Method and system for authenticating payment transactions using a user device

Abstract

A method and system for authenticating a payment transaction is disclosed. The method includes receiving a request from a merchant application installed in a user device to verify a telephone number associated with a user identification module card. In addition, a first key is obtained from at least one of a server associated with a manufacturer of the user device and a network server. In addition, a first ciphertext is generated based on at least one of a telephone number and a unique identification value associated with the user device using the first key, wherein the first ciphertext is provided to a server associated with the manufacturer for verification. Upon verifying the first ciphertext, the method includes receiving a second ciphertext from a server associated with the manufacturer, wherein the merchant application provides the second ciphertext and payment transaction details to an issuer server to authenticate the payment transaction.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to U.S. patent application No. 17 / 136,425, filed on December 29, 2020, the disclosure of which is hereby incorporated by reference in its entirety.

[0003] background Technical Field

[0004] The present disclosure relates to authentication of payment transactions. In particular, but not exclusively, the present disclosure relates to a method and system for authenticating a payment transaction using a user device. Background Art

[0005] In today's environment, two-factor authentication or two-step verification is commonly used as a security process to verify the user performing a payment transaction. Two-factor authentication protects the user's credentials as well as the resources that the user can access. In addition, two-factor authentication provides an improved level of security compared to authentication methods that rely on single-factor authentication (SFA), in which the user only provides one factor, such as a password or password. Two-factor authentication methods rely on the user to provide a password as well as a second factor, such as a unique one-time password (OTP) via text message, push notification, software-generated time-based one-time password (e.g., TOTP), biometric authentication, etc. In addition, text message-based OTP is a preferred two-factor authentication to verify the user corresponding to the payment transaction by verifying the mobile number associated with the user's device using the OTP.

[0006] Furthermore, existing text message-based two-factor authentication processes reduce payment success rates and total payment transaction times due to various reasons, including network failures and delays in receiving the OTP in the text message from the issuer via the service provider of the user's device's cellular network. Furthermore, the failure rate of payment transactions increases, and customer satisfaction decreases due to failure to receive the OTP from the issuer within a predefined time interval.

[0007] The information disclosed in this Background section of the present disclosure is only for enhancement of understanding of the general background of the present disclosure and should not be taken as an acknowledgement or any form of suggestion that this information constitutes the prior art already known to a person skilled in the art. Summary of the invention

[0008] Additional features and advantages are realized through the techniques of the present disclosure.Other embodiments and aspects of the present disclosure are described in detail herein and are considered a part of the claimed disclosure.

[0009] In some non-limiting embodiments or aspects, a computer-implemented method is provided, comprising: receiving, by at least one processor of a user device, a request from a merchant application installed in the user device to verify a telephone number associated with a user identification module (SIM) card in the user device, wherein the request to verify the telephone number is received when a payment transaction is initiated in the user device; in response to receiving the request, obtaining, by the at least one processor, a first key from at least one of a server associated with a manufacturer of the user device and a network server; generating, by the at least one processor, a first ciphertext based on at least one of a telephone number and a unique identification value associated with the user device using the first key, wherein the first ciphertext is provided to a server associated with the manufacturer for verification; and when verifying the first ciphertext, receiving, by the at least one processor, a second ciphertext from a server associated with the manufacturer, wherein the merchant application provides the second ciphertext and payment transaction details to an issuer server to authenticate the payment transaction.

[0010] In some non-limiting embodiments or aspects, obtaining the first key from a server associated with the manufacturer of the user device includes: sending a request for the first key to a server associated with the manufacturer of the user device; and one of the following: (i) receiving the first key from the server associated with the manufacturer, wherein the server associated with the manufacturer generates the first key in real time using one or more cryptographic techniques; and (ii) obtaining the first key from a memory associated with the user device, wherein the first key is generated by the server associated with the manufacturer and stored in the memory associated with the user device during manufacturing of the user device.

[0011] In some non-limiting embodiments or aspects, obtaining the first key from the network server includes: sending a request for the first key to the network server via a server associated with the manufacturer of the user device; and receiving the first key from the network server via a server associated with the manufacturer of the user device, wherein the network server generates the first key in real time using one or more cryptographic techniques.

[0012] In some non-limiting embodiments or aspects, the first ciphertext is generated based on one or more encryption techniques using at least one of a telephone number and a unique identification value associated with the user device and the first key. In some non-limiting embodiments or aspects, providing the first ciphertext to a server associated with the manufacturer triggers the server associated with the manufacturer to decrypt the first ciphertext using the first key and one or more decryption techniques corresponding to the one or more encryption techniques used to generate the first ciphertext, and verifying the telephone number and unique identification value associated with the user device based on user information stored in a database corresponding to the server associated with the manufacturer of the user device.

[0013] In some non-limiting embodiments or aspects, the second cryptogram received by the at least one processor from the server associated with the manufacturer is generated by the server associated with the manufacturer based on at least one of a telephone number and a unique identification value associated with the user device using a second key, wherein the second key is obtained from the network server. In some non-limiting embodiments or aspects, providing the second cryptogram and the payment transaction details to the issuer server includes sending the second cryptogram and the payment transaction details to the issuer server via at least one of: the network server, a direct integration with the issuer server, an access control server (ACS), a merchant plug-in (MPI) provider, or any combination thereof.

[0014] In some non-limiting embodiments or aspects, the method further comprises: after authenticating the payment transaction, receiving an authentication response from the issuer server, wherein the authentication of the payment transaction comprises: decrypting the second ciphertext by the issuer server using a second key, wherein the second key is obtained from the network server; verifying the telephone number associated with the user device by the issuer server based on payer information stored in a database associated with the issuer server; and providing the authentication response to the user device by the issuer server based on the result of the verification. In some non-limiting embodiments or aspects, the unique identification value comprises at least an International Mobile Equipment Identity (IMEI) code associated with the user device.

[0015] In some non-limiting embodiments or aspects, a user device for authenticating a payment transaction is provided, comprising: at least one processor; and a memory, the memory being communicatively coupled to the at least one processor, wherein the memory stores processor instructions, which when executed cause the at least one processor to: receive a request from a merchant application installed in the user device to verify a telephone number associated with a subscriber identity module (SIM) card in the user device, wherein the request to verify the telephone number is received when a payment transaction is initiated in the user device; in response to receiving the request, obtain a first key from at least one of a server associated with a manufacturer of the user device and a network server; generate a first cryptogram based on at least one of a telephone number and a unique identification value associated with the user device using the first key, wherein the first cryptogram is provided to a server associated with the manufacturer for verification; and upon verifying the first cryptogram, receive a second cryptogram from a server associated with the manufacturer, wherein the merchant application provides the second cryptogram and payment transaction details to an issuer server to authenticate the payment transaction.

[0016] In some non-limiting embodiments or aspects, the at least one processor is configured to obtain the first key from a server associated with the manufacturer of the user device, including: sending a request for the first key to the server associated with the manufacturer of the user device; and one of the following: (i) receiving the first key from the server associated with the manufacturer, wherein the server associated with the manufacturer generates the first key in real time using one or more cryptographic techniques; and (ii) obtaining the first key from a memory associated with the user device, wherein the first key is generated by the server associated with the manufacturer and stored in the memory associated with the user device.

[0017] In some non-limiting embodiments or aspects, the at least one processor is configured to obtain the first key from the network server, including: sending a request for the first key to the network server via a server associated with the manufacturer of the user device; and receiving the first key from the network server via a server associated with the manufacturer of the user device, wherein the network server generates the first key in real time using one or more cryptographic techniques. In some non-limiting embodiments or aspects, the at least one processor is configured to generate the first ciphertext based on one or more encryption techniques using at least one of a telephone number and a unique identification value associated with the user device and the first key.

[0018] In some non-limiting embodiments or aspects, the at least one processor is configured to provide the first cryptogram to a server associated with the manufacturer to trigger the server associated with the manufacturer to decrypt the first cryptogram using the first key and one or more decryption techniques corresponding to the one or more encryption techniques used to generate the first cryptogram, and verify the telephone number and unique identification value associated with the user device based on the user information stored in the database of the server associated with the manufacturer of the user device. In some non-limiting embodiments or aspects, the at least one processor is configured to receive a second cryptogram generated by the server associated with the manufacturer based on at least one of the telephone number and the unique identification value associated with the user device using a second key, wherein the second key is obtained from the network server. In some non-limiting embodiments or aspects, the at least one processor is also configured to provide the second cryptogram and the payment transaction details to the issuer server, including sending the second cryptogram and the payment transaction details to the issuer server via at least one of the following: the network server, direct integration with the issuer server, access control server (ACS), merchant plug-in (MPI) provider, or any combination thereof.

[0019] In some non-limiting embodiments or aspects, the at least one processor is also configured to: receive an authentication response from the issuer server after authenticating the payment transaction, wherein the authentication of the payment transaction includes: the issuer server decrypting the second ciphertext using a second key, wherein the second key is obtained from the network server; the issuer server verifying the telephone number associated with the user device based on payer information stored in a database associated with the issuer server; and the issuer server providing the authentication response to the user device based on the result of the verification.

[0020] In some non-limiting embodiments or aspects, a network server is provided, comprising: at least one processor; and a memory, the memory being communicatively coupled to the at least one processor, wherein the memory stores processor instructions, which when executed cause the at least one processor to: receive a request for a first key from at least one of a user device and a server associated with a manufacturer of the user device; provide the first key to at least one of the user device and the server associated with the manufacturer, wherein the user device generates a first cryptogram using the first key based on at least one of a telephone number associated with a subscriber identity module (SIM) card in the user device and a unique identification value associated with the user device; receive a request for a second key from a server associated with the manufacturer; and provide the second key to a server associated with the manufacturer and an issuer server, wherein the server associated with the manufacturer generates a second cryptogram using the second key, and wherein the second cryptogram is verified to authenticate a payment transaction.

[0021] In some non-limiting embodiments or aspects, providing the first key includes: generating the first key in real time using one or more cryptographic techniques; and sending the first key to at least one of the user device and a server associated with the manufacturer. In some non-limiting embodiments or aspects, providing the second key includes: generating the second key in real time using one or more cryptographic techniques; and sending the second key to a server associated with the manufacturer and the issuer server.

[0022] Other non-limiting embodiments or aspects are set forth in the following numbered clauses:

[0023] Clause 1: A computer-implemented method, comprising: receiving, by at least one processor of a user device, a request from a merchant application installed in the user device to verify a telephone number associated with a subscriber identity module (SIM) card in the user device, wherein the request to verify the telephone number is received when a payment transaction is initiated in the user device; in response to receiving the request, obtaining, by the at least one processor, a first key from at least one of a server and a network server associated with a manufacturer of the user device; generating, by the at least one processor, a first ciphertext based on at least one of a telephone number and a unique identification value associated with the user device using the first key, wherein the first ciphertext is provided to a server associated with the manufacturer for verification; and when verifying the first ciphertext, receiving, by the at least one processor, a second ciphertext from a server associated with the manufacturer, wherein the merchant application provides the second ciphertext and payment transaction details to an issuer server to authenticate the payment transaction.

[0024] Clause 2: A method according to clause 1, wherein obtaining the first key from a server associated with the manufacturer of the user device comprises: sending a request for the first key to a server associated with the manufacturer of the user device; and one of the following: (i) receiving the first key from a server associated with the manufacturer, wherein the server associated with the manufacturer generates the first key in real time using one or more cryptographic techniques; and (ii) obtaining the first key from a memory associated with the user device, wherein the first key is generated by a server associated with the manufacturer and stored in a memory associated with the user device during manufacturing of the user device.

[0025] Clause 3: A method according to clause 1 or 2, wherein obtaining the first key from the network server comprises: sending a request for the first key to the network server via a server associated with the manufacturer of the user device; and receiving the first key from the network server via a server associated with the manufacturer of the user device, wherein the network server generates the first key in real time using one or more cryptographic techniques.

[0026] Clause 4: The method of any of clauses 1-3, wherein the first ciphertext is generated based on one or more cryptographic techniques using at least one of a telephone number and a unique identification value associated with the user device and the first key.

[0027] Clause 5: A method according to any one of clauses 1-4, wherein providing the first ciphertext to a server associated with the manufacturer triggers the server associated with the manufacturer to decrypt the first ciphertext using the first key and one or more decryption techniques corresponding to the one or more encryption techniques used to generate the first ciphertext, and to verify the telephone number and unique identification value associated with the user device based on user information stored in a database corresponding to the server associated with the manufacturer of the user device.

[0028] Clause 6: A method according to any one of clauses 1-5, wherein the second ciphertext received by the at least one processor from the server associated with the manufacturer is generated by the server associated with the manufacturer using a second key based on at least one of a telephone number and a unique identification value associated with the user device, wherein the second key is obtained from the network server.

[0029] Clause 7: A method according to any one of clauses 1-6, wherein providing the second ciphertext and the payment transaction details to the issuer server includes sending the second ciphertext and the payment transaction details to the issuer server via at least one of: the network server, direct integration with the issuer server, an access control server (ACS), a merchant plug-in (MPI) provider, or any combination thereof.

[0030] Clause 8: The method according to any one of clauses 1-7 further includes: after authenticating the payment transaction, receiving an authentication response from the issuer server, wherein the authentication of the payment transaction includes: the issuer server decrypting the second ciphertext using a second key, wherein the second key is obtained from the network server; the issuer server verifying the telephone number associated with the user device based on the payer information stored in a database associated with the issuer server; and the issuer server providing the authentication response to the user device based on the result of the verification.

[0031] Clause 9: A method as described in any of clauses 1-8, wherein the unique identification value comprises at least an International Mobile Equipment Identity (IMEI) code associated with the user device.

[0032] Clause 10: A user device for authenticating a payment transaction, comprising: at least one processor; and a memory, the memory being communicatively coupled to the at least one processor, wherein the memory stores processor instructions that, when executed, cause the at least one processor to: receive a request from a merchant application installed in the user device to verify a telephone number associated with a subscriber identity module (SIM) card in the user device, wherein the request to verify the telephone number is received when a payment transaction is initiated in the user device; in response to receiving the request, obtain a first key from at least one of a server and a network server associated with a manufacturer of the user device; generate a first ciphertext using the first key based on at least one of a telephone number and a unique identification value associated with the user device, wherein the first ciphertext is provided to a server associated with the manufacturer for verification; and upon verifying the first ciphertext, receive a second ciphertext from a server associated with the manufacturer, wherein the merchant application provides the second ciphertext and payment transaction details to an issuer server to authenticate the payment transaction.

[0033] Clause 11: A user device according to clause 10, wherein the at least one processor is configured to obtain the first key from a server associated with the manufacturer of the user device, including: sending a request for the first key to the server associated with the manufacturer of the user device; and one of the following: (i) receiving the first key from the server associated with the manufacturer, wherein the server associated with the manufacturer generates the first key in real time using one or more cryptographic techniques; and (ii) obtaining the first key from a memory associated with the user device, wherein the first key is generated by the server associated with the manufacturer and stored in the memory associated with the user device.

[0034] Clause 12: A user device according to clause 10 or 11, wherein the at least one processor is configured to obtain the first key from the network server, including: sending a request for the first key to the network server via a server associated with the manufacturer of the user device; and receiving the first key from the network server via a server associated with the manufacturer of the user device, wherein the network server generates the first key in real time using one or more cryptographic techniques.

[0035] Clause 13: A user device according to any one of clauses 10-12, wherein the at least one processor is configured to generate the first ciphertext based on one or more encryption techniques using at least one of a telephone number and a unique identification value associated with the user device and the first key.

[0036] Clause 14: A user device according to any one of clauses 10-13, wherein the at least one processor is configured to provide the first ciphertext to a server associated with the manufacturer to trigger the server associated with the manufacturer to decrypt the first ciphertext using the first key and one or more decryption techniques corresponding to the one or more encryption techniques used to generate the first ciphertext, and to verify the telephone number and unique identification value associated with the user device based on user information stored in a database corresponding to the server associated with the manufacturer of the user device.

[0037] Clause 15: A user device according to any of clauses 10-14, wherein the at least one processor is configured to receive a second ciphertext generated by a server associated with the manufacturer using a second key based on at least one of a telephone number and a unique identification value associated with the user device, wherein the second key is obtained from the network server.

[0038] Clause 16: A user device according to any one of clauses 10-15, wherein the at least one processor is further configured to provide the second ciphertext and the payment transaction details to the issuer server, including sending the second ciphertext and the payment transaction details to the issuer server via at least one of the following: the network server, direct integration with the issuer server, an access control server (ACS), a merchant plug-in (MPI) provider, or any combination thereof.

[0039] Clause 17: A user device according to any one of clauses 10-16, wherein the at least one processor is further configured to: receive an authentication response from the issuer server after authenticating the payment transaction, wherein the authentication of the payment transaction includes: decrypting the second ciphertext by the issuer server using a second key, wherein the second key is obtained from the network server; verifying the telephone number associated with the user device by the issuer server based on payer information stored in a database associated with the issuer server; and providing the authentication response to the user device by the issuer server based on the result of the verification.

[0040] Clause 18: A network server comprising: at least one processor; and a memory communicatively coupled to the at least one processor, wherein the memory stores processor instructions that, when executed, cause the at least one processor to: receive a request for a first key from at least one of a user device and a server associated with a manufacturer of the user device; provide the first key to at least one of the user device and the server associated with the manufacturer, wherein the user device generates a first cryptogram using the first key based on at least one of a telephone number associated with a subscriber identity module (SIM) card in the user device and a unique identification value associated with the user device; receive a request for a second key from a server associated with the manufacturer; and provide the second key to a server associated with the manufacturer and an issuer server, wherein the server associated with the manufacturer generates a second cryptogram using the second key, and wherein the second cryptogram is verified to authenticate a payment transaction.

[0041] Clause 19: A network server according to clause 18, wherein providing the first key comprises: generating the first key in real time using one or more cryptographic techniques; and sending the first key to at least one of the user device and a server associated with the manufacturer.

[0042] Clause 20: A network server according to clause 18 or 19, wherein providing the second key includes: generating the second key in real time using one or more cryptographic techniques; and sending the second key to a server associated with the manufacturer and the issuer server.

[0043] A computer-implemented method for authenticating a payment transaction is disclosed herein. In some non-limiting embodiments or aspects, the method includes receiving a request from a merchant application installed in a user device to verify a telephone number associated with a user identity module (SIM) card in the user device. In response to receiving the request, the method includes obtaining a first key from at least one of a server associated with a manufacturer of the user device and a network server. In addition, the method includes using the first key to generate a first cryptogram based on at least one of a telephone number and a unique identification value associated with the user device, wherein the first cryptogram is provided to a server associated with the manufacturer for verification. When verifying the first cryptogram, the method includes receiving a second cryptogram from a server associated with the manufacturer, wherein the merchant application provides the second cryptogram and payment transaction details to an issuer server to authenticate the payment transaction.

[0044] In some non-limiting embodiments or aspects, the present disclosure may include a user device for authenticating a payment transaction. The user device includes at least one processor, and a memory communicatively coupled to the at least one processor, wherein the memory stores at least one processor instruction, which when executed causes the at least one processor to receive a request from a merchant application installed in the user device for verifying a telephone number associated with a subscriber identity module (SIM) card in the user device. In response to receiving the request, the at least one processor is configured to obtain a first key from at least one of a server associated with a manufacturer of the user device and a network server. In addition, the at least one processor is configured to generate a first cryptogram based on at least one of a telephone number and a unique identification value associated with the user device using the first key, wherein the first cryptogram is provided to a server associated with the manufacturer for verification. Upon verifying the first cryptogram, the at least one processor is configured to receive a second cryptogram from a server associated with the manufacturer, wherein the merchant application provides the second cryptogram and payment transaction details to an issuer server to authenticate the payment transaction.

[0045] In some non-limiting embodiments or aspects, the present disclosure may include a network server. The network server includes at least one processor and a memory communicatively coupled to the at least one processor, wherein the memory stores at least one processor instruction, which when executed causes the at least one processor to receive a request for a first key from at least one of a user device and a server associated with the user device. In addition, the at least one processor is configured to provide the first key to at least one of the user device and the server associated with the manufacturer, wherein the user device uses the first key to generate a first cryptogram based on at least one of a telephone number associated with a subscriber identity module (SIM) card in the user device and a unique identification value associated with the user device. In addition, the at least one processor is configured to receive a request for a second key from a server associated with the manufacturer. Thereafter, the at least one processor is configured to provide the second key to a server associated with the manufacturer and an issuer server, wherein the server associated with the manufacturer generates a second cryptogram using the second key, and wherein the second cryptogram is verified to authenticate a payment transaction.

[0046] The foregoing summary is illustrative only and is not intended to be limiting in any way. In addition to the illustrative aspects, embodiments, and features described above, further aspects, embodiments, and features may become apparent by reference to the drawings and the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] The novel features and characteristics of the present disclosure are set forth in the appended claims. However, the disclosure itself, as well as the preferred modes of use, additional objects and advantages thereof, may best be understood with reference to the following detailed description of illustrative embodiments when read in conjunction with the accompanying drawings. The accompanying drawings, which are incorporated into and constitute a part of the present disclosure, illustrate exemplary embodiments and, together with the description, serve to explain the principles disclosed. In the figures, the leftmost digit of a reference number identifies the figure in which the reference number first appears. One or more embodiments will now be described, by way of example only, with reference to the accompanying drawings, in which like reference numerals represent similar elements, and in which:

[0048] Figure 1 is an exemplary environment for authenticating a payment transaction according to some non-limiting embodiments or aspects of the present disclosure;

[0049] Figure 2A is a simplified block diagram of a user device according to some non-limiting embodiments or aspects of the present disclosure;

[0050] Figure 2B is a simplified block diagram of a network server for facilitating authentication of payment transactions according to an embodiment of the present disclosure;

[0051] Figure 3 is a flow chart illustrating method steps for authenticating a payment transaction according to some non-limiting embodiments or aspects of the present disclosure;

[0052] Figure 4A is an exemplary merchant application with multiple payment instruments for initiating payments to a merchant according to some non-limiting embodiments or aspects of the present disclosure;

[0053] Figure 4B is an exemplary user device that requests and obtains a first key from a first server according to some non-limiting embodiments or aspects of the present disclosure;

[0054] Figure 4C is an exemplary user device that requests and obtains a first key from a network server via a first server according to some non-limiting embodiments or aspects of the present disclosure;

[0055] Figure 4D is an exemplary user device that sends a first cryptographic text for authentication to a first server according to some non-limiting embodiments or aspects of the present disclosure;

[0056] Figure 4E is an exemplary user device that receives a second ciphertext from a first server after verifying a first ciphertext according to some non-limiting embodiments or aspects of the present disclosure;

[0057] Figure 4F is an exemplary user device that sends a second cryptogram and a payment transaction for authentication to an issuer server and receives an authentication response from the issuer server according to some non-limiting embodiments or aspects of the present disclosure; and

[0058] Figure 5 is an exemplary computer system for authenticating a payment transaction according to some non-limiting embodiments or aspects of the present disclosure.

[0059] It will be appreciated by those skilled in the art that any block diagram herein represents a conceptual view of an exemplary system that embodies the principles of the subject matter of the present invention. Similarly, it will be appreciated that any flow charts, flow diagrams, state transition diagrams, pseudocodes, etc. represent various processes that can be substantially represented in a computer-readable medium and executed by a computer or processor, whether or not such a computer or processor is explicitly shown. Although each of the accompanying drawings illustrates a specific embodiment for the purpose of illustrating clear examples, other embodiments may omit, add, reorder, and / or modify any of the elements shown in the figures. DETAILED DESCRIPTION

[0060] In this document, the term “exemplary” is used herein to mean “serving as an example, instance, or illustration.” Any embodiment, aspect, or implementation of the inventive subject matter described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other embodiments.

[0061] In the following detailed description of non-limiting embodiments or aspects of the present disclosure, reference is made to the accompanying drawings that form part of the present disclosure, and the specific embodiments in which the present disclosure can be practiced are shown in the drawings by way of illustration. However, it should be understood that it is not desirable to limit the present disclosure to the disclosed form, but on the contrary, the present disclosure is intended to cover all modifications, equivalents and alternatives that belong to the spirit and scope of the present disclosure. It should be understood that other embodiments can be utilized and can be changed without departing from the scope of the present disclosure. Therefore, the following description should not be considered to have a restrictive meaning.

[0062] The term "comprises" or any other variation thereof is intended to cover a non-exclusive inclusion, such that a setup, apparatus, or method that includes a list of components or steps includes not only those components or steps, but may also include other components or steps not expressly listed or inherent to such setup, apparatus, or method. In other words, without more constraints, one or more elements in a system or device following "comprises ... a" does not exclude the presence of other or additional elements in the system or method.

[0063] The term "includes / including" or any other variation thereof is intended to encompass a non-exclusive inclusion, such that a configuration, apparatus, or method that includes a series of components or steps includes not only those components or steps, but may also include other components or steps that are not expressly listed or inherent to such configuration, apparatus, or method. In other words, without further constraints, one or more elements in a system or device following "includes ... a" do not exclude the presence of other or additional elements in the system or method.

[0064] Aspects, components, elements, structures, actions, steps, functions, instructions, etc. used herein should not be understood as critical or necessary unless explicitly described as such. Also, as used herein, the article "one" is intended to include one or more items, and can be used interchangeably with "one or more" and "at least one". In addition, as used herein, the term "set" is intended to include one or more items (e.g., related items, unrelated items, combinations of related items and unrelated items, etc.), and can be used interchangeably with "one or more" or "at least one". In the case of wishing to have only one item, the term "one" or similar language is used. Also, as used herein, the term "having" etc. is intended to be an open term. In addition, unless otherwise explicitly stated, the phrase "based on" is intended to mean "based at least in part". Unless otherwise explicitly specified, the term "some non-limiting embodiments or aspects" means "one or more (but not all) embodiments or aspects of the present disclosure". The description of some non-limiting embodiments or aspects with several components that communicate with each other does not mean that all these components are required. On the contrary, various optional components are described to illustrate various possible embodiments of the present disclosure.

[0065] When a single device or article is described herein, it may be apparent that more than one device / article (whether or not they cooperate) may be used in place of a single device / article. Similarly, where more than one device or article is described herein (whether or not they cooperate), it may be apparent that a single device / article may be used in place of more than one device or article, or a different number of devices / articles may be used in place of the number of devices or procedures shown. The functions and / or features of a device may alternatively be embodied by one or more other devices that are not explicitly described as having such functions / features. Therefore, other embodiments of the present disclosure need not include the device itself.

[0066] As used herein, the terms "transmit (communication / communicate)", "send" and / or "receive" may refer to the reception / receipt, transmission, delivery, provision, etc. of information (e.g., data, signals, messages, instructions, commands, etc.). A unit (e.g., a device, a system, a component of a device or system, a combination thereof, etc.) communicating with another unit means that the one unit is able to directly or indirectly receive information from the other unit and / or transmit information to the other unit. This may refer to a direct or indirect connection (e.g., a direct communication connection, an indirect communication connection, etc.) that is wired and / or wireless in nature. In addition, although the transmitted information may be modified, processed, relayed and / or routed between the first unit and the second unit, the two units may also communicate with each other. For example, the first unit may communicate with the second unit even if the first unit passively receives information and does not actively transmit the information to the second unit. As another example, the first unit may communicate with the second unit if at least one intermediate unit (e.g., a third unit located between the first unit and the second unit) processes the information received from the first unit and transmits the processed information to the second unit. In some non-limiting embodiments or aspects, a message may refer to a network packet (eg, a data packet, etc.) that includes data. It should be understood that many other arrangements are possible.

[0067] As used herein, the term "server" and / or "processor" may refer to one or more computing devices or computing units, such as processors, storage devices, and / or similar computer components, which communicate with client devices and / or other computing devices through a network (e.g., the Internet or a private network), and in some examples, facilitate communication between other servers and / or client devices. It should be understood that there may be various other arrangements. As used herein, the term "system" may refer to one or more computing devices or a combination of computing devices, such as but not limited to processors, servers, client devices, software applications, and / or other similar components. In addition, as used herein, references to "servers" or "processors" may refer to previously described servers and / or processors, different servers and / or processors, and / or combinations of servers and / or processors that are described as performing a previous step or function. For example, as used in the specification and claims, a first server and / or a first processor described as performing a first step or function may refer to the same or different servers and / or processors described as performing a second step or function.

[0068] Figure 1 An exemplary environment for authenticating a payment transaction using a user device (101) according to some non-limiting embodiments or aspects of the present disclosure is shown.

[0069] In some non-limiting embodiments or aspects, a user may use a user device (101) to pay a transaction amount to a merchant via a merchant application installed in the user device (101). For example, the user device (101) may be a smartphone, a tablet, etc. In addition, the merchant application may include an application that allows a user to purchase one or more goods (e.g., groceries, clothing, appliances, electronic devices, etc.), one or more services (e.g., news subscriptions, music subscriptions, e-books, etc.), etc. The merchant may include at least one of an individual, an organization, etc., which accepts the transaction amount in exchange for providing goods and / or services. The user may select a payment card from a plurality of payment instruments stored in the merchant application to pay the transaction amount to the merchant.

[0070] The multiple payment instruments stored in the merchant application are referred to as "cards on file". The selection of a payment card indicates that a payment transaction is initiated in the user device. In addition, when the user selects a payment card, the merchant application sends a request to the user device (101) to verify the telephone number associated with the user identification module (SIM) card in the user device (101). After receiving the request from the merchant application, the user device (101) obtains a first key from at least one of a server associated with a manufacturer of the user device (101) and a network server (102). The manufacturer may include at least one of the following: an entity that produces the user device (101) or one or more components of the user device (101), an entity that provides one or more services (e.g., software applications required to operate the user device (101)) in the user device (e.g., an operating system, a device driver, etc.). The first key may be an alphanumeric string that is used to determine the output of one or more encryption techniques and one or more decryption techniques.

[0071] A server associated with the manufacturer of the user device (101) is Figure 1 The network server (102) is represented as the first server (103). The phrases "server associated with the manufacturer" and "first server (103)" are used interchangeably in this disclosure. The network server (102) is an entity that assists in processing payment transactions between an issuer financial institution associated with a user and an acquirer financial institution associated with a merchant based on authentication and authorization of the payment transaction.

[0072] In some non-limiting embodiments or aspects, after obtaining a first key from a network server (102) or a first server (103), the user device (101) generates a first ciphertext. The first ciphertext is generated based on at least one of a telephone number and a unique identification value associated with the user device (101) using the first key as an input to one or more encryption techniques. The one or more encryption techniques may include one of a symmetric key-based encryption technique, an asymmetric key-based encryption technique, a digital signature-based encryption technique, a cryptographic hash function, JSON Web Encryption (JWE), a JSON Web Signature (JWS), and / or any combination thereof. The first ciphertext is an encrypted text, including at least one of a ciphertext, a digital signature, a cryptographic hash, and the like. In addition, the unique identification value associated with the user device (101) indicates an alphanumeric key for uniquely identifying the user device (101). The unique identification value may include an International Mobile Equipment Identity (IMEI) code, a Media Access Control (MAC) address, and the like of the user device (101).

[0073] In some non-limiting embodiments or aspects, a first cryptogram generated by a user device (101) is provided to a server associated with a manufacturer for verification. The first server (103) triggers verification of the first cryptogram by decrypting the first cryptogram using a first key and one or more decryption techniques corresponding to one or more encryption techniques used by the user device (101). The one or more decryption techniques may include one of a symmetric key-based decryption technique, an asymmetric key-based decryption technique, a digital signature-based cryptographic technique, a cryptographic hash function, JWE, JWS, and / or any combination thereof. In addition, the first server (103) verifies a telephone number and a unique identification value associated with the user device (101) based on user information (106) (e.g., a telephone number and a unique identification value) stored in a database. The database corresponds to a server associated with the manufacturer of the user device (101).

[0074] In some non-limiting embodiments or aspects, after verifying the phone number and the unique identification value, the first server (103) sends a second ciphertext to the user device (101). The first server (103) generates the second ciphertext based on at least one of the phone number and the unique identification value associated with the user device (101) using a second key. In some non-limiting embodiments or aspects, the second ciphertext may include the phone number of the user device (101) corresponding to the unique identification value. The second key may be an alphanumeric string that is used to determine the output of a cryptographic technique (e.g., one or more encryption techniques). The second ciphertext is generated using a cryptographic technique, the cryptographic technique including one of a symmetric key-based encryption technique, an asymmetric key-based encryption technique, a digital signature-based encryption technique, a cryptographic hash function, JWE, JWS, and / or any combination thereof. The second ciphertext is an encrypted text, including at least one of a ciphertext, a digital signature, an encrypted hash, etc. In addition, the first server (103) obtains a second key required to generate the second ciphertext from the network server (102).

[0075] In some non-limiting embodiments or aspects, after verifying the first ciphertext, the user device (101) receives a second ciphertext from a server associated with the manufacturer. The merchant application installed in the user device (101) provides the second ciphertext and the payment transaction details to the issuer server (104) via the network server (102) to authenticate the payment transaction. For example, the payment transaction details may include payment card details, payment transaction amount, issuer details, acquirer details, etc. In addition, the issuer server (104) decrypts the second ciphertext using a second key. The issuer server (104) obtains the second key from the network server (102). After decrypting the second ciphertext, the issuer server (104) verifies the telephone number associated with the user device (101) received in the second ciphertext based on the payer information (107) stored in the database associated with the issuer server (104). The payer information (107) may include the user's telephone number and corresponding payment card information. The issuer server (104) provides an authentication response to the user device (101) based on the result of the verification, and the user device (101) receives the authentication response from the issuer server (104).

[0076] In some non-limiting embodiments or aspects, the user device (101), the network server (102), the issuer server (104), and the server associated with the manufacturer (e.g., the first server (103)) are interconnected via a communication network (105) to communicate with each other. In addition, the communication network (105) may include, for example, direct interconnection, an e-commerce network, a peer-to-peer (P2P) network, a local area network (LAN), a wide area network (WAN), a wireless network (e.g., using a wireless application protocol), the Internet, Wi-Fi, etc. , cellular networks, wired networks, short-range communications, etc.

[0077] Figure 2A A simplified block diagram of a user device (101) is shown according to some non-limiting embodiments or aspects of the present disclosure.

[0078] In some non-limiting embodiments or aspects, the user device (101) may include at least one central processing unit ("CPU" or "processor") (201) and a memory (202) storing instructions executable by the at least one processor (201). The processor (201) may include at least one data processor for executing a program component, the program component for executing a request generated by a user or a system. The memory (202) is communicatively coupled to the processor (201). The user device (101) also includes an input / output (I / O) interface (203). The I / O interface (203) is coupled to the processor (201), and input signals and / or output signals are transmitted through the I / O interface. In some non-limiting embodiments or aspects, the merchant application, the ciphertext generation module (205), and the communication module (206) may exist inside the memory (202). In another embodiment, the merchant application, the ciphertext generation module (205), and the communication module (206) may exist outside the memory (202). In addition, the user device (101) includes a subscriber identity module (SIM) card (204) communicatively connected to the processor (201). In addition, the user device (101) includes a battery (207) for providing power required for operation of the user device (101). In some non-limiting embodiments or aspects, the SIM card (204) includes information such as a SIM number and a telephone number associated with the SIM card (204).

[0079] In some non-limiting embodiments or aspects, a ciphertext generation module (205) is used to generate a first ciphertext based on at least one of a telephone number and a unique identification value associated with a user device (101) using a first key. The ciphertext generation module (205) obtains the telephone number from a SIM card (204) in the user device (101), obtains the unique identification value from a memory (202) in the user device (101), and obtains the first key from at least one of a server associated with a manufacturer or a memory (202) in the user device (101). In some non-limiting embodiments or aspects, the first key may be generated by a server associated with the manufacturer and stored in a memory (202) associated with the user device (101). In addition, the ciphertext generation module (205) generates the first ciphertext using one or more encryption techniques. The one or more encryption techniques may include one of an encryption technique based on a symmetric key, an encryption technique based on an asymmetric key, a cryptographic technique based on a digital signature, a cryptographic hash function, JWE, JWS, and / or any combination thereof.

[0080] In some non-limiting embodiments or aspects, the communication module (206) is used to communicate with a server associated with the manufacturer (e.g., the first server (103)) via the communication network (105) to send a request for a first key and receive the first key from the first server (103). In addition, the communication module (206) is used to communicate with the network server (102) via the communication network (105) to send the request for the first key to the network server (102) directly or through the first server (103), and receive the first key from the network server (102) directly or via the first server (103). In addition, the communication module (206) is used to communicate with the issuer server (104) via the communication network (105) to provide the second cryptogram and payment transaction details to the issuer server (104) to authenticate the payment transaction, and receive an authentication response from the issuer server (104) after authenticating the payment transaction.

[0081] Figure 2B A simplified block diagram of a network server (102) is shown in accordance with some non-limiting embodiments or aspects of the present disclosure.

[0082] In some non-limiting embodiments or aspects, the network server (102) may include at least one central processing unit ("CPU" or "processor") (208) and a memory (209) storing instructions executable by the at least one processor (208). The processor (208) may include at least one data processor for executing program components, the program components for executing user or system generated requests. The memory (209) is communicatively coupled to the processor (208). The network server (102) also includes an input / output (I / O) interface (210). The I / O interface (210) is coupled to the processor (208), and input signals and / or output signals are transmitted through the I / O interface.

[0083] In some non-limiting embodiments or aspects, the key generation module (211) is used to generate a first key and a second key. After receiving a request from a user device (101), the first key is generated in real time using one or more cryptographic techniques. The first key is used by the user device (101) to generate a first ciphertext. The first key is also used by the first server (103) to verify the first ciphertext. After receiving a request from the first server (103), the second key is generated in real time using one or more cryptographic techniques. The second key is used by the first server (103) to generate a second ciphertext. The second key is also used by the issuer server (104) to verify the second ciphertext. In another embodiment, the first key and the second key can be generated periodically (e.g., every minute, 5 minutes, 15 minutes, etc.) using one or more cryptographic techniques and stored in the memory (209). If a request is received from the user device (101) or the first server (103), the periodically generated first key and second key are used to generate the first ciphertext and the second ciphertext, respectively.

[0084] In some non-limiting embodiments or aspects, the key sharing module (212) is used to provide the generated first key to the user device (101) and a server associated with the manufacturer of the user device (101) (e.g., the first server (103)). In addition, the key sharing module (212) is used to provide the generated second key to the first server (103) and the issuer server (104). In some non-limiting embodiments or aspects, the key generation module (211) and the key sharing module (212) can be combined into a single module.

[0085] Figure 3 A flow chart illustrating method steps for authenticating a payment transaction according to some non-limiting embodiments or aspects of the present disclosure is shown.

[0086] The order in which the method (300) is described is not intended to be construed as a limitation, and any number of the described method blocks may be combined in any order to implement the method. Additionally, individual blocks may be deleted from the method without departing from the spirit and scope of the subject matter described herein. Furthermore, the method may be implemented in any suitable hardware, software, firmware, and / or combinations thereof.

[0087] At step 301, the user device (101) receives a request from a merchant application installed in the user device (101) to verify a phone number associated with a SIM card in the user device (101).

[0088] In some non-limiting embodiments or aspects, the user may use the user device (101) to pay the merchant the transaction amount through a merchant application installed in the user device (101). The merchant application may include an application that allows the user to purchase one or more goods (e.g., groceries, clothing, appliances, electronic devices, etc.), one or more services (e.g., news subscriptions, music subscriptions, e-books, etc.), etc. In addition, the user may select a payment card from a plurality of payment instruments stored in the merchant application to pay the merchant the transaction amount, such as Figure 4A The various payment instruments stored in the merchant application are referred to as "cards on file". The selection of a payment card indicates the initiation of a payment transaction in the user device.

[0089] In some non-limiting embodiments or aspects, in order to pay a transaction amount to a merchant, an issuer server (104) associated with a payment card needs to authenticate a user by verifying a phone number associated with a SIM card (204) in a user device (101) using payer information (107) stored in a database associated with the issuer server (104). In addition, after the user selects a payment card, the merchant application sends a request to the user device (101) to verify the phone number associated with the SIM card (204) in the user device (101).

[0090] Return to reference Figure 3 At step 302, in response to receiving the request, the user device (101) obtains a first key from at least one of a server associated with a manufacturer of the user device (101) and a network server (102).

[0091] In some non-limiting embodiments or aspects, the first key may be an alphanumeric string used to determine the output of one or more encryption techniques and one or more decryption techniques. The first key is generated using one or more cryptographic techniques, such as a pseudo-random number generator, a Diffie-Hellman technique, a key management interoperability protocol, a software token, etc. In some non-limiting embodiments or aspects, the first key may include two subkeys, wherein the first subkey is provided to the user device (101) and the second subkey is provided to the first server (103). In another embodiment, the first key may include a single key or a single subkey provided to both the user device (101) and the first server (103).

[0092] In some non-limiting embodiments or aspects, the user device (101) sends a request for the first key (401) to a server associated with a manufacturer (e.g., a first server (103) of the user device (101)), such as Figure 4B As shown. The server associated with the manufacturer generates the first key (401) in real time using one or more cryptographic techniques. In addition, the user device (101) receives the first key (401) from the server associated with the manufacturer, as shown. Figure 4B shown.

[0093] In some non-limiting embodiments or aspects, the user device (101) obtains a first key (401) from a memory (202) associated with the user device (101). The first key (401) stored in the memory (202) is generated by a server associated with a manufacturer and is stored in the memory (202) during manufacture of the user device.

[0094] In some non-limiting embodiments or aspects, the user device (101) obtains the first key (401) from the network server (102) by sending a request for the first key (401) to the network server (102) directly or via a server associated with a manufacturer of the user device (101), such as Figure 4C As shown. The network server (102) generates the first key (401) in real time using one or more cryptographic techniques. In addition, the user device (101) receives the first key (401) from the network server (102) directly or via a server associated with the manufacturer of the user device (101), as shown. Figure 4C When the user device (101) directly obtains the first key (401) from the network server (102), the first key (401) is also provided by the network server (102) to the first server (103).

[0095] Return to reference Figure 3At step 303, the user device (101) generates a first ciphertext based on at least one of a telephone number and a unique identification value associated with the user device (101) using a first key (401), wherein the first ciphertext is provided to a server associated with the manufacturer for verification.

[0096] In some non-limiting embodiments or aspects, the user device (101) generates a first ciphertext based on one or more encryption techniques using at least one of a telephone number and a unique identification value associated with the user device (101) and a first key (401). The unique identification value includes at least an International Mobile Equipment Identity (IMEI) code, a MAC address, etc. associated with the user device (101). The one or more encryption techniques may include one of an encryption technique based on a symmetric key, an encryption technique based on an asymmetric key, a cryptographic technique based on a digital signature, a cryptographic hash function, JWE, JWS, and / or any combination thereof. The first ciphertext is an encrypted text, including at least one of a ciphertext, a digital signature, an encrypted hash, etc. In some non-limiting embodiments or aspects, the user device (101) may provide a security authentication certificate together with the first ciphertext to the first server (103). The security authentication certificate indicates the integrity of the user device (101).

[0097] In some non-limiting embodiments or aspects, after generating the first cryptogram (402), the user device (101) provides the first cryptogram (402) to a server associated with the manufacturer for verification, such as Figure 4DAs shown. In addition, the server associated with the manufacturer uses the first key (401) and one or more decryption techniques corresponding to the one or more encryption techniques used to generate the first ciphertext (402) to decrypt the first ciphertext (402). The one or more decryption techniques may include one of a symmetric key-based decryption technique, an asymmetric key-based decryption technique, a digital signature-based cryptographic technique, a cryptographic hash function, JWE, JWS, and / or any combination thereof. In addition, the first server (103) verifies the telephone number and unique identification value associated with the user device (101) based on the user information (106) stored in the database corresponding to the manufacturer of the server associated with the user device (101). In some non-limiting embodiments or aspects, the first server (103) verifies the telephone number and unique identification value by generating a new ciphertext using the user information (106) (e.g., telephone number and unique identification value) stored in the database corresponding to the server and the first key (401). In addition, when comparing the first ciphertext (402) with the new ciphertext, if the first ciphertext (402) and the new ciphertext are the same, the verification is successful. Alternatively, if the first ciphertext (402) and the new ciphertext are different, the authentication is unsuccessful. Successful authentication indicates the association between the SIM card (204) in the user device (101) and the device integrity.

[0098] Return to reference Figure 3 , at step 304, upon verifying the first cryptogram (402), the user device (101) receives a second cryptogram from a server associated with the manufacturer, wherein the merchant application provides the second cryptogram and payment transaction details to the issuer server (104) to verify the payment transaction.

[0099] In some non-limiting embodiments or aspects, in Figure 4E After verifying the first ciphertext (402), the second ciphertext (403) received by the user device (101) from the server associated with the manufacturer is generated by the server associated with the manufacturer using a second key based on at least one of a phone number and a unique identification value associated with the user device (101). The phone number and the unique identification value are stored in the database as user information (106). In some non-limiting embodiments or aspects, the second ciphertext (403) may include the user's phone number. The second ciphertext is an encrypted text, including at least one of a ciphertext, a digital signature, an encrypted hash, etc. The second ciphertext is generated using a cryptographic technique, and the cryptographic technique includes one of a symmetric key-based encryption technique, an asymmetric key-based encryption technique, a digital signature-based encryption technique, a cryptographic hash function, JWE, JWS, and / or any combination thereof.

[0100] In some non-limiting embodiments or aspects, the first server (103) obtains the second key from the network server (102). After successfully verifying the first ciphertext (402), the first server (103) sends a request to the network server (102) to obtain the second key. The network server (102) generates the second key in real time using one or more cryptographic techniques, such as a pseudo-random number generator, Diffie-Hellman technology, a key management interoperability protocol, a software token, etc. In some non-limiting embodiments or aspects, the second key may include two subkeys, wherein the first subkey is provided to the first server (103) and the second subkey is provided to the issuer server (104). In another embodiment, the second key may include a single key or a single subkey provided to both the first server (103) and the issuer server (104). The first server (103) generates the second ciphertext (403) using the user information (106) and the second key, and provides the second ciphertext (403) to the user device (101), such as Figure 4E shown.

[0101] In some non-limiting embodiments or aspects, the user device (101) provides the second cryptogram (403) and the payment transaction (404) including the payment transaction details received from the first server (103) to the issuer server (104) by sending the second cryptogram (403) and the payment transaction (404) to the issuer server (104) via at least one of a network server (102), a direct integration with the issuer server (104), an access control server (ACS), and a merchant plug-in (MPI) provider, such as Figure 4F For example, the payment transaction details may include payment card details, payment transaction amount, issuer details, acquirer details, etc. The user device (101) provides the second cryptogram (403) and the payment transaction (404) to the issuer server (104) to authenticate the payment transaction (404) and the user.

[0102] In some non-limiting embodiments or aspects, the issuer server (104) decrypts the second ciphertext (403) using the second key. The second key is obtained from the network server (102). In some non-limiting embodiments or aspects, the issuer server (104) may request the second key from the network server (102). In another embodiment, the network server (102) may provide the second key when providing the second key to the first server (103). After decrypting the second ciphertext (403), the issuer server (104) obtains the user's phone number from the second ciphertext (403). In addition, the issuer server (104) verifies the phone number associated with the user device (101) based on the payer information (107) stored in the database associated with the issuer server (104). The issuer server (104) verifies the phone number received in the second ciphertext (403) by comparing the phone number with the payer information (107). The payer information (107) includes the identity of the user, such as name, date of birth, etc., and the user's phone number. When the telephone number received in the second ciphertext (403) matches the payee information (107), the verification is successful. When the telephone number received in the second ciphertext (403) does not match the payee information (107), the verification is unsuccessful. If the verification is successful, the payment transaction (404) is authenticated by the issuer server (104). If the verification is unsuccessful, the payment transaction (404) is not authenticated by the issuer server (104). In addition, the issuer server (104) provides an authentication response (405) to the user device (101) based on the result of the verification, such as Figure 4F The authentication response (405) includes at least one of a success message or an unsuccessful message based on the verification result.

[0103] In some non-limiting embodiments or aspects, the user device (101) receives an authentication response (405) from the issuer server (104) indicating one of a successful authentication or an unsuccessful authentication of the payment transaction (404). The successful authentication of the payment transaction (404) indicates that the payment transaction (404) was initiated by an authorized user. In addition, the merchant application provides the authentication response (405) to the network server (102) to authorize the payment transaction (404).

[0104] The method of authenticating a payment transaction (404) includes authenticating a user as an authorized user of the payment transaction (404) by decrypting a second ciphertext (403) to verify the telephone number with payer information (107) stored in a database associated with an issuer server (104). The verification of the first ciphertext (402) by the first server (103) confirms the integrity of the user device (101) and confirms the association of the telephone number and SIM card (204) with the user device (101). The second ciphertext (403) generated by the first server (103) using the second key is used to authenticate the user and the payment transaction (404). The verification of the second ciphertext (403) by the issuer server (104) confirms that the generation of the second ciphertext (403) was performed solely by the first server (103). In addition, the user telephone number received in the second ciphertext (403) matches the payer information (107) indicating that the user is an authorized user and the payment transaction (404) is a valid transaction between the user and the merchant. The method of authenticating the payment transaction (404) eliminates the need for a text message based one-time password to authenticate the user. In addition, the method of authenticating the payment transaction (404) to keep the phone number secure allows only the first server (103) and the issuer server (104) to access the phone number.

[0105] Figure 5 A block diagram of an exemplary computer system (500) for implementing embodiments consistent with the present disclosure is shown. In some non-limiting embodiments or aspects, the computer system (500) can be used to implement a method for authenticating a payment transaction (404). The computer system (500) can include a central processing unit ("CPU" or "processor") (502). The processor (502) can include at least one data processor for executing a program component for dynamic resource allocation at run time. The processor (502) can include a special-purpose processing unit, such as an integrated system (bus) controller, a memory management control unit, a floating point unit, a graphics processing unit, a digital signal processing unit, etc.

[0106] The processor (502) may be configured to communicate with one or more I / O devices (not shown) via an input / output (I / O) interface (501). The I / O interface (501) may employ communication protocols / methods such as, but not limited to, audio, analog, digital, mono, RCA, stereo, IEEE-(139)4, serial bus, universal serial bus (USB), infrared, PS / 2, BNC, coaxial, component, composite, digital video interface (DVI), high-definition multimedia interface (HDMI), RF antenna, S-Video, VGA, IEEE802.1n / b / g / n / x, Cellular (e.g., Code Division Multiple Access (CDMA), High Speed ​​Packet Access (HSPA+), Global System for Mobile Communications (GSM), Long Term Evolution (LTE), etc.

[0107] Using the I / O interface (501), the computer system (500) can communicate with one or more I / O devices. For example, the input device (510) can be an antenna, keyboard, mouse, joystick, (infrared) remote control, camera, card reader, fax machine, dongle, biometric reader, microphone, touch screen, touch pad, trackball, stylus, scanner, storage device, transceiver, video device / source, etc. The output device (511) can be a printer, fax machine, video display (e.g., cathode ray tube (CRT), liquid crystal display (LCD), light emitting diode (LED), plasma, plasma display panel (PDP), organic light emitting diode display (OLED)), etc.), audio speaker, etc.

[0108] In some non-limiting embodiments or aspects, the computer system (500) is connected to a service operator via a communication network (509). The processor (502) can be configured to communicate with the communication network (509) via a network interface (503). The network interface (503) can communicate with the communication network (509). The network interface (503) can use a connection protocol, including but not limited to direct connection, Ethernet (e.g., twisted pair 10 / (100) / (100)0Base T), Transmission Control Protocol / Internet Protocol (TCP / IP), Token Ring, IEEE 802.11a / b / g / n / x, etc. The communication network (509) can include but is not limited to direct interconnection, e-commerce network, peer-to-peer (P2P) network, local area network (LAN), wide area network (WAN), wireless network (e.g., using wireless application protocol), Internet, Wi-Fi, etc. Etc. Using the network interface (503) and the communication network (509), the computer system (500) can communicate with one or more service operators.

[0109] In some non-limiting embodiments or aspects, the processor (502) may be configured to communicate with a memory (505) (eg, Figure 5The storage interface (504) can communicate with the memory (505), which includes but is not limited to a memory drive, a removable optical drive, etc., and the memory uses a connection protocol such as Serial Advanced Technology Attachment (SATA), Integrated Drive Electronics (IDE), IEEE-(139)4, Universal Serial Bus (USB), Fibre Channel, Small Computer System Interface (SCSI), etc. The memory drive may also include a drum, a magnetic disk drive, a magneto-optical disk drive, an optical disk drive, a redundant array of independent disks (RAID), a solid-state memory device, a solid-state drive, etc.

[0110] The memory (505) may store a series of programs or database components, including but not limited to a user interface (506), an operating system (507), a network server (508), etc. In some non-limiting embodiments or aspects, the computer system (500) may store user / application data (506), such as data, variables, records, etc., as described in the present disclosure. Such a database may be implemented as a fault-tolerant, relational, scalable, secure database, such as Oracle or Sybase.

[0111] The operating system (507) can facilitate resource management and operation of the computer system (500). Examples of operating systems include, but are not limited to: OS UNIX-like distributions (e.g., BERKELEY SOFTWARE (BSD), OPENBSD, etc.), DISTRIBUTIONS (e.g., RED wait), ( / 7 / 8, 10, etc.), ANDROID TM , OS, etc.

[0112] In some non-limiting embodiments or aspects, the computer system (500) may implement a web browser ( Figure 5 The program components stored in the web browser (not shown). Figure 5 (not shown) may be a hypertext viewing application, such as INTERNET CHROME TM , etc. Secure web browsing can be provided using Hypertext Transfer Protocol Secure (HTTPS), Secure Sockets Layer (SSL), Transport Layer Security (TLS), etc. Web browsers can use technologies such as AJAX, DHTML, Application Programming Interface (API) and the like. In some non-limiting embodiments or aspects, the computer system (500) may implement a mail server ( Figure 5 The mail server may be an Internet mail server, such as Exchange, etc. The mail server (not shown in the figure) can use dynamic server pages (ASP), C++ / C#, .NET、CGI SCRIPTS、 PHP, The mail server can use tools such as Internet Message Access Protocol (IMAP), Messaging Application Programming Interface (MAPI), Exchange, Post Office Protocol (POP), Simple Mail Transfer Protocol (SMTP), etc. In some non-limiting embodiments or aspects, the computer system (500) can implement a mail client ( Figure 5 The mail client (not shown) stores the program components. Figure 5 ) may be a mail viewing application, such as MAIL, wait.

[0113] In addition, embodiments consistent with the present disclosure may be implemented using one or more computer-readable storage media. A computer-readable storage medium refers to any type of physical memory that can store information or data that can be read by a processor. Therefore, a computer-readable storage medium can store instructions executed by one or more processors, including instructions that cause the processor to perform steps or stages consistent with the embodiments described herein. The term "computer-readable medium" should be understood to include tangible items and does not include carrier waves and transient signals, e.g., non-transient ones. Examples include random access memory (RAM), read-only memory (ROM), volatile memory, non-volatile memory, hard disk drives, compact disk (CD) ROMs, digital video disks (DVDs), flash drives, disks, and any other known physical storage media.

[0114] In some non-limiting embodiments or aspects, the computer system (500) can receive at least one of a request for a first key (401), a request for a second key, a second ciphertext (403), a payment transaction (404), and an authentication response (405) from a remote device (512) such as a user device (101), a first server (103), and an issuer server (104) via a communication network (509).

[0115] The described operations can be implemented as methods, systems or products for manufacturing software, firmware, hardware or any combination thereof using standard programming and / or engineering techniques. The described operations can be implemented as codes maintained in a "non-transitory computer-readable medium", where a processor can read and execute the code from a computer-readable medium. The processor is at least one of a microprocessor and a processor capable of processing and executing inquiries. Non-transitory computer-readable media may include media such as magnetic storage media (e.g., hard disk drives, floppy disks, tapes, etc.), optical memories (CD-ROMs, DVDs, optical disks, etc.), volatile and non-volatile memory devices (e.g., EEPROMs, ROMs, PROMs, RAMs, DRAMs, SRAMs, flash memory, firmware, programmable logic, etc.), etc. In addition, non-transitory computer-readable media may include all computer-readable media except transient. The code implementing the described operations may be further implemented in hardware logic (e.g., integrated circuit chips, programmable gate arrays (PGAs), application ASICs, etc.).

[0116] An "article of manufacture" includes a non-transitory computer-readable medium and / or hardware logic in which code may be implemented. A device in which code implementing the described operational embodiments is encoded may include a computer-readable medium or hardware logic. Of course, those skilled in the art will recognize that many modifications may be made to this configuration without departing from the scope of the present disclosure, and that the article of manufacture may include suitable information bearing media known in the art.

[0117] Unless expressly specified otherwise, the terms "some non-limiting embodiments or aspects," "embodiments," "multiple embodiments," "described embodiments," "described multiple embodiments," "one or more embodiments," "some non-limiting embodiments or aspects," and "certain non-limiting embodiments or aspects" mean "one or more (but not all) embodiments of the present disclosure." The description of some non-limiting embodiments or aspects with several components in communication with each other does not mean that all of these components are required. Instead, various optional components are described to illustrate various possible embodiments of the present disclosure.

[0118] Unless expressly specified otherwise, the terms "including," "comprising," "having," and variations thereof mean "including but not limited to." Unless expressly specified otherwise, an enumerated listing of items does not mean that any or all of the items are mutually exclusive. Unless expressly specified otherwise, the terms "a," "an," and "the" mean "one or more." The description of some non-limiting embodiments or aspects with several components in communication with each other does not mean that all of these components are required. Instead, various optional components are described to illustrate various possible embodiments of the present disclosure.

[0119] Figure 3 The illustrated operations of show specific events that occur in a particular order. In alternative embodiments, certain operations may be performed, modified, or removed in a different order. In addition, steps may be added to the logic described above, and the steps may still conform to the described embodiments. In addition, the operations described herein may be performed in sequence, or certain operations may be processed in parallel. However, the operations may be performed by a single processing unit or a distributed processing unit.

[0120] The description of some non-limiting embodiments or aspects with several components in communication with each other does not mean that all of these components are required. Instead, various optional components are described to illustrate various possible embodiments of the present disclosure.

[0121] Finally, the language used in the specification is selected primarily for readability and didactic purposes, and is not selected to delimit or limit the subject matter of the present invention. It is therefore intended that the scope of the present disclosure is not limited by this detailed description, but rather by any claims issued on applications based on the present disclosure. Therefore, the disclosure of the embodiments of the present disclosure is intended to be illustrative, rather than limiting, of the scope of the present disclosure set forth in the appended claims.

[0122] While various aspects and embodiments have been disclosed herein, other aspects and embodiments will be apparent to those skilled in the art. The various aspects and embodiments disclosed herein are for purposes of illustration and are not intended to be limiting, with the true scope and spirit being indicated by the following claims.

Claims

1. A computer-implemented method comprising: receiving, by a user device, a selection of a payment card from a plurality of payment cards stored in a merchant application on the user device for use in a payment transaction between a user of the user device and a merchant associated with the merchant application; In response to receiving the selection of the payment card, initiating, by the user device, a payment transaction between the user and the merchant via the merchant application; In response to receiving a selection of the payment card, sending, by the merchant application, to the user device a request for verification of a telephone number associated with a subscriber identity module (SIM) card in the user device; receiving, by the user device from the merchant application installed in the user device, a request to verify the telephone number associated with a SIM card in the user device; as well as In response to receiving the request, obtaining, by the user device, the telephone number from the SIM card and a key from at least one of a server associated with a manufacturer of the user device or a network server; Wherein obtaining the key comprises: sending a request for the key to a server associated with a manufacturer of the user device; and One of the following: (i) receiving the key from a server associated with the manufacturer, wherein the server associated with the manufacturer generates the key in real time using one or more cryptographic techniques; (ii) obtaining the key from a memory associated with the user device, wherein the key is generated by a server associated with the manufacturer and stored in the memory associated with the user device during manufacture of the user device; or (iii) sending a request for the key from a server associated with a manufacturer of the user device to the network server; and receiving the key from the network server via the server associated with the manufacturer of the user device, wherein the network server generates the key in real time using the one or more cryptographic techniques; generating, by the user device, a first ciphertext based on the telephone number using the key; sending, by the user device, the first cryptographic text and a security authentication certificate to a server associated with the manufacturer for verification, the security authentication certificate indicating the integrity of the user device; and Upon verification of the first cryptogram and the secure authentication certificate by a server associated with the manufacturer, a second cryptogram is received by the user device from a server associated with the manufacturer, wherein the merchant application provides the second cryptogram and payment transaction details to an issuer server to authenticate the payment transaction.

2. The method according to claim 1, wherein: The first ciphertext is generated based on one or more encryption techniques using at least one of a telephone number and a unique identification value associated with the user device and the key.

3. The method according to claim 1, wherein: Providing the first ciphertext to a server associated with the manufacturer triggers the server associated with the manufacturer to decrypt the first ciphertext using the key and one or more decryption techniques corresponding to the one or more encryption techniques used to generate the first ciphertext, and to verify a telephone number and a unique identification value associated with the user device based on user information stored in a database corresponding to the server associated with the manufacturer of the user device.

4. The method according to claim 1, wherein: A second cryptogram received by at least one processor from a server associated with the manufacturer is generated by the server associated with the manufacturer based on at least one of a telephone number and a unique identification value associated with the user device using the key obtained from the network server.

5. The method according to claim 1, wherein: Providing the second ciphertext and the payment transaction details to the issuer server includes sending the second ciphertext and the payment transaction details to the issuer server via at least one of: the network server, a direct integration with the issuer server, an access control server (ACS), a merchant plug-in (MPI) provider, or any combination thereof.

6. The method according to claim 1, further comprising: After authenticating the payment transaction, receiving an authentication response from the issuer server, wherein the authentication of the payment transaction comprises: Decrypting the second ciphertext by the issuer server using the key, wherein the key is obtained from the network server; verifying, by the issuer server, a telephone number associated with the user device based on payer information stored in a database associated with the issuer server; and The authentication response is provided by the issuer server to the user device based on a result of the verification.

7. The method of claim 1, wherein the unique identification value comprises at least an International Mobile Equipment Identity (IMEI) code associated with the user device.

8. A user device for authenticating a payment transaction, comprising: at least one processor; as well as a memory communicatively coupled to the at least one processor, wherein the memory stores processor instructions that, when executed, cause the at least one processor to: receiving a selection of a payment card from among a plurality of payment cards stored in a merchant application of the user device for use in a payment transaction between a user of the user device and a merchant associated with the merchant application; initiating a payment transaction between the user and the merchant via the merchant application in response to receiving a selection of the payment card; In response to receiving a selection of the payment card, receiving a request from a merchant application installed in the user device to verify a telephone number associated with a subscriber identity module (SIM) card in the user device; In response to receiving the request, obtaining the telephone number from a SIM card and obtaining a key from at least one of a server associated with a manufacturer of the user device or a network server; wherein when obtaining the key, wherein when obtaining the key, the processor instructions further cause the at least one processor to: sending a request for the key to a server associated with a manufacturer of the user device; and One of the following: (i) receiving the key from a server associated with the manufacturer, wherein the server associated with the manufacturer generates the key in real time using one or more cryptographic techniques; (ii) obtaining the key from a memory associated with the user device, wherein the key is generated by a server associated with the manufacturer and stored in a memory associated with the user device during manufacture of the user device, wherein the key includes the key; or (iii) sending a request for the key from a server associated with a manufacturer of the user device to the network server; and receiving the key from the network server via the server associated with the manufacturer of the user device, wherein the network server generates the key in real time using the one or more cryptographic techniques; generating a first ciphertext based on the telephone number using the key; sending the first cryptographic text and a security authentication certificate to a server associated with the manufacturer for verification, the security authentication certificate indicating the integrity of the user device; as well as Upon verification of the first cryptogram and the secure authentication certificate by a server associated with the manufacturer, a second cryptogram is received from a server associated with the manufacturer, wherein the merchant application provides the second cryptogram and payment transaction details to an issuer server to authenticate the payment transaction.

9. The user device according to claim 8, wherein: The at least one processor is configured to generate the first ciphertext based on one or more encryption techniques using at least one of a telephone number and a unique identification value associated with the user device and the key.

10. The user device according to claim 8, wherein: The at least one processor is configured to provide the first ciphertext to a server associated with the manufacturer to trigger the server associated with the manufacturer to decrypt the first ciphertext using the key and one or more decryption techniques corresponding to the one or more encryption techniques used to generate the first ciphertext, and to verify a telephone number and a unique identification value associated with the user device based on user information stored in a database corresponding to the server associated with the manufacturer of the user device.

11. The user device according to claim 8, wherein: The at least one processor is configured to receive a second cryptogram generated by a server associated with the manufacturer based on at least one of a telephone number and a unique identification value associated with the user device using the key, wherein the key is obtained from the network server.

12. The user device according to claim 8, wherein: The at least one processor is further configured to provide the second cryptogram and the payment transaction details to the issuer server, including sending the second cryptogram and the payment transaction details to the issuer server via at least one of: the network server, a direct integration with the issuer server, an access control server (ACS), a merchant plug-in (MPI) provider, or any combination thereof.

13. The user device according to claim 8, wherein: The at least one processor is further configured to: After authenticating the payment transaction, receiving an authentication response from the issuer server, wherein the authentication of the payment transaction comprises: Decrypting the second ciphertext by the issuer server using the key, wherein the key is obtained from the network server; verifying, by the issuer server, a telephone number associated with the user device based on payer information stored in a database associated with the issuer server; and The authentication response is provided by the issuer server to the user device based on a result of the verification.

Images