Enhancements to transaction processing in a secure environment using a merchant computer

Patent metadata

Field	Value
Publication number	US-10909539-B2
Application number	US-201414527652-A
Country	US
Kind code	B2
Filing date	Oct 29, 2014
Priority date	Oct 29, 2013
Publication date	Feb 2, 2021
Grant date	Feb 2, 2021

Abstract

Embodiments of the present invention are directed to methods, systems, and apparatuses for performing a secure authentication process to authenticate a payment device used in a transaction between a merchant and a user. The secure authentication process may receive an authentication request message including user data, user computing device data and transaction data to verify that an account is enrolled in the secure authentication process and perform a risk analysis to determine whether the transaction should be authenticated.

First claim

What is claimed is:

1. A method comprising:
receiving, by an access control server computer, an authentication request message from a merchant computer for a payment device used in a transaction between a user and a merchant associated with the merchant computer, the authentication request message including user data, user computing device data associated with a user computing device used in the transaction including a unique device identifier, and transaction data for the transaction;
determining, by the access control server computer, that the payment device is enrolled in an authentication program based at least in part on the user computing device data;
receiving, by the access control server computer and from a directory server computer, data identifying previous authentication processes of an authentication program that is associated with the user computing device, the data identifying previous authentication processes retrieved from an authentication history server in response to a query by the directory server computer, the previous authentication processes comprising previous challenge request messages and previous challenge response messages associated with the user computing device that correspond to previous transactions and that involve the use of a particular secure data element, the particular secure data element associated with the previous transactions;
performing, by the access control server computer, a risk analysis using the user data, the user computing device data, the transaction data received in the authentication request message, and the data identifying previous authentication processes to compute a risk score based at least in part in determining that authentication is available for the transaction, the data identifying previous authentication processes including information indicating a type of the particular secure data element, a result of a matching between the particular secure data element and a stored data element, the stored data element stored in the directory server computer, and a number of attempts to authenticate utilizing the particular secure data element during the previous authentication processes;
transmitting, by the access control server computer and to the merchant computer, an indication that a challenge process that includes a challenge request message is required based at least in part on the risk score and a threshold associated with the transaction;
receiving, by the access control server computer and from the user computing device, a request for the challenge request message via a web address provided by the merchant computer to the user computing device in response to the indication;
transmitting, by the access control server computer and to the user computing device, the challenge request message in response to the user computing device being redirected to the access control server computer via the web address included in a modified authentication response message transmitted to the user computing device by the merchant computer;
receiving, by the access control server computer and from the user computing device, a challenge response message that corresponds to the challenge request message, the challenge response message including the particular secure data element;
evaluating, by the access control server computer, the particular secure data element against the stored data element to determine if the particular secure data element matches within a certain range of the stored data element;
provisioning, by the access control server computer and to the merchant computer, a verification value in the authentication response message in response to receiving the challenge response message and evaluating the particular secure data element, the merchant computer configured to use the verification value in generating an authorization request message for the transaction;
receiving, by the access control server computer and from the merchant computer, the authorization request message for the transaction, the authorization request message including the verification value;
determining, by the access control server computer, to authorize the transaction based at least in part on the authorization request message and the verification value; and
transmitting, by the access control server computer and to the merchant computer, an authorization response message authorizing the transaction.

2. The method of claim 1 , wherein the authentication request message is generated by the merchant computer.

3. The method of claim 1 , wherein performing the risk analysis further comprises using the previous transactions associated with the payment device to compute the risk score.

4. The method of claim 1 , wherein the challenge response message includes the particular secure data element, the particular secure data element including one or more of a password or a token.

5. The method of claim 1 , wherein determining that authentication is available for the transaction further comprises:
determining, by the access control server computer, that a bank identification number associated with the payment device is within a bank identification number range provided by an issuer computer.

6. The method of claim 1 , wherein the authentication request message is generated by an application stored on the user computing device.

7. The method of claim 1 , wherein the transaction is a purchase transaction.

8. The method of claim 1 , wherein the verification value is sent from the merchant computer to a payment processing server computer as part of an authorization process for the transaction.

9. An access control server computer comprising:
a processor; and
a tangible non-transitory computer readable medium coupled to the processor, the tangible non-transitory computer readable medium comprising code, executable by the processor for implementing a method comprising:
receiving an authentication request message from a merchant computer for a payment device used in a transaction between a user and a merchant associated with the merchant computer, the authentication request message including user data, user computing device data associated with a user computing device used in the transaction including a unique device identifier, and transaction data for the transaction;
determining that the payment device is enrolled in an authentication program based at least in part on the user computing device data;
receiving, from a directory server computer, data identifying previous authentication processes of an authentication program that is associated with the user computing device, the data identifying previous authentication processes retrieved from an authentication history server in response to a query by the directory server computer, the previous authentication processes comprising previous challenge request messages and previous challenge response messages associated with the user computing device that correspond to previous transactions and that involve the use of a particular secure data element, the particular secure data element associated with the previous transactions;
performing a risk analysis using the user data, the user computing device data, the transaction data received in the authentication request message, and the data identifying previous authentication processes to compute a risk score based at least in part on determining that the payment device is enrolled in the authentication program, the data identifying previous authentication processes including information indicating a type of the particular secure data element, a result of a matching between the particular secure data element and a stored data element, the stored data element stored in the directory server computer, and a number of attempts to

Assignees

• Visa Int Service Ass

Inventors

• Fisher Douglas
• Newland Karl
• Wright Patrick
• Wong Kevin
• Brownlee Christopher

Classifications

• G06Q20/34

  using cards, e.g. integrated circuit [IC] cards or magnetic cards · CPC title

• G06Q20/425

  using two different networks, one for transaction and one for security confirmation · CPC title

• G06Q20/4012

  Verifying personal identification numbers [PIN] · CPC title

• G06Q20/405

  Establishing or using transaction specific rules · CPC title

• G06Q20/40145

  Biometric identity checks · CPC title