System and method for authentication using payment protocol

Patent metadata

Field	Value
Publication number	US-10977646-B2
Application number	US-201715622698-A
Country	US
Kind code	B2
Filing date	Jun 14, 2017
Priority date	May 8, 2012
Publication date	Apr 13, 2021
Grant date	Apr 13, 2021

Abstract

Methods, systems, and devices are disclosed for using a payment processing network as an authorization engine to access secure physical areas, such as college dormitories, office buildings. A keycard with a cryptogram generator is presented by a user to an access device, and the access device or associated computer sends an access request message formatted like a payment authentication request message to an aggregator/acquirer and payment processing network. The payment processing network validates the cryptogram and returns an access response message, again formatted like a payment authorization response message, indicating that the keycard is authentic. The gate, door, turnstile, or other barrier is then temporarily unlocked to let the user through.

First claim

What is claimed is:

1. A computer-implemented method comprising:
receiving from an access terminal, by one or more server computers in a payment processing network, an access request message comprising authentication data having a format of a payment authorization request message for a payment transaction, the format being syntactically correct for the payment processing network;
determining, by the one or more server computers, that the authentication data is associated with a user that wants access associated with the access terminal by at least:
extracting a bank identification number (BIN) from the authentication data; and
mapping the BIN to a plurality of BINs maintained in a predefined lookup table, the plurality of BINs including a subset of BINs associated with third party aggregators, the third party aggregators maintaining a mapping of the authentication data to user credentials associated with the access request message;

suppressing, by the one or more server computers in the payment processing network, routing of the access request message to an issuer computer based on the determination that the authentication data is associated with the user that wants access associated with the access terminal, the bank identification number (BIN) is associated with a third party aggregator of the third party aggregators, and that the access request message is free of a transaction amount; and
transmitting, by the one or more server computers to the access terminal, an access response message enabling access associated with the access terminal to the user.

2. The computer-implemented method of claim 1 wherein the authentication data includes:
an account identifier of the user.

3. The computer-implemented method of claim 2 wherein the account identifier comprises a primary account number (PAN).

4. The computer-implemented method of claim 2 wherein the authentication data includes one or more of:
a client identifier;
a client transaction identifier;
a primary account number (PAN) as the account identifier;
a card sequence number;
an expiration date; and/or
an indicator for track 2 data.

5. The computer-implemented method of claim 1 wherein the authentication data is from a portable consumer device read by the access terminal.

6. The computer-implemented method of claim 5 wherein the authentication data from the portable consumer device includes a first cryptogram, the method further comprising:
calculating, at the one or more server computers, a second cryptogram; and
comparing the first cryptogram to the second cryptogram to authenticate the portable consumer device, wherein the access response message is based on the comparison.

7. The computer-implemented method of claim 5 wherein the portable consumer device is selected from the group consisting of a plastic card with an ID-1 size conforming to International Standards Organization (ISO)/International Electrotechnical Commission (IEC) standard 7810, a key fob, and a mobile phone.

8. The computer-implemented method of claim 1 , wherein the access terminal is associated with a location that the user wants to access.

9. The computer-implemented method of claim 1 further comprising:
receiving, by the one or more server computers in the payment processing network, a second payment authorization request message;
ascertaining, at the one or more server computers, that the second payment authorization request message is for the payment transaction, the ascertaining based on content of the second payment authorization request message;
forwarding the second payment authorization request message to the issuer based in part on the ascertaining;
receiving, at the one or more server computers, a payment authorization response message from the issuer in response to the second payment authorization request message; and
forwarding, by the one or more server computers, the payment authorization response message.

10. A computerized system in a payment processing network, comprising:
one or more processors; and
memory including instructions that, when executed by the one or more processors, cause the one or more processors to at least:
receive from an access terminal an access request message comprising authentication data having a format of a payment authorization request message for a payment transaction, the format being syntactically correct for the payment processing network;
determine that the authentication data is associated with a user that wants access associated with the access terminal by at least:
extracting a bank identification number (BIN) from the authentication data; and
mapping the BIN to a plurality of BINs maintained in a predefined lookup table, the plurality of BINs including a subset of BINs associated with third party aggregators, the third party aggregators maintaining a mapping of the authentication data to user credentials associated with the access request message;

suppress routing of the access request message to an issuer based on the determination that the authentication data is associated with the user that wants access associated with the access terminal, the bank identification number (BIN) is associated with a third party aggregator of the third party aggregators, and that the access request message is free of a transaction amount; and
transmit to the access terminal an access response message enabling access associated with the access terminal to the user.

11. The computerized system of claim 10 , wherein the access terminal is configured to format the authentication data to the format of the payment authorization request message for the payment transaction.

12. The computerized system of claim 10 , wherein the payment processing network is configured to process credit and debit cards.

13. The computerized system of claim 10 , wherein the authentication data is obtained from a portable consumer device.

14. The computerized system of claim 13 , wherein the portable consumer device comprises an authentication identifier element and a payment identifier element.

15. The computerized system of claim 13 , wherein the access terminal is further configured to:
address a first application identifier (AID) on the portable consumer device for the access request message; and
address a second AID on the portable consumer device for a second payment authorization request message.

16. The computerized system of claim 10 , wherein the authentication data comprises a CVV.

17. The computerized system of claim 10 , wherein the computerized system is further configured to:
receive a second payment authorization request message having a second account identifier from a second portable consumer device;
forward the second payment authorization request message to the issuer;
receive a second payment authorization response message in response to the second payment authorization request message; and
complete a transaction associated with the second payment authorization request message.

18. The computerized system of claim 17 , wherein the second payment authorization request message has a third cryptogram and the computerized system in the payment processing network is further configured to:
calculate a fourth cryptogram based on a locally stored sequence number;
compare the third and fourth cryptograms; and
modify the second payment authorization response message based on the comparison of the third and fourth cryptograms.

Assignees

• Visa Int Service Ass

Inventors

• O'Connell Craig
• Wong Kevin E
• Hilgers Nancy
• Nelsen Mark

Classifications

• G06Q20/4014 Primary

  Identity check for transactions · CPC title

• G07C9/27

  with central registration · CPC title

• G07C9/00571

  operated by interacting with a central unit · CPC title

• G06Q20/3821 Primary

  Electronic credentials · CPC title

• G06Q20/409

  Device specific authentication in transaction processing · CPC title