System and method for near field contactless card communication and cryptographic authentication - Patents.com

Abstract

Systems and methods for authentication may include an authentication server. The authentication server may include a processor and a memory. The processor may be configured to receive cryptograms associated with a first Near Field Communication Data Exchange Format (NDEF) read. The processor may be configured to perform first factor authentication of the cryptograms. The processor may be configured to receive a first data set associated with a second NDEF read. The processor may be configured to extract metadata from the first data set. The processor may be configured to perform second factor authentication based on the metadata after the first factor authentication. The processor may be configured to generate a message indicating a result of the second factor authentication. The processor may be configured to transmit a message instructing the processor to perform one or more actions.

Description

[Technical field]

[0001] (CROSS REFERENCE TO RELATED APPLICATIONS) This application claims priority to U.S. Patent Application No. 17 / 161,424, filed January 28, 2021, the disclosure of which is incorporated by reference in its entirety herein.

[0002] (Technical field) The present disclosure relates to systems and methods for contactless card communications, and more particularly, to systems and methods for near field wireless communication and cryptographic authentication of contactless cards. [Background technology]

[0003] In card-based operations, many data points are stored within the chip and can be transmitted to devices that communicate with the card when the card is swiped or other data transfers occur. These operations often involve the use of the card to communicate with point-of-sale (POS) devices, servers, or other devices that may also send information back to the card. Such communications must be protected from eavesdropping and unauthorized access.

[0004] However, transmission of data without encryption or other protection is subject to interception, replay and other attacks and may be subject to other vulnerabilities, resulting in increased security risks and an increased risk of account and card misuse. These risks may be further increased by the use of contactless cards, which communicate wirelessly with other devices.

[0005] Measures taken to address security risks may consume system resources and hinder business efficiency. Performing a large number of operations may increase the consumption of system resources, reduce operational efficiency, and cause operations to be unable to be performed or to degrade performance.

[0006] These and other deficiencies exist, and therefore what is needed is a system and method of authentication that overcomes these shortcomings by protecting communications from eavesdropping and unauthorized access in a secure and reliable manner. Summary of the Invention

[0007] An embodiment of the present disclosure provides an authentication server. The authentication server may include a processor and a memory. The processor may be configured to receive cryptogram associated with a first Near Field Communication Data Exchange Format (NDEF) read. The processor may be configured to perform first factor authentication of the cryptogram. The processor may be configured to receive a first data set associated with a second NDEF read. The processor may be configured to extract metadata from the first data set. The processor may be configured to perform second factor authentication based on the metadata after the first factor authentication. The processor may be configured to generate a message indicating a result of the second factor authentication. The processor may be configured to transmit a message instructing the processor to perform one or more actions.

[0008] An embodiment of the present disclosure provides a method of authentication. The method may include receiving cryptogram associated with a first Near Field Communication Data Interchange Format (NDEF) read. The method may include performing a first factor authentication. The method may include receiving a first data set associated with a second NDEF read. The method may include extracting metadata from the first data set. The method may include performing a second factor authentication based on the metadata after the first factor authentication. The method may include generating a message indicating a result of the second factor authentication. The method may include sending a message instructing the processor to perform one or more actions.

[0009] An embodiment of the present disclosure provides a computer-readable non-transitory medium comprising computer-executable instructions that, when executed on a processor, perform a procedure comprising the steps of receiving a cryptogram associated with a first Near Field Communication Data Interchange Format (NDEF) read; performing a first factor authentication; receiving a first data set, the first data set associated with a second NDEF read; extracting metadata from the first data set; after the first factor authentication, performing a second factor authentication based on the metadata; after the second factor authentication, performing a third factor authentication by generating one or more prompts associated with one or more queries; sending one or more prompts via one or more notifications; receiving input responsive to one or more queries; authenticating the input; and after authenticating the input, converting a first type operation to a second type operation.

[0010] The various embodiments of the present disclosure, together with further objects and advantages, may best be understood by reference to the following description taken in conjunction with the accompanying drawings, in which: [Brief description of the drawings]

[0011] [Figure 1] FIG. 1 illustrates an authentication system according to an exemplary embodiment. [Figure 2A] FIG. 2A is a diagram illustrating a contactless card according to an exemplary embodiment. [Figure 2B] FIG. 2B is a diagram of a contact pad of a contactless card according to an exemplary embodiment. [Diagram 3] FIG. 3 illustrates an authentication method according to an example embodiment. [Figure 4] FIG. 4 illustrates a sequence diagram of an authentication process according to an example embodiment. [Diagram 5] FIG. 5 illustrates an authentication method according to an example embodiment. [Figure 6] FIG. 6 illustrates an authentication method according to an example embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] The following description of the embodiments provides non-limiting representative examples with reference to numbers to particularly describe the features and teachings of various aspects of the present invention. It should be recognized from the description of the embodiments that the described embodiments can be implemented separately or in combination with other embodiments. Those skilled in the art who review the description of the embodiments should be able to learn and understand the various aspects of the present invention described. The description of the embodiments should facilitate the understanding of the present invention to the extent that it is understood that other embodiments are consistent with the application of the present invention within the scope of the knowledge of those skilled in the art who read the description of the embodiments, although not specifically covered.

[0013] The systems and methods disclosed herein convert card-not-present transactions into card-present transactions, resulting in reduced risk and lower fraud rates. Card-not-present transactions may be created based on various input parameters, including but not limited to primary account number, card verification value, expiration date, etc. Upon entering the communication field of the device, the card is authenticated by a first factor authentication and is configured to transmit a first data set to an application including instructions to be executed on the device for second factor authentication to convert the first type of operation to a second type of operation. This may be accomplished by reading data from the card of the last few transactions, which is compared by the server with data stored or accessible for known transactions. Additionally, the application may be configured to ask the user one or more questions to answer as a third factor authentication. In this manner, multi-factor authentication may be utilized to protect communications susceptible to phishing and replay attacks, reducing security risks and the risk of account and card misuse.

[0014] Advantages of the systems and methods disclosed herein include improved authentication by protecting communications from interception and unauthorized access. The systems and methods disclosed herein enable encrypted data communications to avoid data interception, phishing and replay attacks, and mitigate other security vulnerabilities.

[0015] In addition, to improve authentication, multiple authentication factors can be implemented and customized queries can be sent via prompts, which can further reduce security risks and improve transaction efficiency.

[0016] These features can be implemented without burdening users with unnecessary security tasks that degrade the user experience, and furthermore, these features can be performed in a manner that enables time-efficient performance of transactions in order to comply with user expectations and transaction requirements.

[0017] Thus, the systems and methods disclosed herein reduce the risk of fraudulent activity, such as misuse of a card or an account associated with the card. The systems and methods disclosed herein improve upon implementations that lack secure authentication. These benefits may be advantageously achieved while promoting system efficiency and avoiding degradation of the user experience.

[0018] Figure 1 illustrates an authentication system 100. System 100 may include a first device 105, a second device 110, a network 115, a server 120, and a database 125. Although Figure 1 illustrates a single instance of the components of system 100, system 100 may include any number of components.

[0019] The system 100 may include a first device 105. The first device 105 may comprise a contactless card, a contact-based card, a network-enabled computer, or other device described herein. The network-enabled computer referred to herein includes, but is not limited to, a computing or communication device, such as a server, a network appliance, a personal computer, a workstation, a telephone, a handheld PC, a personal digital assistant, a contactless card, a thin client, a fat client, an Internet browser, a kiosk, a tablet, a terminal, or other device. As further described below in FIGS. 2A-2B, the first device 105 may include one or more processors 102 and a memory 104. The memory 104 may include one or more applets 106 and one or more counters 108. Each counter 108 may include a counter value. The memory 104 may include a counter value, transmission data, and at least one key.

[0020] The first device 105 may include a communication interface 107. The communication interface 107 may include communication capabilities with a physical interface and a contactless interface. For example, the communication interface 107 may be configured to communicate with the physical interface, such as by swiping through a card swipe interface or by inserting into a card chip reader at an automated teller machine (ATM) or other device configured to communicate through the physical interface. In other examples, the communication interface 107 may be configured to establish contactless communication with a card reader via near-field wireless communication methods such as NFC, Bluetooth, Wi-Fi, RFID, and other forms of contactless communication. As shown in FIG. 1, the communication interface 107 may be configured to directly communicate with the second device 110, the server 120, and / or the database 125 via the network 115.

[0021] The first device 105 may be in data communication with any number of components of the system 100. For example, the first device 105 may transmit data to the second device 110 and / or the server 120 over the network 115. The first device 105 may transmit data to the database 125 over the network 115. In some examples, the first device 105 may be configured to transmit data over the network 115 after entering one or more communication fields of any device. Without limitation, each entry may be associated with a tap, a swipe, a wave, and / or any combination thereof.

[0022] The system 100 may include a second device 110. The second device 110 may include one or more processors 112 and a memory 114. The memory 114 may include one or more applications, including but not limited to an application 116. The second device 110 may be in data communication with any number of components of the system 100. For example, the second device 110 may transmit data to a server 120 over a network 115. The second device 110 may transmit data to a database 125 over the network 115. Without limitation, the second device 110 may be a network-enabled computer. A network-enabled computer as referred to herein may include a computing or communication device, including, but not limited to, for example, a server, a network appliance, a personal computer, a workstation, a telephone, a handheld PC, a personal digital assistant, a contactless card, a thin client, a fat client, an Internet browser, a kiosk, a tablet, a terminal, or other device. The second device 110 may be a mobile device, which may include, for example, an iPhone®, an iPad®, an Apple® iPad®, or other mobile device running Apple's iOS® operating system, any device running Microsoft®'s Windows Mobile operating system, any device running Google®'s Android® operating system, and / or other smartphones, tablets, or similar wearable mobile devices.

[0023] The second device 110 may include processing circuitry and additional components, including processors, memory, error and parity / CRC checkers, data encoders, anti-collision algorithms, controllers, command decoders, security primitives, and anti-tamper hardware, as necessary to perform the functions described herein. The second device 110 may further include a display device and an input device. The display may be any type of device for presenting visual information, such as a computer monitor, a flat panel display, a liquid crystal display, a light emitting diode display, a mobile device screen including a plasma panel, a cathode ray tube display, etc. The input device may include any device available and supported by the user's device for inputting information into the user's device, such as a touch screen, a keyboard, a mouse, a cursor control device, a touch screen, a microphone, a digital camera, a video recorder, or a video camera, etc. These devices may be used to input information and interact with the software and other devices described herein.

[0024] The system 100 may include a network 115. In some examples, the network 115 may be one or more of a wireless network, a wired network, or any combination of wireless and wired networks and may be configured to connect to any one of the components of the system 100. For example, the first device 105 may be configured to connect to the server 120 via the network 115. In some examples, the network 115 may include one or more of a fiber optic network, a passive optical network, a cable network, an Internet network, a satellite network, a wireless local area network (LAN), a global system for mobile communications, a personal communication service, a personal area network, a wireless application protocol, a multimedia messaging service, an enhanced messaging service, a short message service, a time division multiplexing based system, a code division multiple access based system, a digital amplifier, Wi-Fi, fixed wireless data, IEEE 802.11b, 802.15.1, 802.11n, and 802.11g, Bluetooth, NFC, radio frequency identification (RFID), Wi-Fi, and / or the like.

[0025] Additionally, network 115 may include, but is not limited to, telephone lines, optical fiber, IEEE Ethernet 902.3, wide area networks, wireless personal area networks, LANs, or global networks such as the Internet. Additionally, network 115 may support an Internet network, a wireless communication network, a cellular network, or the like, or any combination thereof. Network 115 may further include one network or any number of the exemplary types of networks described above, operating as a standalone network or in conjunction with one another. Network 115 may utilize one or more protocols of one or more network elements to which they are communicatively coupled. Network 115 may translate from other protocols to one or more protocols of the network devices. Although network 115 is shown as a single network, it should be understood that, according to one or more examples, network 115 may comprise multiple interconnected networks, such as, for example, the Internet, a service provider network, a cable television network, a corporate network such as a credit card association network, a home network, and the like.

[0026] The system 100 may include one or more servers 120. In some examples, the server 120 may include one or more processors 122 coupled to a memory 124. The server 120 may be configured as a central system, server, or platform for controlling and invoking various data at different times to perform multiple workflow actions. The server 120 may be configured to connect to the first device 105. The server 120 may be in data communication with the applets 106 and / or applications 116. For example, the server 120 may be in data communication with the applets 106 via one or more networks 115. The first device 105 may be in communication with the one or more servers 120 via one or more networks 115 and may operate as a respective front-end to back-end pair with the server 120. The first device 105 may send one or more requests to the server 120, for example, from the applet 106 running thereon. The one or more requests may be associated with retrieving data from the server 120. The server 120 may receive one or more requests from the first device 105. Based on the one or more requests from the applet 106, the server 120 may be configured to obtain the requested data. The server 120 may be configured to transmit the received data to the applet 106, where the received data is responsive to the one or more requests.

[0027] In some examples, server 120 may be a dedicated server computer, such as a blade server, or may be a personal computer, laptop computer, notebook computer, palmtop computer, network computer, mobile device, wearable device, or any processor-controlled device capable of supporting system 100. Although Figure 1 shows a single server 120, other embodiments may use multiple servers or multiple computer systems as needed or desired to support users, and may also use backup or redundant servers to prevent network downtime in the event that a particular server fails.

[0028] The server 120 may include applications that include instructions for execution on the server 120. For example, an application may comprise instructions for execution on the server 120. The applications of the server 120 may communicate with any component of the system 100. For example, the server 120 may execute one or more applications that enable network and / or data communication with, for example, one or more components of the system 100 to transmit and / or receive data. Without limitation, the server 120 may be a network-enabled computer. As referred to herein, a network-enabled computer may include a computing device or a communication device, including, but not limited to, a server, a network appliance, a personal computer, a workstation, a telephone, a handheld PC, a personal digital assistant, a contactless card, a thin client, a fat client, an Internet browser, or other device. Server 120 may be a mobile device, which may include, for example, an iPhone®, iPad®, Apple®'s iPad®, or other mobile device running Apple's iOS® operating system, a device running Microsoft's Windows® Mobile operating system, a device running Google's Android® operating system, and / or other smartphones, tablets, or wearable mobile devices.

[0029] Server 120 may include processing circuitry and may include additional components including processors, memory, error and parity / CRC checkers, data encoders, anti-collision algorithms, controllers, command decoders, security primitives, and anti-tamper hardware as necessary to perform the functions described herein. Server 120 may further include display devices and input devices. The display may be any type of device for presenting visual information, such as a computer monitor, flat panel display, liquid crystal display, light emitting diode display, plasma panel, mobile device screen including cathode ray tube display. The input devices may include any device available and supported by the user's device for inputting information into the user's device, such as a touch screen, keyboard, mouse, cursor control device, touch screen, microphone, digital camera, video recorder or video camera. These devices may be used to input information and interact with the software and other devices described herein.

[0030] The system 100 may include one or more databases 125. The database 125 may include a relational database, a non-relational database, or other database implementations, including a plurality of relational and non-relational databases, and any combination thereof. In some examples, the database 125 may include a desktop database, a mobile database, or an in-memory database. Furthermore, the database 125 may be hosted internally by any component of the system 100, such as the first device 105 or the server 120, or the database 125 may be hosted externally to any component of the system 100, such as the first device 105 or the server 120, by a cloud-based platform, or in any storage device in data communication with the first device 105 and the server 120. In some examples, the database 125 may be in data communication with any number of components of the system 100. For example, the server 120 may be configured to retrieve requested data sent by the applet 106 from the database 125. The server 120 may be configured to transmit received data from the database 125 to the applet 106 over the network 115, the received data being responsive to one or more transmitted requests. In other examples, the applet 106 may be configured to transmit one or more requests for the requested data from the database 125 over the network 115.

[0031] In some examples, exemplary procedures according to the disclosure described herein may be executed by a processing device and / or computing device (e.g., computer hardware device), such processing / computing configuration may be or may include all or part of a computer / processor, including, for example, but not limited to, one or more microprocessors, and capable of using instructions stored in a computer-accessible medium (e.g., RAM, ROM, hard drive, or other storage device). For example, the computer-accessible medium may be part of the memory of the first device 105, the second device 110, the server 120, and / or the database 125, or other computer hardware configuration.

[0032] In some examples, a computer-accessible medium (e.g., a storage device such as a hard disk, floppy disk, memory stick, CD-ROM, RAM, ROM, or a collection thereof, as described hereinabove) may be provided (e.g., in communication with the processing device). The computer-accessible medium may include executable instructions. Additionally or alternatively, a storage device may be provided separate from the computer-accessible medium, which may provide instructions to the processing device, for example, to configure the processing device to perform certain example procedures, processes, and methods, as described hereinabove.

[0033] The application 116 of the client device 110 may be configured to perform one or more reads of the card 105 as part of the first factor authentication. For example, the application 116 may be configured to perform a read, such as a near field communication read, of a tag, such as a near field communication tag, of the card 105. The card 105 may be configured to transmit a cryptogram. For example, the card 105 may be configured to transmit data responsive to a read, such as an initial read, via the communication interface 107 of the card 105 after entering one or more communication fields of any device. In some examples, the card 105 may be configured to transmit a cryptogram after an initial entry into a first communication field of the device 110. Without limitation, each entry may be associated with a tap, a swipe, a wave, and / or any combination thereof. The application 116 of the client device 110 may be configured to receive the cryptogram transmitted by the card 105. The cryptogram may be generated based on an initial read of the tag of the card 105. For example, the cryptogram may be obtained via a Near Field Communication Data Exchange Format (NDEF) read. In some examples, the card 105 may be configured to encrypt the ciphertext before transmitting it.

[0034] The application 116 of the client device 110 may be configured to send the cryptogram received from the card 105 to the server 120. In some examples, the server 120 may be configured to receive the cryptogram sent by the card 105. The server 120 may be configured to decrypt the cryptogram as part of the first factor authentication. In other examples, the application 116 of the client device 110 may be configured to decrypt the cryptogram as part of the first factor authentication.

[0035] The server 120 may be configured to send one or more messages to the application 116 of the client device 110. For example, one of the messages may comprise an indication of the authentication status of the cryptogram. For example, the server 120 may be configured to send a message to the application 116 of the client device 110 indicating an authentication verification, such as an authentication success status of the cryptogram. Unless the server 120 is unable to authenticate the cryptogram, the server 120 may be configured to send a message indicating an authentication failure status of the cryptogram. If the authentication of the cryptogram is unsuccessful, the server 120 may be configured to instruct the client application 116 of the client device 110, via one or more commands, to re-read the tag of the card 105 to receive the cryptogram. In this manner, the server 120 may be configured to decrypt the cryptogram as part of the first factor authentication.

[0036] The application 116 of the device 110 may be configured to receive one or more messages from the server 120. The application 116 of the device 110 may be configured to perform another read after the first factor authentication. For example, the application 116 of the device 110 may be configured to perform a second read of the card 105. The card 105 may be configured to transmit a first data set after the second read. For example, the first data set may be obtained via a second read, such as a Near Field Communication Data Exchange Format (NDEF) read. The first data set may be transmitted by the card 105 to the application 116 of the client device 110 via the second read. The first data set may comprise one or more previous data sets. The first data set may include data regarding the last three transactions, such as, but not limited to, an identifier associated with the first data set, a type of the first data set, a method of inputting into a communication field, a timestamp, and an amount. The second read may be associated with one or more gestures, including but not limited to a tap, swipe, or wave, representing any number of entries of the communication interface 107 of the card 105 into the communication field of the device.

[0037] Prior to performing the second factor authentication, the application 116 of the client device 110 or the server 120 may be configured to extract metadata from a first data set, which may be extracted from the first device 105. In some examples, the second factor authentication may include authentication of the metadata. For example, the second factor authentication may comprise authentication of the metadata of the first device 105, such as a card. In some examples, the metadata belonging to the first device 105 may be personalized, for example, by an issuer, upon creation of the first device 105. The metadata of the first device 105 may be customized to include, but is not limited to, multiple fields including one or more previous transactions (including merchant and transaction data for a predetermined number of transactions, e.g., five transactions), one or more transaction date stamps and / or time stamps, one or more phone numbers, one or more addresses, and / or combinations thereof, and / or other personally identifiable information that may be authenticated. In some examples, a mobile phone number associated with a user or account may be read from the first device 105, and the second factor authentication may be sent to the application 116 of the client device 110. For example, the second factor authentication may comprise a Short Message System one-time password received by the application 116 of the client device 110.

[0038] The application 116 of the client device 110 may be configured to perform the second factor authentication. For example, one or more sets of previous data may be evaluated against one or more reference sets of previous data as part of the second factor authentication. In another example, the application 116 of the client device 110 may be configured to send a first data set to the server 120 for evaluation as part of the second factor authentication. The application 116 of the client device 110 may be configured to generate a result of the second factor authentication by comparing the one or more sets of previous data with the one or more reference sets of previous data. Based on the result of the second factor authentication, the application 116 of the client device 110 may be configured to generate and display one or more messages indicating the result of the second factor authentication.

[0039] The application 116 of the client device 110 may be configured to perform a third factor authentication. The third factor authentication may be performed prior to the conversion of the first type of operation to a second type of operation by the application 116 of the client device 110. In other examples, the server 120 or the application 116 of the client device 110 may be configured to generate, send, and / or receive one or more messages indicating the results of the second factor authentication. For example, at least one of the messages may be configured to instruct the application 116 or the server 120 to perform one or more actions. The one or more actions may include the conversion of the first type of operation to a second type of operation. For example, the first type of operation may comprise a card-not-present transaction. The second type of operation may comprise a card-present transaction. In this manner, the conversion may improve security by indicating that a card was present to perform one or more operations, such as capturing communication with a card reader, contactless or contact-enabled terminal. In this manner, conversion of a first type of operation to a second type of operation may depend on the outcome (e.g., successful) of the second factor authentication, as the first device 105 is proven to be in the user's physical possession, thereby distinguishing between card-present and card-not-present transactions. The second factor authentication may also be followed by a third factor authentication. For example, the application 116 of the client device 110 may be configured to perform the third factor authentication by generating one or more prompts sent via one or more notifications. In some examples, the third factor authentication may be performed by prompting, via one or more notifications, input in response to one or more queries.

[0040] Without limitation, the one or more queries may include at least one selected from the group of a primary account number, a cardholder identifier (first name, middle name, last name, type of operation, date, cardholder nationality, cardholder language, address, date of birth, email, phone number, expiration date, credit card number, debit card number, and / or any combination thereof. Additionally, the one or more queries may include requests for portions of any number of these queries, including, but not limited to, redacted portions. The one or more queries may resemble knowledge-based authentication that forms the basis of a third factor authentication.

[0041] The application 116 of the client device 110 may be configured to receive inputs in response to one or more queries. For example, the inputs to the one or more queries may include a response including an answer as to how many times a user has shopped at a particular store or performed an operation at a specified reader or terminal within a time frame. In another example, the inputs to the one or more queries may include a response including an answer as to a number of items associated with a most recent purchase. In another example, the inputs to the one or more queries may include a response including an answer as to a spending amount associated with a most recent purchase. In another example, the inputs to the one or more queries may include a response including an answer as to the location and / or identity of the last two transactions.

[0042] Figure 2A illustrates one or more first devices 200. As described above with respect to Figure 1, the first devices 200 may refer to the same or similar components as the first device 105. Although Figures 2A and 2B illustrate a single instance of the components of the first device 200, any number of components may be utilized.

[0043] The first device 200 may be configured to communicate with one or more components of the system 100. The first device 200 may comprise a contact or contactless card, which may comprise a payment card, such as a credit card, debit card, or gift card, issued by a service provider 205 and displayed on the front or back of the contactless card 200. In some examples, the contactless card 200 is not related to a payment card and may comprise, but is not limited to, an identification card, a membership card, and a transportation card. In some examples, the payment card may comprise a dual interface contactless payment card. The contactless card 200 may comprise a substrate 210, which may include a single layer or one or more laminated layers of plastic, metal, and other materials. Exemplary substrate materials include polyvinyl chloride, polyvinyl chloride acetate, acrylonitrile butadiene styrene, polycarbonate, polyester, anodized titanium, palladium, gold, carbon, paper, and biodegradable materials. In some examples, contactless card 200 may have physical characteristics that conform to the ID-1 format of the ISO / IEC 7810 standard, and contactless cards may also conform to the ISO / IEC 14443 standard. However, it is understood that contactless card 200 according to the present disclosure may have different characteristics, and the present disclosure does not require that the contactless card be implemented as a payment card.

[0044] The contactless card 200 may also include identification information 215 displayed on the front and / or back of the card, and a contact pad 220. The contact pad 220 may be configured to establish contact with another communication device, including, but not limited to, a user device, a smart phone, a laptop, a desktop, or a tablet computer. The contactless card 200 may also include processing circuitry, an antenna, and other components not shown in FIG. 2A. These components may be located behind the contact pad 220 or elsewhere on the substrate 210. The contactless card 200 may also include a magnetic strip or tape (not shown in FIG. 2A) that may be located on the back of the card.

[0045] As shown in Figure 2B, the contact pad 220 of Figure 2A may include processing circuitry 225 for storing and processing information, including a processor 230, such as a microprocessor, and memory 235. It will be understood that the processing circuitry 225 may include additional components including processors, memory, error and parity / CRC checkers, data encoders, anti-collision algorithms, controllers, command decoders, security primitives, and anti-tamper hardware as necessary to perform the functions described herein.

[0046] The memory 235 may be a read-only memory, a write-once read-multiple memory, or a read / write memory, e.g., RAM, ROM, and EEPROM, and the contactless card 200 may include one or more of these memories. Read-only memory may be programmable as read-only at the factory or programmable only once. One-time programmability allows it to be written once and read many times. Write-once / read-multiple memory may be programmed at some point after the memory chip leaves the factory. Once programmed, the memory cannot be rewritten, but it can be read many times. Read / write memory may be programmed and reprogrammed many times after leaving the factory. It may also be read many times.

[0047] The memory 235 may be configured to store one or more applets 240, one or more counters 245, and a customer identifier 250. The one or more applets 240 may comprise one or more software applications configured to run on one or more contactless cards, such as a Java Card applet. However, it is understood that the applet 240 is not limited to a Java Card applet and may be any software application operable on a contactless card or other device having limited memory. The one or more counters 245 may comprise a numeric counter sufficient to store an integer number. The customer identifier 250 may include a unique alphanumeric identifier assigned to a user of the contactless card 200, which may distinguish the user of the contactless card from other contactless card users. In some examples, the customer identifier 250 may identify both a customer and an account assigned to the customer, and may further identify the contactless card associated with the customer's account.

[0048] Although the processor and memory elements of the foregoing exemplary embodiments have been described with reference to contact pads, the invention is not so limited, and it will be appreciated that these elements may be implemented outside of the contact pads 220, may be implemented completely separate from the contact pads 220, or may be implemented as additional elements in addition to the processor 230 and memory 235 elements located within the contact pads 220.

[0049] In some examples, the contactless card 200 may include one or more antennas 255. The one or more antennas 255 may be disposed within the contactless card 200 and around the processing circuitry 225 of the contact pads 220. For example, the one or more antennas 255 may be integral with the processing circuitry 225, or the one or more antennas 255 may be used with an external booster coil. As another example, the one or more antennas 255 may be external to the contact pads 220 and the processing circuitry 225.

[0050] In one embodiment, the coil of the contactless card 200 may function as the secondary of an air-core transformer. The terminal may communicate with the contactless card 200 by interrupting the power or amplitude modulation. The contactless card 200 may use a gap in the power connection of the contactless card to infer data sent from the terminal, which may be functionally maintained by one or more capacitors. The contactless card 200 may return communication by switching the load or load modulation of the coil of the contactless card. Load modulation may be detected on the coil of the terminal due to interference.

[0051] Figure 3 shows a method of authentication 300. Figure 3 may reference the same or similar components of the system 100 and first device 200 of Figures 2A and 2B.

[0052] At block 305, the method 300 may include authenticating the cryptogram. For example, the cryptogram may be authenticated as part of a first factor authentication. In some examples, an application including instructions for executing on the device may be configured to perform the first factor authentication. In other examples, a server may be configured to perform the first factor authentication. For example, an application on the client device may be configured to perform one or more reads of the card as part of the first factor authentication. For example, the application may be configured to perform a read, such as a near field communication read, of a tag, such as a near field communication tag of the card. The card may be configured to transmit the cryptogram. For example, the card may be configured to transmit data responsive to a read, such as an initial read, via a communication interface of the card after entering one or more communication fields of any device. In some examples, the card may be configured to transmit the cryptogram after an initial entry into a first communication field of the device. Without limitation, each entry may be associated with a tap, a swipe, a wave, and / or any combination thereof. The application on the client device may be configured to receive the cryptogram transmitted by the card. The cryptogram may be generated based on an initial read of a tag of the card. For example, the cryptogram may be obtained via a Near Field Communication Data Exchange Format (NDEF) read. In some examples, the card may be configured to encrypt the cryptogram before transmitting it.

[0053] The application on the client device may be configured to transmit the cryptogram received from the card to the server. In some examples, the server may be configured to receive the cryptogram transmitted by the card. The server may be configured to decrypt the cryptogram as part of the first factor authentication. In other examples, the application on the client device may be configured to decrypt the cryptogram as part of the first factor authentication.

[0054] At block 310, the method 300 may include transmitting one or more messages. For example, the server may be configured to transmit one or more messages to an application of the client device. For example, one of the messages may comprise an indication of an authentication status of the cryptogram. For example, the server may be configured to transmit a message to the application of the client device indicating an authentication verification, such as an authentication success status of the cryptogram. Unless the server is able to authenticate the cryptogram, the server may be configured to transmit a message indicating an authentication failure of the cryptogram. If the cryptogram is not successfully authenticated, the server may be configured to instruct the client application of the client device, via one or more commands, to re-read the tag of the card to receive the cryptogram. In this manner, the server may be configured to decrypt the cryptogram as part of the first factor authentication. In some examples, the server may be configured to transmit one or more messages instructing the execution of the second factor authentication.

[0055] At block 315, the method 300 may include evaluating the first data set. For example, the application of the device may be configured to receive one or more messages from the server. The application of the device may be configured to perform another read after the first factor authentication. For example, the application of the device may be configured to perform a second read of the card. The card may be configured to transmit the first data set after the second read. For example, the first data set may be obtained via a second read, such as a Near Field Communication Data Exchange Format (NDEF) read. The first data set may be transmitted by the card to the application of the client device via the second read. The first data set may comprise one or more previous data sets. Without limitation, the first data set may include data regarding the last three transactions, such as an identifier associated with the first data set, the type of the first data set, the method of entry into the communication field, a timestamp, and an amount. The second read may be associated with one or more gestures, including but not limited to a tap, a swipe, or a wave, representing any number of entries of the communication interface of the card into the communication field of the device.

[0056] The application of the client device may be configured to perform the second factor authentication. For example, one or more sets of prior data may be evaluated against one or more reference sets of prior data as part of the second factor authentication. In other examples, the application of the client device may be configured to transmit data to a server for evaluation as part of the second factor authentication.

[0057] At block 320, the method 300 may include sending one or more additional messages. For example, the application of the client device may be configured to generate a result of the second factor authentication by comparing one or more sets of previous data with one or more reference sets of previous data. Based on the result of the second factor authentication, the application of the client device may be configured to generate and display one or more additional messages indicating the result of the second factor authentication. In other examples, the server may be configured to generate and send one or more additional messages indicating the result of the second factor authentication. Furthermore, prior to performing the second factor authentication, the application of the client device or the server may be configured to extract metadata from the first data set. The metadata may be extracted from the first device. In some examples, the second factor authentication may include authentication of metadata. For example, the second factor authentication may comprise authentication of metadata of a card. In some examples, the metadata belonging to the first device may be personalized upon creation of the first device, for example, by an issuer. The metadata of the first device may be customized to include multiple fields including, but not limited to, one or more previous transactions (including merchant and transaction data for a predetermined number of transactions, such as five transactions), one or more transaction dates and timestamps, one or more phone numbers, one or more addresses, and / or combinations thereof, and / or other personally identifiable information that can be authenticated. In some examples, a mobile phone number associated with a user or account may be read from the first device and a second factor authentication may be sent to an application on the client device. For example, the second factor authentication may comprise a short messaging system one-time password received by an application on the client device.

[0058] At block 325, the method 300 may include generating one or more prompts. For example, the server may be configured to generate the one or more prompts. In other examples, an application of the device may be configured to generate the one or more prompts. An application of the client device may be configured to perform a third factor authentication. The third factor authentication may be performed by the application of the client device prior to converting the first type operation to a second type operation. In other examples, the server or application of the client device may be configured to generate, send, and / or receive one or more messages indicating a result of the second factor authentication. For example, at least one of the messages may be configured to instruct the application or server to perform one or more actions. The one or more actions may include converting the first type operation to a second type operation. For example, the first type operation may comprise a card-not-present transaction. The second type operation may comprise a card-present transaction. In this manner, the conversion may improve security by indicating that a card was present to perform one or more operations, such as capturing communication with a card reader, contactless or contact-enabled terminal. In this manner, conversion of a first type of operation to a second type of operation may depend on an outcome such as successful second factor authentication, which distinguishes between card-present and card-not-present transactions, since the first device has been certified as physically secure. Also, the second factor authentication may be followed by a third factor authentication. For example, an application on the client device may be configured to perform the third factor authentication by generating one or more prompts transmitted via one or more notifications. In some examples, the third factor authentication may be performed by prompting, via one or more notifications, input in response to one or more queries.

[0059] Without limitation, the one or more queries may include at least one selected from the group of: primary account number, cardholder identifier such as first name, middle name, last name, etc., type of operation, date, cardholder nationality, cardholder language, address, date of birth, email, phone number, expiration date, credit card number, debit card number, and / or any combination thereof. Additionally, the one or more queries may include requests for any number of portions of these queries, including, but not limited to, redacted portions. The one or more queries may resemble knowledge-based authentication that forms the basis of a third factor authentication.

[0060] At block 330, the method 300 may include sending one or more prompts. In some examples, a server may be configured to send the one or more prompts. For example, the server may be configured to send the one or more prompts to an application on the device.

[0061] At block 335, the method 300 may include authenticating the input in response to the one or more queries. For example, the server may be configured to receive the input in response to the one or more queries. In another example, an application may be configured to receive the input in response to the one or more queries. For example, an application on the client device may be configured to send the received input to the server for authentication. The application on the device may be configured to authenticate the received input in response to the one or more queries by comparing a reference input to the received input. For example, after successful authentication of the input by the application on the client device or server, the application on the client device or server may be configured to convert the first type of operation to a second type of operation. The third factor authentication may be performed prior to converting the first type of operation to a second type of operation by the application on the client device. In another example, the server or application on the client device may be configured to generate, send, and / or receive one or more messages indicating a result of the second factor authentication. For example, at least one of the messages may be configured to instruct the application or server to perform one or more actions. The one or more actions may include converting the first type of operation to a second type of operation. For example, the first type of operation may comprise a card-not-present transaction. The second type of operation may comprise a card-present transaction. In this manner, the conversion may improve security by indicating that a card was present to perform one or more operations, such as capturing communication with a card reader, contactless or contact-enabled terminal. In this manner, the conversion from the first type of operation to the second type of operation may depend on an outcome, such as a successful outcome of a second factor authentication, since a card-present transaction is distinguished from a card-not-present transaction because the first device has been proven to be in the user's physical possession. In some examples, the application on the client device may be configured to receive and authenticate the input via one or more responses in response to queries presented in one or more prompts.In another example, the application on the client device may be configured to transmit input received via one or more responses responsive to queries posed in one or more prompts to a server for authentication, and the server may be configured to transmit the received input to a database for authentication of the input and conversion of the transaction.

[0062] The client device or server application may be configured to receive inputs responsive to one or more queries. For example, the inputs to the one or more queries may include a response including an answer as to how many times a user has shopped at a particular store or performed an operation at a specified reader or terminal within a time frame. In another example, the inputs to the one or more queries may include a response including an answer as to a number of items associated with a most recent purchase. In another example, the inputs to the one or more queries may include a response including an answer as to a spending amount associated with a most recent purchase. In another example, the inputs to the one or more queries may include a response including an answer as to the location and / or identity of the last two transactions.

[0063] 4 shows a sequence diagram 400 of an authentication process according to an example embodiment. FIG 4 may refer to the same or similar components of the system 100, the first device 200 of FIG 2A and FIG 2B, and the method 300 of FIG 3.

[0064] At step 410, an application on the client device may be configured to perform one or more reads of the card as part of the first factor authentication. For example, the application may be configured to perform a read, such as a near field communication read, of a tag, such as a near field communication tag, on the card.

[0065] At step 420, the card may be configured to transmit the cryptogram. The card may be configured to transmit data in response to a read, such as an initial read, via the card's communication interface after entering one or more communication fields of any device. For example, the card may be configured to transmit the cryptogram after an initial entry into a first communication field of the device. Without limitation, each entry may be associated with a tap, a swipe, a wave, and / or any combination thereof. An application of the client device may be configured to receive the cryptogram transmitted by the card. The cryptogram may be generated based on an initial read of the card's tag. For example, the cryptogram may be obtained via a Near Field Communication Data Exchange Format (NDEF) read. In some examples, the card may be configured to encrypt the cryptogram before transmitting it.

[0066] At step 430, the application on the client device may be configured to send the cryptogram received from the card to the server. In some examples, the server may be configured to receive the cryptogram sent by the card. The server may be configured to decrypt the cryptogram as part of the first factor authentication. In other examples, the application on the client device may be configured to decrypt the cryptogram as part of the first factor authentication.

[0067] At step 440, the server may be configured to send one or more messages to the application of the client device. For example, one of the messages may comprise an indication of the authentication status of the cryptogram. For example, the server may be configured to send a message to the application of the client device indicating the authentication verification, such as a successful authentication status of the cryptogram. Unless the server is able to authenticate the cryptogram, the server may be configured to send a message indicating a failure to authenticate the cryptogram. If the cryptogram is not successfully authenticated, the server may be configured to instruct the client application of the client device, via one or more commands, to re-read the tag of the card to receive the cryptogram. In this manner, the server may be configured to decrypt the cryptogram as part of the first factor authentication.

[0068] At step 450, the application on the device may be configured to receive one or more messages from the server. The application on the device may be configured to perform another read after the first factor authentication. For example, the application on the device may be configured to perform a second read of the card.

[0069] At step 460, the card may be configured to transmit data, such as a first data set, after the second read. For example, the first data set may be obtained via a second Near Field Communication Data Exchange Format (NDEF) read. The first data set may be transmitted by the card to the processor via the read. The first data set may comprise one or more previous data sets. Without limitation, the first data set may include data regarding the last three transactions, such as an identifier associated with the first data set, the type of the first data set, the method of entry into the communication field, a timestamp, and an amount. The second read may be associated with one or more gestures, including but not limited to a tap, a swipe, or a wave, representing any number of entries of the card's communication interface into the device's communication field.

[0070] At step 470, the application of the client device may be configured to perform the second factor authentication. For example, the one or more sets of previous data may be evaluated against one or more reference sets of previous data as part of the second factor authentication. In another example, the application of the client device may be configured to send the first data set to the server for evaluation as part of the second factor authentication. For example, the server may be configured to perform the second factor authentication of the first data set by generating a result of the second factor authentication by comparing the one or more sets of previous data to the one or more reference sets of previous data. The reference sets of previous data may be stored on the server. In another example, the one or more reference sets of previous data may be accessible by the server and retrieved from a database. In another example, the application of the client device may be configured to generate a result of the second factor authentication by comparing the one or more sets of previous data to the one or more reference sets of previous data. Based on the result of the second factor authentication, the application of the client device may be configured to generate and display one or more messages indicating the result of the second factor authentication.

[0071] In step 480, the server may be configured to send one or more additional messages indicating a result of the second factor authentication of the first data set. The server may be configured to instruct an application of the client device to perform second factor authentication via the one or more additional messages.

[0072] At step 490, the application of the client device may be configured to perform a third factor authentication. The third factor authentication may be performed prior to converting the first type of operation to a second type of operation by the application of the client device. In other examples, the server or application of the client device may be configured to generate, send, and / or receive one or more messages indicating a result of the second factor authentication. For example, at least one of the messages may be configured to instruct the application or server to perform one or more actions. The one or more actions may include converting the first type of operation to a second type of operation. For example, the first type of operation may comprise a card-not-present transaction. The second type of operation may comprise a card-present transaction. In this manner, the conversion may improve security by indicating that a card was present to perform one or more operations, such as by capturing communication with a card reader, contactless or contact-enabled terminal. In this manner, the conversion of the first type of operation to the second type of operation may depend on an outcome, such as a successful second factor authentication, which distinguishes between card-present and card-not-present transactions, since the first device has been proven physically secure. Also, the third factor authentication may be performed after the second factor authentication. In other examples, the server may be configured to perform the third factor authentication. In some examples, the server may be configured to instruct an application of the client device to perform the third factor authentication. For example, the application of the client device may be configured to perform the third factor authentication by generating one or more prompts transmitted via one or more notifications. In some examples, the third factor authentication may be performed by prompting, via one or more notifications, input in response to one or more queries.

[0073] Without limitation, the one or more queries may include at least one selected from the group of: primary account number, cardholder identifier such as first name, middle name, last name, etc., type of operation, date, cardholder nationality, cardholder language, address, date of birth, email, phone number, expiration date, credit card number, debit card number, and / or any combination thereof. Additionally, the one or more queries may include requests for any number of portions of these queries, including, but not limited to, redacted portions. The one or more queries may resemble knowledge-based authentication that forms the basis of a third factor authentication.

[0074] The application on the client device may be configured to receive inputs responsive to one or more queries. For example, the inputs to the one or more queries may include a response including an answer as to how many times a user has shopped at a particular store or performed an operation at a specified reader or terminal within a time frame. In another example, the inputs to the one or more queries may include a response including an answer as to a number of items associated with a most recent purchase. In another example, the inputs to the one or more queries may include a response including an answer as to an amount of spending associated with a most recent purchase. In another example, the inputs to the one or more queries may include a response including an answer as to the location and / or identity of the last two transactions.

[0075] 5 illustrates a method 500 of authentication according to an example embodiment. FIG 5 may refer to the same or similar components of the system 100, the first device 200 of FIG 2A and FIG 2B, the method 300 of FIG 3, and the sequence diagram 400 of FIG 4.

[0076] At block 505, method 500 may include performing first factor authentication. For example, an application on the client device may be configured to perform the first factor authentication. In other examples, a server may be configured to perform the first factor authentication. The application on the client device may be configured to perform one or more reads of the card as part of the first factor authentication. For example, the application may be configured to perform a read, such as a near field communication read, of a tag, such as a near field communication tag, on the card.

[0077] At block 510, the method 500 may include verifying a response to the first factor authentication. In some examples, an application of the client device may be configured to receive a response to the first factor authentication. The response may include a cryptogram. The application of the client device may be configured to verify the response to the first factor authentication. The card may be configured to transmit the cryptogram via the response. The card may be configured to transmit data in response to a read, such as an initial read, via the communication interface of the card after entering one or more communication fields of any device. For example, the card may be configured to transmit the cryptogram after an initial entry into a first communication field of the device. Without limitation, each entry may be associated with a tap, a swipe, a wave, and / or any combination thereof. The application of the client device may be configured to receive the cryptogram transmitted by the card. The cryptogram may be generated based on an initial read of a tag of the card. For example, the cryptogram may be obtained via a Near Field Communication Data Exchange Format (NDEF) read. In some examples, the card may be configured to encrypt the cryptogram before transmitting it. In some examples, the application of the client device may be configured to decrypt the cryptogram as part of the first factor authentication.

[0078] In other examples, the server may be configured to receive a response to the first factor authentication. The application on the client device may be configured to send a cryptogram received from the card to the server. In some examples, the server may be configured to receive a cryptogram sent by the card. The server may be configured to decrypt the cryptogram as part of the first factor authentication.

[0079] At block 515, the method 500 may include performing a second factor authentication. For example, an application of the client device may be configured to perform the second factor authentication. The application of the device may be configured to perform another read after the first factor authentication. For example, the application of the device may be configured to perform a second read of the card. The card may be configured to transmit data, such as a first data set, after the second read. For example, the first data set may be obtained via a second Near Field Communication Data Exchange Format (NDEF) read. The first data set may be transmitted by the card to the processor via the second read. The second read may be associated with one or more gestures, including but not limited to a tap, a swipe, or a wave, representing any number of entries of the card's communication interface into the device's communication field.

[0080] In other examples, the server may be configured to perform the second factor authentication. For example, the server may be configured to send one or more messages to an application on the client device indicating an instruction for the application on the client device or the server to perform the second factor authentication.

[0081] At block 520, the method 500 may include verifying a response to the second factor authentication. In some examples, an application of the client device may be configured to receive a response to the second factor authentication. For example, the application of the client device may be configured to receive a response to the second factor authentication that includes a first data set. The first data set may include one or more previous data sets. Without limitation, the first data set may include data regarding the last three transactions, such as an identifier associated with the first data set, a type of the first data set, a method of input into a communication field, a timestamp, and an amount.

[0082] The application of the client device may be configured to validate a response to the second factor authentication. For example, the one or more sets of previous data may be evaluated against one or more reference sets of previous data as part of the second factor authentication. In other examples, the application of the client device may be configured to generate a result of the second factor authentication by comparing the one or more sets of previous data to the one or more reference sets of previous data. Based on the result of the second factor authentication, the application of the client device may be configured to generate and display one or more messages indicating the result of the second factor authentication.

[0083] In other examples, the server may be configured to receive a response to the second factor authentication. For example, the server may be configured to validate the response to the second factor authentication. The application of the client device may be configured to send a first data set to the server for evaluation as part of the second factor authentication. For example, the server may be configured to perform the second factor authentication of the first data set by generating a result of the second factor authentication by comparing the one or more sets of previous data to one or more reference sets of previous data. The reference sets of previous data may be stored on the server. In other examples, the one or more reference sets of previous data may be accessible by the server and retrieved from a database.

[0084] At block 525, the method 500 may include performing a third factor authentication. For example, an application of the client device may be configured to perform the third factor authentication. The third factor authentication may be performed prior to converting the first type operation to a second type operation by the application of the client device. In other examples, a server or application of the client device may be configured to generate, send, and / or receive one or more messages indicating a result of the second factor authentication. For example, at least one of the messages may be configured to instruct the application or server to perform one or more actions. The one or more actions may include converting the first type operation to a second type operation. For example, the first type operation may comprise a card-not-present transaction. The second type operation may comprise a card-present transaction. In this manner, the conversion may improve security by indicating that a card was present to perform one or more operations, such as capturing communication with a card reader, contactless or contact-enabled terminal. In this manner, conversion of a first type of operation to a second type of operation may depend on an outcome such as successful second factor authentication, which distinguishes between card-present and card-not-present transactions, since the first device has been certified as physically secure. Also, the second factor authentication may be followed by a third factor authentication. For example, an application on the client device may be configured to perform the third factor authentication by generating one or more prompts transmitted via one or more notifications. In some examples, the third factor authentication may be performed by prompting, via one or more notifications, input in response to one or more queries.

[0085] Without limitation, the one or more queries may include at least one selected from the group of: primary account number, cardholder identifier such as first name, middle name, last name, etc., type of operation, date, cardholder nationality, cardholder language, address, date of birth, email, phone number, expiration date, credit card number, debit card number, and / or any combination thereof. Additionally, the one or more queries may include requests for any number of portions of these queries, including, but not limited to, redacted portions. The one or more queries may resemble knowledge-based authentication that forms the basis of a third factor authentication.

[0086] In other examples, the server may be configured to perform the third factor authentication. In some examples, the server may be configured to instruct an application on the client device to perform the third factor authentication.

[0087] At block 530, the method 500 may include verifying a response to the third factor authentication. For example, an application of the client device may be configured to receive an input in response to one or more queries. The application of the device may be configured to authenticate the input received in response to the one or more queries by comparing a reference input to the received input. In some examples, an application of the client device may be configured to receive a response to the third factor authentication. For example, an application of the client device may be configured to verify the response to the third factor authentication. The application of the client device may be configured to receive an input in response to the one or more queries. For example, the input to the one or more queries may include a response including an answer regarding how many times a user has shopped at a particular store or performed an operation at a specified reader or terminal within a time frame. In another example, the input to the one or more queries may include a response including an answer regarding a number of items associated with a most recent purchase. In another example, the input to the one or more queries may include a response including an answer regarding a spending amount associated with a most recent purchase. In another example, the input to the one or more queries may include a response including an answer regarding a location and / or identity of the last two transactions.

[0088] In another example, the server may be configured to receive a response to the third factor authentication. For example, the server may be configured to validate the response to the third factor authentication. The server may be configured to validate an input of the third factor authentication.

[0089] At block 535, the method 500 may include converting the data from a first type to a second type. For example, after the input is successfully authenticated by an application of the client device or server, the application of the client device or server may be configured to convert the transaction from a card-not-present transaction to a card-present transaction, a transaction associated with the first data set. In some examples, the application of the client device may be configured to receive and authenticate the input via one or more responses in response to a query posed in one or more prompts. In other examples, the application of the client device may be configured to send the input received via one or more responses in response to a query posed in one or more prompts to a server for authentication. The server may be configured to send the received input to a database for authentication of the input and conversion of the transaction.

[0090] The client device or server application may be configured to receive inputs responsive to one or more queries. For example, the inputs to the one or more queries may include a response including an answer regarding how many times a user has shopped at a particular store or performed an operation at a specified reader or terminal within a time frame. In another example, the inputs to the one or more queries may include a response including an answer regarding a number of items associated with a most recent purchase. In another example, the inputs to the one or more queries may include a response including an answer regarding an amount spent associated with a most recent purchase. In another example, the inputs to the one or more queries may include a response including an answer regarding the location and / or identity of the last two transactions. In another example, the client device application may be configured to send the received inputs to a server for authentication.

[0091] Fig. 6 illustrates an authentication method 600 according to an example embodiment. Fig. 6 may refer to the same or similar components of the system 100, the first device 200 of Fig. 2A and Fig. 2B, the method 300 of Fig. 3, the sequence diagram 400 of Fig. 4, and the method 500 of Fig. 5.

[0092] At block 605, the method 600 may include performing a first read. For example, the first read may be performed by an application on the device. The device may include one or more processors. The device may include a memory. The device may include an application that includes instructions for executing on the device.

[0093] At block 610, the method 600 may include authenticating the cryptogram. The processor may be configured to perform first factor authentication. In some examples, the first factor authentication may comprise authenticating the cryptogram. For example, the cryptogram may be obtained via a Near Field Communication Data Exchange Format (NDEF) read. An initial read of the card's tag may provide the cryptogram.

[0094] At block 615, the method 600 may include performing a second read. For example, after the first factor authentication, the processor may be configured to perform another read, such as the second read. In some examples, the read performed after the first factor authentication may include an NDEF read.

[0095] At block 620, the method 600 may include authenticating the data. For example, a second swipe may generate data, such as a first data set. The first data set may be transmitted by the card to the processor via the swipe. The first data set may include one or more previous data sets. Without limitation, the first data set may include data regarding the last three transactions, such as an identifier associated with the first data set, the type of the first data set, the method of entry into the communication field, a timestamp, and an amount. The swipe may be associated with one or more gestures, including but not limited to a tap, a swipe, or a wave, representing any number of entries of the card's communication interface into the device's communication field.

[0096] The first data set may be transmitted by the processor for another authentication factor, such as a second factor authentication. For example, the processor may be configured to transmit the first data set to a server. In some examples, the processor may be configured to transmit the first data set for second factor authentication. For example, one or more sets of previous data may be evaluated against one or more reference sets of previous data. The processor may be configured to generate a result of the second factor authentication by comparing the one or more sets of previous data to the one or more reference sets of previous data. Based on a result of the second factor authentication, the processor may be configured to transmit one or more messages indicating a result of the second factor authentication.

[0097] In another example, the server may be configured to generate a second factor authentication result by comparing one or more sets of previous data with one or more reference sets of previous data. The processor may be configured to receive one or more messages indicating a result of the second factor authentication. For example, the processor may be configured to receive a message from the server indicating an authentication verification, such as a successful result of the second factor authentication. In another example, the processor may be configured to receive a message from the server indicating a failed result of the second factor authentication. The processor may be configured to retransmit the first data set for the second factor authentication as long as the processor is configured to receive a message indicating a failed result of the second factor authentication. For example, the processor may be configured to retransmit the first data set for the second factor authentication up to a predetermined number corresponding to a threshold value. When the threshold value is reached, the processor may be configured to stop the authentication process. In another example, the processor may be configured to stop the authentication process as long as the processor is configured to receive a message indicating a failed result of the second factor authentication.

[0098] Prior to performing the second factor authentication, the client device or server application may be configured to extract metadata from a first data set. The metadata may be extracted from the first device. In some examples, the second factor authentication may include authentication of the metadata. For example, the second factor authentication may comprise authentication of the metadata of the first device. In some examples, the metadata belonging to the first device may be personalized, for example, by an issuer, upon creation of the first device. The metadata of the first device may be customized to be configured to include multiple fields including, but not limited to, one or more previous transactions (including merchant and transaction data for a predetermined number of transactions, such as five transactions), one or more transaction dates and timestamps, one or more phone numbers, one or more addresses, and / or combinations thereof, and / or other personally identifiable information that may be authenticated. In some examples, a mobile phone number associated with the user or account may be read from the first device and the second factor authentication may be transmitted to the application of the client device. For example, the second factor authentication may comprise a short message system one-time password received by the application of the client device.

[0099] After receiving the message indicating a result of the second factor authentication, the processor may be configured to convert the transaction from a card-not-present transaction to a card-present transaction. In some examples, the transaction may be associated with transaction data.

[0100] At block 625, the method 600 may include generating one or more queries. For example, the processor may be configured to perform a third factor authentication. The third factor authentication may be performed prior to converting the first type of operation to a second type of operation by an application of the client device. In other examples, the server or application of the client device may be configured to generate, send, and / or receive one or more messages indicating a result of the second factor authentication. For example, at least one of the messages may be configured to instruct the application or server to perform one or more actions. The one or more actions may include converting the first type of operation to a second type of operation. For example, the first type of operation may comprise a card-not-present transaction. The second type of operation may comprise a card-present transaction. In this manner, the conversion may improve security by indicating that a card was present to perform one or more operations, such as capturing communication with a card reader, contactless or contact-enabled terminal. In this manner, the conversion of the first type of operation to the second type of operation may depend on an outcome, such as a successful second factor authentication, because the first device has been certified as physically secure, thereby distinguishing between card-present and card-not-present transactions. For example, the processor may be configured to perform the third factor authentication by generating one or more prompts transmitted via one or more notifications. In some examples, the third factor authentication may be performed by prompting, via one or more notifications, input in response to one or more queries.

[0101] Without limitation, the one or more queries may include at least one selected from the group of: primary account number, cardholder identifier such as first name, middle name, last name, etc., type of operation, date, cardholder nationality, cardholder language, address, date of birth, email, phone number, expiration date, credit card number, debit card number, and / or any combination thereof. Additionally, the one or more queries may include requests for any number of portions of these queries, including, but not limited to, redacted portions. The one or more queries may resemble knowledge-based authentication that forms the basis of a third factor authentication.

[0102] In another example, the query may include a question asking how many times a user has shopped at a particular merchant within a time frame or performed an operation at a specified reader or terminal. In another example, the query may include a question requesting a number of items associated with a recent purchase. In another example, the query may include a question requesting an amount spent associated with a recent purchase. In another example, the query may include a question requesting the location and / or identity of the last two transactions.

[0103] At block 630, the method 600 may include transmitting the one or more queries via the one or more prompts. For example, a processor may be configured to transmit the one or more queries. In another example, a server may be configured to transmit the one or more queries.

[0104] In some examples, the prompts for input in response to the one or more queries may be time-limited. For example, the prompts for input may be configured to expire after a predetermined amount of time, including but not limited to seconds, minutes, hours, etc. In another example, the one or more processors may be configured to prompt for additional input in response to the one or more queries after the predetermined amount of time has elapsed. In some examples, the additional input in response to the one or more queries may differ from the input originally requested in response to the one or more queries. Thus, the initial set of one or more queries may differ from the additional set of one or more queries.

[0105] For example, the processor may be configured to request the user's middle name via one or more prompts. If no input is received or provided within 10 seconds, the input responsive to this query expires after 10 seconds and another input prompt responsive to another query may be generated and transmitted. For example, the processor may be configured to request the last four digits of a primary account number, which input must be provided within 15 seconds. In some examples, the predetermined time associated with the additional queries may be different than the predetermined time associated with the initial query. In other examples, the predetermined time associated with the additional queries may be the same as the predetermined time associated with the initial query.

[0106] In another example, the processor may be configured to generate and send a prompt requesting input of the user's nationality within 5 seconds. If no input is received or provided within 5 seconds, the input responsive to the query may expire after 5 seconds and another prompt may be generated and sent requesting input responsive to another query. For example, the processor may be configured to request the location of the most recent transaction and whether the transaction is associated with a credit card or debit card, in which case the input must be provided within 10 seconds.

[0107] In some examples, the prompt for input may be associated with a threshold number of one or more queries. For example, the input prompt may be associated with any number, such as two queries. After exhausting the number of queries, the processor may be configured to determine whether to authenticate the input based on a response input associated with the query prompt. Using the above example, the processor may be configured to terminate the received input responsive to the query if, after exhausting two queries, the processor determines that the input is incorrect.

[0108] At block 635, the method 600 may include receiving the input in response to the one or more queries. For example, a processor may be configured to receive the input in response to the one or more queries. In another example, a server may be configured to receive the input in response to the one or more queries.

[0109] At block 640, the method 600 may include authenticating the input. For example, the processor may be configured to receive the input and then authenticate the input in response to one or more queries. In another example, the server may be configured to receive the input and then authenticate the input in response to one or more queries.

[0110] Additionally, it should be noted that the systems and methods described herein may be embodied in one or more physical media, such as, but not limited to, a compact disc (CD), a digital versatile disc (DVD), a floppy disk, a hard drive, a read-only memory (ROM), a random access memory (RAM), as well as other physical media capable of storing data. For example, a data storage device may include a random access memory (RAM) and a read-only memory (ROM) that may be configured to access and store data, information, and computer program instructions. Data storage may also include storage media or other suitable types of memory (e.g., RAM, ROM, programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), magnetic disks, optical disks, floppy disks, hard disks, removable cartridges, flash drives, any type of tangible and non-transitory storage media) in which files constituting an operating system, application programs including, for example, a web browser application, an email application, and / or other applications, and data files may be stored. Data storage in a network-enabled computer system may include electronic information, files, and documents stored in various ways, e.g., flat files, indexed files, hierarchical databases, relational databases, databases created and maintained using software such as Oracle® Corporation, Microsoft® Excel files, Microsoft® Access files, and solid-state storage devices, which may include enterprise storage including flash arrays, hybrid arrays, server-side products, online or cloud storage, or other storage mechanisms. Additionally, the diagram shows various components (e.g., servers, computers, processors) separately.The functionality illustrated as being performed by various components may be performed by other components, and the various components may be combined or separated. Other variations are possible.

[0111] In the foregoing specification, various embodiments have been described with reference to the accompanying drawings. It will be apparent, however, that various modifications and changes are possible and additional embodiments may be implemented without departing from the broader scope of the invention as set forth in the claims. The specification and drawings are, therefore, to be regarded in an illustrative sense and not in a restrictive sense.

Claims

1. A method for secure data communication, comprising: receiving, by the server, a ciphertext, the ciphertext comprising a user identification; performing a first factor authentication with the server, the first factor authentication decrypting the ciphertext and verifying the user identity; receiving, by the server, a data set from an application executing on a device; performing, by the server, a second factor authentication comprising verifying the data set; generating, by the server, an authentication message; A secure method of data communication.

2. sending, by the server, a retrieve message to the application in response to the first factor authentication being successful; the acquisition message initiates acquisition of the data set by the application.

2. A method for secure data communication according to claim 1.

3. The authentication message indicates execution of the first factor authentication and the second factor authentication.

2. A method for secure data communication according to claim 1.

4. The method further comprising: transmitting, by the server, the authentication message to the application; the authentication message instructs the application to perform one or more actions.

2. A method for secure data communication according to claim 1.

5. The one or more actions include at least one selected from the group of transformations from a first type of operation to a second type of operation. A method for secure data communication according to claim 4.

6. The first type of operation comprises a card-not-present transaction; the second type of operation comprises a card-present transaction. A method for secure data communication according to claim 5.

7. The method further comprising: performing, by the server, a third factor authentication by verifying one or more user-provided data obtained via the device; the one or more user-provided data are obtained in response to the authentication message generated by the server. A method for secure data communication according to claim 4.

8. The one or more user-provided data comprises at least one selected from the group of a primary account number and a cardholder identification number. A method for secure data communication according to claim 7.

9. The cryptogram is retrieved by the device from a memory of a contactless card via near field communication (NFC); obtaining the cryptogram corresponds to a first NFC reading of the contactless card by the device; A method for secure data communication according to claim 7.

10. The data set is stored in the memory of the contactless card; the data set is obtained by the device from the memory of the contactless card by performing a second NFC read of the contactless card. A method for secure data communication according to claim 9.

11. The method of claim 10, wherein validating the data set comprises matching, by the server, the data set with one or more sets of data associated with previous transactions performed with the contactless card. A method for secure data communication according to claim 10.

12. A memory; a processor; The processor, receiving a ciphertext comprising a first set of identification data; performing a first factor authentication of the cryptogram; receiving a second set of identification data comprising one or more metadata from an application executing on the device; performing a second factor authentication based on the one or more metadata following the first factor authentication; generating an authentication message indicating a result of the second factor authentication; sending the authentication message to the device; Authentication server.

13. The processor performs third factor authentication by verifying one or more user-provided data obtained via the device; the one or more user-provided data are obtained in response to the authentication message sent by the authentication server.

13. The authentication server of claim 12.

14. The processor sends the authentication message to an application; the authentication message instructs the application to perform one or more actions.

13. The authentication server of claim 12.

15. The one or more actions include at least one selected from the group of transformations from a first type of operation to a second type of operation.

15. The authentication server of claim 14.

16. A computer-readable non-transitory medium comprising computer-executable instructions that, when executed by a processor, perform a procedure comprising the steps of: The steps include: receiving a cryptogram, the cryptogram comprising a user identification; performing a first factor authentication, the first factor authentication comprising: decrypting the ciphertext and verifying the user identity within the ciphertext; receiving a data set from an application running on the device; performing a second factor authentication comprising verifying the data set; generating an authentication message; A non-transitory computer-readable medium.

17. The procedure comprises: and in response to the first factor authentication being successful, sending a capture message to the application. the acquisition message initiates acquisition of the data set by the application.

17. The computer-readable non-transitory medium of claim 16.

18. The cryptogram is obtained from a memory of the contactless card by performing a first NFC read of the contactless card by the device.

20. The computer-readable non-transitory medium of claim 17.

19. The method of claim 19, wherein the data set is stored in the memory of the contactless card and is obtained by the device by performing a second NFC read of the contactless card.

20. The computer-readable non-transitory medium of claim 18.

20. The data set comprising one or more sets of data associated with previous transactions conducted with the contactless card.

20. The computer-readable non-transitory medium of claim 19.

Images