Efficient and secure authentication system

Patent metadata

Field	Value
Publication number	US-12301580-B2
Application number	US-202217947759-A
Country	US
Kind code	B2
Filing date	Sep 19, 2022
Priority date	Apr 24, 2018
Publication date	May 13, 2025
Grant date	May 13, 2025

Abstract

An authentication request message from a user conducting an interaction at a resource provider computer is received. It is determined that data representing an indication that the resource provider is trusted by the user and including a trusted marker is present in a database. Authentication to the user is provided, and information indicating that the user has been authenticated and the trusted marker are sent so that authorization request message for the interaction that includes the trusted marker is generated. The trusted marker is validated, and the authorization request message including information related to the interaction and the validated trusted marker is sent to an authorizing entity computer.

First claim

What is claimed is:

1. A method comprising:
receiving, by a directory server computer, an authentication request message from a user conducting an interaction at a resource provider computer operated by a resource provider;
determining, by the directory server computer, that data representing an indication that the resource provider is trusted by the user is present in a database, the data comprising a trusted marker;
in response to the determining that the data comprising the trusted marker is present, providing, by the directory server computer, an authentication to the user with respect to the interaction;
sending, by the directory server computer to the resource provider computer, information indicating that the user has been authenticated and the trusted marker;
receiving, by a processing computer, an authorization request message for the interaction from the resource provider computer, the authorization request message comprising the trusted marker received by the resource provider computer from the directory server computer;
validating, by the processing computer, the trusted marker; and
sending, by the processing computer, the authorization request message comprising information related to the interaction and the validated trusted marker to an authorizing entity computer.

2. The method of claim 1 , further comprising:
prior to the receiving the authentication request message, receiving, by the directory server computer, the indication that the resource provider is trusted by the user;
providing, by the directory server computer, a first level of authentication to the user; and
storing, by the directory server computer in the database, the data representing the indication that the resource provider is trusted, wherein the first level of authentication is provided to the user before the storing of the data,
wherein the providing the authentication to the user further comprises providing a second level of authentication that is lower than the first level of authentication before the user is allowed to complete the interaction.

3. The method of claim 2 , wherein the second level of authentication is no authentication.

4. The method of claim 2 , wherein the providing the first level of authentication comprises initiating an authentication process, during which the user is requested to input a password.

5. The method of claim 2 , wherein:
the providing the first level of authentication comprises requesting the user to input a password, and
the providing the second level of authentication further comprises:
collecting device data of a device operated by the user, and
authenticating the user based on the device data.

6. The method of claim 1 , wherein the resource provider computer stores an account identifier for an account of the user.

7. The method of claim 6 , wherein the interaction is a stored credential transaction.

8. The method of claim 1 , wherein the authentication request message includes a resource provider identifier of the resource provider and a verification value of the user.

9. The method of claim 1 , wherein the indication that the resource provider is trusted is received from the resource provider computer.

10. The method of claim 1 , wherein the indication that the resource provider is trusted is received from the authorizing entity computer.

11. A directory server computer comprising:
a processor; and
a computer-readable medium, coupled to the processor, the computer-readable medium comprising code which, when executed by the processor, causes the processor to perform a method including:
receiving an authentication request message from a user conducting an interaction at a resource provider computer operated by a resource provider;
determining that data representing an indication that the resource provider is trusted by the user is present in a database, the data comprising a trusted marker;
in response to the determining that the data comprising the trusted marker is present, providing an authentication to the user with respect to the interaction; and
sending, to the resource provider computer, information indicating that the user has been authenticated and the trusted marker,

wherein:
the resource provider computer sends, to a processing computer, an authorization request message for the interaction, the authorization request message comprising the trusted marker received by the resource provider computer from the directory server computer, and
the processing computer validates the trusted marker, and sends the authorization request message comprising information related to the interaction and the validated trusted marker to an authorizing entity computer.

12. The directory server computer of claim 11 , wherein the resource provider computer stores an account identifier for an account of the user.

13. The directory server computer of claim 12 , wherein the interaction is a stored credential transaction.

14. The directory server computer of claim 12 , wherein the method further includes:
prior to the receiving the authentication request message, receiving the indication that the resource provider is trusted by the user;
providing a first level of authentication to the user; and
storing the data representing the indication that the resource provider is trusted in the database, wherein the first level of authentication is provided before the storing of the data,
wherein the providing the authentication to the user further includes providing a second level of authentication that is lower than the first level of authentication before the user is allowed to complete the interaction.

15. The directory server computer of claim 14 , wherein the second level of authentication is no authentication.

16. The directory server computer of claim 14 , wherein the providing the first level of authentication includes initiating an authentication process during which the user is requested to input a password.

17. The directory server computer of claim 11 , wherein the authentication request message includes a resource provider identifier of the resource provider and a verification value of the user.

18. The directory server computer of claim 11 , wherein the indication that the resource provider is trusted is received from the resource provider computer.

19. The directory server computer of claim 11 , wherein the indication that the resource provider is trusted is received from the authorizing entity computer.

20. A system comprising:
a directory server computer comprising a first processor and a first computer-readable medium comprising code which, when executed by the first processor, causes the first processor to perform operations including:
receiving an authentication request message from a user conducting an interaction at a resource provider computer operated by a resource provider;
determining that data representing an indication that the resource provider is trusted by the user is present in a database, the data comprising a trusted marker;
in response to the determining that the data comprising the trusted marker is present, providing an authentication to the user with respect to the interaction; and
sending, to the resource provider computer, information indicating that the user has been authenticated and the trusted marker; and

a processing computer comprising a second processor and a second computer-readable medium comprising code which, when executed by the second processor, causes the second processor to perform operations including:
receiving an auth

Assignees

• Visa Int Service Ass

Inventors

• Nelsen Mark
• Wilson David William
• Mangiagalli Guido
• Surin Anjana Neera
• Mohammed Sayeed
• Johnson Alan
• Lavender Phillip
• Powell Glenn

Classifications

• H04L2463/082

  applying multi-factor authentication · CPC title

• H04L63/083

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• G06Q20/40

  Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists · CPC title

• G06F2221/2113

  Multi-level security, e.g. mandatory access control · CPC title

• G06F21/31

  User authentication · CPC title