System and method for contextual handover authentication over short range wireless communication

Abstract

Systems and methods are provided for implementing strong user authentication over a public network. One operational aspect of the disclosed systems and methods relates to integration of browser functionality to communicate with processes and hardware elements on a device initiating a network connection to implement a context switching authentication scheme. The disclosed systems and processes also relate to an implementation of two factor strong authentication based on a single authentication input from a user involving NFC reading of a contactless card by a mobile device within Bluetooth proximity of a device initiating a network connection.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to U.S. patent application No. 17 / 731,080, filed on April 27, 2022, the disclosure of which is incorporated herein by reference in its entirety. Technical Field

[0003] The present disclosure relates to systems and methods for providing authentication credentials and authenticated user information over a network, and more particularly to systems and methods for providing context switching based authentication using short range wireless communications. Background Art

[0004] Authentication of the source of access requests transmitted over public networks to systems and applications storing access-restricted resources (such as sensitive user information) is a significant challenge for enabling secure electronic transactions and / or user data access. Several routines have been designed for providing reliable user authentication before granting access to sensitive and / or private information. One such routine corresponds to a two-factor authentication process, whereby a first form of authentication includes a first verification of the user's identity based on specific access credential information (e.g., username and password) entered by the user; and a second form of authentication triggered after the first verification typically includes transmitting a message (e.g., a push notification or an automated phone call sent to a device registered with the user) to a pre-identified second device associated with the user, and receiving a user confirmation via the pre-identified second device. Such authentication schemes typically involve a third-party data provider for pre-identifying the second device required to perform the second authentication step. As a result, existing systems and processes for implementing online access authentication are cumbersome and require additional user authentication input, which further makes such processes prone to human error. These and other deficiencies still exist. Summary of the invention

[0005] Embodiments of the present disclosure relate to a method for authenticating a connection request from a first device associated with a user using an authentication application stored on a second device associated with the same user, wherein the second device is communicatively coupled to the first device via a short-range communication protocol such as a Bluetooth Low Energy (BLE) link. The method may include: in response to a transmission received through a BLE link established between the first user device and the second user device, launching an authentication application stored on the first user device, the transmission including a Uniform Resource Indicator (URI) identifying the authentication application. The method may also include: generating, by the authentication application, a list of authentication schemes available on the first user device, wherein each authentication scheme is associated with one or more authentication actions using the first user device; generating, by the authentication application, one or more authentication tokens to indicate a successful authentication result of an authentication scheme selected by the user; and transmitting, over the BLE link, the one or more authentication tokens from the first user device to the second user device, thereby authenticating a network access request initiated from a browser running on the second user device.

[0006] In some embodiments, one of the authentication list from the list of authentication schemes available on the first user device may correspond to an NFC read of a contactless card performed by the first user device, the contactless card storing user identification information as NFC transferable data. The contactless card-based authentication scheme corresponds to a single user action of bringing the contactless card within NFC range of the first user device.

[0007] One aspect of the present disclosure relates to a system for implementing context switching authentication, which system may include: a computer hardware device configured to: in response to a transmission received through a Bluetooth Low Energy (BLE) link established between a first user device and a second user device, launch an authentication application stored on the first user device, the transmission including a uniform resource identifier (URI) identifying the authentication application. The computer hardware device may also be configured to: generate a list of authentication schemes available on the first user device, wherein each authentication scheme is associated with one or more authentication actions performed by the first user device; generate one or more authentication tokens to represent a successful authentication result of the authentication scheme selected by the user; and transmit the one or more authentication tokens to the second user device over the BLE link to thereby authenticate a network access request initiated from a browser running on the second user device.

[0008] According to some embodiments, the computer hardware device can be configured to provide an authentication scheme comprising: using a first user device as a reader to perform near field communication (NFC) reading of a contactless card that stores user identification information as NFC transferable data; and generating one or more authentication tokens to thereby authenticate the source of a network access request initiated from a browser running on a second user device.

[0009] Another aspect of the present disclosure relates to a non-transitory computer-readable medium, which includes instructions for execution by a computer hardware device, wherein, when executing the instructions, the computer hardware device is configured to perform a process including the following: launching an authentication application stored on the first user device in response to a transmission received through a Bluetooth link established between the first user device and the second user device, the transmission including a uniform resource indicator (URI) identifying the authentication application; generating a list of authentication schemes available on the first user device, the list being responsive to a selection input made using the first user device, wherein each authentication scheme is associated with one or more authentication actions performed by the user using the first user device; generating one or more authentication tokens to represent a successful authentication result of the authentication scheme selected by the user; and transmitting the one or more authentication tokens to the second user device over the Bluetooth link to thereby authenticate a network access request initiated from a browser running on the second user device.

[0010] In some embodiments, the authentication scheme for generating one or more authentication tokens corresponds to successful verification of one or more user identification information acquired by performing an NFC read of a contactless card by the first user device, the contactless card storing the user identification information as NFC transmittable data. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Various embodiments of the present disclosure together with further objects and advantages may be best understood by referring to the following description taken in conjunction with the accompanying drawings.

[0012] Figure 1 An exemplary system implementation of context switch authentication using Bluetooth procedures according to some embodiments of the present disclosure is shown.

[0013] Figure 2 An exemplary system implementation for providing context switch authentication with two-factor strong authentication based on a single user action according to some embodiments of the present disclosure is shown.

[0014] Figure 3A is an illustration of a contactless card according to some embodiments of the present disclosure.

[0015] Figure 3Bis an illustration of a contact pad of a contactless card according to some embodiments of the present disclosure.

[0016] Figure 4 is a flow chart of an automatic context switching authentication process according to some embodiments of the present disclosure.

[0017] Figure 5 is a flow chart of an automatic context switching authentication process for implementing two-factor authentication using a single authentication action from a user according to some embodiments of the present disclosure.

[0018] Figure 6 is a block diagram illustration of an exemplary system according to some embodiments of the present disclosure. DETAILED DESCRIPTION

[0019] The following description of the embodiments provides non-limiting representative examples with reference to the accompanying drawings to specifically describe the features and teachings of different aspects of the present invention. From the description of the embodiments, the described embodiments should be considered to be able to be implemented individually or in combination with other embodiments. A person of ordinary skill in the art reviewing the description of the embodiments should be able to learn and understand the different aspects described in the present invention. The description of the embodiments should promote the understanding of the present invention to such an extent that other implementations that are not specifically covered but are within the knowledge of those skilled in the art who have read the description of the embodiments will be understood to be consistent with the application of the present invention.

[0020] One aspect of the present disclosure relates to a system and method for an improved implementation of access authentication that can be applied, for example, to grant access rights to sensitive resources and / or information over a public network such as the Internet. The proposed scheme involves a novel integration of browser functionality into a process that enables a connected computing device without authentication capabilities to establish authenticated access to restricted online resources, the browser functionality enabling a website to access and use hardware and software functionality associated with a connected computing device (e.g., a smartphone and / or tablet with a web browsing application).

[0021] Therefore, some embodiments of the present disclosure enable user and / or access authentication functionality configured on one user device to be seamlessly applied to authenticate a connection initiated by another user device that may not have the above authentication configuration / functionality. Therefore, according to some embodiments, authentication capabilities configured on a specific user device (e.g., a smartphone, a tablet) can be dynamically applied to authenticate a connection initiated by another different user device (e.g., a computer, a laptop, a tablet, a smartphone, etc.). In this embodiment, authentication information between two user devices can be communicated over a short-range communication link (such as a Bluetooth Low Energy (BLE)) link.

[0022] For purposes of this disclosure, the term "website" is used interchangeably to refer to a web server that hosts a website.

[0023] Another aspect of the present disclosure relates to a system and method for implementing a dual form factor strong authentication process while requiring a single authentication input from a user. The dual form factor strong authentication process corresponds to the verification of user authentication information stored on a contactless card and read via NFC by a reader integrated and / or installed on a user mobile device. The contactless card used in the authentication process includes an integrated processor and a memory for storing user identification credentials as NFC Data Exchange Format (NDEF) data. In this dual form factor strong authentication implementation, a first form of authentication is implicitly verified upon successful pairing and interaction of (a user device requesting access) with another nearby user device (e.g., a user mobile device), which is also configured as an NFC reader of a contactless card. Verification of the information obtained by (a nearby user device) the user mobile device via NFC reading of the contactless card will constitute an explicit verification of the second form of authentication. In addition, the only external authentication action required (e.g., as provided by the user) to facilitate the described dual form factor strong authentication scheme is to bring the contactless card into the NFC range of the mobile device reader.

[0024] In some embodiments, where a username and / or password can be used as a first form of authentication, three-factor strong authentication can be achieved by the described systems and methods based on verification of proximity of devices associated with two different users (e.g., a first user device within Bluetooth range of a second user device (requesting access) and a contactless card within NFC range of the first user device), while requiring two authentication inputs from the user, corresponding to entering a username and / or password credential through a mobile device and tapping a contactless card on the user's mobile device.

[0025] One aspect of the present disclosure relates to a dynamic triggering process that is initiated upon detecting that a website code received by a connected user device (e.g., a website loaded by a browser of the connected user device) includes one or more instructions for initiating a Bluetooth process on a source device (e.g., the connected user device) to thereby establish a Bluetooth low energy (BLE) connection with one or more other user devices within a Bluetooth pairing range of the connected user device. Once the above website code is detected, an authentication application stored on a first user device that is set within a Bluetooth pairing range of the connected user device can be dynamically initiated based on the one or more instructions transmitted over the BLE connection.

[0026] The authentication application launched on the first user device can then, in response to an authentication request from a website, perform the generation and provision of the required authentication information to confirm that the entity requesting access to some access-restricted electronic resources and / or websites is in possession of or within proximity of both a first user device (e.g., a user mobile device with authentication capabilities) and a second device (e.g., a connected user device) associated with the entity requesting access, thereby authenticating the entity as the user it claims to be, and providing the requested access.

[0027] One aspect of the present disclosure relates to a proposed system and method for using an authentication scheme that includes contactless card storage and NFC-transmittable user authentication information (e.g., readable by a mobile device having a reader component running a corresponding application) combined with browser functionality for using a Bluetooth process for a connected user device to enable the contactless card authentication process to authenticate a connection initiated by the connected user device.

[0028] According to some embodiments, a user may dynamically receive one or more notifications on a first user device and / or a second user device, prompting the user to use the first user device to authenticate a network connection initiated from the second user device. Authentication information may be transmitted from the first device to the second device for communication to a destination website requiring authentication. In other embodiments, the first device may send authentication information directly to a destination website requiring authentication in order to authenticate a connection initiated from the second user device.

[0029] Some embodiments of the present disclosure are directed to providing two-factor authentication strength based on verifying that an entity requesting access to sensitive user information holds two devices, namely a first user device (e.g., a smartphone, tablet with an NFC reader) and a contactless card with an NFC tag, while requiring only a single authentication action and / or input from the user (e.g., tapping an NFC-enabled contactless card to a reader on the first user device that is actively paired with a (second) connected user device). As described above, the proposed context switching authentication scheme can be enabled, for example, via any proximity-based electronic pairing protocol that can be established between two user devices.

[0030] One aspect of the present disclosure relates to a method for implementing context switching authentication, the method comprising the following steps: in response to a transmission received via a Bluetooth link established between a first user device and a second user device, launching a specific authentication application stored on the first user device. The transmission may include a URI identifying the specific authentication application stored on the first user device. When launched, the authentication application may provide a list of authentication schemes available on the first user device, wherein each authentication scheme is associated with one or more authentication actions performed by a user using a second user device. Upon successful completion of the authentication process (based on user selection of an authentication scheme), the authentication application may generate one or more authentication tokens to represent the successful authentication result of the authentication scheme selected by the user. The authentication token may be transmitted from the first user device to the second user device over the Bluetooth link to thereby authenticate a network access request initiated from a browser running on the second user device when transmitted to a corresponding network server.

[0031] Information exchanged between the first user device and the second user device over the Bluetooth interlink may be encrypted and include one or more user personal identification information (PII) and / or payment credential information (PCI).

[0032] According to some embodiments, one or more authentication actions performed using the first user device may include entering one or more user login credentials into the first user device, and / or confirming the user identity by entering a temporary one-time password sent to the first user device as text and / or voice.

[0033] The URI encoded in the transmission received by the first device over the Bluetooth link may include a Hypertext Transfer Protocol (HTTP) deep link that redirects the user to the information page if the authentication application is not installed on the first user device. In some embodiments, if the authentication application is not installed on the first user device, the URI may be encoded to redirect the user to an application store for downloading the authentication application. In some embodiments, the URI may include a universal link using a customized format with one or more identifiers for specifying a target application to be launched on the first user device. In some embodiments, the URI may include a uniform resource locator (URL).

[0034] According to some embodiments, one or more authentication tokens generated by an authentication application running on a first user device may be transmitted to a requesting authentication network server via a back-end application programming interface (API) integrated with the requesting authentication network server, thereby authenticating a network access request initiated by a browser running on a second user device.

[0035] One aspect of the present disclosure may relate to a system for implementing context switch authentication. The system may include: a computer hardware device configured to implement an authentication process according to the embodiments described above. Another aspect of the present disclosure may relate to a non-transitory computer-readable medium, the non-transitory computer-readable medium including instructions for execution by a computer hardware device, wherein when the instructions are executed, the computer hardware device is configured to perform a process related to one or more embodiments described above.

[0036] Figure 1 An exemplary system 100 for a context switch authentication implementation is shown that uses a first user device (e.g., user mobile device 110) to authenticate a sensitive data access request (129) initiated by a second user device (120) over a standard network connection (128) to a network device hosting sensitive data (e.g., network server 150 storing secure data 153). The request (129) for sensitive data may be initiated by a second user device (e.g., user computing device 120, also referred to as a requesting access or connecting user device for purposes of this disclosure) and transmitted over network connection 128 to a destination network server (e.g., network server 150).

[0037] refer to Figure 1 In the illustrated exemplary embodiment 100, a BLE link (134) between a first user device and a second user device may be invoked by a request for authentication data (130) sent by a destination network server (e.g., network server 150) to a user device (120) requesting access thereby attempting to authenticate a request for access (129) to sensitive and / or secure data 153 stored thereon.

[0038] In addition to the first user device and the second user device, the exemplary system 100 may also include an application server (e.g., application server 140) that is communicatively coupled to the user mobile device 110 and responds to one or more communications from one or more applications (e.g., application 113) stored on the user mobile device 110. The application server (140) may also be connected to a database (e.g., database 144), which may be used to store one or more user personally identifiable information (PII) and / or payment credential information (PCI). Although Figure 1 A single instance of a component is shown, but system 100 may include any number of components.

[0039] Return to reference Figure 1 , a first user device (e.g., user mobile device 110) can receive one or more transmissions 125 over a BLE link (134) to a second user device (e.g., user computing device 120) disposed within Bluetooth pairing proximity of the first user device (110).

[0040] The one or more transmissions (125) may include a request (130) for authentication data received from the network server (150) prior to granting the (access-requesting) second user device (120) access to the requested sensitive data (e.g., secure data 153) over the network connection (128), and / or one or more electronic notifications and / or messages for specific authentication data required by the (destination) network server (150). The transmissions (125) may also include an authentication response in the form of one or more authentication tokens (126) generated by an authentication application (114) running on the first user device (110) and / or a corresponding application (143) running on the application server (140). In some embodiments, the generation of the authentication tokens (126) may be performed in part by an application (from the application suite 143) running on the application server (140) and in part by an authentication application (114) running on the first user device (110).

[0041] A request for authentication data (130) (interchangeably referred to as an authentication request (130) for purposes of this disclosure) may be generated by a (destination) network server (150) in response to a sensitive data access request (129) and transmitted to an access requesting device (e.g., user computing device 120) via a network connection (128). Once received by the user device (120) requesting access, the authentication request (130) may be wirelessly transmitted from the user device (120) requesting access to the first user device (110) via a dynamically invoked BLE link (134) for authentication processing. Upon completion of the authentication process, one or more authentication tokens (126) may be generated (to indicate a successful authentication result) and sent to the user device (120) requesting access via the BLE link. The authentication tokens (126) may then be included in an authentication response (131) and communicated to an appropriate network server (e.g., network server 150) over a network connection (128) established, for example, via a network (127).

[0042] As described, according to some embodiments of the present disclosure, an authentication process may be performed by an authentication application (114) stored on a user mobile device. The authentication application (114) may have one or more application components stored on a first user device and / or one or more components stored on a corresponding application server (140). In some embodiments, in response to receiving one or more authentication requests by a user mobile device (110) over a Bluetooth Low Energy (BLE) link (e.g., BLE link 134), a user authentication process may be performed by the authentication application (114) performing one or more client-side operations and further communicating with one or more applications 143 on the application server (140) over a network 127 to initiate one or more server-side operations associated with the user authentication process. According to exemplary embodiment 100, the user authentication process may correspond to the generation of an authentication token (126), which may be transmitted directly to a second user device (120) over a BLE link (134). The authentication token 126 may then be transmitted over the network connection 128 to the network server 150 to enable the (second) user device ( 120 ) requesting access to access the secure data 153 hosted on the network server 150 .

[0043] In some embodiments, the authentication token 126 may be transmitted from the user mobile device (110) over the BLE link 134 to the device requesting access (e.g., the user computing device 120), and from there to the network server 150 over the network connection (128) established through the network 127. The authentication token may also be transmitted directly by the (first) user mobile device (110) and / or the application server (120) to an appropriate network server (e.g., the network server 150) via, for example, the network 127. The network server (150) may store information about different authentication signatures from one or more verified sources, for example, to perform verification and validation of the authentication token 126 included in the authentication response (131).

[0044] The user mobile device (110) may be configured to transmit one or more user-related data messages to the application server (140). The user-related data may correspond to one or more user identification information stored in part or in whole on the user mobile device (110) and / or the application server (140). The user-related data may also correspond to one or more real-time captured user inputs provided in response to one or more actionable notifications received by the user mobile device (110).

[0045] User mobile device 110 may be a network-enabled computer device. Exemplary network-enabled computer devices include, but are not limited to, servers, network appliances, personal computers, workstations, phones, handheld personal computers, personal digital assistants, thin clients, fat clients, Internet browsers, mobile devices, self-service terminals, contactless cards, or other computer devices or communication devices. For example, network-enabled computer devices may include: iPhone, iPod, iPad or running Apple Any other mobile device running Microsoft Any device running Google Mobile OS operating system, and / or any other smartphone, tablet or similar wearable mobile device.

[0046] The first user device (e.g., user mobile device 110) may include a processor (111), a memory (112), and one or more applications (113). Processor 111 may be a processor, a microprocessor, or other processor, and the first user device 110 may include one or more of these processors. Processor 111 may include processing circuitry that may include additional components, including additional processors, memories, error and parity check / CRC checkers, data encoders, anti-collision algorithms, controllers, command decoders, security primitives, and anti-tampering hardware as necessary to perform the functions described herein.

[0047] The processor 111 may be coupled to a memory 112. The memory (112) may be a read-only memory, a write-once read-many memory, or a read / write memory, such as a RAM, a ROM, and an EEPROM, and the user mobile device 110 may include one or more of these memories. The read-only memory may be programmable by the manufacturer to be read-only or one-time programmable. One-time programmability provides the opportunity to write once and then read multiple times. The write-once read-many memory may be programmed at a certain point in time after the memory chip has been shipped. Once the memory is programmed, it cannot be rewritten, but can be read multiple times. The read / write memory may be programmed and reprogrammed multiple times after shipping. It may also be read multiple times. The memory 112 may be configured to store one or more software applications (113), and the memory 112 may also store user-related information, such as the user's private and / or financial account information.

[0048] One or more software applications 113 may include one or more mobile applications, a web browser with one or more browser extensions, one or more electronic data collection and authentication applications, and / or one or more banking applications with, for example, integrated authentication functionality. Application 113 may also include instructions for execution on a first user device (e.g., a user mobile device 110). In some examples, the first user device 110 may execute one or more applications, such as software applications, that enable, for example, network communications with one or more components of the system 100, transmission and / or reception of data, and execution of the functions described herein. When executed by the processor 111, one or more applications from application 113 may provide the functions described in this specification, particularly to implement and execute the steps and functions in the process flow described herein. For example, the authentication application 114 may perform one or more client-side operations when performing one or more user authentication operations in response to one or more authentication requests received on a BLE link (134) to a second user device (120). Execution of the authentication process and subsequent generation of the authentication token 126 may be performed in part or in whole by the authentication application 114 and / or a corresponding server-side application 143 stored on the application server (140). The authentication token 126, indicating a successful authentication result, may then be transmitted by the first user device (110) to the user computing device (120) over the same BLE link (134) over which one or more transmissions (125) including the authentication request (130) were received by the first user device (110). The authentication token 126 may then be transmitted by the second user device (120) to the network server 150 over the network connection 128, as indicated by the data transfer (131). Upon confirming the authentication token (126), the network server (140) may validate the sensitive data access request (129) and grant the (second) user device (120) requesting access access to the secure data (153), as indicated by the information regarding the authentication token (126). Figure 1 The data transfer path (132) shown in the exemplary embodiment 100 is indicated.

[0049] Such processes may be implemented in software (such as a software module) for execution by a computer or other machine. One or more applications may also provide a graphical user interface (GUI) through which a user can view and interact with other components and devices within the system 100. The GUI may be formatted as a web page in, for example, HyperText Markup Language (HTML), Extensible Markup Language (XML), or any other suitable form for presentation on a display device depending on the application used by the user to interact with the system 100.

[0050] The first user device (e.g., user mobile device 110) may also include an input / output (I / O) device 115. The I / O device may include a display or any type of device for presenting visual information (such as a computer monitor, a flat panel display, and a mobile device screen), including a liquid crystal display, a light emitting diode display, a plasma panel, and a cathode ray tube display. The I / O device 115 may also include any device for entering information available and supported by the user device (110), such as a touch screen, a keyboard, a mouse, a cursor control device, a touch screen, a microphone, a digital camera, a video recorder, or a camcorder. The I / O device 115 may also include a reader (116) to enable automatic acquisition / reading of data using, for example, a near field communication (NFC) protocol. The I / O device (115) may be used to enter and / or read in information and interact with the software and other devices described herein.

[0051] Application server 140 may be a network-enabled computer device. Exemplary network-enabled computer devices include, but are not limited to, servers, network appliances, personal computers, workstations, phones, handheld personal computers, personal digital assistants, thin clients, fat clients, Internet browsers, mobile devices, self-service terminals, contactless cards, or other computer or communication devices. For example, a network-enabled computer device may include a iPhone, iPod, iPad or running Apple Any other mobile device running Microsoft Any device running Google Mobile OS operating system, and / or any other smartphone, tablet or similar wearable mobile device.

[0052] Application server 140 may include a processor (141), a memory (142), and one or more applications (143). Processor 141 may be a processor, a microprocessor, or other processor, and application server 140 may include one or more of these processors. Processor (141) may include processing circuitry that may contain additional components, including additional processors, memories, error and parity / CRC checkers, data encoders, anti-collision algorithms, controllers, command decoders, security primitives, and anti-tampering hardware as necessary to perform the functions described herein.

[0053] Processor 141 may be coupled to memory 142. Memory 142 may be a read-only memory, a write-once read-many memory, or a read / write memory, such as RAM, ROM, and EEPROM, and application server (140) may include one or more of these memories. Read-only memory may be programmable by the manufacturer to be read-only or one-time programmable. One-time programmability provides the opportunity to write once and then read multiple times. Write-once read-many memory may be programmed at a certain point in time after the memory chip has been shipped. Once the memory is programmed, it cannot be rewritten, but may be read multiple times. Read / write memory may be programmed and reprogrammed multiple times after shipping. It may also be read multiple times. Memory 142 may be configured to store one or more software applications, such as application suite 143. Application server 140 may also store data corresponding to PII and PCI of one or more users.

[0054] The application suite 143 may include one or more software applications that include instructions for execution on the application server (140). In some examples, the application server 140 may execute one or more applications, such as software applications that enable, for example, network communication with one or more components of the system 100, transmission and / or reception of data, and execution of the functions described herein. When executed by the processor (141), the one or more applications from the application suite 143 may provide the functions described herein. For example, one or more applications from the application suite (143) may perform one or more server-side operations for implementing a user authentication process in response to one or more authentication requests received by the user mobile device (110) over a Bluetooth Low Energy (BLE) link (e.g., BLE link 134) to a (second) user device (120) requesting access. The one or more authentication requests may then be communicated to the application server (140) via the network (127). For example, one or more applications from application suite 143 stored on application server (140) can provide one or more server-side functions for the generation of authentication token (126), which can be sent back to a corresponding application (e.g., authentication application 114) on user mobile device (110) and transmitted from it over BLE link (134) to user device (120) requesting connection. Authentication token 126 can then be included in authentication response (131) and transmitted over network connection 128 to network server 150 to authenticate sensitive data access request 129 and provide access to secure data (153) for user device (120) requesting access, as represented by data access path (132) in exemplary system implementation (100).

[0055] Such processes may be implemented in software (such as a software module) for execution by a computer or other machine. Applications 113 and / or 143 may provide a GUI through which a user may view and interact with other components and devices within system 100. The GUI may be formatted as a web page in, for example, Hypertext Markup Language (HTML), Extensible Markup Language (XML), or any other suitable form for presentation on a display device depending on the application used by the user to interact with system 100.

[0056] Database 144 may include one or more databases configured to store data, including but not limited to one or more user identification information and / or financial account information. Database 144 may include a relational database, a non-relational database, or other database implementation, and any combination thereof (including multiple relational databases and non-relational databases). In some examples, database 144 may include a desktop database, a mobile database, or an in-memory database. In addition, database 144 may be hosted internally by application server (140), or implemented externally on a different storage device or database or on any storage device that communicates data with application server (140). Database 144 may be supported by one or more local servers, or associated with a cloud-based platform.

[0057] System 100 may also include one or more networks 127. In some examples, network 127 may be one or more of a wireless network, a wired network, or any combination of a wireless network and a wired network, and may be configured to connect user mobile devices (110), user computing devices (120), application servers (140), and network servers (150). Database 144 may be connected to application server 140 via network 127 and / or direct connection (145). The network 127 may include one or more of the following: a fiber optic network, a passive optical network, a cable network, an Internet network, a satellite network, a wireless local area network (LAN), a global system for mobile communications, a personal communications service, a personal area network, a wireless application protocol, a multimedia messaging service, an enhanced messaging service, a short message service, a time division multiplexing-based system, a code division multiple access-based system, D-AMPS, Wi-Fi, fixed wireless data, IEEE 802.11b, 802.15.1, 802.11n and 802.11g, Bluetooth, NFC, radio frequency identification (RFID), Wi-Fi, and / or the like.

[0058] In addition, the network 127 may include, but is not limited to, telephone lines, optical fibers, IEEE Ethernet 902.3, wide area networks, wireless personal area networks, LANs, or global networks (such as the Internet). In addition, the network 127 may support an Internet network, a wireless communication network, a cellular network, or the like, or any combination thereof. The network 127 may also include a network, or any number of networks of the above exemplary types, operating as independent networks or in cooperation with each other. The network 127 may use one or more protocols of one or more network elements to which they are communicatively coupled. The network 127 may convert other protocols to or from one or more protocols of a network device. Although the network 127 is depicted as a single network, it should be appreciated that according to one or more examples, the network 127 may include multiple interconnected networks, such as, for example, the Internet, a service provider network, a cable television network, a corporate network (such as a credit card association network), and a home network. The network 127 may also include or be configured to create one or more front channels that may be publicly accessible and through which communications may be observable, and one or more secure back channels that may not be publicly accessible and through which communications may not be observable.

[0059] In some examples, communications between a user mobile device (110) and an application server (140) can occur using one or more front channels and one or more secure back channels. A front channel can be a communication protocol that employs a publicly accessible and / or unsecured communication channel. Exemplary front channels include, but are not limited to, the Internet, open networks, and other publicly accessible communication networks. In some examples, communications sent using a front channel may be subject to unauthorized observation by another device. In some examples, front channel communications can include Hypertext Transfer Protocol (HTTP) Secure Sockets Layer (SSL) communications, HTTP Secure (HTTPS) communications, and browser-based communications with a server or other device.

[0060] The secure back channel may be a communication protocol that employs a secure and / or non-publicly accessible communication channel. In some embodiments, the communication link between the user mobile device (110) and the application server (140) may correspond to a secure back channel communication. In some examples, the selected number of devices may include known, trusted, or otherwise previously authorized devices. Exemplary secure back channels include, but are not limited to, closed networks, private networks, virtual private networks, offline private networks, and other dedicated communication networks.

[0061] Return to reference Figure 1, the request for authentication data (130) sent back to the second (requesting access) user device (120) may include one or more instructions for obtaining the required user authentication data from another source within the pairing proximity of the user device (120) requesting access. Thus, the BLE link 134 can be established in response to the exchange of authentication request and / or response messages (125) between the second (requesting connection) user device and the first (providing authentication) user device. In one embodiment, the one or more instructions with the request for authentication data (130) sent back from the network server (150) may include a uniform resource indicator (URI) identifying an authentication mode and / or authentication application (e.g., authentication application 114) stored on the user mobile device (110), which authentication mode and / or authentication application can be used to perform the authentication process.

[0062] According to some embodiments, invocation of one or more applications (e.g., authentication application 114) stored on the user mobile device (110) may require user authorization and may only be permitted upon detection of specific user input, for example, provided in response to an authentication request (130) included in a transmission (125) and received by the user mobile device (110) over a BLE link (134) to a (second) user computing device (120). According to some embodiments, user authentication-related input (e.g., captured by one or more I / O devices 115 installed on the user mobile device 110) may be transmitted to the application server (140) for execution.

[0063] As described above, one aspect of the proposed system and method relates to an authentication scheme for a uniquely configured contactless card having an integrated NFC tag storing NFC-transmittable user authentication information (e.g., readable by a mobile device having a reader component and running a corresponding application). Figure 3A and Figure 3B To describe the specific structure, configuration and operation of the contactless card, including its integrated processor, memory and NFC functionality, as well as the secure method of storing sensitive information as NFC transferable data. Figure 2 An exemplary system implementation (200) for context switching authentication using the aforementioned contactless card is shown in FIG.

[0064] Figure 2An exemplary system and method for implementing context switch authentication using a contactless card (202) readable, for example, by a first user device (e.g., a user mobile device 110) is shown. The contactless card (202) may include an integrated processor (203) and a memory (204). The card integrated memory (204) may store a plurality of items including one or more applets (205) that may be communicatively coupled to one or more applications running on the user mobile device 110 and / or one or more applications stored on a corresponding application server. The card integrated memory (204) may also store an application transaction counter (206) to track a sequence of transactions involving the contactless card (202). The contactless card (202) may also include a near field communication (NFC) interface (207) to conduct NFC communications with, for example, the user mobile device (110).

[0065] According to some embodiments, the contactless card (202) and the user mobile device (110) can be used in conjunction with browser functionality for a Bluetooth process for accessing a user device requesting access (e.g., the second user device 120) so that a single authentication action involving the contactless card (202) and the first user device (110) can provide two-factor strong authentication for a connection request initiated by the second user device (120) (requesting access), which is located within Bluetooth pairing distance of the first user device (110).

[0066] Figure 2 The illustrated exemplary context switch authentication implementation (200) uses a contactless card (202) having a symmetrically encrypted NFC channel (208) with a first user device (110) for encrypted transmission of user authentication data 210 (stored as NDEF data on the contactless card (202)) to, for example, an authentication application (114) running on the first user device (110). The NFC channel (208) can be activated, for example, when a reader (116) of the user mobile device (110) is moved into NFC proximity of the contactless card (202), and / or vice versa.

[0067] In an exemplary embodiment (200), a configuration involving a contactless card (202) and a user mobile device (110) is used in conjunction with a dynamically established Bluetooth communication link (e.g., BLE link 134) between a (second) device requesting access (e.g., user computing device 120) and a first user device (110) to implement a two-factor authentication strength. The two-factor authentication strength may correspond to, for example, confirming that an entity or source requesting access to sensitive user information (e.g., secure data 153) from a second user device (120) is in possession of two other different user devices, namely, a first user device (e.g., user mobile device 110) and a contactless card (202). The described context switching authentication scheme provides a two-factor authentication strength that requires only a single authentication action / input from a user (e.g., tapping an NFC-enabled contactless card (202) to a reader (116) of a first user device (110) that is proximity paired with a second user device (120) (requesting access). The proposed context switch authentication scheme may be enabled, for example, via any proximity-based electronic pairing protocol that may be established between the first user device (110) and the second user device (120).

[0068] FIG. 3A to FIG. 3B An exemplary contactless card 300 is shown. FIG. 3A to FIG. 3B A single instance of the components of card 300 is shown, but any number of components may be used.

[0069] Card 300 may be configured to communicate with one or more components of system 100. Card 300 may include a contact-based card (e.g., a card read by swiping a magnetic stripe or by inserting a chip reader) or a contactless card, and card 300 may include a payment card, such as a credit card, a debit card, or a gift card. Figure 3A As shown, card 300 may be issued by a service provider logo 305 displayed on the front of card 300 (and / or the back of card 300). In some examples, the payment card may include a dual-interface contactless payment card. In some examples, card 300 is not related to a payment card and may include, but is not limited to, an ID card, a membership card, and a transportation card.

[0070] Card 300 may include a substrate 310 that may include a single layer or one or more laminated layers of plastic, metal, and other materials. Exemplary substrate materials include polyvinyl chloride, polyvinyl chloride acetate, acrylonitrile butadiene styrene, polycarbonate, polyester, anodized titanium, palladium, gold, carbon, paper, and biodegradable materials. In some examples, card 300 may have physical characteristics of an ID-1 format that conforms to the ISO / IEC 7810 standard, and card 300 may additionally conform to the ISO / IEC 14443 standard. However, it should be understood that a card 300 according to the present disclosure may have different characteristics, and the present disclosure does not require implementation in a payment card.

[0071] The card 300 may also include identification information 315 displayed on the front and / or back of the card, and the card 300 may also include a contact pad 320. The contact pad 320 may be configured to establish contact with another communication device (including but not limited to a user device, a smartphone, a laptop computer, a desktop computer, or a tablet computer). The card 300 may also include Figure 3A Processing circuits, antennas, and other components not shown in the figure may be located behind contact pads 320 or elsewhere on substrate 310.

[0072] The service provider logo 305 may include the name and logo of the service provider, and may also include information related to the service provider, including but not limited to a phone number, address, instructions for handling the card 300 if it has been lost or damaged, and other information. The service provider logo 305 may also include an image or graphic design.

[0073] Identification information 315 may include, but is not limited to, account number, name, expiration date, phone number, nickname, and other information. In some examples, identification information 315 may also include an image or graphic design. For example, identification information 315 may include a user image, photo, drawing, or mark.

[0074] like Figure 3B As shown, Figure 3A The contact pads 320 may include processing circuitry 325 for storing and processing information, including a processor 330 (such as a microprocessor) and memory 335. It should be understood that the processing circuitry 325 may include additional components, including processors, memories, error and parity / CRC checkers, data encoders, anti-collision algorithms, controllers, command decoders, security primitives, and anti-tampering hardware as needed to perform the functions described herein.

[0075] Memory 335 can be a read-only memory, a write-once read-many memory, or a read / write memory, such as a RAM, a ROM, and an EEPROM, and the card 300 can include one or more of these memories. A read-only memory can be programmable by the manufacturer to be read-only or one-time programmable. One-time programmability provides the opportunity to write once and then read multiple times. A write-once / read-many memory can be programmed at a certain point in time after the memory chip has been shipped. Once the memory is programmed, it is no longer rewritten, but can be read multiple times. A read / write memory can be programmed and reprogrammed multiple times after shipping. It can also be read multiple times.

[0076] Memory 335 can be configured to store one or more applet programs 340, one or more counters 345 and customer identifier 350. One or more applet programs 340 can include one or more software applications configured to be executed on one or more contact-based cards or contactless cards, such as Java Card applet programs. However, it should be understood that applet program 340 is not limited to Java Card applet programs, but can be any software application operable on contact-based cards or contactless cards or other devices with limited memory. One or more counters 345 can include digital counters that are enough to store integers. Customer identifier 350 can include a unique alphanumeric identifier assigned to the user of card 300, and the identifier can distinguish the user of contactless card from other contactless card users. In some examples, customer identifier 350 can identify both the customer and the account assigned to the customer, and can also identify the contactless card associated with the customer's account.

[0077] The processor and memory elements of the aforementioned exemplary embodiments are described with reference to the contact pads, but the present disclosure is not limited thereto. It should be understood that these elements may be implemented outside of the contact pads 320 or completely separated therefrom, or implemented as other elements other than the processor 230 and memory 235 elements located within the contact pads 220.

[0078] In some examples, the card 300 may include one or more antennas 355. The one or more antennas 355 may be placed within the card 300 and around the processing circuit 325 of the contact pad 320. For example, the one or more antennas 355 may be integral with the processing circuit 325, and the one or more antennas 355 may be used with an external booster coil. For another example, the one or more antennas 355 may be external to the contact pad 320 and the processing circuit 325.

[0079] In an embodiment, the coil of the card 300 can act as the secondary of an air core transformer. The terminal can communicate with the card 300 by cutting off power or amplitude modulation. The card 300 can use the gap in the power connection of the card to infer the data transmitted from the terminal, which can be functionally maintained by one or more capacitors. The card 300 can return communication by switching the load on the coil of the card or load modulation. Load modulation can be detected in the coil of the terminal by interference.

[0080] Figure 4 An operational overview of a context switch authentication process according to some embodiments of the present disclosure is provided. Figure 4 At (402), a first user device (e.g., a user mobile device 110) receives a transmission containing a URI via a Bluetooth link established with a second user device (e.g., a user computing device 120) within an appropriate range of the first user device. Upon receiving the transmission via the BLE link with the second user device, an authentication interface application identified by the URI is launched on the first user device (step 404). The authentication interface application may provide a list of authentication modes and programs available on the first user device (step 406). Once an authentication mode is selected and appropriate authentication input commensurate with the selected authentication mode is entered using, for example, the first user device, the authentication information is verified. In step 408, one or more authentication tokens are generated to indicate successful authentication of the user. The authentication process and subsequent generation of authentication tokens may involve matching the user authentication input with previously verified and securely stored user information. The process may be performed by an authentication application on the user mobile device (110) and / or a corresponding server-side application on the application server (140). In some embodiments, the authentication operation may be performed in part by an authentication application on the first user device (110), and in part by a corresponding application server (140).

[0081] At step 410, an authentication token is transmitted from the first user device (110) to the second device (120) via a Bluetooth link. In some embodiments, the authentication token may be generated by an application server (120) and transmitted directly to the device requesting access (e.g., the second user device 120) via a public network connection (e.g., network 127). At step 412, the authentication token is communicated to a network server hosting sensitive data content (e.g., secure data 153) to thereby authenticate the network access request initiated from the second user device (120). Note that the network access request may be initiated by a user or automatically (e.g., by a website or application on the second user device).

[0082] Figure 5An exemplary flow chart (500) corresponding to an operational overview of a context switch authentication process according to some embodiments of the present disclosure is shown. Referring to the exemplary flow chart (500), at step 502, a first user device (e.g., a user mobile device 110) receives a URI transmission via a Bluetooth link established with a second user device (e.g., a user computing device 1120) that is located within an appropriate range of the first user device. Upon receiving the transmission via the BLE link with the second user device, a notification is generated that the user authenticates a contactless card (e.g., contactless card 202) using the first user device (e.g., user mobile device 110) as a reader. At step 506, information read from the contactless card via NFC transmission is verified. The verification can be performed by an appropriate application on the user mobile device and / or a corresponding application on an application server (140) that is communicatively coupled to the user mobile device. Upon confirming the information, one or more authentication tokens are generated to indicate successful verification of the NFC-transmitted data from the contactless card (202). The authentication token can be generated by one or more applications stored on the user mobile device 110 and / or the application server 140. At step 510, the authentication token is transmitted from the first user device to the second user device via the active BLE link. At step 512, the authentication token is communicated to the request authentication network server to thereby authenticate the secure network connection request initiated from the second user device. Note that the secure network connection request can be initiated by the user or automatically (e.g., by a website or application on the second user device).

[0083] Figure 6 A block diagram of an exemplary embodiment of a system according to the present disclosure is shown. For example, the exemplary processes according to the present disclosure described herein may be performed by a processing device and / or a computing device (e.g., a computer hardware device) 605. Such a processing device / computing device 605 may be, for example, all or part of a computer / processor 610, or include, but are not limited to, a computer / processor 610, which may include, for example, one or more microprocessors, and use instructions stored on a computer-accessible medium (e.g., RAM, ROM, hard drive, or other storage device).

[0084] like Figure 6As shown, for example, a computer-accessible medium 615 (e.g., a storage device as described above, such as a hard disk, a floppy disk, a memory stick, a CD-ROM, a RAM, a ROM, etc., or a collection thereof) may be provided (e.g., in communication with the processing device 605). The computer-accessible medium 615 may contain executable instructions 620 thereon. Additionally or alternatively, a storage device 625 may be provided separately from the computer-accessible medium 615, which may provide instructions to the processing device 605 so as to configure the processing device to perform certain exemplary processes, procedures, and methods, for example, as described above.

[0085] In addition, the exemplary processing device (605) may be provided with or include an input / output port (635), which may include, for example, a wired network, a wireless network, the Internet, an intranet, a data collection probe, a sensor, etc. Figure 6 As shown, the exemplary processing device (605) can communicate with an exemplary display device (630), for example, according to certain exemplary embodiments of the present disclosure, the display device can be a touch screen configured to input information to the processing device in addition to outputting information from the processing device. In addition, the exemplary display device (630) and / or the storage device (625) can be used to display and / or store data in a user-accessible format and / or a user-readable format.

[0086] As used herein, the term "card" is not limited to a specific type of card. More specifically, it should be understood that, unless otherwise indicated, the term "card" may refer to a contact-based card, a contactless card, or any other card. It should also be understood that the present disclosure is not limited to cards with specific purposes (e.g., payment cards, gift cards, identification cards, membership cards, transportation cards, access cards), cards associated with specific types of accounts (e.g., credit accounts, debit accounts, membership accounts), or cards issued by specific entities (e.g., commercial entities, financial institutions, government entities, social clubs). On the contrary, it should be understood that the present disclosure includes cards with any purpose, account association, or issuing entity.

[0087] The systems and methods described herein can provide secure, authenticated access to restricted electronic resources and / or websites. Once authenticated access has been established, the resources and / or websites can allow, but are not limited to, financial transactions (e.g., credit and debit card transactions), account management transactions (e.g., card refresh, card replacement, and new card addition transactions), membership transactions (e.g., join and leave transactions), access point transactions (e.g., building access and secure store access transactions), transportation transactions (e.g., ticketing and boarding transactions), and other transactions.

[0088] As described herein, personally identifiable information (PII) may include any sensitive data, including financial data (e.g., account information, account balances, account activity), personal information and / or personally identifiable information (e.g., Social Security number, home or work address, date of birth, telephone number, email address, passport number, driver's license number), access information (e.g., passwords, security codes, authorization codes, biometric data), and any other information that a user may wish to avoid disclosure to unauthorized persons.

[0089] The present disclosure is not limited to the specific embodiments described in this application, which are intended to be illustrations of various aspects. Many modifications and variations can be made without departing from its spirit and scope as is apparent. In addition to those listed herein, functionally equivalent methods and devices within the scope of the present disclosure can become apparent from the preceding representative descriptions. Such modifications and variations are intended to fall within the scope of the attached representative claims. The present disclosure is limited only by the terms of the attached representative claims and the full range of equivalents given by such representative claims. It should also be understood that the terms used herein are only for the purpose of describing specific embodiments and are not intended to be restrictive.

[0090] Additionally, note that the systems and methods described herein may be tangibly embodied in one or more physical media, such as, but not limited to, compact disks (CDs), digital versatile disks (DVDs), floppy disks, hard disks, read-only memories (ROMs), random access memories (RAMs), and other physical media capable of data storage. For example, data storage devices may include random access memories (RAMs) and read-only memories (ROMs), which may be configured to access and store data, information, and computer program instructions. Data storage devices may also include storage media or other suitable types of memory (e.g., such as, for example, RAMs, ROMs, programmable read-only memories (PROMs), erasable programmable read-only memories (EPROMs), electrically erasable programmable read-only memories (EEPROMs), magnetic disks, optical disks, floppy disks, hard disks, removable tape cartridges, flash drives, any type of tangible and non-transitory storage media) in which files including operating systems, application programs (including, for example, web browser applications, email applications, and / or other applications), and data files may be stored. Data storage devices of network-enabled computer systems may include electronic information, files, and documents stored in a variety of ways, including, for example, flat files, indexed files, hierarchical databases, relational databases (such as using, for example, from Databases created and maintained by the Company's software), Excel files, Access files, solid-state storage devices (which may include flash arrays, hybrid arrays, or server-side products), enterprise storage devices (which may include online or cloud storage devices), or any other storage mechanism. In addition, the various figures show various components (e.g., servers, computers, processors, etc.) separately. Functions described as being performed at various components may be performed at other components, and various components may be combined or separated. Other modifications may also be made.

[0091] In the foregoing description, various embodiments have been described with reference to the accompanying drawings. However, it will be apparent that various modifications and changes may be made thereto, and additional embodiments may be implemented without departing from the broader scope of the invention as set forth in the following claims. Accordingly, the description and drawings should be regarded as illustrative rather than restrictive.

Claims

1. A method for implementing context switch authentication, the method comprising: receiving, by an authentication application stored on a first user device over a Bluetooth link established between the first user device and a second user device, a transmission including a uniform resource indicator (URI) identifying the authentication application; generating, by the authentication application, a list of authentication schemes available on the first user device, wherein each authentication scheme is associated with one or more authentication actions using the second user device; generating one or more authentication tokens by the authentication application to indicate a successful authentication result of the authentication scheme selected by the user; as well as The one or more authentication tokens are transmitted from the first user device to the second user device over the Bluetooth link to thereby authenticate a network access request initiated from a browser running on the second user device.

2. The method according to claim 1, wherein: The one or more authentication actions include one or more of: entering login credentials using the first user device; confirming identity by entering a temporary one-time password sent to the first user device as text and / or voice.

3. The method according to claim 1, wherein: The URI includes a Hypertext Transfer Protocol (HTTP) deep link that will redirect the first user device to an information page if the authentication application is not installed on the first user device.

4. The method according to claim 1, wherein: If the authentication application is not installed on the first user device, the URI is encoded to redirect the first user device to an application store for downloading the authentication application.

5. The method according to claim 1, wherein: The URI includes a universal link using a custom format having one or more identifiers for specifying a target application to be launched on the first user device.

6. The method according to claim 1, wherein: The website loaded by the browser on the second user device includes instructions for initiating a Bluetooth procedure on the second user device to establish a connection with the first user device within pairing distance of the second user device.

7. The method according to claim 1, wherein: Information exchanged between the first user equipment and the second user equipment over the Bluetooth link is encrypted.

8. The method according to claim 1, wherein: The information exchanged between the first user equipment and the second user equipment over the Bluetooth link includes one or more user personal identification information (PII).

9. The method according to claim 1, wherein: The information exchanged between the first user equipment and the second user equipment over the Bluetooth link includes payment related information.

10. The method according to claim 1, wherein: An authentication scheme from the list of authentication schemes available on the first user device corresponds to verification of one or more information obtained by the first user device by performing an NFC read of a contactless card storing one or more user identification information as NFC transferable data.

11. The method according to claim 1, wherein: The one or more authentication actions correspond to a single user action of bringing a contactless card into NFC range of the first user device.

12. The method according to claim 1, wherein: The one or more authentication tokens are transmitted from the first user device to the request authentication network server via a backend application programming interface (API) integrated with the request authentication network server.

13. A system for implementing context switch authentication, the system comprising: A computer hardware device, wherein the computer hardware device is configured to: receiving, via a Bluetooth link established between a first user device and a second user device, a transmission including a uniform resource indicator (URI) identifying an authentication application stored on the first user device; generating a list of authentication schemes available on the first user device, wherein each authentication scheme is associated with one or more authentication actions performed by a user using the second user device; Generate one or more authentication tokens to indicate successful authentication results of the authentication scheme selected by the user; as well as The one or more authentication tokens are transmitted to the second user device over the Bluetooth link to thereby authenticate a network access request initiated from a browser running on the second user device.

14. The system according to claim 13, wherein: The computer hardware device is also configured to provide an authentication scheme, which includes: using the first user device as a reader to perform near field communication (NFC) reading of a contactless card, the contactless card storing user identification information as NFC transmittable data; and generating the one or more authentication tokens.

15. The system of claim 14, wherein: The computer hardware device is configured to transmit the one or more authentication tokens generated by the authentication scheme to the request authentication web server via a backend application programming interface (API) integrated with the request authentication web server.

16. The system of claim 13, wherein: The computer hardware device is also configured to encrypt information exchanged between the second user device and the first user device over the Bluetooth link.

17. The system of claim 13, wherein: The computer hardware device is also configured to transmit one or more user personal identification information (PII) as part of the information exchanged over the Bluetooth link.

18. A non-transitory computer-readable medium comprising instructions for execution by a computer hardware device, wherein when executing the instructions, the computer hardware device is configured to perform a process comprising: receiving a transmission received over a Bluetooth link established between a first user device and a second user device, the transmission comprising a uniform resource indicator (URI) identifying an authentication application stored on the first user device; generating a list of authentication schemes available on the first user device, the list of authentication schemes being responsive to a selection input made using the first user device, wherein each authentication scheme is associated with one or more authentication actions performed by a user using the first user device; Generate one or more authentication tokens to indicate successful authentication results of the authentication scheme selected by the user; as well as The one or more authentication tokens are transmitted to the second user device over the Bluetooth link to thereby authenticate a network access request initiated from a browser running on the second user device.

19. The non-transitory computer readable medium of claim 18, wherein: The authentication scheme used to generate the one or more authentication tokens corresponds to performing, by the first user device, an NFC read of a contactless card, the contactless card storing user identification information as NFC transferable data.

20. The non-transitory computer-readable medium of claim 18, further comprising instructions for configuring the computer hardware device to transmit the one or more authentication tokens generated by the selected authentication scheme to the request authentication network server via a back-end application programming interface (API) integrated with the request authentication network server.

Images