Method and system for provisioning access data to mobile device

Patent metadata

Field	Value
Publication number	US-10959093-B2
Application number	US-201514935091-A
Country	US
Kind code	B2
Filing date	Nov 6, 2015
Priority date	May 8, 2014
Publication date	Mar 23, 2021
Grant date	Mar 23, 2021

Abstract

A method and system for provisioning access data in a second application on a mobile device using a first application on the mobile device. Authentication data may be input into the first application, and an authentication code may be requested from a remote server. The authentication code may include access data to be provisioned, in encrypted form. After the authentication code is received by the first application in the mobile device, it can pass the authentication code to a second application that initiates an access data provisioning process.

First claim

What is claimed is:

1. A method comprising:
receiving, by a validation entity computer, an authentication code comprising an encrypted portion comprising access data, a date and time when the authentication code was generated and when a user was authenticated by an authorization computer system, from the authorization computer system via a first application and a second application on a mobile device, and via a wallet server, after the authorization computer system authenticates the user using the first application in the mobile device;
decrypting, by the validation entity computer, the encrypted portion of the authentication code to obtain the access data, and the date and time when the authentication code was generated;
validating, by the validation entity computer, the authentication code by determining that a time between the date and time when the authentication code was generated and a date and time when the authentication code is received by the validation entity computer is within a predetermined time period; and
initiating, by the validation entity computer, provisioning the access data obtained from the authentication code to the mobile device by sending a message to a provisioning server computer, which transmits the access data to the second application on the mobile device.

2. The method of claim 1 , wherein the authentication code includes a non-encrypted information component, the non-encrypted information component including information used to decrypt the encrypted portion.

3. The method of claim 1 , wherein receiving the authentication code comprises receiving the authentication code from the authorization computer system, after the authorization computer system authenticates the user.

4. The method of claim 1 , wherein the access data comprises a token.

5. The method of claim 1 , wherein the access data comprises a primary account number and a CVV value.

6. The method of claim 1 , wherein the mobile device is a wearable device.

7. The method of claim 1 , wherein the access data comprises a payment token.

8. The method of claim 1 , wherein the mobile device is a mobile phone.

9. The method of claim 1 , wherein the first application is a banking application and the second application is a merchant application.

10. The method of claim 1 , wherein the encrypted portion comprises, in encrypted form, a primary account number and CVV or CVV2 value associated with the primary account number.

11. The method of claim 10 , wherein the encrypted portion further comprises a device identifier for the mobile device.

12. The method of claim 1 , further comprising:
receiving the access data from the second application of the mobile device; and
initiating an authorization process which authorizes or declines access to the mobile device based upon the access data.

13. The method of claim 12 , wherein initiating the authorization process comprising transmitting an authorization request message to the authorization computer system, which authorizes or declines access using the access data in the authorization request message, wherein the authorization computer system is an issuer computer system.

14. The method of claim 1 , wherein the encrypted portion of the authentication code further comprises device specification information about the mobile device, the device specific information being in the form of a digital signature.

15. A system comprising:
a validation entity computer comprising
a processor, and
a non-transitory computer readable medium coupled to the processor, the non-transitory computer readable medium comprising code, executable by the processor, for implementing a method comprising
receiving an authentication code comprising an encrypted portion comprising access data, a date and time when the authentication code was generated and when a user was authenticated by an authorization computer system, from the authorization computer system via a first application and a second application on a mobile device, and via a wallet server, after the authorization computer system authenticates the user using the first application on the mobile device,
decrypting the encrypted portion of the authentication code to obtain the access data, and the date and time when the authentication code was generated,
validating the authentication code by determining that a time between the date and time when the authentication code was generated and a date and time when the authentication code is received by the validation entity computer is within a predetermined time period, and
initiating provisioning the access data obtained from the authentication code to the mobile device by sending a message to a provisioning server computer, which transmits the access data to the second application on the mobile device;
the mobile device; and
the wallet server.

16. The system of claim 15 , wherein the authentication code includes a non-encrypted information component, the non-encrypted information component including information used to decrypt the encrypted portion.

17. The system of claim 15 , wherein the access data comprises a token.

18. The system of claim 15 , wherein the access data comprises a primary account number and a CVV value.

19. The system of claim 15 , wherein the non-transitory computer readable medium comprises a settlement module comprising code for settling transactions and an authorization module comprising code for authorizing transactions.

20. The system of claim 15 , further comprising: the authorization computer system configured to generate the authentication code and send the authentication code to the validation entity computer.

21. The system of claim 20 , further comprising: the provisioning server computer configured to receive the access data from the validation entity computer and provision the access data to the mobile device.

22. The system of claim 21 , wherein the mobile device is a mobile phone.

Assignees

• Visa Int Service Ass

Inventors

• Powell Glenn
• Sheets John F
• Wagner Kim R

Classifications

• G06Q20/405

  Establishing or using transaction specific rules · CPC title

• H04W12/35

  Protecting application or service provisioning, e.g. securing SIM application provisioning · CPC title

• H04W12/068

  using credential vaults, e.g. password manager applications or one time password [OTP] applications · CPC title

• H04W12/04

  Key management, e.g. using generic bootstrapping architecture [GBA] · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title