Techniques for performing authentication in ecommerce transactions

Patent metadata

Field	Value
Publication number	US-12437279-B2
Application number	US-202117341516-A
Country	US
Kind code	B2
Filing date	Jun 8, 2021
Priority date	Jun 30, 2020
Publication date	Oct 7, 2025
Grant date	Oct 7, 2025

Abstract

The present invention provides a technical solution by which a consumer can be successfully authenticated in the scenario where the payment card or payment token provided by the consumer in an e-commerce/card not present transaction does not correspond to the payment account that is to provide the funds for effecting payment. This technical solution advantageously ensures that authentication security is not compromised whilst also enabling the consumer to enjoy the increased flexibility that comes with funding a transaction using a payment account that is not associated with the payment card/token provided by the consumer. Additionally, the present invention requires relatively little change to the configuration of the computing devices that collectively function to enable the transaction to take place (e.g. payment network computing devices, merchant computing devices, access control servers (ACS)).

First claim

The invention claimed is:

1. A computer-implemented method for authenticating a transaction using a preferred payment card for a consumer which is different to a first card which the consumer has entered details of into an e-commerce platform, comprising:
receiving, by a payment network server from a first access control server, ACS, a first message comprising a request to identify the preferred payment card, the request including details of the first card, wherein the first ACS is associated with an issuer of the first card, the first card is associated with a first payment account, and the preferred payment card is associated with a preferred payment account that is different than the first payment account;
performing a lookup operation, by the payment network server, using the details of the first card;
identifying, by the payment network server from the lookup operation, details of the preferred payment card;
transmitting, by the payment network server to the first ACS, a second message comprising details of the preferred payment card;
transmitting, by the first ACS, the second message directly to a second ACS for processing, wherein the second ACS is associated with an issuer of the preferred payment card;
receiving, by the payment network server from a merchant acquirer server, an authorisation request, wherein the authorisation request includes an authentication response from the second ACS; and
transmitting, by the payment network server to the issuer of the preferred payment card, the authorisation request.

2. The computer-implemented method of claim 1 , wherein the authentication response from the second ACS further includes a step up authentication response in the case where the second ACS has determined that step up authentication is required.

3. The computer-implemented method of claim 2 , wherein the authentication response comprises a cryptogram.

4. The computer-implemented method of claim 3 , wherein the cryptogram results from the second ACS and the consumer performing any strong customer authentication, SCA.

5. The computer-implemented method of claim 4 , wherein the second message further comprises a preferred primary account number, PPAN.

6. The computer-implemented method of claim 5 , wherein the second message further comprises a preferred primary account number, PPAN, further comprising:
extracting, by the payment network server, the FPAN or DPAN from the first message; and
obtaining, by the payment network server, a corresponding PPAN by performing a lookup operation using the FPAN or DPAN.

7. The computer-implemented method of claim 4 , further comprising:
implementing, by a directory server, a directory service comprising:
receiving, by the directory server from an e-commerce merchant server, the first message; and
routing, by the directory server, the first message to the first ACS.

8. The computer-implemented method of claim 2 , further comprising:
inserting the authentication response into an authorisation response.

9. The computer-implemented method of claim 8 , wherein the authentication response comprises a cryptogram.

10. The computer-implemented method of claim 9 , wherein the cryptogram results from the second ACS and the consumer performing any strong customer authentication, SCA.

11. The computer-implemented method of claim 1 , further comprising:
inserting the authentication response into an authorisation response.

12. The computer-implemented method of claim 1 , wherein the first message further comprises a funding primary account number, FPAN or a device primary account number, DPAN.

13. The computer-implemented method of claim 1 , wherein the second message further comprises a preferred primary account number, PPAN.

14. The computer-implemented method of claim 13 , wherein the second message further comprises a preferred primary account number, PPAN, further comprising:
extracting, by the payment network server, the FPAN or DPAN from the first message; and
obtaining, by the payment network server, a corresponding PPAN by performing a lookup operation using the FPAN or DPAN.

15. The computer-implemented method of claim 1 , further comprising:
implementing, by a directory server, a directory service comprising:
receiving, by the directory server from an e-commerce merchant server, the first message; and
routing, by the directory server, the first message to the first ACS.

Assignees

• Mastercard International Inc

Inventors

• Noë James Christian
• Cowen Michael John
• Tierney John

Classifications

• H04L9/3247

  involving digital signatures · CPC title

• G06Q40/02

  Banking, e.g. interest calculation or account maintenance (credit or loans G06Q40/03) · CPC title

• G06Q20/40975

  using encryption therefor · CPC title

• G06Q20/02

  involving a neutral party, e.g. certification authority, notary or trusted third party [TTP] · CPC title

• G06Q20/385

  using an alias or single-use codes · CPC title