System and method utilizing chain of trust

Patent metadata

Field	Value
Publication number	US-12456116-B2
Application number	US-202017626358-A
Country	US
Kind code	B2
Filing date	Jul 20, 2020
Priority date	Jul 18, 2019
Publication date	Oct 28, 2025
Grant date	Oct 28, 2025

Abstract

Embodiments of the invention are directed to systems and methods for authenticating a user device using an authenticating device that has previously been associated with a user and/or a credential. The user may initiate a transaction at the user device. An authenticating device associated with the transaction may be sent an authentication request corresponding to the user device. The user may indicate whether or not the user device is authenticated utilizing the authenticating device. If the user device is authenticated, the transaction may proceed. If the user device is not authenticated the transaction may be rejected.

First claim

What is claimed is:

1. A method comprising:
receiving, by a resource provider computer that is a merchant computer from a first user device that is a home appliance configured to initiate a payment transaction and is not configured to store payment credential information for processing the initiated payment transaction and is not configured with an interface to receive an authentication input from a user, a transaction request comprising a device credential or a token, wherein the device credential or the token is previously associated with a second user device based on an enrollment process with an enrollment module, wherein the first user device is associated with the user;
retrieving, from a mapping stored in a memory of resource provider computer, an association between the device credential or token and the second user device, wherein the mapping indicates an association between payment credentials or tokens and a plurality of user devices, and wherein the mapping identifies a user device configured to act as an authenticating device;
identifying, by the resource provider computer, the second user device associated with the device credential or the token in the transaction request from the first user device based on the retrieved mapping, wherein the second user device acts as an authenticating device for the first user device according to the mapping to perform the authentication with the resource provider computer for the transaction request received from the first user device, wherein the first user device and second user device are associated with a same payment credential or token;
based on the second user device associated with the device credential or token being identified based on the retrieved mapping, transmitting, by the resource provider computer to the second user device, an authentication request to authenticate the resource provider computer with the first user device;
receiving, by the resource provider computer from the second user device, an authentication response, the authentication response comprising an indication that the first user device is authenticated;
transmitting, by the resource provider computer, an authorization request message to an authorizing entity computer in response to receiving the indication that the first user device is authenticated;
receiving an authorization response message authorizing the transaction request; and
receiving from the first user device a subsequent transaction request, authenticating the subsequent transaction request without requiring authentication with the second user device.

2. The method of claim 1 , wherein the resource provider computer receives the device credential associated with the user from the first user device, and the method further comprises:
obtaining, by the resource provider computer from a token provider computer, the token corresponding to the device credential and a cryptogram; and
generating, by the resource provider computer, the authorization request message to include the token and the cryptogram, and exclude the device credential.

3. The method of claim 2 , wherein the cryptogram includes data about an authentication method used in the authentication request.

4. The method of claim 1 , wherein the authorization request message further includes a first identifier for the first user device and a second identifier for the second user device, wherein transmitting the authorization request message causes the authorizing entity computer to maintain an association between the payment credential, the first identifier for the first user device, and the second identifier for the second user device, the association allowing subsequent transactions initiated by the first user device to be conducted.

5. The method of claim 1 , wherein prior to receiving the transaction request from the first user device, the method comprises:
receiving, by the resource provider computer, a first identifier of the first user device and a second identifier of the second user device;
associating, by the resource provider computer, the first user device with the second user device; and
storing, by the resource provider computer, the first identifier of the first user device with the second identifier of the second user device in a database.

6. The method of claim 5 , wherein identifying the second user device comprises retrieving the identifier of the second user device from the database.

7. The method of claim 1 , wherein the first user device does not have a user interface that includes an alphanumeric key pad.

8. The method of claim 1 , wherein the authentication request includes a biometric authentication request.

9. The method of claim 1 , wherein the first user device is a household appliance and the second user device is a mobile phone.

10. A resource provider computer comprising:
one or more processors; and
one or more computer-readable media comprising code, when executed by the one or more processors, cause the resource provider computer to perform a method comprising:
receiving, by the resource provider computer that is a merchant computer from a first user device that is a home appliance configured to initiate a payment transaction and is not configured to store payment credential information for processing the initiated payment transaction and is not configured with an interface to receive an authentication input from a user, a transaction request comprising a device credential or a token, wherein the device credential or the token is previously associated with a second user device based on an enrollment process with an enrollment module, wherein the first user device is associated with the user;
retrieving, from a mapping stored in a memory of resource provider computer, an association between the device credential or token and the second user device, wherein the mapping indicates an association between payment credentials or tokens and a plurality of user devices, and wherein the mapping identifies a user device configured to act as an authenticating device;
identifying the second user device associated with the device credential in the transaction request from the first user device based on the retrieved mapping, wherein the second user device acts as an authenticating device for the first user device according to the mapping to perform the authentication with the resource provider computer for the transaction request received from the first user device, wherein the first user device and second user device are associated with a same payment credential or token;
based on the second user device associated with the device credential or token being identified based on the retrieved mapping, transmitting, to the second user device, an authentication request to authenticate the resource provider computer with the first user device;
receiving, from the second user device, an authentication response, the authentication response comprising an indication that the first user device is authenticated;
transmitting an authorization request message to an authorizing entity computer in response to receiving the indication that the first user device is authenticated;
receiving an authorization response message authorizing the transaction request; and
receiving from the first user device a subsequent transaction request, authenticating the subsequent transaction request without requiring authentication with the second user device.

11. The resource provider computer of claim 10 , wherein the authorization response message is received from the authorizing entity computer.

12. The resource provider computer of claim 10 , wherein the resource provider computer grants access to a secure location if the aut

Assignees

• Visa Int Service Ass

Inventors

• Surin Anjana
• Johnson Alan
• Ansari Ansar
• Chitalia Jalpesh
• Shankar Ramesh
• Menon Manjush
• Cline Mark
• Sharma Sanjeev
• Mohammed Sayeed

Classifications

• H04L2209/56

  Financial cryptography, e.g. electronic payment or e-cash · CPC title

• H04L9/3231

  Biological data, e.g. fingerprint, voice or retina (network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861) · CPC title

• H04L9/3228

  One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key · CPC title

• H04L9/3213 Primary

  using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807) · CPC title

• G06Q2220/00

  Business processing using cryptography · CPC title