Systems and methods for providing online and hybridcard interactions

Patent metadata

Field	Value
Publication number	US-12511639-B2
Application number	US-202217839740-A
Country	US
Kind code	B2
Filing date	Jun 14, 2022
Priority date	Jul 3, 2019
Publication date	Dec 30, 2025
Grant date	Dec 30, 2025

Abstract

Various embodiments are generally directed to authenticating a user for non-payment purposes utilizing a payment protocol, a computer device and a contactless card. The payment protocol may be consistent with an EMV standard. An application may determine that authorization or verification of a user may be required to access non-payment features of another application associated with the user and the computer device. The application may then receive and/or facilitate transmission of encrypted data from a communications interface of a contactless card associated with an account and utilizing either an offline or online technique to do so. The offline or online technique may involve one or more operations that can verify the identity of the user and/or otherwise authorize the user to have access to various aspects of the other application.

First claim

What is claimed is:

1 . A method comprising:
receiving, by an application executing on a processor, an application transaction counter (ATC), a digital signature, and a public key from a contactless card; verifying, by the application, the digital signature based on the public key; receiving, by the application, a request comprising a non-payment event; transmitting, by the application, a message comprising the request and a cryptogram to an authentication server, wherein the cryptogram is based at least in part on the ATC and a key associated with the card; receiving, by the application, a response from the authentication server verifying the cryptogram, wherein the response is based on the payment protocol and conforms to the payment format, wherein the response reflects the performance of the non-payment event, wherein the authentication server authorizes the non-payment event using the payment protocol based at least in part on the indication to request authorization of the non-payment event using the payment protocol; receiving, by the application, an ATC of the authentication server and determining a difference between the ATC of the authentication server and the ATC of the contactless card; responsive to the difference indicating the ATC of the authentication server and the ATC of the contactless card are out of synch by an amount greater than zero but less than a first threshold, incrementing, by the application, the ATC of the contactless card based on the verification of the cryptogram; and responsive to the difference being equal to or greater than the first threshold, synchronizing, by the application, the updated ATC of the contactless card with the ATC of the authentication server.

2 . The method of claim 1 , wherein the non-payment event comprises one or more of: (i) activating the contactless card, (ii) modifying a personal identification number (PIN) of the contactless card, or (iii) modifying an address associated with the contactless card.

3 . The method of claim 2 , wherein the response from the authentication server reflects one or more of: (i) the activation of the contactless card, (ii) the modification of the PIN of the contactless card, or (iii) the modification of the address associated with the contactless card.

4 . The method of claim 1 , wherein the ATC, the digital signature, and the public key are received using near field communication (NFC).

5 . The method of claim 1 , wherein the cryptogram is generated by one of the contactless card or the application, wherein the ATC is updated by incrementing the ATC by a predefined value associated with the card.

6 . The method of claim 5 , wherein the generation of the cryptogram is based on the payment protocol, wherein the cryptogram is an authorization request cryptogram (ARQC).

7 . The method of claim 1 , wherein the message includes a predefined transaction value to mimic the payment protocol to verify contactless card perform the non-payment event without completing a payment, wherein the payment protocol comprises the Europay, Mastercard, and Visa (EMV) protocol.

8 . A non-transitory computer-readable storage medium, the computer-readable storage medium including instructions that when executed by a processor, cause the processor to:
receive, by an application, an application transaction counter (ATC), a digital signature, and a public key from a contactless card; verify, by the application, the digital signature based on the public key; receive, by the application, a request comprising a non-payment event; transmit, by the application, a message comprising the request and a cryptogram to an authentication server, wherein the cryptogram is based at least in part on the ATC and a key associated with the card; receive, by the application, a response from the authentication server verifying the cryptogram, wherein the response is based on the payment protocol and conforms to the payment format, wherein the response reflects the performance of the non-payment event, wherein the authentication server authorizes the non-payment event using the payment protocol based at least in part on the indication to request authorization of the non-payment event using the payment protocol; receive, by the application, an ATC of the authentication server and determine a difference between the ATC of the authentication server and the ATC of the contactless card; responsive to the difference indicating the ATC of the authentication server and the ATC of the contactless card are out of synch by an amount greater than zero but less than a first threshold, increment, by the application, the ATC of the contactless card based on the verification of the cryptogram; and responsive to the difference being equal to or greater than the first threshold, synchronize, by the application, the updated ATC of the contactless card with the ATC of the authentication server.

9 . The computer-readable storage medium of claim 8 , wherein the non-payment event comprises one or more of: (i) activating the contactless card, (ii) modifying a personal identification number (PIN) of the contactless card, or (iii) modifying an address associated with the contactless card.

10 . The computer-readable storage medium of claim 9 , wherein the response from the authentication server reflects one or more of: (i) the activation of the contactless card, (ii) the modification of the PIN of the contactless card, or (iii) the modification of the address associated with the contactless card.

11 . The computer-readable storage medium of claim 8 , wherein the ATC, the digital signature, and the public key are received using near field communication (NFC).

12 . The computer-readable storage medium of claim 8 , wherein the cryptogram is generated by one of the contactless card or the application, wherein the ATC is updated by incrementing the ATC by a predefined value associated with the card.

13 . The computer-readable storage medium of claim 12 , wherein the generation of the cryptogram is based on the payment protocol, wherein the cryptogram is an authorization request cryptogram (ARQC).

14 . The computer-readable storage medium of claim 8 , wherein the message includes a predefined transaction value to mimic the payment protocol to verify contactless card perform the non-payment event without completing a payment, wherein the payment protocol comprises the Europay, Mastercard, and Visa (EMV) protocol.

Assignees

• Capital One Services Llc

Inventors

• Mossler Lara
• Lerner Evan
• Manivannan Aravindhan

Classifications

• H04W12/06

  Authentication · CPC title

• H04L9/3247

  involving digital signatures · CPC title

• H04L9/3234

  involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853) · CPC title

• H04L9/3073

  involving pairings, e.g. identity based encryption [IBE], bilinear mappings or bilinear pairings, e.g. Weil or Tate pairing · CPC title

• H04L9/0877

  using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM] · CPC title