System and method for authentication using payment protocol

Patent metadata

Field	Value
Publication number	US-9727862-B2
Application number	US-201313889696-A
Country	US
Kind code	B2
Filing date	May 8, 2013
Priority date	May 8, 2012
Publication date	Aug 8, 2017
Grant date	Aug 8, 2017

Abstract

Methods, systems, and devices are disclosed for using a payment processing network as an authorization engine to access secure physical areas, such as college dormitories, office buildings. A keycard with a cryptogram generator is presented by a user to an access device, and the access device or associated computer sends an access request message formatted like a payment authentication request message to an aggregator/acquirer and payment processing network. The payment processing network validates the cryptogram and returns an access response message, again formatted like a payment authorization response message, indicating that the keycard is authentic. The gate, door, turnstile, or other barrier is then temporarily unlocked to let the user through.

First claim

What is claimed is:

1. A method comprising:
receiving from an access terminal, by one or more server computers in a payment processing network, an access request message comprising authentication data, the access request message having a format of a payment authorization request message for a payment transaction, the format being syntactically correct for the payment processing network, wherein said authentication data comprises a primary account number (PAN) and a first cryptogram, wherein the access request message is free of a transaction amount;
analyzing, by the one or more server computers, the authentication data in the access request message;
determining, by the one or more server computers, that the authentication data is associated with a user that wants access past a barrier coupled to the access terminal based at least in part on determining a bank identification number (BIN) extracted from the primary account number (PAN);
in response to determining that the bank identification number (BIN) is associated with a third party aggregator and that the access request message is free of the transaction amount, preventing, by the one or more server computers in the payment processing network, routing of the access request message to an issuer computer;
in response to determining, by the one or more server computers, that the first cryptogram included in the authentication data matches a locally generated second cryptogram, preparing, by the one or more server computers, an access response message based on the determination; and
transmitting, by the one or more server computers, the access response message to the access terminal thereby automatically unlocking the barrier coupled to the access terminal, such that the user can move past the barrier.

2. The method of claim 1 wherein the determining that the bank identification number (BIN) is associated with a third party aggregator comprises matching the BIN with an entry in a lookup table.

3. The method of claim 1 wherein the authentication data further comprises:
a client identifier;
a client transaction identifier;
an account identifier comprised of the primary account number (PAN);
a card sequence number;
an expiration date;
an indicator for track 2 data;
a currency code for a transaction amount;
an indicator of minor units for the transaction amount; and
a value of the transaction amount.

4. The method of claim 1 wherein the authentication data is from a portable consumer device read by the access terminal.

5. The method of claim 4 wherein the authentication data from the portable consumer device includes the first cryptogram, the method further comprising:
calculating, at the one or more server computers, the second cryptogram; and
comparing the first cryptogram to the second cryptogram to authenticate the portable consumer device,
wherein the access response message is based on at least the comparison.

6. The method of claim 4 wherein the portable consumer device is selected from the group consisting of a plastic card with an ID-1 size conforming to International Standards Organization (ISO)/International Electrotechnical Commission (IEC) standard 7810, a key fob, and a mobile phone.

7. The method of claim 4 further comprising:
receiving, by the one or more server computers in the payment processing network, a second payment authorization request message;
ascertaining, at the one or more server computers, that the second payment authorization request message is for the payment transaction, the ascertaining based on content of the second payment authorization request message;
forwarding the second payment authorization request message to the issuer based in part on the ascertaining;
receiving, at the one or more server computers, a payment authorization response message from the issuer in response to the second payment authorization request message; and
forwarding, by the one or more server computers, the payment authorization response message.

8. A non-transitory machine-readable storable medium having collectively stored thereon instructions executable by one or more processors of a computing system in a payment processing network that, when executed by the one or more processors, cause the computing system to at least:
receive from an access terminal an access request message comprising authentication data, the access request message having a format of a payment authorization request message for a payment transaction, the format being syntactically correct for the payment processing network, wherein said authentication data comprises a primary account number (PAN) and a first cryptogram, wherein the access request message is free of a transaction amount;
analyze the authentication data in the access request message;
determine that the authentication data is associated with a user that wants access past a barrier coupled to the access terminal based at least in part on determining a bank identification number (BIN) extracted from the primary account number (PAN);
in response to determining that the bank identification number (BIN) is associated with a third party aggregator and that the access request message is free of the transaction amount, preventing, in the payment processing network, routing of the access request message to an issuer;
in response to determining that the first cryptogram included in the authentication data matches a locally generated second cryptogram, prepare an access response message; and
transmit the access response message to the access terminal thereby automatically unlocking the barrier coupled to the access terminal, such that the user can move past the barrier.

9. A computerized system in a payment processing network, comprising:
one or more processors; and
memory including instructions that, when executed by the one or more processors, cause the one or more processor to at least:
receive from an access terminal an access request message comprising authentication data, the access request message having a format of a payment authorization request message for a payment transaction, the format being syntactically correct for the payment processing network, wherein said authentication data comprises a primary account number (PAN) and a first cryptogram, wherein the access request message is free of a transaction amount;
analyze the authentication data in the access request message;
determine that the authentication data is associated with a user that wants access past a barrier coupled to the access terminal based at least in part on determining a bank identification number (BIN) extracted from the primary account number (PAN);
in response to determining that the bank identification number (BIN) is associated with a third party aggregator and that the access request message is free of the transaction amount, preventing, in the payment processing network, routing of the access request message to an issuer;
in response to determining that the cryptogram included in the authentication data matches a locally generated second cryptogram, prepare an access response message; and
transmit the access response message to the access terminal thereby automatically unlocking the barrier coupled to the access terminal, such that the user can move past the barrier.

10. A system for authorizing access to an area using a payment processing network, the system comprising:
a portable consumer device having:
a processor;
a memory operatively coupled with the processor;
an account identifier stored in the memory; and
a sequence number stored in the memory,
wherein the processor is operable to calculate a first cryptogram based on the sequence number;

one or more server computers of a

Assignees

• Visa Int Service Ass

Inventors

• O'Connell Craig
• Wong Kevin E
• Hilgers Nancy
• Nelsen Mark

Classifications

• G07C9/27

  with central registration · CPC title

• G07C9/00571

  operated by interacting with a central unit · CPC title

• G06Q20/409

  Device specific authentication in transaction processing · CPC title

• G06Q20/4014 Primary

  Identity check for transactions · CPC title

• G06Q20/3821 Primary

  Electronic credentials · CPC title