Patent ID: 12200134

Embodiments of the present disclosure and their advantages are best understood by referring to the detailed description that follows. It should be appreciated that like reference numerals are used to identify like elements illustrated in one or more of the figures, wherein showings therein are for purposes of illustrating embodiments of the present disclosure and not for purposes of limiting the same.

DETAILED DESCRIPTION

Provided are methods utilized for multifactor authentication through cryptography-enabled smart cards. Systems suitable for practicing methods of the present disclosure are also provided.

An organization may issue one or more payment cards to customers, clients, and/or employees to process payments through an electronic card and/or transaction network associated with a backend payment processor on the network. A payment card may be linked to an account with an online transaction service provider, such as a service provider that facilitates processing of payments and enforcement of expense policies for payment instruments. In one example, such a payment processing and expense management system may be provided by BREX®, Inc. of San Francisco, CA, USA., which may provide electronic transaction processing services to customers and client organizations through credit accounts, debit cards, direct debit/credit through automated clearing house (ACH), wire transfers, gift cards, and other types of funding sources that may be issued to the organizations by the payment processing and expense management system, and well as other integrated financial service providers. Digital accounts and physical payment cards may be used for in-store or physical payment transactions, such as by scanning a payment card or capturing data representing the account via a point-of-sale (POS) device and the like. Further, accounts and cards may also be used via one or more websites and/or applications of online merchants. In order to more securely identify and authenticate users, as well as secure transaction processing, multifactor authentication may be used through a physical payment card having an embedded microchip.

For example, an employee or other user of an organization may wish to process a purchase of items or services via a digital account and/or payment card that provides values, credit, or other funds to the user. When originally establishing an account and/or being issued a payment card that may be linked to an account, the user may establish account creation details and/or personal information tied to the payment card. For example, the user may provide personal information for the user, business or merchant information for an entity, or other types of identification information including a name, address, and/or other identifier. The user may also establish authentication information, such as a name, password, PIN, and/or other secret used to authenticate the user and/or access to the account. When the payment card is created and issued, the payment card may include a microchip, such as an EMV chip, Java Smart Card chip, NFC chip and/or antenna, or the like.

When initially created, the chip is loaded or programmed with a unique cryptographic signing function, mechanism, and/or data, which allows for uniquely signing requests for authentication and the like digitally by scanning or otherwise reading the chip of the card. The chip may further be coupled to a passive antenna, which allows scanning of the chip, reading the data, and digitally signing using the cryptographic data on the chip. The user may also link the account and/or payment card to a mobile application of the system that resides on a mobile smart phone of the user, which may allow secure access to the account and/or multifactor authentication by scanning the microchip on the phone. Thus, the user may link the payment card (and its corresponding cryptographic data) and a mobile smart phone (and corresponding mobile application) to each other and/or the user's account so that multifactor authentication may be facilitated.

In order to pay for a transaction (e.g., a transfer or payment to another user, merchant, or other entity), the user may provide the payment card or may login to an account using authentication information. Payment card data may be stored to one or more storage mediums on the payment card, such as a magnetic stripe or an EMV chip, which may then be read to facilitate an in-person or card-present transaction. For example, a POS device and/or card reader may be used to read the card data from a merchant device at a merchant location. However, online transactions may also be performed using card data, such as in a card-not-present transaction. A payment may then be issued to another party to the transaction by entering transaction details that are then submitted for processing. The payment processing and expense management system may include an integration with one or more electronic card networks that allows for data exchange and communications between over payment networks. The payment processing and expense management system may receive or detect the transaction data for the electronic transaction over a network and may request multifactor authentication by reading the microchip of the physical payment card using a scanning device (e.g., a mobile smart phone that may include an RFID, NFC, etc., scanner). In response to receiving or detection the transaction data, the system may then issue a multifactor authentication request to the linked device of the user.

When issuing the multifactor request by the payment processing and expense management system, a communication may be sent to the computing device of the user that is linked to the physical payment card and/or account. The communication may correspond to a push notification for a mobile application of the system, however, other communication channels may also be used including text messaging, email, operating system (OS) based messaging, and the like. The user may be instructed to place the card in proximity to their mobile smart phone or other computing device. The request or other message may also activate a wireless communication component on the user's device, which may include capabilities to scan, read, and/or activate the microchip. This then allows the microchip to be activated so that the multifactor authentication request can be digitally signed using the cryptographic signing data stored by the card's chip. Once signed or other cryptographic key or PIN is provided back the user's device for the multifactor authentication request, the user's computing device may respond to the payment processing and expense management system to authenticate the user. This may include turning a card-not-present transaction to a card-present transaction by verifying the payment card is in possession of the user having their computing device. Additional confidence factors may be used to further validate the user is properly identified and not fraudulent, including a location, device activity, biometrics, and the like. Thus, the multifactor authentication may provide additional factors to two-factor authentication by using the payment card alone. In other embodiments, the multifactor authentication challenge may be in response to other types of authentication requests. For example, the payment card's microchip may be used with the application on the user's computing device when logging in to the user's account, requesting use of cryptocurrency, or performing other security action using the cryptographic signing data of the card's chip.

FIG.1is a block diagram of a networked system100suitable for implementing the processes described herein, according to an embodiment. As shown, system100may comprise or implement a plurality of devices, servers, and/or software components that operate to perform various methodologies in accordance with the described embodiments. Exemplary devices and servers may include device, stand-alone, and enterprise-class servers, operating an OS such as a MICROSOFT® OS, a UNIX® OS, a LINUX® OS, or another suitable device and/or server-based OS. It can be appreciated that the devices and/or servers illustrated inFIG.1may be deployed in other ways and that the operations performed, and/or the services provided by such devices and/or servers may be combined or separated for a given embodiment and may be performed by a greater number or fewer number of devices and/or servers. One or more devices and/or servers may be operated and/or maintained by the same or different entities.

System100includes a physical card110, a computing device130, and a personal computer150in communication for multifactor authentication, such as over a network170. Physical card110may be used by a user to process transactions in-person or over a network, which may include a card chip120activatable and/or scannable by computing device130for multifactor authentication.

Physical card110may correspond to a physical payment card that may be used to store card data corresponding to financial data used to process transactions. In some embodiments, physical card110may correspond to a standard sized card (e.g., ˜85.×54 mm (3.37×2.125 in)) card having rounded corners) that may include card identifiers112, such as a 16-digit card number or other series of digits and/or alphanumeric codes for payment processing on a card network, and other card data stored on a magnetic stripe114or one or more other storage mechanisms (e.g., EMV chip or the like). Physical card110may also correspond to a key fob or other device that similarly may include a data storage mechanism. In some embodiments, physical card110may be used to facilitate transactions using card identifiers112(e.g., a credit or debit card number, card verification value (CVV), issued user, card processor network identifier, and the like) over one or more networks, such as with digital network exchanges for card-not-present transactions. In additional embodiments, physical card110may be used to process transactions in-person at physical merchant locations by scanning magnetic stripe114or other mechanisms storing card data.

Physical card110includes a card chip120having an antenna122and cryptographic data124. Card chip120may correspond to an EMV chip, Java Smart Card chip, NFC or RFID chip, or the like that may store cryptographic data124for a cryptographic signing function or mechanism to provide a digital signature and/or cryptographic key that may be used to validate the authenticity and/or integrity of a message, such as an authentication message. Cryptographic data124may utilize a cryptographic signing using a mathematical function, such as RSA mechanisms and signatures. Card chip120may be activated and/or read using antenna122, which may correspond to a passive antenna that is activated and powered through short-range wireless communications. However, in other embodiments, card chip120may include a power unit and/or charge, which may be rechargeable and/or utilized for a lifetime of the power unit with antenna122. Cryptographic data124may be initially coded and stored to card chip120at a creation of physical card110and/or card chip120or may be later encoded with data including recoding cryptographic data124when physical card110exchanges ownership. Physical card110and cryptographic data124may be linked to backend data for a user, such as a user's identification, account, and/or mobile smart device/mobile application that allows for multifactor authentication by computing device130signing a message using card chip120when accessing cryptographic data124using antenna122.

Computing device130and/or personal computer150may include one or more processors, memories, and other appropriate components for executing instructions such as program code and/or data stored on one or more computer readable mediums to implement the various applications, data, and steps described herein. For example, such instructions may be stored in one or more computer readable media such as memories or data storage devices internal and/or external to various components of system100and/or accessible over a network.

Computing device130may be implemented using any appropriate hardware and software configured for wired and/or wireless communication with physical card110and/or over a network with a device or server requesting multifactor authentication. In various embodiments, computing device130may be implemented as a personal computer (PC), a smart phone, laptop/tablet computer, wristwatch with appropriate computer hardware resources, other type of wearable computing device, and/or other types of computing devices capable of transmitting and/or receiving data. Although only one computing device is shown, a plurality of computing device may function similarly.

Computing device130ofFIG.1contains an authentication application140, other applications132, a database134, and a communication component136. Authentication application140and other applications132may correspond to executable processes, procedures, and/or applications with associated hardware. In other embodiments, computing device130may include additional or different software as required.

Authentication application140may correspond to one or more processes to execute software modules and associated components of computing device130to perform multifactor authentication using physical card110, which may include processing transactions at a physical merchant location and/or over a network with an online marketplace. In this regard, authentication application140may correspond to specialized hardware and/or software utilized to process a received message or request for multifactor authentication when physical card110is used to process a transaction. In some embodiments, authentication application140may be used to establish the transaction. For example, at a physical merchant location, authentication application140may designate the items for purchase, where physical card110and/or computing device130may provide card data for physical card110to process the transaction. With digital or electronic transactions, authentication application140may designate the items for purchase through the online marketplace for the merchant and provide the card data for transaction processing. In other embodiments, the message or request for multifactor authentication may be received in response to a different event, such as an account login, use of cryptocurrency stored on physical card110, computing device130, or another device, or other authentication event.

In various embodiments, authentication application140may correspond to a general browser application configured to retrieve, present, and communicate information over the Internet (e.g., utilize resources on the World Wide Web) or a private network. For example, authentication application140may provide a web browser, which may send and receive information over one or more networks, including retrieving website information, presenting the website information to the user, and/or communicating information to the website, including payment information for the transaction. However, in other embodiments, authentication application140may include a dedicated application of a service provider, transaction processor, or another entity (e.g., a merchant), which may be configured to assist in processing transactions electronically.

When the event requiring multifactor authentication occurs, authentication application140may receive a message or request that requires a digital signature or cryptographic key from cryptographic data124in card chip120of physical card110. Authentication application140may execute a multifactor authentication process142with the received message, which may then activate a short-range wireless protocol and signaling of communication component136. Multifactor authentication process142may request computing device130and physical card110be brought into proximity, such as touched to a case, interface, or component of computing device130. Multifactor authentication process142may then activate card chip120and utilize cryptographic data124from card chip120using antenna122and the short-range wireless signaling of communication component136. By utilizing cryptographic data124, card chip120may digitally sign the message and receive cryptographic signature data144for the message. Cryptographic signature data144may correspond to a cryptographic signature of the message and may be transmitted to the device or service of the system requesting multifactor authentication (e.g., a payment processing and expense management system). Thereafter, authentication application140may receive authentication results146that indicate whether authentication has been processed and completed, or if it has been refused.

In various embodiments, computing device130includes other applications132as may be desired in particular embodiments to provide features to computing device130. For example, other applications132may include security applications for implementing client-side security features, programmatic client applications for interfacing with appropriate application programming interfaces (APIs) over a network, or other types of applications. Other applications132may also include email, texting, voice and IM applications that allow receipt of multifactor authentication requests. Other applications132may also include other location detection applications, which may be used to determine a location for computing device130and provide the location as additional confidence factors for multifactor authentication.

Computing device130may further include database134which may include, for example, identifiers such as operating system registry entries, cookies associated with authentication application140and/or other applications132, identifiers associated with hardware of computing device130, or other appropriate identifiers. Database134may also further store received transaction data for processed transactions, as well as data used for multifactor authentication, such as a multifactor authentication request or message and cryptographic signature data144.

Computing device130includes at least one communication component136adapted to communicate with physical card110and/or over a network. In various embodiments, communication component136may include a DSL (e.g., Digital Subscriber Line) modem, a PSTN (Public Switched Telephone Network) modem, an Ethernet device, a broadband device, a satellite device and/or various other types of wired and/or wireless network communication devices. Short-range communication by communication component136may be facilitated using a microwave, radio frequency, infrared, Bluetooth, near field communication devices, and the like.

Personal computer150may be implemented using any appropriate hardware and software configured for wired and/or wireless communication with physical card110and/or personal computer150over a network170during a multifactor authentication. In various embodiments, personal computer150may be implemented as a personal computer (PC), a smart phone, laptop/tablet computer, wristwatch with appropriate computer hardware resources, other type of wearable computing device, and/or other types of computing devices capable of transmitting and/or receiving data. Although only one computing device is shown, a plurality of computing device may function similarly.

Personal computer150ofFIG.1contains browser application160and a network interface component152. Browser application160may correspond to executable processes, procedures, and/or applications with associated hardware. In other embodiments, personal computer150may include additional or different software as required.

Browser application160may correspond to one or more processes to execute software modules and associated components of personal computer150to perform multifactor authentication using physical card110, which may include processing transactions at a physical merchant location and/or over a network with an online marketplace. In this regard, browser application160may correspond to specialized hardware and/or software that may be used to log in to a device associated with a service provider for physical card110. For example, browser application160may be used to log in to a dashboard associated with a service provider. Computing device130may present, through an additional wireless medium (e.g. Bluetooth antenna of the like), which may be distinct from an NFC or RFID antenna, as a WebAuthN (webauthn.io) authenticator (e.g. Yubikey), that it has a cryptographic ‘enclave’ associated with card chip120.

Thereafter, when a user logs in to a service provider's website or application, such as through browser application160to the service provider associated with physical card110, the service provider may receive the user's login name or other identifier. The service provider may pull from a backend database to identify the user and card chip120associated with that user (e.g., from their login name or other identifier). Browser application160may initiate an authentication protocol, such as the WebAuthN protocol, for authentication during the login attempt. Browser application160may view that the available WebAuthN authenticator or other authentication protocol is available, such as if computing device130is available or presenting over Bluetooth. Browser application160may then initiates WebAuthN protocol or other authentication protocol and prompt a user to enter a PIN via computing device130. This may then unlock card chip120when physical card110is in proximity to computing device130. Unlocking card chip120may enable signing operations, which then returning the signed result back over computing device130to browser application160. Browser application160then may complete the authentication and the user may then login, such as without a password or foregoing additional authentication. This may occur over short range communications or over network170.

Thus, a mobile application, such as authentication application140, may serve as the engagement between physical card110and personal computer150, for example, via NFC and/or Bluetooth communications. When the required protocol is initiated (e.g., CTAP2 for WebAuthN), authentication application140may request enter of a PIN, biometric, or other authentication information to computing device130. Further, authentication application140may request scanning, entry, or other reading of physical card110, such as by reading card chip120. Further entry of additional authentication information, such as a PIN, may validate that physical card110and computing device130are in proximity and therefore can digitally sign information.

Personal computer150includes at least one network interface component152adapted to communicate with physical card110and/or computing device130over a network170. In various embodiments, network interface component152may include a DSL (e.g., Digital Subscriber Line) modem, a PSTN (Public Switched Telephone Network) modem, an Ethernet device, a broadband device, a satellite device and/or various other types of wired and/or wireless network communication devices. Short-range communication by network interface component152may be facilitated using a microwave, radio frequency, infrared, Bluetooth, near field communication devices, and the like.

System100may further include a network170, which may be implemented as a single network or a combination of multiple networks. Network170may be used by computing device130for communication with a backend server of a payment processing and/or expense management system for multifactor authentication. For example, in various embodiments, network170may include the Internet or one or more intranets, landline networks, wireless networks, and/or other appropriate types of networks. Thus, network170may correspond to small scale communication networks, such as a private or local area network, or a larger scale network, such as a wide area network or the Internet, accessible by the various components of system100.

FIG.2is an exemplary physical payment card200having an embedded microchip for cryptographically signing multifactor authentication requests, according to an embodiment. Physical payment card200ofFIG.2includes identifiers, data, and components for interacting with computing device130, discussed in reference to system100ofFIG.1, for multifactor authentication.

In this regard, physical payment card200includes identifiers on one or more surfaces of the card, as well as microchips and/or storage devices for storing encoded data and/or cryptographically signing requests for multifactor authentication. For example, identifier written, designed on, and/or embossed into a card surface may include a transaction service provider202, an account type204, a name206, an account identifier208, and/or a card network210. Each of these identifiers may be utilized when establishing the card and/or utilizing the card including for card-not-present transactions. For example, at least name206and/or account identifier208may be required to be entered on a checkout webpage when processing a transaction. In some embodiments, a CVV value may also be placed on a reverse side of physical payment card200, which also may be required, as well as other data not placed on physical payment card200(e.g., a billing address or the like). Further, when performing card-present transactions, such as at a merchant location, an EMV chip and/or magnetic strip214may be read by a card reader and/or scanner, such as one incorporated in or linked to a POS device. This may allow for fast and more secure transfer of card data, which may include data for a payment processing gateway selection.

When performing a transaction or another authentication linked with physical payment card200, a multifactor authentication may be required. Thus, a smart card chip216may further be embedded or enclosed within physical payment card200. Smart card chip216may correspond to a Java Card chip or the like that may utilize an integrated circuit with a contact or contactless smart card design to communicate with card readers, mobile smart phones, and the like. Smart card chip216may include contact points to provide electrical connectivity to the integrated circuit or may utilize a passive antenna and design (e.g., a loop antenna coil) to capture a wireless signal. This may allow smart card chip216to be powered and thereafter execute instructions programmed and/or encoded to smart card chip216. These instructions, when executed, may perform processes to digitally sign messages from another device, such as a mobile smart phone, using a cryptographic function or message.

In some embodiments, physical payment card200may further be usable and/or connectable to a physical and/or protective case of a computing device, such as a protective phone cover or case or a mobile smart phone. The protective case may include a slot for physical payment card200so that short-range wireless communication components of the computing device (e.g., the mobile smart phone) may activate and/or interact with smart card chip216for multifactor authentication. In other embodiments, the protective case may include and/or provide wired and/or wireless communication components to activate and/or interact with smart card chip216using an embedded antenna and circuitry components in order to provide multifactor authentication processes.

FIG.3is a flowchart300for multifactor authentication through cryptography-enabled smart cards, according to an embodiment. Note that one or more steps, processes, and methods described herein of flowchart300may be omitted, performed in a different sequence, or combined as desired or appropriate.

At step302of flowchart300, an authentication request for an account linked to a physical payment card is received. This authentication request may be received for a use of the physical payment card and/or funds linked the physical payment card, or for access and/or use of the account. Once received, a multifactor authentication request is sent to a computing device associated with the account, at step304. The multifactor authentication request may ask the user to provide that the user is in possession of the physical payment card by bringing the physical payment card into proximity of the computing device that is trusted, such as a known mobile smart phone registered and/or linked to the card and/or account.

At step306, a short-range wireless signaling component on the computing device is activated. The multifactor authentication request may include a message, code, or an operation to alert a user of the computing device to scan or read the physical payment card using a short-range communication component of the computing device. The request itself may activate the short-range wireless signaling component or the user may be requested to activate a component for scanning. At step308, a local chip antenna on the physical payment card is then scanned using the short-range wireless signaling component. Scanning of the chip's antenna may include activating the antenna using power transferred through the wireless signaling, such as by activating a passive antenna that allows the chip to exchange data with the computing device.

At step310, a cryptographic signature from the physical payment cared is determined by scanning the local chip antenna. This may include reading cryptographic data from the chip and/or requesting that the chip digitally sign the multifactor authentication request. The cryptographic signature may be generated and/or provided using a cryptographic signing algorithm or function that is particular to the card and provided on the card during creation of the card and/or chip. At step312, an authentication is negotiated for the authentication request based on the cryptographic signature. This may include verifying that the cryptographic signature properly authenticates that the card and computing device are in proximity and correspond to the account and/or user. Thus, an authentication decision is determined at step314. If refused, at step316, flowchart300refuses authentication of a use of the account, which may provide increased security to transaction utilizing the card and/or account. However, if authentication is successful, at step318, a use of the account is authenticated through a multifactor authentication, thereby further securing the use of the account.

FIG.4is a block diagram of a computer system suitable for implementing one or more components inFIG.1, according to an embodiment. In various embodiments, the communication device may comprise a personal computing device (e.g., smart phone, a computing tablet, a personal computer, laptop, a wearable computing device such as glasses or a watch, Bluetooth device, key FOB, badge, etc.) capable of communicating with the network. The service provider may utilize a network computing device (e.g., a network server) capable of communicating with the network. It should be appreciated that each of the devices utilized by users and service providers may be implemented as computer system400in a manner as follows.

Computer system400includes a bus402or other communication mechanism for communicating information data, signals, and information between various components of computer system400. Components include an input/output (I/O) component404that processes a user action, such as selecting keys from a keypad/keyboard, selecting one or more buttons, image, or links, and/or moving one or more images, etc., and sends a corresponding signal to bus402. I/O component404may also include an output component, such as a display411and a cursor control413(such as a keyboard, keypad, mouse, etc.). An optional audio input/output component405may also be included to allow a user to use voice for inputting information by converting audio signals. Audio I/O component405may allow the user to hear audio. A transceiver or network interface406transmits and receives signals between computer system400and other devices, such as another communication device, service device, or a service provider server via network170. In one embodiment, the transmission is wireless, although other transmission mediums and methods may also be suitable. One or more processors412, which can be a micro-controller, digital signal processor (DSP), or other processing component, processes these various signals, such as for display on computer system400or transmission to other devices via a communication link418. Processor(s)412may also control transmission of information, such as cookies or IP addresses, to other devices.

Components of computer system400also include a system memory component414(e.g., RAM), a static storage component416(e.g., ROM), and/or a disk drive417. Computer system400performs specific operations by processor(s)412and other components by executing one or more sequences of instructions contained in system memory component414. Logic may be encoded in a computer readable medium, which may refer to any medium that participates in providing instructions to processor(s)412for execution. Such a medium may take many forms, including but not limited to, non-volatile media, volatile media, and transmission media. In various embodiments, non-volatile media includes optical or magnetic disks, volatile media includes dynamic memory, such as system memory component414, and transmission media includes coaxial cables, copper wire, and fiber optics, including wires that comprise bus402. In one embodiment, the logic is encoded in non-transitory computer readable medium. In one example, transmission media may take the form of acoustic or light waves, such as those generated during radio wave, optical, and infrared data communications.

Some common forms of computer readable media includes, for example, floppy disk, flexible disk, hard disk, magnetic tape, any other magnetic medium, CD-ROM, any other optical medium, punch cards, paper tape, any other physical medium with patterns of holes, RAM, PROM, EEPROM, FLASH-EEPROM, any other memory chip or cartridge, or any other medium from which a computer is adapted to read.

In various embodiments of the present disclosure, execution of instruction sequences to practice the present disclosure may be performed by computer system400. In various other embodiments of the present disclosure, a plurality of computer systems400coupled by communication link418to the network (e.g., such as a LAN, WLAN, PTSN, and/or various other wired or wireless networks, including telecommunications, mobile, and cellular phone networks) may perform instruction sequences to practice the present disclosure in coordination with one another.

Where applicable, various embodiments provided by the present disclosure may be implemented using hardware, software, or combinations of hardware and software. Also, where applicable, the various hardware components and/or software components set forth herein may be combined into composite components comprising software, hardware, and/or both without departing from the spirit of the present disclosure. Where applicable, the various hardware components and/or software components set forth herein may be separated into sub-components comprising software, hardware, or both without departing from the scope of the present disclosure. In addition, where applicable, it is contemplated that software components may be implemented as hardware components and vice-versa.

Software, in accordance with the present disclosure, such as program code and/or data, may be stored on one or more computer readable mediums. It is also contemplated that software identified herein may be implemented using one or more general purpose or specific purpose computers and/or computer systems, networked and/or otherwise. Where applicable, the ordering of various steps described herein may be changed, combined into composite steps, and/or separated into sub-steps to provide features described herein.

The foregoing disclosure is not intended to limit the present disclosure to the precise forms or particular fields of use disclosed. As such, it is contemplated that various alternate embodiments and/or modifications to the present disclosure, whether explicitly described or implied herein, are possible in light of the disclosure. Having thus described embodiments of the present disclosure, persons of ordinary skill in the art will recognize that changes may be made in form and detail without departing from the scope of the present disclosure. Thus, the present disclosure is limited only by the claims.