Systems and methods for use in authenticating users in connection with network transactions

Patent metadata

Field	Value
Publication number	US-12567062-B2
Application number	US-202318387440-A
Country	US
Kind code	B2
Filing date	Nov 6, 2023
Priority date	Oct 5, 2017
Publication date	Mar 3, 2026
Grant date	Mar 3, 2026

Abstract

Systems and methods are provided for authenticating users. An exemplary method includes receiving, by a directory server (DS), an authentication request for a transaction to an account where the request includes a token and a cryptogram, and transmitting the token and cryptogram to a digital service server (DSS). The method also includes mapping, by the DSS, the token to an account number for the account, validating the cryptogram, generating a directory server nonce (DSN) for the request, and transmitting the DSN and the account number to the DS. The method further includes transmitting, by the DS, the DSN and the account number to an access control server (ACS) associated with an issuer of the account and, in response to an issuer authentication value (IAV), compiling an accountholder authentication value (AAV) including the IAV, the DSN and an amount of the transaction and transmitting the AAV to a merchant or server.

First claim

What is claimed is:

1 . A system for authenticating a user to a payment account in connection with a transaction, the system comprising:
a directory server, wherein the directory server is configured to:
receive an authentication request for the transaction associated with the payment account, the payment account associated with an account number, and the authentication request including at least one of a token associated with the payment account and the account number;
transmit the at least one of the token and the account number to a digital service server (DSS), which is separate from the directory server;
receive, from the DSS, a directory server nonce (DSN) for the authentication request;
transmit the DSN and the account number to an access controller server (ACS) associated with an issuer of the payment account, the ACS being separate from the directory server and the DSS;
receive an issuer authentication value (IAV) from the ACS;
in response to receiving the IAV, compile an accountholder authentication value (AAV), the AAV including the IAV, the DSN, and at least one of a merchant identifier, a currency code and an amount of the transaction; and
transmit the AAV to a server associated with an entity involved in the transaction, whereby the entity is permitted to include the AAV in an authorization request and the issuer is permitted to validate the IAV, prior to approving the transaction.

2 . The system of claim 1 , further comprising:
the DSS coupled in communication with the directory server, wherein the authentication request includes the token for the payment account, and wherein the DSS is further configured to map the token to the payment account number for the account, prior to transmitting the account number to the directory server.

3 . The system of claim 2 , wherein the authentication request includes a cryptogram, and wherein the DSS is configured to validate the cryptogram prior to transmitting the DSN to the directory server.

4 . The system of claim 1 , further comprising:
the DSS coupled in communication with the directory server, wherein the authentication request includes a cryptogram, and wherein the DSS is configured to:
store the cryptogram in memory prior to transmitting the DSN to the directory server;
locate the cryptogram in the memory based on the DSN; and
validate the cryptogram in response to the authorization request including the AAV.

5 . The system of claim 1 , wherein the AAV includes the merchant identifier and the amount of the transaction, wherein the amount of the transaction includes a logarithmic amount of the transaction, and wherein the merchant identifier includes a hash of the merchant identifier.

6 . The system of claim 1 , wherein the directory server is further configured to generate a message authentication code (MAC) based on at least the DSN, wherein the AAV includes the MAC, and wherein the system further comprises a payment network configured to:
receive the authorization request including the AAV; validate the MAC based on a shared key with the directory server; and transmit the authorization request, or part thereof, to the DSS.

7 . The system of claim 6 , further comprising:
the DSS coupled in communication with the directory server, wherein the DSS is configured to:
generate the DSN for the authentication request;
transmit the DSN and the account number for the payment account to the directory server; and
validate a digital secure remote payment (DSRP) cryptogram included in the authentication request and to provide a validation result for the DSRP cryptogram to the payment network; and
the payment network is configured to;
transmit the authorization request, including the validation result, to the issuer of the payment account.

8 . The system of claim 1 , wherein the DSN includes at least an application transaction count (ATC) and a randomly generated value.

9 . The system of claim 1 , wherein the AAV includes the amount of the transaction, which is a logarithmic amount of the transaction, and wherein the AAV includes the IAV, the DSN, the logarithmic amount, a hash of the merchant identifier for the entity, the currency code, a key ID for a shared key and a MAC generated by the shared key.

10 . A computer-implemented method for authenticating a user to a payment account in connection with a transaction, the method comprising:
receiving, by a directory server, an authentication request for the transaction associated with the payment account, the payment account associated with an account number, and the authentication request including at least one of a token associated with the payment account and the account number; transmitting, by the directory server, the at least one of the token and the account number to a digital service server (DSS), which is separate from the directory server; receiving, by the directory server from the DSS, a directory server nonce (DSN) for the authentication request; transmitting, by the directory server, the DSN and the account number to an access controller server (ACS) associated with an issuer of the payment account, the ACS being separate from the directory server and the DSS; receiving, by the directory server, an issuer authentication value (IAV) from the ACS; in response to receiving the IAV, compiling, by the directory server, an accountholder authentication value (AAV), the AAV including the IAV, the DSN, and at least one of a merchant identifier, a currency code and an amount of the transaction; and transmitting, by the directory server, the AAV to a server associated with an entity involved in the transaction, whereby the entity is permitted to include the AAV in an authorization request and the issuer is permitted to validate the IAV, prior to approving the transaction.

11 . The computer-implemented method of claim 10 , wherein the authentication request includes the token for the payment account, and wherein the method further comprises mapping, by the DSS, the token to the account number for the account, prior to transmitting the account number to the directory server.

12 . The computer-implemented method of claim 11 , wherein the authentication request includes a cryptogram, and wherein the method further comprises validating, by the DSS, the cryptogram prior to transmitting the DSN to the directory server.

13 . The computer-implemented method of claim 10 , wherein the authentication request includes a cryptogram, and wherein the method further comprises:
storing, by the DSS, the cryptogram in memory prior to transmitting the DSN to the directory server; locating, by the DSS, the cryptogram in the memory based on the DSN; and validating, by the DSS, the cryptogram in response to the authorization request including the AAV.

14 . The computer-implemented method of claim 10 , wherein the AAV includes the merchant identifier and the amount of the transaction, wherein the amount of the transaction includes a logarithmic amount of the transaction, and wherein the merchant identifier includes a hash of the merchant identifier.

15 . The computer-implemented method of claim 10 , further comprising:
generating, by the directory server, a message authentication code (MAC) based on at least the DSN, wherein the AAV includes the MAC; receiving, by a payment network, the authorization request including the AAV; validating, by the payment network, the MAC based on a shared key with the directory server; and transmitting, by the payment network, the authorization request, or part thereof, to the DSS.

16 . A non-transitory com

Assignees

• Mastercard International Inc

Inventors

• Lakka Sowmya Reddy
• Piel Brian
• Palomba Vincenzo
• Main Jonathan James
• Roberts David Anthony

Classifications

• G06Q20/401

  Transaction verification · CPC title

• G06Q20/04

  Payment circuits · CPC title

• G06Q20/38215 Primary

  Use of certificates or encrypted proofs of transaction rights · CPC title

• G06Q20/12

  specially adapted for electronic shopping systems · CPC title

• H04L65/00

  Network arrangements, protocols or services for supporting real-time applications in data packet communication (real-time or near real-time messaging, e.g. instant messaging [IM] H04L51/04; selective video distribution H04N21/00) · CPC title