read only memory (ROM), which may be configured to access and store data and information and computer program instructions. Data storage may also include storage media or other suitable type of memory (e.g., such as, for example, RAM, ROM, programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), magnetic disks, optical disks, floppy disks, hard disks, removable cartridges, flash drives, any type of tangible and non-transitory storage medium), where the files that comprise an operating system, application programs including, for example, web browser application, email application and/or other applications, and data files may be stored. The data storage of the network-enabled computer systems may include electronic information, files, and documents stored in various ways, including, for example, a flat file, indexed file, hierarchical database, relational database, such as a database created and maintained with software from, for example, Oracle® Corporation, Microsoft® Excel file, Microsoft® Access file, a solid state storage device, which may include an all flash array, a hybrid array, or a server-side product, enterprise storage, which may include online or cloud storage, or any other storage mechanism.
Account provider system 130 and user device 140 may further include, for example, a processor, which may be several processors, a single processor, or a single device having multiple processors. Although depicted as single elements, it should be appreciated that according to one or more embodiments, account provider system 130 and/or user device 140, may comprise a plurality of account provider systems 130 and/or user devices.
Account provider system 130 and user device 140 may further include data storage, such as data storage 138. The data storage may include electronic information, files, and documents stored in various ways, including, for example, a flat file, indexed file, hierarchical database, relational database, such as a database created and maintained with software from, for example, Oracle® Corporation, Microsoft® Excel file, Microsoft® Access file, a solid state storage device, which may include an all flash array, a hybrid array, or a server-side product, enterprise storage, which may include online or cloud storage or any other storage mechanism.
As shown in FIG. 1, each account provider system 130 and user device 140 may include various components. As used herein, the term “component” may be understood to refer to computer executable software, firmware, hardware, and/or various combinations thereof. It is noted there where a component is a software and/or firmware component, the component is configured to affect the hardware elements of an associated system. It is further noted that the components shown and described herein are intended as examples. The components may be combined, integrated, separated, or duplicated to support various applications. Also, a function described herein as being performed at a particular component may be performed at one or more other components and by one or more other devices instead of or in addition to the function performed at the particular component. Further, the components may be implemented across multiple devices or other components local or remote to one another. Additionally, the components may be moved from one device and added to another device, or may be included in both devices.
As depicted in FIG. 1, system 100 may include dynamic transaction card 120. A dynamic transaction card may include any transaction card that is able to display alerts, notifications, and/or other output to a card holder via a display and/or LED lighting 126 and/or receive input to interact with the dynamic transaction card via, for example, a sensor 124. Although FIG. 1 depicts a single sensor, 124, multiple sensors may be included in dynamic transaction card 120. Dynamic transaction card 120 also may be composed of various materials that enable the entire exterior surface of card 120 to act as a sensor. A dynamic transaction card may be able to communicate with, for example, a mobile device using RFID, Bluetooth, NFC, WiFi Direct and/or other related technologies. For example, communications between a dynamic transaction card and a mobile device may include methods, systems, and devices described in U.S. patent application Ser. No. 14/338,423 filed on Jul. 23, 2014, the entire contents of which are incorporated herein by reference.
A dynamic transaction card may be able to communicate with EMV terminals via contact points positions on the exterior of card 120 such as those positions on a secure payment chip, which may be an EMV chip 122 located on the dynamic transaction card 120 or an EMV plate positions on the exterior of card 120 connected to an EMV processor within card 120. For example, contact points position on the exterior of card 120 may be directly connected and adjacent to a secure payment processor, which may be an EMV processor (e.g., secure payment chip 122, which may be an EMV chip). In another example, the contact points positions on the exterior of card 120 may be connected to an secure payment processor, which may be an EMV processor sing a form of wired connection (e.g., electrical wiring, plastic jumpers, and/or the like) such that the secure payment processor, which may be an EMV processor may be positioned at any location in the interior of card 120 as described in U.S. Provisional Application 62/270,648, the entire contents of which are incorporated herein by reference.
A dynamic transaction card 120 may also include hardware components to provide contactless payments and/or communications. For example, dynamic transaction card 120 may include an output layer, an outer protective layer, potting, applications (e.g., a Java Applet), application integration (e.g., Java Applet integration), a secure payment chip 122, which may be an EMV chip, one or more sensors, a display, a display driver, firmware, a bootloader, a microcontroller, one or more antenna, an energy storage component, power management, a flexible PCB, a chassis, and/or card backing. A secure payment chip 122, which may be an EMV chip, embedded in the dynamic transaction card 120 may include a number of contacts that may be connected and activated using an interface device.
Account provider system 130 may include systems associated with, for example, a banking service company such as Capital One®, Bank of America®, Citibank®, Wells Fargo®, Sun Trust, various community banks, and the like, as well as a number of other financial institutions such as Visa®, MasterCard®, and American Express® that issue credit and/or debit cards, for example, as transaction cards. Account provider system 130 may include and/or be connected to one or more computer systems and networks to process transactions. For example, account provider system 130 may process transactions as shown and described in FIG. 5 below. Account provider system 130 may include systems associated with financial institutions that issue transaction cards, such as a dynamic transaction card 120, and maintains a contract with cardholders for repayment. In various embodiments, an account provider system 130 may issue credit, debit, and/or stored value cards, for example. Account provider system 130 may include, by way of example and not limitation, depository institutions (e.g., banks, credit unions, building societies, trust companies, mortgage loan companies, pre-paid gift cards or credit cards, etc.), contractual institutions (e.g., insurance companies, pension funds, mutual funds, etc.), investment institutions (e.g., investment banks, underwriters, brokerage funds, etc.), and other non-bank financial institutions (e.g., pawn shops or brokers, cashier's check issuers, insurance firms, check-cashing locations, payday lending, currency exchanges, microloan organizations, crowd-funding or crowd-sourcing entities, third-party payment processors, etc.).
A user device 140, may be a mobile device, and may be any device capable of communicating with a transaction card 120 via, for example, short range wireless technology, such as Bluetooth technology, NFC technology, WiFi Direct technology, and/or the like and execute various functions to transmit and receive account data (e.g., card number, account type, account balance, account limits, budget data, recent transactions, and/or the like) associated with dynamic transaction card 120. For example, user device 140 could be an iPhone, iPod, iPad, and/or Apple Watch from Apple® or any other mobile device running Apple's iOS operating system, any device running Google's Android® operating system, including, for example, smartphones running the Android® operating system and other wearable mobile devices, such as Google Glass or Samsung Galaxy Gear Smartwatch, any device running Microsoft's Windows® Mobile operating system, and/or any other smartphone or like device.
A user device 140 may also be a network-enabled computer. As referred to herein, a network-enabled computer may be, but is not limited to: e.g., any computer device, or communications device including, e.g., a server, a network appliance, a personal computer (PC), a workstation, a mobile device, a phone, a handheld PC, a personal digital assistant (PDA), a thin client, a fat client, an Internet browser, or other device.
Dynamic transaction card 120 may include firmware and/or a bootloader. A bootloader may include code to be executed as a dynamic transaction card is activated and before any operating system, firmware, or other code is executed on the dynamic transaction card 120. A bootloader may be activated via a sensor and energy storage component of the dynamic transaction card 120. A bootloader may be activated and/or load an application and/or program upon detection that card 120 has been inserted into a terminal, charger, and/or the like. A bootloader may be activated using only one technique described herein, using multiple techniques described herein, and/or using a card holder or card provider selected technique(s) described herein. A bootloader may only be active during a short interval after the card powers up. Dynamic transaction card 120 may also be activated using program code that may be flashed directly to a microprocessor such as a microcontroller, a secure payment processor, which may be an EMV processor, and/or the like. Dynamic transaction card 120 may not use a bootloader but instead may cycle between a sleep state and an active state using program code and/or memory.
A dynamic transaction card 120 may include a microcontroller and an antenna. An antenna may include, for example, a loop antenna, a fractal antenna, and/or the like. An antenna may transmit to and receive signals from a mobile device, such as user device 140, to conduct transactions and display data as described throughout the specification. A microcontroller may communicate with a secure payment chip, which may be an EMV chip, Java Applet, Java Applet integration, sensor(s), power management, antenna, energy storage component, display, display driver, firmware, bootloader, and/or any other component of dynamic transaction card 120. A microcontroller may control the card operations to conduct transactions and/or display data as described throughout this specification.
FIG. 2 illustrates a system associated with the use of a dynamic transaction card. The example system 200 in FIG. 2 may enable a financial institution, for example, to provide network services to its cardholders, and may include providing transaction card data, account data, and/or any other data to a mobile device that may in turn provide that data to a dynamic transaction card. For example, a financial institution may include a front-end controlled domain 206, a back-end controlled domain 212, and a backend 218 as part of account provider system 130, a user device 202 may include user device 140, and a dynamic transaction card may include dynamic transaction card 120.
User device 202 may be a network-enabled computer. As referred to herein, a network-enabled computer may be, but is not limited to: e.g., any computer device, or communications device including, e.g., a server, a network appliance, a personal computer (PC), a workstation, a mobile device, a phone, a handheld PC, a personal digital assistant (PDA), a thin client, a fat client, an Internet browser, or other device. The one or more network-enabled computers of the example system 200 may execute one or more software applications to enable, for example, network communications.
User device 202 may be a mobile device, and may further be an iPhone, iPod, iPad from Apple® or any other mobile device running Apple's iOS operating system, any device running Google's Android® operating system, including for example, Google's wearable device, Google Glass, any device running Microsoft's Windows® Mobile operating system, and/or any other smartphone or like wearable mobile device. User device 202 also may be similar to user device 140 as shown and described in FIG. 1.
Data transmitted may be encrypted. Encryption/decryption may occur using a key that was preloaded onto the dynamic transaction card upon personalization at the issuing financial institution and/or a key preloaded to a secure payment processing circuit, which may be an EMV circuit. Data received may include new account and/or card data. For example, where partially pre-loaded card and/or account data are stored on a dynamic transaction card, new card and/or account data may be received from an account holder's mobile device via a wireless connection (e.g., BLE, NFC, WiFi, and/or the like) or a contact connection (e.g., using a terminal in contact with an EMV processor and/or other microchip). Data received may include an applet and/or applet data required to execute transactions, manipulate dynamic displays, and/or perform any of the functionality described herein.
Also, fully pre-loaded and/or partially pre-loaded data may also include keys (e.g., public/private key pairs, private key pairs, and/or the like) that may be used by circuitry associated with an EMV or similar chip to execute transactions using the EMV or similar chip processor on the card.
A mobile application may be paired with a dynamic transaction card to facilitate secure authentication and secure online checkout. The mobile application may notify a backend account provider system and/or data storage associated with the mobile application via an application programming interface (API) call to the backend to facilitate secure multi-factor authentication of a user by utilizing the dynamic transaction card as a physical token. The mobile application may communicate with a dynamic transaction card via a short range wireless communication network, Bluetooth, BLE, and/or NFC, and may communicate with the backend account provider system via mobile networks or WiFi.
FIG. 4 illustrates an example method of utilizing a dynamic transaction card as a physical token to facilitate a secure method of multi-factor authentication of a dynamic transaction card and a user device. The method 400 may start at block 402. At block 404, a user may log in to a user device application executed on a user device. For example, a mobile application such as a mobile banking application may require a username and password in order for a customer to log in to a customer account.
User device application executed on a user device may enable an active communication mode on the user device. For example, an NFC connection may be utilized to pair a dynamic transaction card with a user device. In an embodiment, the system may enable Industry Standard NFC Transmission. For example, an NFC attachment, included on the dynamic transaction card, may enable two loop antennas to form an air-core transformer when placed near one another by using magnetic induction. The system may operate at 13.56 MHz or any other acceptable frequency. Also, the attachment may provide for a passive communication mode, where the initiator device provides a carrier field, permitting answers by the target device via modulation of existing fields. Additionally, the attachment may also provide for an active communication mode by allowing alternate field generation by the initiator and target devices.
As such, to utilize the dynamic transaction card to facilitate a secure multi-factor authentication, the active communication mode may be required to be enabled for the user device. The system may evaluate whether the active communication mode is enabled for the user device at block 406. If the active communication mode is not enabled on the user device, the process may end at block 408.
Based on the operating system of a user device, a user device application executed on the user device may have both an active communication mode and a passive/reader communication mode, or may be limited to only having a passive/reader communication mode. In an additional embodiment, if a mobile device only has a passive reader mode, a short range wireless connection, such as a Bluetooth or BLE connection, may be utilized as the connection between the dynamic transaction card and the user device application. As such, the system configuration described herein utilizing dynamic transaction cards in conjunction with a user device application transforms the user device application to an interoperable application that may be utilized across different operating systems, providing an operating system neutral mobile secure multi-factor authentication system.
Upon activation of the dynamic transaction card to wake up the card, a wireless connection, which may include a Bluetooth, BLE, or NFC connection may be established between the dynamic transaction card and the user device. For example, a dynamic transaction card may be placed within the range of a user device NFC antenna which may read user information stored on the dynamic transaction card, and may confirm the user's identity on the backend through the user device application by evaluating associated data stored in data storage associated with the dynamic transaction card and/or account provider system data storage. In another example, a user device may include a Bluetooth on BLE radio to read the user information associated with the dynamic transaction card.
A user may be prompted by a user device application executed on a user device to validate the user identity by utilizing a dynamic transaction card, which may provide a unique physical token for each user at block 410. At block 412, the application processor on the dynamic transaction card may be utilized to generate a passive tag, which may be utilized to securely store user account information in the passive tag. As such, sensitive user account information does not need to be entered to facilitate the multi-factor authentication and may be obtained through the connection between the dynamic transaction card and the user device. For example, if an NFC connection is utilized, the information may be obtained via a NFC antenna on the user device. A user may be issued a unique identifier stored on the dynamic transaction card's passive tag rather than storing personal information such as a customer name, zip code, email address, etc.
At block 414, the dynamic transaction card may receive a connection attempt from a user device application associated with the user device to pair the dynamic transaction card with the user device. Utilizing this connection, the user device application executed on the user device may obtain the user account information stored on the passive tag at block 416. The user may be authenticated by utilizing multi-factor authentication based on the pairing of the dynamic transaction card and the successful log in of the customer to the user device application. This multi-factor authentication may provide computer access control in which the user is only authenticated after successfully presenting these pieces of evidenced to an authentication system. For example, the user may be authenticated based on evaluation of the connection between the dynamic transaction card and the user device, log in credentials of the user for logging in to the user device application executed on the user device and user information stored in a digital security database. The introduction of the user device and dynamic transaction card may provide immutable hardware identifiers, processors for encryption and location awareness, as well as new interactions via touch, microphone, camera, Bluetooth, BLE, and/or NFC, as the user device and dynamic transaction card are something users typically have in their possession. The user device and dynamic transaction card may also enable transmission of data about users and data indicative of things users know. The digital security database may store information about a user that is enrolled in push notification authentication, including identifying characteristics of the dynamic transaction card, the user device and login information for the user for the user device application executed on the user device. Thus, systems and methods for authentication described herein provide a novel digital authentication framework that utilizes digital authentication techniques enabled by user devices and dynamic transaction cards.
The process may end at block 418.
In various example embodiments, push notification authentication may be utilized to facilitate the secure multi-factor authentication utilizing a dynamic transaction card and a user device. An account provider system may identify the user's identification and their registered device, which may include the user device and/or dynamic transaction card. The account provider system may also identify the user's login and the user's registered device. The account provider system servers may transmit a push notification to the user device and dynamic transaction card combination for the account. The customer may receive, for example, a slide up advising them the authentication request. The customer then may authenticate via the appropriate transaction level, swipe, password/touchID/pattern recognition or facial recognition and the customer application on the user device may transmit the customer's response—approve or deny—back to the card issuers server. If the customer receives this push notification, the customer may authenticate via the mobile device and/or dynamic transaction card as shown and described herein.
An application processor on the dynamic transaction card may also be utilized to generate a unique key, which may include a token, which may be utilized to securely store user validation information, which in turn may be utilized to authenticate the user. As such, sensitive user information does not need to be entered to facilitate the multi-factor authentication and may be obtained through the wireless connection. The unique key may be associated with the user device application user login and may include a single-use transaction key.
The request facilitate a secure multi-factor authentication may be processed using the systems described in FIGS. 1, 2, 3. Data may be securely transmitted between a user device, a dynamic transaction card, a financial institution, and a merchant. Moreover, a mobile banking application and/or a financial institution application may provide a secure connection and/or security features (e.g., cryptographic keys, protocol, hash algorithm, digital signatures, passwords, checksums, and/or the like) to conduct secure communications with a financial institution and merchant backend and receive updated financial data to transmit, via RFID, BLE, Bluetooth, NFC, and/or the like, to a dynamic transaction card for storage and/or display.
For example, a mobile application may communicate with a backend account provider and/or merchant system via a mobile network or WiFi to pass user/account information to the backend. User account information may be encrypted to facilitate a secure transfer of the information. The transmitted information may include a key or token of encrypted information representing a financial account, the amount of the transaction and/or other information necessary to facilitate the multi-factor authentication. The backend account provider system may verify the user account information, as it may use the user account information to look up the account of the user and determine whether a user should be authenticated, and my also relatedly by utilized to determine whether an associated transaction should be authorized. The account provider system may check the account information against certain parameters to determine, for example, whether the authentication request complies with certain parameters, and/or whether the associated token has expired.
An API may also encrypt, for example account and routing numbers to ensure that any passing user account identifying data is secure during transmission and storage. The data may be read and encrypted using a private key stored within the dynamic transaction card processor. A user device also may store instructions to encrypt and/or encode data being transmitted from the user device. A user device may store instructions to decrypt and/or decode data received at the user device. A user device may store encryption/encoding/decryption/decoding instruction in a secure element or a secure microprocessor. For example, where a user device includes a secure payment chip, which may be an EMV chip, encryptions/encoding/decryption/decoding instructions may be stored within the secure payment chip, which may be an EMV chip. A user device may store instructions to validate a public/private key handshake between the user device and a dynamic transaction card to pair the user device and dynamic transaction card device via a Bluetooth/BLE connection.
In another embodiment, the user device may include a personal computer and the associated user device application may include a desktop application. To facilitate the multi-factor authentication described herein, the dynamic transaction card may be connected to an external portable connection device, for example a Universal Serial Bus (USB) dongle. To facilitate the user authentication processing described herein, the dynamic transaction card connected to the portable connection device may be inserted into the associated user device.
In another embodiment, to facilitate the multi-factor authentication described herein, the dynamic transaction card may be inserted into a magnetic stripe reader, which may be any electronic data input device that reads data from a magnetic stripe on a credit or debit card, for example. The magnetic stripe reader may include a magnetic reading head capable of reading information from a magnetic stripe. For example, the magnetic stripe reader may be capable of reading, for example, cardholder information from tracks 1, 2, and 3 on magnetic cards. In various embodiments, track 1 may be written on a card with code known as DEC SIXBIT plus odd parity and the information on track 1 may be contained in several formats (e.g., format A, which may be reserved for proprietary use of the card issuer; format B; format C-M which may be reserved for us by ANSI subcommittee X3B10; and format N-Z, which may be available for use by individual card issuers). In various embodiments, track 2 may be written with a 5-bit scheme (4 data bits plus 1 parity). Track 3 may be unused on the magnetic stripe. In various embodiments, track 3 transmission channels may be used for transmitting dynamic data packet information to further enable enhanced token-based payments. The magnetic strip reader may read user information stored on the dynamic transaction card, and may confirm the user's identity on the backend by evaluating associated data stored in data storage associated with the dynamic transaction card and/or account provider system data storage.
The dynamic transaction card may also be inserted into a smart payment terminal, such as those provided by Square®, Poynt®, and Clover® to facilitate the multi-factor authentication described herein. The smart payment terminal may read user information stored on the dynamic transaction card, and may confirm the user's identity on the backend by evaluating associated data stored in data storage.
receive, at the application processor, a request from a user device application executed on a user device to authenticate a user of the user device, wherein the user has logged in to the user device application on the user device using one or more log-in credentials before the request is received;
receive, at the payment processing microprocessor, data from the user device application for a user purchase being initiated by a transaction system, wherein the transaction system is in communication with the user device application and configured to store user information;
create, with the antenna, a wireless connection between the dynamic transaction card and the user device; and
provide, to the user device application, user validation information to complete the user purchase initiated by the transaction system, wherein the user validation information is stored in a passive tag of the dynamic transaction card,
wherein the user validation information includes a unique identifier associated with the user and is used to authenticate the user of the user device based on (1) an evaluation of the wireless connection between the dynamic transaction card and the user device, (2) the one or more login credentials of the user, and (3) a comparison of the user validation information received from the dynamic transaction card application to user information stored in the transaction system; and
wherein the user information includes: characteristics of the dynamic transaction card, the user device and login information for the user for the user device application.
2. The dynamic transaction card of claim 1, wherein the secure payment chip comprises a EuroPay-MasterCard-Visa (EMV) chip.
3. The dynamic transaction card of claim 1, wherein the user device comprises a mobile device.
4. The dynamic transaction card of claim 3, wherein the connection between the dynamic transaction card and the user device application comprises a Near Field Communication (NFC) connection.
5. The dynamic transaction card of claim 4, wherein the user device application enables an active NFC communication mode on the user device.
6. The dynamic transaction card of claim 3, wherein the connection between the dynamic transaction card and the user device application comprises a short range wireless connection.
7. The dynamic transaction card of claim 6, wherein the short range wireless connection comprises a Bluetooth or Bluetooth Low Energy (BLE) connection.
8. The dynamic transaction card of claim 6, wherein the user device application enables a passive communication mode on the user device.
9. The dynamic transaction card of claim 1, wherein the user device comprises a personal computer and the user device application comprises a desktop application.
10. The dynamic transaction card of claim 9, wherein the dynamic transaction card is connected to a portable connection device.
11. The dynamic transaction card of claim 10, wherein the portable connection device comprises a Universal Serial Bus (USB) dongle.
12. The dynamic transaction card of claim 10, wherein the dynamic transaction card connected to the portable connection device is inserted in to the personal computer to facilitate user authentication.
13. The dynamic transaction card of claim 9, wherein the connection between the dynamic transaction card and the desktop application comprises a Near Field Communication (NFC) connection.
14. The dynamic transaction card of claim 13, wherein the desktop application enables an active NFC communication mode on the personal computer.
15. The dynamic transaction card of claim 9, wherein the connection between the dynamic transaction card and the desktop application comprises a short range wireless connection.
16. The dynamic transaction card of claim 15, wherein the short range wireless connection between the dynamic transaction card and the desktop application comprises a Bluetooth or Bluetooth Low Energy (BLE) connection.
17. The dynamic transaction card of claim 15, wherein the desktop application enables a passive communication mode on the user device.
18. The dynamic transaction card of claim 1, wherein the dynamic transaction card application generates a unique key associated with the one or more log-in credentials.
19. The dynamic transaction card of claim 18, wherein the unique key comprises a single-use transaction key.
20. The dynamic transaction card of claim 18, wherein an account provider system is configured to evaluate the unique key to authenticate the user.
21. The dynamic transaction card of claim 1, wherein the dynamic transaction card is inserted into a magnetic stripe reader to facilitate user authentication.
22. The dynamic transaction card of claim 1, wherein the dynamic transaction card is inserted into a smart payment terminal to facilitate user authentication.
US15/661,493 2016-12-28 2017-07-27 Smart card multi-factor authentication device Active US10535068B2 (en)
US201662439585P true 2016-12-28 2016-12-28
US15/661,493 US10535068B2 (en) 2016-12-28 2017-07-27 Smart card multi-factor authentication device
CA2990122A CA2990122A1 (en) 2016-12-28 2017-12-22 Smart card multi-factor authentication device
EP17210982.9A EP3343488A1 (en) 2016-12-28 2017-12-28 Smart card multi-factor authentication device
US20180181958A1 US20180181958A1 (en) 2018-06-28
US10535068B2 true US10535068B2 (en) 2020-01-14
ID=60813770
US15/661,493 Active US10535068B2 (en) 2016-12-28 2017-07-27 Smart card multi-factor authentication device
US (1) US10535068B2 (en)
EP (1) EP3343488A1 (en)
CA (1) CA2990122A1 (en)
CN108810010A (en) * 2018-06-29 2018-11-13 芜湖奥优商贸有限公司 A kind of information sharing method for internet trade information service platform
KR100725146B1 (en) * 2005-12-08 2007-05-29 주식회사 케이티프리텔 System and method for settlement by using card recognition equipment
US20170200144A1 (en) * 2016-01-13 2017-07-13 Paypal, Inc. Dongle device for automatic pairing of payment terminal to mobile computing device
US20170228715A1 (en) * 2016-02-05 2017-08-10 Mastercard International Incorporated Method and system for point of sale payments
US10255464B2 (en) * 2017-01-31 2019-04-09 Square, Inc. Systems and methods for determining clock rates for communicating with processing devices
US10380389B1 (en) * 2015-12-11 2019-08-13 Square, Inc. Reading payment object upon detection of reader readiness
2017-07-27 US US15/661,493 patent/US10535068B2/en active Active
2017-12-22 CA CA2990122A patent/CA2990122A1/en active Pending
2017-12-28 EP EP17210982.9A patent/EP3343488A1/en active Pending
CA2990122A1 (en) 2018-06-28
US20180181958A1 (en) 2018-06-28
EP3343488A1 (en) 2018-07-04
US10362136B2 (en) 2019-07-23 Device profile data usage for state management in mobile device authentication
KR101820573B1 (en) 2018-01-19 Mobile-merchant proximity solution for financial transactions
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:LOCKE, TYLER;KELLY, KEVIN;REEL/FRAME:043118/0780
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:CAPITAL ONE FINANCIAL CORPORATION;REEL/FRAME:049531/0454