Using on-demand application to generate virtual number for contactless card to securely autofill form

Abstract

To provide using on-demand applications to generate virtual numbers for a contactless card to securely autofill forms.SOLUTION: In a system 100, an application server receives, from a mobile device, a link and a request generated by a contactless card and including encrypted data, determines one or more functions for processing the encrypted data, based on the encrypted data, selects an application including the one or more functions for processing the encrypted data, and transmits the application to a client device.SELECTED DRAWING: Figure 1A

Description

[Technical field]

[0001] TECHNICAL FIELD Embodiments herein relate generally to computing platforms and, more specifically, to generating virtual numbers for contactless cards and securely auto-filling form fields using on-demand applications.

[0002] Related Applications This application claims priority to U.S. patent application Ser. No. 16 / 265,961, entitled "Secure Auto-Filling of Forms Using an On-Demand Application for Generating Virtual Numbers for Contactless Cards," filed Feb. 1, 2019, the contents of which are incorporated herein by reference in their entirety. [Background technology]

[0003] A payment card account identifier is often a long string of numbers and / or characters. Therefore, it is difficult for a user to manually enter the account identifier correctly. In fact, users often make mistakes and enter incorrect account numbers into a computing interface (e.g., a payment interface). In many cases, a native operating system (OS) application downloaded from an application store may include a function to assist a user in entering an account identifier into a form. However, some users may not have such an application on their device. Thus, these users need to manually enter the account identifier correctly. Summary of the Invention

[0004] The embodiments disclosed herein provide a system, method, article of manufacture, and computer readable medium for tapping a contactless card to a computing device to securely generate a virtual card number that can be auto-filled into a form field. According to one example, a first application may output a form comprising a payment field. An operating system (OS) may receive a uniform resource locator (URL) comprising encrypted data from the contactless card. A second application may be dynamically downloaded and installed from the received URL. The second application may transmit the encrypted data to an authentication server, which may verify the encrypted data. The second application may receive a virtual account number, an expiration date associated with the virtual account number, and a CVV associated with the virtual account number from a virtual account number server. The second application may provide the virtual account number, the expiration date, and the CVV to an auto-fill service of the OS. The auto-fill service of the OS may auto-fill the virtual account number into a payment field of the first application. [Brief description of the drawings]

[0005] [Figure 1A] 1 illustrates an embodiment of a system for tapping a contactless card to a computing device to securely generate a virtual card number that can be auto-populated into form fields. [Figure 1B] 1 illustrates an embodiment of a system for tapping a contactless card to a computing device to securely generate a virtual card number that can be auto-populated into form fields. [Figure 1C] 1 illustrates an embodiment of a system for tapping a contactless card to a computing device to securely generate a virtual card number that can be auto-populated into form fields. [Figure 2A] 1 illustrates an embodiment in which a contactless card is tapped to a computing device to securely generate a virtual card number that can be auto-populated into form fields. [Figure 2B] 1 illustrates an embodiment in which a contactless card is tapped to a computing device to securely generate a virtual card number that can be auto-populated into form fields. [Figure 2C] 1 illustrates an embodiment in which a contactless card is tapped to a computing device to securely generate a virtual card number that can be auto-populated into form fields. [Figure 2D] 1 illustrates an embodiment in which a contactless card is tapped to a computing device to securely generate a virtual card number that can be auto-populated into form fields. [Diagram 3] 1 illustrates an embodiment of a first logic flow. [Figure 4] 1 illustrates a second logic flow embodiment. [Diagram 5] 13 illustrates a third logic flow embodiment. [Figure 6] 13 illustrates a fourth logic flow embodiment. [Figure 7] 1 illustrates an embodiment of a computing architecture. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0006] The embodiments disclosed herein provide a secure technique for using a contactless card to generate card data (e.g., account number, expiration date, and / or card verification value (CVV)) that can be automatically populated into forms on a computing device without the need to pre-install an application (e.g., a banking application, an account management application, a payment application, etc.) on the device. Generally, the contactless card may come within communication range of a computing device, e.g., via a tap gesture, when the computing device is outputting a form including card data fields. In doing so, the contactless card generates a uniform resource locator (URL) that is transmitted to the computing device. At least a portion of the URL may be directed to an application server that hosts one or more applications and / or application segments. An application may include an application available via an application store, while a segment of an application may include a portion of an application (e.g., one or more pages, one or more functions, etc.). For example, an application segment may be an on-demand application, such as an instant application and / or a progressive web application. One or more application segments associated with the URL may be downloaded to and executed on the computing device.

[0007] The URL generated by the contactless card may further include data used by the authentication server as part of the verification process. For example, the URL may include encrypted data that is decrypted by the server as part of the verification process. The downloaded application segment may receive the URL and extract the encrypted data. The downloaded application may send the encrypted data to the authentication server for verification. Once verified, the authentication server may instruct the virtual account number server to generate card data for the account associated with the contactless card. The card data may include a virtual account number, an expiration date, a CVV, and the user's address. The virtual account number may be a different account number than the account number associated with the contactless card. The generated card data may then be sent to an application segment running on the computing device. The application segment may provide the card data to an autofill service of the OS. The autofill service may automatically enter the card data into a corresponding payment field of a form.

[0008] As an advantage, the embodiments disclosed herein improve the security of all devices and associated data. For example, the embodiments disclosed herein provide security for applications installed via an application store when auto-filling card data without requiring the user to install the application from the application store onto the computing device. Furthermore, traditional approaches require the user to manually enter card data into forms. However, doing so may allow other users or devices to capture the card data as the user enters the card data into the form. Since the user no longer needs to manually enter the card data into the form, the security of the card data is enhanced.

[0009] With general reference to the notation and nomenclature used herein, one or more portions of the following detailed description may be presented in terms of program procedures executed on a computer or network of computers. These procedure descriptions and representations are used by those skilled in the art to most effectively convey the substance of their work to others skilled in the art. A procedure is herein, and generally, conceived to be a self-consistent sequence of operations leading to a desired result. These operations are those requiring physical manipulation of physical quantities. Usually, though not necessarily, these quantities take the form of electrical, magnetic, or optical signals capable of being stored, transferred, combined, compared, and otherwise manipulated. It is sometimes convenient, primarily for reasons of common usage, to refer to these signals as bits, values, elements, symbols, characters, terms, numbers, or the like. It should be noted, however, that all of these and similar terms are to be associated with the appropriate physical quantities and are merely convenient labels applied to these quantities.

[0010] Further, these operations are often referred to in terms, such as adding or comparing, which are commonly associated with mental operations performed by a human operator. However, no such capability of a human operator is necessary, or desirable in most cases, in any of the operations described herein forming part of one or more of the embodiments. Rather, these operations are machine operations. Useful machines for performing the operations of the various embodiments include digital computers selectively activated or configured by a computer program stored therein and written in accordance with the teachings herein, and / or include apparatus or digital computers specially constructed for the required purposes. Various embodiments also relate to apparatus or systems for performing these operations. These apparatus may be specially constructed for the required purposes. The required structure for these various machines will be apparent from the description given.

[0011] Reference is now made to the drawings, wherein like reference numerals are used to refer to like elements throughout. In the following description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding thereof. It will be apparent, however, that the novel embodiments may be practiced without these specific details. In other instances, well-known structures and devices are shown in block diagram form in order to facilitate the description. The intention is to cover all modifications, equivalents, and alternatives within the scope of the claims.

[0012] FIG. 1A illustrates a schematic diagram of an exemplary system 100 corresponding to the disclosed embodiments. As shown, the system 100 includes one or more contactless cards 101, one or more mobile devices 110, an authentication server 120, a virtual account number server 140, and an application server 150. The contactless card 101 is representative of any type of payment card, such as a credit card, a debit card, an ATM card, a gift card, etc. The contactless card 101 may include one or more chips (not shown), such as a radio frequency identification (RFID) chip, configured to communicate with the mobile device 110 via NFC, EMV standard, or other short-range protocols in wireless communication. Although NFC is used as an example of a communication protocol, the present disclosure is equally applicable to other types of wireless communication, such as EMV standard, Bluetooth, and / or Wi-Fi. The mobile device 110 is representative of any type of network-enabled computing device, such as a smartphone, a tablet computer, a wearable device, a laptop, a portable gaming device, etc. Servers 120, 140, 150 are representative of any type of computing device, such as a server, a workstation, a computing cluster, a cloud computing platform, a virtualized computing system, and the like.

[0013] As shown, the memory 111 of the mobile device 110 includes an instance of an operating system (OS) 112. Examples of operating systems 112 include Android OS, iOS, macOS, Linux, and Windows operating systems. As shown, the OS 112 includes an autofill service 114, a web browser 115, and one or more other applications 116. The autofill service 114 inserts data into the views of the other applications (e.g., the web browser 115 and / or the other applications 116) to fill in forms in the other applications. The autofill service 114 may also retrieve user data from the views of the applications and store the data for later use. The autofill service 114 is used as a reference example herein and should not be considered limiting of the disclosure. This disclosure is equally applicable to other types of code that automatically fills in form fields in applications and / or web pages by inserting data into the form fields, such as accessibility services. The web browser 115 is an application that allows the mobile device 110 to access information over the network 130 (e.g., over the Internet). In operation, the web browser 115 may access content including one or more forms 127. For example, the web browser 115 may load a bank card management page that includes one or more forms 127 with fields of card data (e.g., name fields, card number fields, expiration fields, CVV fields, billing address fields, shipping address fields, etc.). The other application 116 is representative of any application that includes one or more forms 129 with fields of card data (e.g., name fields, card number fields, expiration fields, CVV fields, billing address fields, shipping address fields, etc.).For example, other applications 116 include dedicated merchant applications for processing purchases, applications for services (e.g., taxi services, delivery services, etc.), etc. Each instance of other application 116 includes one or more forms 129 with fields for card data.

[0014] As another example, a user may make a purchase from a merchant's website using a web browser 115 and / or other application 116 provided by the merchant. To complete the transaction, the user must provide card data in one or more forms 127 in the web browser 115 and / or forms 129 in the other application 116. The use of the web browser 115 and / or other application 116 as reference examples herein should not be considered as limiting the disclosure, as the disclosure is equally applicable to all types of applications that include forms with fields for card data and all types of forms with fields for card data.

[0015] Typically, a user may encounter a form 127, 129 that includes one or more fields of card data (e.g., a name field, a card number field, an expiration date field, a CVV field, a billing address field, a shipping address field, etc.). Traditionally, a user must manually enter their name, card number, expiration date, CVV, and / or address information. Some mobile operating systems allow such data to be auto-filled into forms, while other mobile operating systems have limitations in auto-filling such data. Additionally, operating systems that allow data to be auto-filled into forms require the user to authenticate using a dedicated application to do so. For example, previous solutions require the user to install an account management application provided by the issuer of the contactless card 101 and authenticate with the application to auto-fill the card data into the form 127, 129. Advantageously, however, the embodiments disclosed herein solve such problems by leveraging the contactless card 101 to trigger the generation of a virtual account number, expiration date, and / or CVV that can be copied to the auto-fill service 114 of the OS 112 without the need for an application (e.g., an account management application) pre-installed on the device 110.

[0016] To do so, the user may tap the contactless card 101 to the mobile device 110, thereby bringing the contactless card 101 close enough to the card reader 119 of the mobile device 110 to enable NFC data transfer between the communication interface 107 of the contactless card 101 and the card reader 119 of the mobile device 110. In some embodiments, the mobile device 110 may trigger the card reader 119 via an application program interface (API) call. In one example, the mobile device 110 triggers the card reader 119 via an API call in response to a user tapping or selecting an element of a user interface, such as a form field. Additionally and / or alternatively, the mobile device 110 may trigger the card reader 119 based on periodically polling the card reader 119. More generally, the mobile device 110 may trigger the card reader 119 to communicate using any viable method. After communication is established between the mobile device 110 and the contactless card 101, the applet 103 executing on a processor (not shown) of the contactless card 101 generates and transmits data to the mobile device 110 via the communication interface 107. In some embodiments, the data generated by the contactless card 101 may include a URL 106. The URL may be directed to an application server 150 or other location hosting one or more account applications 151. When the OS 112 receives the URL 106, the OS may dynamically download the account application 151 from the URL 106 and dynamically install the account application 151 on the device. The URL 106 may further be a universal link URL (or a deep link URL) that opens a local resource (e.g., one or more specific pages of the associated account application 151). The page of the account application 151 to be opened at run time on the mobile device 110 may be specified as a parameter of the URL.

[0017] More generally, the URL 106 is representative of one or more URLs (and / or uniform resource identifiers (URIs)) directed to one or more account applications 151 of the application server 150. The applet 103 may select the URL 106 based on any suitable selection technique (e.g., randomly, based on data received from the mobile device 110, etc.). The account applications 151 may include on-demand applications that may be dynamically downloaded and installed on the mobile device 110. As shown, the account applications 151 include an instant application 152 and a progressive web application 153. An instant application is a non-persistent application that may be dynamically downloaded and installed on the mobile device 110. An example of an instant application 152 is an Android® instant application. An instant application 152 is an on-demand application that may be installed and executed on the mobile device 110 as soon as the download is complete. Furthermore, the instant application 152 corresponds to a subset of applications that are selected based on a particular function to be performed, while the remainder of the application may be downloaded at a later time (or as part of a background process). For example, an instant application 152 may be a subset of an overall account management application that performs various functions, whereas an instant application 152 comprises one or more portions of the account management application and / or a subset of the functionality provided by the account management application.

[0018] In general, a progressive web application is an on-demand application that runs on the web browser 115 and maintains persistence when executed on the mobile device 110. For example, the progressive web application may be updated in the background as storage on the mobile device 110 is allocated and new features are added to the progressive web application. One example of a progressive web application 153 is an Android progressive web application. As previously mentioned, the progressive web application 153 may be dynamically downloaded and automatically executed on the web browser 115 once the download is complete. The progressive web application 153 corresponds to a subset of an application that is selected based on a particular function to be performed. For example, the progressive web application 153 may be a subset of an overall account management application that performs various functions, while the progressive web application 153 comprises one or more portions of the account management application and / or a subset of the functionality provided by the account management application.

[0019] In some embodiments, the account applications 151 include one or more portions (or segments) of other applications (e.g., account management applications, etc.). Thus, stated another way, the account applications 151 may include a subset (or all) of the pages and / or functionality of the other applications. For example, a first account application 151 may include a page that allows a customer to view a bank account balance and a page that allows a customer to send an email to customer service while excluding other functionality provided by the full account management application (e.g., payment scheduling, loan requests, etc.). Advantageously, the first account application 151 may perform associated functions without the need to pre-install the bank's account management application on the mobile device 110. More generally, the account applications 151 may be collectively considered an accessible cloud-based "application bundle," a subset of which may be quickly downloaded to the mobile device 110. Thus, the application bundle may collectively include all functionality provided by the account management applications, but only the subset of the account applications 151 necessary to perform one or more required operations is downloaded to the mobile device 110.

[0020] The URL 106 generated by the applet 103 may further include the encrypted data 105 as a parameter. As described in more detail below, the encrypted data 105 may be used by the authentication server 120 to verify the data generated by the contactless card 101. For example, the applet 103 of the contactless card 101 may use an encryption algorithm to generate an encrypted payload of the encrypted data 105 based at least in part on the private key 104 stored in the memory 102 of the contactless card 101. In such an embodiment, the private key 104 and some other data (e.g., a customer identifier, an account identifier, etc.) may be provided as input to an encryption algorithm that outputs the encrypted data 105. In general, the applet 103 may use any type of encryption algorithm and / or system to generate the encrypted data 105, and the use of a particular encryption algorithm as an example herein should not be considered limiting of the disclosure. In some embodiments, the applet 103 may perform encryption using a key diversification technique to generate the encrypted payload. Examples of key diversification techniques are described in U.S. Patent Application No. 16 / 205,119, filed November 29, 2018. The aforementioned patent application is hereby incorporated by reference in its entirety.

[0021] As mentioned, the applet 103 of the contactless card 101 may include the encrypted data 105 as a parameter of the URL 106, thereby generating a URL 108 with the encrypted data. For example, if the URL to the application server 150 and / or the account application 151 is "http: / / www.example.com / accountapp" and the encrypted data 105 is "ABC123", the URL 108 with the encrypted data may be "http: / / www.example.com / accountapp?data=ABC123". In some embodiments, the applet 103 may encode the encrypted data 105 according to a URL-compatible encoding format before including the encrypted data 105 as a parameter of the URL 106. For example, the encrypted data 105 may be a string of binary data (e.g., 0's and 1's) that may not be URL-compatible. Thus, the applet 103 may encode the encrypted data 105 into the American Standard Code for Information Interchange (AGRI) base64 encoding format. By doing so, the binary encrypted data 105 is represented in an ASCII string format by converting it to a radix-64 representation (e.g., "ABC123" in the previous example). Additionally, the URL 106 may include an instruction as to which page of the application 151 to open upon installation. Continuing with the previous example, a page identifier of "1" (or other page identifier such as a page name) may be added as a parameter to the URL 106, and the URL 108 with the encrypted data may be "http: / / www.example.com / accountapp?data=ABC123&p=1".

[0022] Once generated, the applet 103 may transmit the URL 108 with the encrypted data to the mobile device 110, for example, via NFC. In one embodiment, once received by the OS 112, the OS 112 causes the web browser 115 to access the URL 108 with the encrypted data. Doing so causes information describing the mobile device 110 to be transmitted along with the request to access the URL 108 with the encrypted data. For example, the information may include attributes of the mobile device 110, such as the operating system version, hardware capabilities, and software capabilities. In response, the application server 150 may transmit to the mobile device 110 an account application 151 associated with the URL 108 with the encrypted data. In some embodiments, the application server 150 selects the account application 151 based on the received attributes of the mobile device 110. For example, if the OS 112 of the mobile device 110 does not support progressive web applications 153, the application server 150 may select a corresponding instant application 152 as the account application 151. In some embodiments, if the application server 150 selects the instant application 152 as the account application 151, the application server 150 may cause the mobile device 110 to open an application store application (e.g., one of the other applications 116) and download the instant application 152. Examples of application stores include the Google® Playstore, the Apple® AppStore, the Amazon® Appstore, etc.

[0023] In some embodiments, when the OS 112 receives the URL 108 with the encrypted data, the URL is directed to an instant application 152. In some such embodiments, the instant application 152 is downloaded via an application store. Thus, instead of opening a web browser 115, the OS 112 opens a corresponding application store application 116. In some embodiments, the application store application 116 is opened in the background of the OS 112 without opening the application store application 116 in the foreground of the OS 112. In such embodiments, the instant application 152 is downloaded in the background of the OS 112. Regardless of whether this occurs in the foreground or background of the OS 112, the application store application 116 downloads, installs, and executes the instant application 152. However, in some embodiments, such instant application 152 may be downloaded using the web browser 115 regardless of where the instant application 152 is stored.

[0024] Additionally and / or alternatively, application server 150 may select account application 151 based on the portion of the application required to perform a given function. For example, application server 151 may determine based on encrypted data 105 in URL 108 having the encrypted data that the function includes one or more of extracting encrypted data 105, decrypting encrypted data 105, sending decrypted encrypted data 105 to authentication server 120, receiving virtual card data 126 from VAN generator 142, and providing virtual card data 126 to autofill service 114. Thus, application server 150 may select one or more account applications 151 that include the functionality required to perform the aforementioned functions. For example, the application server 150 may select one or more instant applications 152 that include functionality to extract the encrypted data 105, decrypt the encrypted data 105, send the decrypted encrypted data 105 to the authentication server 120, receive the virtual card data 126 from the VAN generator 142, and provide the virtual card data 126 to the autofill service 114. In some embodiments, the application server 150 may send additional portions of the application to the mobile device 110 (e.g., as part of a background download).

[0025] Similarly, the application server 150 may select one or more progressive web applications 153 based on the portions of the application required to perform a given function. For example, the progressive web applications 153 may be optimized for a given task and / or function. As another example, the progressive web applications 153 may include a subset of the core progressive web applications 153 that perform the required functions (and / or additional functions). The core progressive web applications 153 may include the complete functionality of an account management application. Thus, continuing with the previous example, the application server 150 may select one or more progressive web applications 153 optimized to extract the encrypted data 105, decrypt the encrypted data 105, send the decrypted encrypted data 105 to the authentication server 120, receive the virtual card data 126 from the VAN generator 142, and provide the virtual card data 126 to the autofill service 114. Similarly, the application server 150 may select a subset of the core progressive web applications 153, the subset including functionality for extracting the encrypted data 105, decrypting the encrypted data 105, sending the decrypted encrypted data 105 to the authentication server 120, receiving the virtual card data 126 from the VAN generator 142, and providing the virtual card data 126 to the autofill service 114.

[0026] FIG. 1B illustrates an embodiment in which an exemplary account application 151-1 is dynamically downloaded and installed in the memory 111 of the mobile device 110. The account application 151 may be an instant application 152 and / or a progressive web application 153. In FIG. 1B, some elements of FIG. 1A are not shown for clarity. As noted, the account application 151-1 may be selected by the application server 150 based on one or more required functions, functions performed by the account application 151-1, and / or parameters of the mobile device 110. Although depicted as executing within the memory 111 (e.g., as an instant application 152), if the account application 151-1 is a progressive web application 153, the progressive web application 153 instance of the account application 151-1 may execute in the web browser 115. In one embodiment in which the account application 151-1 is a progressive web application 153, the progressive web application 153 may decide to download and install the instant application 152 from the application server 150 on the mobile device 110.

[0027] Further, regardless of whether the account application 151-1 is an instant application 152 or a progressive web application 153, the account application 151-1 includes sufficient pages or functions to perform the necessary functions (e.g., functions described herein). More specifically, once downloaded to the mobile device 110, the account application 151-1 may open one or more pages (e.g., pages specified by one or more parameters of the URL 106) that receive as input the URL 108 having the encrypted data, extract the encrypted data 105 from the URL 108 having the encrypted data, and transmit the encrypted data 105 over the network 130 to the authentication server 120. Further, the account application 151-1 may convert the encrypted data 105 to its original encoding format (e.g., from ASCIIbase64 to binary) before transmitting the binary encrypted data 105 to the authentication server 120. As described in more detail below, the account application 151-1 may receive the virtual card data 126 from the VAN generator 142 and provide the virtual card data 126 to the autofill service 114.

[0028] Upon receipt, the authentication application 123 may authenticate the encrypted data 105. For example, the authentication application 123 may attempt to decrypt the encrypted data 105 using a copy of the private key 104 stored in the memory 122 of the authentication server 120. The private key 104 may be identical to the private key 104 stored in the memory 102 of the contactless card 101, where each contactless card 101 is manufactured to include a unique private key 104 (and the authentication server 120 stores a corresponding copy of each unique private key 104). Thus, the authentication application 123 may successfully decrypt the encrypted data 105, thereby verifying the encrypted data 105. For example, as noted, a customer identifier may be used to generate the encrypted data 105. In such an example, the authentication application 123 may decrypt the encrypted data 105 using the private key 104 of the authentication server 120. If the result of the decryption results in a customer identifier associated with the account in account data 124, authentication application 123 verifies the encrypted data 105 and instructs VAN generator 142 to generate virtual card data 126 for the account associated with contactless card 101. If authentication application 123 cannot decrypt the encrypted data to produce the expected result (e.g., a customer identifier for the account associated with contactless card 101), authentication application 123 does not verify the encrypted data 105. Because the verification failed, authentication application 123 does not instruct VAN generator 142 to generate virtual card data 126 to maintain the security of the associated account.

[0029] The embodiment shown in FIG. 1B reflects where the authentication application 123 verifies the encrypted data 105 and instructs a virtual account number (VAN) generator 142 in memory 141 of the virtual account number server 140 to generate virtual card data 126. The virtual card data 126 may comprise a virtual account number, an expiration date, and / or a CVV for an account associated with the contactless card 101. In some embodiments, the VAN generator 142 generates the virtual account number, the expiration date, and the CVV. In other embodiments, the VAN generator 142 generates a virtual account number and selects an existing expiration date and / or CVV (e.g., from the account data 124). For example, the existing expiration date and / or CVV may be the expiration date and / or CVV of the contactless card 101 or another card associated with the account in the account data 124. The card data 126 may further include the account holder's name and one or more known addresses associated with the contactless card 101.

[0030] In at least one embodiment, the card data 126, including the virtual account number, generated by the VAN generator 142 is restricted to a particular merchant or group of merchants. The virtual account number and / or card data 126 may further include other restrictions (e.g., time restrictions, amount restrictions, etc.). Once generated, the VAN generator 142 may send the virtual card data 126 to an account application 151-1 running on the mobile device 110. The VAN generator 142 may provide the virtual card data 126 to the account application 151-1 via any suitable method, such as a push notification, a text message, an email, one or more data packets, etc.

[0031] Once received by the account application 151-1, the account application 151-1 may provide the virtual account number, expiration date, CVV, and address of the virtual card data 126 to the autofill service 114 of the OS 112, for example, via the autofill service's application programming interface (API) 114. Thus, the account application 151-1 further includes functionality for receiving the virtual card data 126 and providing the virtual card data 126 to the autofill service 114. As shown in FIG. 1B, the autofill service 114 stores the virtual card data 126, including the virtual account number, expiration date, and CVV. As noted, the virtual card data 126 may further include the account holder's name, billing address, and / or shipping address. By doing so, the autofill service 114 can insert the virtual card data 126 into forms 127, 129 of the web browser 115 and other applications 116, respectively.

[0032] 1C illustrates an embodiment in which the auto-fill service 114 automatically fills in virtual card data 126 into forms 127 of a web browser 115 and forms 129 of other applications 116. As described in more detail with reference to FIGS. 2A-2D, the auto-fill service 114 may auto-fill each element of the virtual card data 126 into a corresponding field of the forms 127, 129. In at least one embodiment, the user may be prompted to approve the auto-filling of the virtual card data 126 into the forms 127, 129.

[0033] FIG. 2A is a schematic 200 illustrating an exemplary embodiment of tapping a contactless card 101 to generate virtual card data for filling an exemplary form using an autofill service 114. As shown, a web browser 115 outputs a page at a URL 201. The page at the URL 201 includes a form (e.g., a payment form, etc.) having form fields 202-204 and 209. Field 202 corresponds to an account number field, field 203 corresponds to an expiration date field, field 204 corresponds to a CVV field, and field 209 corresponds to an address field. Address field 209 may be a billing address and / or a shipping address. The form may include additional elements not shown for clarity. As shown, a notification 205 is output by the OS 112 and / or other services (if installed). The notification 205 instructs the user to tap the contactless card 101 to the mobile device 110. In one embodiment, the user selects the notification 205 before tapping the contactless card 101 to the mobile device 110. However, in some embodiments, the notification 205 is not output and the user taps the contactless card 101 to the mobile device 110 without prompting from the notification 205.

[0034] In one example, OS 112 outputs notification 205 when account number field 202 (or other field) has shifted focus (e.g., selected by a user). To determine which field has shifted focus, OS 112 may parse hypertext markup language (HTML) attributes of account number field 202 to determine that account number field 202 has shifted focus. As another example, OS 112 may output notification 205 when it determines that a form includes one or more payment fields. Additionally, OS 112 may parse metadata of account number field 202 to determine that field 202 is associated with an account number. For example, OS 112 may determine, based on the metadata, that account number field 202 is configured to receive 16 characters as input. As another example, the metadata may specify a name for form field 202 similar to a name associated with an account number field (e.g., “accountnumber”, “accout_number”, etc.). As another example, the metadata of a form field may specify that the form field is associated with an account number field, an expiration date field, a CVV field, a shipping address field, and / or a billing address field. Thus, the OS 112 may output a notification 205 to tap the contactless card 101 to the mobile device 110 based on automatically determining that the form includes one or more payment fields and / or based on determining that a payment field has moved focus.

[0035] As mentioned above, when the contactless card 101 is tapped to the mobile device 110, the OS 112 sends an instruction to the communication interface 107 of the contactless card 101 via the card reader 119 (e.g., via NFC, Bluetooth, RFID, and / or EMV protocols, etc.). The instruction may specify to generate a URL with the encrypted data. As mentioned, the applet 103 may generate the encrypted data using the data (e.g., a customer identifier) ​​and the contactless card's private key 104 as input to an encryption algorithm to generate the encrypted data 105. The applet 103 may then encode the encrypted data 105 into an encoding format compatible with a URL. The applet 103 may then select a URL 106 and include the encoded encrypted data 105 as a parameter of the URL 106. The applet 103 may further add an instruction of one or more pages of the account application 151 as a parameter to the URL. Doing so ensures that the account application 151 opens the correct page at run time by receiving the URL as input (e.g., as an "on create" input provided to the account application 151 at run time). The applet 103 may then send the URL with the encrypted data to the mobile device 110 via the communications interface 107.

[0036] FIG. 2B is a schematic diagram 210 illustrating an embodiment in which the OS 112 of the mobile device 110 receives a URL with encrypted data generated by the contactless card 101. As shown, the OS 112 has the web browser 115 open an exemplary URL 206 directed to the application server 150. In an embodiment, if the payment form fields 202-204 are in one of the other applications 116, the OS 112 opens the web browser 115 and has the web browser 115 access the URL 206. The application server 150 may then receive the request and initiate transmission of the account application 151 associated with the URL 206. As mentioned, the account application 151 may be an instant application 152, a progressive web application 153, or any other application that is not pre-installed on the mobile device 110. In general, the application server 150 selects the account application 151 based on the functionality required and the functions performed by the account application 151. In some embodiments, the application server 150 selects the account application 151 based on attributes describing the mobile device 110 received in the URL 206. For example, if the OS 112 of the mobile device 110 does not support the instant application 152 but does support the progressive web application 153, the application server 150 may send the account application 151, which is the progressive web application 153, to the mobile device 110. Other example attributes describing the mobile device 110 include the detected version of the software installed on the OS 112, the speed of the network connection of the mobile device 110, the remaining battery life of the mobile device 110, etc. Thus, for example, if the mobile device 110 has a slow network connection and / or has little remaining battery life, the application server 150 may select the account application 151 having the smallest size that can perform the required functions.

[0037] FIG. 2C is a schematic diagram 220 illustrating an embodiment in which an instant application 152 version of an account application 151 is downloaded and installed on a mobile device 110. As shown, the account application 151 opens a page reflecting that the encrypted data 105 has been extracted and decrypted from the URL 206. The page of the account application 151 is opened based on the parameter "p=1" of the URL 206. The account application 151 may then send the extracted and decrypted encrypted data 105 to the authentication server 120 for authentication. As shown, the authentication server 120 authenticates the encrypted data 105 and instructs the VAN generator 142 to generate a virtual card number, expiration date, and CVV. The VAN generator 142 then sends the generated data to the account application 151, which outputs a URL 208 that redirects to a previous application (e.g., a web browser 115 and / or other application 116) with a payment form. Other graphic objects may be used in place of the link 208, and the use of the link 208 should not be considered as limiting the disclosure.

[0038] FIG. 2D is a schematic diagram 230 illustrating an embodiment in which a user selects link 208 in account application 151 to return to web browser 115. As shown, autofill service 114 has autofilled exemplary data into form fields 202-204 of web browser 115. More specifically, autofill service 114 has autofilled a virtual account number into form field 202, an expiration date into form field 203, a CVV into form field 204, and the account holder's address into form field 209. Once autofilled, the user may select purchase button 211 to process payment for the purchase. Advantageously, data is autofilled into form fields without requiring a user to manually enter the data and without requiring a dedicated application for autofilling data to be pre-installed on device 110. In some embodiments, autofill service 114 may output a notification (not shown) to the user that must be selected before autofilling data into form fields 202-204 and 209.

[0039] In some embodiments, the autofill service 114 detects form fields (e.g., form fields 202-204, 209), detects content in a notification (e.g., a text message notification) that has a type that matches the type of the detected form field, and provides the parsed content from the notification to keyboard autofill suggestions. By doing so, the autofill service 114 can automatically fill in the corresponding form fields with data from the notification.

[0040] 3 illustrates an embodiment of a logic flow 300. The logic flow 300 may be representative of some or all of the operations performed by one or more embodiments described herein. For example, the logic flow 300 may include some or all of the operations for generating virtual card data using a contactless card and auto-filling a virtual account number into a form using the auto-fill service 114. In this context, the embodiments are not limited.

[0041] As shown, logic flow 300 begins at block 305 where a mobile device 110 that does not include an installed account management application outputs a first application that includes a payment form having payment fields. The first application may be one of a web browser 115 that includes a form 127 and / or other applications 116 that includes a form 129. The payment fields may include one or more of an account number field, an expiration date field, a CVV field, one or more name fields, and one or more address fields (e.g., billing address, shipping address, etc.). For example, OS 112 may parse metadata of the form fields to determine that one or more fields are associated with an account number, expiration date, CVV, billing address, etc. As another example, OS 112 may determine based on the metadata that the field is configured to receive 16 characters as input.

[0042] In some embodiments, a user may tap on a payment field of a form in the web browser 115 to bring focus to one of the payment fields. For example, a user may tap on a payment field of a form to bring focus to the payment field. As another example, a user may select a payment field of a form using a mouse and / or keyboard. More generally, any technique may be used to bring focus to a payment field, including programmatically generated focus. For example, a payment field may move focus based on an HTML "focus()" method. As another example, a payment field may move focus automatically when a form is loaded, for example, based on an "autofocus" HTML attribute that has been applied to the payment field in source code. When a payment field moves focus, the account application 113 and / or the OS 112 may output a notification instructing the user to tap the contactless card 101 to the mobile device 110.

[0043] At block 310, the user taps contactless card 101 to mobile device 110, causing contactless card 101 to generate and send encrypted data as part of a URL to application server 150 and / or one of account applications 151. OS 112 may send instructions to contactless card 101 via NFC card reader 119 specifying the generation and transmission of encrypted data as part of a URL.

[0044] At block 315, the contactless card applet 103 generates encrypted data using the private key 104, the input data (e.g., a customer identifier), and an encryption algorithm. The applet 103 may then include the encrypted data as a parameter of the URL. The applet 103 may further encode the encrypted data before adding the encoded encrypted data as a parameter of the URL. Additionally, the URL may be a universal link URL having a parameter specifying an identifier of one or more pages of the account application 151 to be opened upon download. Additionally, the URL may identify portions of the instant application 152 and / or progressive web application 153 that need to be downloaded first. Doing so allows the identified pages to be opened and downloaded first when the application 151 is downloaded, and other pages that do not open immediately to be downloaded later.

[0045] At block 320, the applet 103 may send a URL including the encrypted data to the mobile device 110. At block 325, the OS 112 instructs the web browser 115 to access the URL received from the contactless card 101 to dynamically download and install (and / or execute) a second application (e.g., one of the account applications 151). Here, the second application is an instant application 152 and / or a progressive web application 153. The application server 150 may then select and send one or more account applications 151 to the mobile device 110. As mentioned, in accessing the URL received from the contactless card 101, the web browser 115 may send information describing the mobile device 110 (e.g., an indication of the type of web browser 115, the version of the web browser, the type of OS 112, and the version of OS 112, etc.). Thus, the application server 150 may select the account application 151 based on the type of application supported by the mobile device 110. Additionally, application server 150 may select account application 151 based on the type of functionality that account application 151 must be configured to perform. Once received, OS 112 executes the received account application 151. For example, OS 112 may load progressive web application 153 into web browser 115. As another example, OS 112 may execute an instant application. Regardless of the type of account application 151, OS 112 receives the URL with the encrypted data from application server 150 and provides the URL with the encrypted data as input to the application.

[0046] At block 330, the account application 151 extracts the encrypted data from the URL and sends the encrypted data to the authentication application 123 of the authentication server 120 for verification. As noted, in some embodiments, the account application 151 may decrypt the encrypted data before sending it to the authentication server 120. At block 335, the authentication application 123 decrypts the encrypted data using a private key in the memory of the authentication server 120 to verify the encrypted data. At block 340, the authentication application 123 sends instructions to the VAN generator 142 specifying generating card data comprising a virtual account number, an expiration date, and a CVV. At block 345, the VAN generator 142 generates the virtual account number, the expiration date, and the CVV. At block 350, the VAN generator 142 sends the virtual account number, the expiration date, and the CVV to the mobile device 110. The VAN generator 142 may further include the account holder's name, billing address, and shipping address, which may be stored locally by the VAN generator 142 and / or received from the authentication server 120.

[0047] At block 355, the second application (e.g., downloaded account application 151) provides the received data to the autofill service 114 of the OS 112. Furthermore, the user may return to the first application (e.g., web browser 115 and / or other application 116). Next, at block 360, the autofill service may autofill the payment fields of the form with the virtual account number, expiration date, CVV, name, and address stored in the autofill service 114. At block 365, the user submits the autofilled form including the card data generated by the VAN generator 142. For example, submission of the form may update payment information (e.g., the user's account), complete a purchase, etc. Advantageously, the form may be autofilled and the purchase may be completed without the need to pre-install an account management application (or other application that communicates with the contactless card 101 and / or authentication server 120) on the device.

[0048] 4 illustrates an embodiment of a logic flow 400. The logic flow 400 may be representative of some or all of the operations performed by one or more embodiments described herein. For example, the logic flow 500 may include some or all of the operations performed by the application server 150 to select an account application 151 for transmission to the mobile device 110. In this context, the embodiments are not limited.

[0049] As shown, the logic flow 400 begins at block 405, where the application server 150 receives attribute data from the mobile device 110. Generally, when following the URL generated by the contactless card 101, the web browser 115 includes data describing the mobile device 110 in a HyperText Transfer Protocol (HTTP) request. The application server 150 may parse the received data to determine, for example, the type of the mobile device 110, the type and / or version of the OS 112, the type and / or version of the web browser 115, etc. At block 410, the application server 150 determines whether the mobile device 110 is compatible with the instant application 152 and / or the progressive web application 153 based on the attribute data of the mobile device 110. For example, the instant application 152 may require a particular type and version of the OS for compatibility, while the progressive web application 153 may require a particular type and version of the OS and web browser for compatibility. The device attributes indicate whether the mobile device 110 meets these requirements.

[0050] At block 415, the application server 150 selects one or more of the instant application 152 and / or the progressive web application 153 based on the determination made at block 410. For example, if the mobile device 110 is compatible with the instant application, the application server 150 may select the instant application 152 as the account application 151. Further, as mentioned, the application server 150 selects one or more of the instant application 152 and / or the progressive web application 153 based on the required functions performed on the mobile device 110 (e.g., extracting the encrypted data, sending the encrypted data to the authentication server, receiving the virtual card data from the VAN generator 142, and providing the received virtual card data to the autofill service 114). At block 420, the application server 150 provides the URL generated by the contactless card 101 as a parameter for downloading the account application 151 selected at block 415. In block 425, the application server 150 sends the selected account application 151 and URL to the mobile device 110. By doing so, the selected application is dynamically downloaded and installed on the mobile device 110.

[0051] 5 illustrates an embodiment of a logic flow 500. The logic flow 500 may be representative of some or all of the operations performed by one or more embodiments described herein. For example, the logic flow 500 may include some or all of the operations performed by the contactless card 101 to generate a URL 108 having encrypted data. In this context, the embodiments are not limited.

[0052] As shown, the logic flow 500 begins at block 505, where the contactless card applet 103 generates encrypted data 105. As mentioned, the encrypted data 105 is the output of an encryption algorithm based on the private key 104 and input data (e.g., a customer identifier). At block 510, the applet 103 encodes the encrypted data 105 according to an encoding format (e.g., ASCIIbase64). At block 515, the applet 103 generates a URL that comprises the encoded encrypted data and one or more application pages of the target account application 151 as parameters. The URL may be directed to the application server 150 and / or one or more of the account applications 151. At block 520, the contactless card 101 transmits the URL generated at block 515 to the mobile device 110. Upon receiving the URL, the OS 112 causes the web browser 115 to access the URL. By doing so, the account application 151 may be dynamically downloaded and installed on the mobile device 110 .

[0053] 6 illustrates an embodiment of a logic flow 600. The logic flow 600 may be representative of some or all of the operations performed by one or more embodiments described herein. For example, the logic flow 600 may include some or all of the operations performed by an account application 151 executing on a mobile device 110. In this context, the embodiments are not limited.

[0054] As shown, logic flow 600 begins at block 605 where a second application (e.g., account application 151) of FIG. 3 receives as input a URL comprising encoded encrypted data. At block 610, account application 151 opens a page of account application 151 specified in the URL. For example, account application 151 may open one or more pages configured to extract the encoded encrypted data from the URL, decrypt the encrypted data, transmit the encrypted data to an authentication server, receive virtual card data from VAN generator 142, and provide the received virtual card data to autofill service 114. As mentioned, account application 151 may be instant application 152 and / or progressive web application 153.

[0055] At block 615, the account application 151 extracts the encoded encrypted data from the URL, for example, based on a parameter name in the URL. At block 620, the account application 151 decodes the encrypted data to an unencoded format (e.g., binary). At block 625, the account application 151 sends the decoded encrypted data to the authentication server 120. At block 630, the account application 151 receives the virtual card data (e.g., one or more of a virtual card number, expiration date, CVV, name, billing address, and shipping address) from the VAN generator 142. At block 635, the account application 151 provides the virtual card data to the autofill service 114.

[0056] FIG. 7 illustrates an embodiment of an exemplary computing architecture 700 comprising a computing system 702 that may be suitable for implementing various embodiments as described above. In various embodiments, the computing architecture 700 may comprise or be implemented as part of an electronic device. In some embodiments, the computing architecture 700 may be representative of a system implementing one or more components of the system 100, for example. In some embodiments, the computing system 702 may be representative of the mobile device 110, the authentication server 120, the virtual account number server 140, and / or the application server 150 of the system 100, for example. The embodiments are not limited in this context. More generally, the computing architecture 700 is configured to implement all logic, applications, systems, methods, apparatus, and functions described herein with reference to FIGS. 1-6.

[0057] The terms "system," "component," and "module" as used in this application are intended to refer to any computer-related entity, either hardware, a combination of hardware and software, software, or software in execution, examples of which are provided by the exemplary computing architecture 700. For example, a component may be, but is not limited to, a process running on a computer processor, a computer processor, a hard disk drive, multiple storage drives (of optical and / or magnetic storage media), an object, an executable, a thread of execution, a program, and / or a computer. As an example, both an application running on a server and the server may be a component. One or more components may reside within a process and / or thread of execution, and a component may be localized on one computer and / or distributed among two or more computers. Furthermore, components may be communicatively coupled to one another by various types of communication media to coordinate operations. Coordination may include unidirectional or bidirectional exchange of information. For example, components may communicate information in the form of signals communicated over the communication media. The information may be embodied as signals assigned to various signal lines. In such an assignment, each message is a signal. However, further embodiments may use data messages as an alternative. Such data messages may be transmitted over a variety of connections, examples of which include parallel interfaces, serial interfaces, and bus interfaces.

[0058] Computing system 702 includes various typical computing elements, such as one or more processors, multi-core processors, co-processors, memory units, chipsets, controllers, peripherals, interfaces, oscillators, timing devices, video cards, audio cards, multimedia input / output (I / O) components, power supplies, etc. However, embodiments are not limited to implementation by computing system 702.

[0059] 7, computing system 702 includes a processor 704, a system memory 706, and a system bus 708. Processor 704 may be any of a variety of commercially available computer processors, including, but not limited to, AMD® Athlon®, Duron® and Opteron® processors, ARM® application, embedded and secure processors, IBM® and Motorola® DragonBall® and PowerPC® processors, IBM and Sony® Cell processors, Intel® Celeron®, Core®, Core(2)Duo®, Itanium®, Pentium®, Xeon®, and XScale® processors and similar processors. Dual microprocessors, multi-core processors, and other multi-processor architectures may also be used as processor 704.

[0060] The system bus 708 provides an interface from the system memory 706 to system components including, but not limited to, the processor 704. The system bus 708 may be any of several types of bus structures that may further interconnect to a memory bus (with or without a memory controller), a peripheral bus, and a local bus using any of a variety of commercially available bus architectures. Interface adapters may connect to the system bus 708 through a slot architecture. Examples of slot architectures include, but are not limited to, Accelerated Graphics Port (AGP), CardBus, (Enhanced) Industry Standard Architecture ((E)ISA), MicroChannel Architecture (MCA), NuBus, Peripheral Component Interconnect (Enhanced) (PCI(X)), PCI Express, Personal Computer Memory Card International Association (PCMCIA), and the like.

[0061] The system memory 706 may include various types of computer-readable storage media in the form of one or more high-speed memory units, such as read-only memory (ROM), random access memory (RAM), dynamic RAM (DRAM), double data rate DRAM (DDRAM), synchronous DRAM (SDRAM), static RAM (SRAM), programmable ROM (PROM), erasable programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), flash memory (e.g., one or more flash arrays), polymer memory such as ferroelectric polymer memory, ovonic memory, phase change or ferroelectric memory, silicon oxide nitride oxide silicon (SONOS) memory, magnetic or optical cards, arrays of devices such as redundant array of independent disks (RAID) drives, solid-state memory devices (e.g., USB memory, solid-state drive (SSD)), and other types of storage media suitable for storing information. In the illustrated embodiment shown in FIG. 7, the system memory 706 may include non-volatile memory 710 and / or volatile memory 712. The non-volatile memory 710 may store a basic input / output system (BIOS).

[0062] The computing system 702 may include various types of computer-readable storage media in the form of one or more low-speed memory units, including an internal (or external) hard disk drive (HDD) 714, a magnetic floppy disk drive (FDD) 716 that reads from or writes to a removable magnetic disk 718, and an optical disk drive 720 that reads from or writes to a removable optical disk 722 (e.g., a CD-ROM or DVD). The HDD 714, FDD 716, and optical disk drive 720 may be connected to the system bus 708 by a HDD interface 724, a FDD interface 726, and an optical drive interface 728, respectively. The HDD interface 724 for external drive implementations may include at least one or both of Universal Serial Bus (USB) and IEEE 1394 interface technologies. The computing system 702 is generally configured to implement all of the logic, systems, methods, apparatus, and functions described herein with reference to FIGS. 1-6.

[0063] The drives and associated computer-readable media provide volatile and / or nonvolatile storage of data, data structures, computer-executable instructions, and the like. For example, a number of program modules may be stored on the drives and memory units 710, 712, including an operating system 730, one or more application programs 732, other program modules 734, and program data 736. In one embodiment, the one or more application programs 732, other program modules 734, and program data 736 may include, for example, various applications and / or components of the system 100, such as applets 103, private keys 104, URLs 106, URLs with encrypted data 108, operating system 112, auto-fill service 114, web browser 115, other applications 116, authentication application 123, and VAN generator 142.

[0064] A user may enter commands and information into the computing system 702 through one or more wired / wireless input devices, for example, a keyboard 738 and a pointing device such as a mouse 740. Other input devices may include a microphone, infrared (IR) remote control, radio frequency (RF) remote control, game pad, stylus pen, card reader, dongle, fingerprint reader, grab, graphic tablet, joystick, keyboard, retina reader, touch screen (e.g., capacitive, resistive, etc.), track ball, track pad, sensor, stylus, etc. These and other input devices are often connected to the processor 704 through an input device interface 742 coupled to the system bus 708, but may be connected by other interfaces, such as a parallel port, an IEEE 1394 serial port, a game port, a USB port, an IR interface, etc.

[0065] A monitor 744 or other type of display device is also connected to the system bus 708 via an interface, such as a video adapter 746. The monitor 744 can be internal or external to the computing system 702. In addition to the monitor 744, computers typically include other peripheral output devices, such as speakers, printers, etc.

[0066] The computing system 702 may operate in a networked environment using logical connections via wired and / or wireless communication to one or more remote computers, such as a remote computer 748. The remote computer 748 may be a workstation, a server computer, a router, a personal computer, a portable computer, a microprocessor-based entertainment device, a peer device, or other common network node, and typically includes many or all of the elements described in connection with the computing system 702, although for simplicity, only a memory / storage device 750 is shown. The logical connections shown include wired / wireless connections to a local area network (LAN) 752 and / or larger networks, e.g., a wide area network (WAN) 754. Such LAN and WAN networking environments are common in offices and businesses, facilitating enterprise-wide computer networks, such as an intranet. All of these may connect to a global communications network, e.g., the Internet. In an embodiment, the network 130 of FIG. 1 is one or more of the LAN 752 and the WAN 754.

[0067] When used in a LAN networking environment, the computing system 702 is connected to the LAN 752 via a wired and / or wireless communication network interface or adapter 756. The adapter 756 may facilitate wired and / or wireless communication to the LAN 752, which may include a wireless access point disposed thereon for communicating with the wireless functionality of the adapter 756.

[0068] When used in a WAN networking environment, the computing system 702 may include a modem 758 or have other means for establishing communications over the WAN 754, such as connected to a communications server on the WAN 754 or via the Internet. The modem 758 may be internal or external, a wired and / or wireless device, and connects to the system bus 708 via the input device interface 742. In a networked environment, program modules depicted relative to the computing system 702, or portions thereof, may be stored in the remote memory / storage device 750. It will be appreciated that the network connections shown are exemplary and other means of establishing a communications link between the computers may be used.

[0069] The computing system 702 is operable to communicate with wired and wireless devices or entities using the IEEE 802 family of standards, such as wireless devices operatively arranged for wireless communication (e.g., IEEE 802.16 wireless modulation technology). This includes at least Wi-Fi (or Wireless Fidelity), WiMax, Bluetooth wireless technologies, and the like. Thus, communication can be a predefined structure, as with traditional networks, or simply ad-hoc communication between at least two devices. Wi-Fi networks provide secure, reliable, and high-speed wireless connectivity using radio technologies called IEEE 802.11x (a, b, g, n, etc.). Wi-Fi networks can be used to connect computers to each other, to the Internet, and to wired networks (using IEEE 802.3 related media and functions).

[0070] Various embodiments may be implemented using hardware elements, software elements, or a combination of both. Examples of hardware elements may include processors, microprocessors, circuits, circuit elements (e.g., transistors, resistors, capacitors, inductors, etc.), integrated circuits, application specific integrated circuits (ASICs), programmable logic devices (PLDs), digital signal processors (DSPs), field programmable gate arrays (FPGAs), logic gates, registers, semiconductor devices, chips, microchips, chipsets, etc. Examples of software may include software components, programs, applications, computer programs, application programs, system programs, machine programs, operating system software, middleware, firmware, software modules, routines, subroutines, functions, methods, procedures, software interfaces, application program interfaces (APIs), instruction sets, computational code, computer code, code segments, computer code segments, words, values, symbols, or any combination thereof. The decision whether an embodiment is implemented using hardware and / or software elements may vary according to any number of factors, such as required computational speed, power levels, thermal tolerances, processing cycle budgets, input data rates, output data rates, memory resources, data bus speeds, and other design or performance constraints.

[0071] One or more aspects of at least one embodiment may be implemented by representative instructions stored on a machine-readable medium that represent various logic in a processor, and when read by a machine, the machine manufactures logic that performs the techniques described herein. Such representations, known as "IP cores," are stored on tangible machine-readable media and provided to various customers or manufacturing facilities for loading into manufacturing machines that create the logic or processors. Some embodiments may be implemented using a machine-readable medium or article that may store, for example, instructions or sets of instructions that, when executed by the machine, cause the machine to perform methods and / or operations in accordance with the embodiments. Such machines may include, for example, any suitable processing platform, computing platform, computing device, processing device, computing system, processing system, computer, processor, etc., and may be implemented using any suitable combination of hardware and / or software. A machine-readable medium or article may include, for example, any suitable type of memory unit, memory device, memory article, memory medium, storage device, storage article, storage medium and / or storage unit, such as memory, removable or non-removable media, erasable or non-erasable media, writable or rewritable media, digital or analog media, hard disk, floppy disk, compact disk read only memory (CD-ROM), compact disk recordable (CD-R), compact disk rewriteable (CD-RW), optical disk, magnetic media, magneto-optical media, removable memory cards or disks, various digital versatile disks (DVDs), tapes, cassettes, etc. The instructions may include any suitable type of code, such as source code, compiled code, interpreted code, executable code, static code, dynamic code, encrypted code, etc., and may be implemented using any suitable high-level, low-level, object-oriented, visual, compiled and / or interpreted programming language.

[0072] The foregoing description of exemplary embodiments has been presented for purposes of illustration and description. It is not intended to be exhaustive or to limit the disclosure to the precise form disclosed. Many modifications and variations are possible in light of this disclosure. It is intended that the scope of the disclosure be limited not by this detailed description, but by the appended claims. Future applications claiming priority to this application may claim the disclosed subject matter in a different manner and may generally include any set of one or more limitations as variously disclosed or demonstrated herein.

Claims

1. An apparatus comprising: A processor circuit; A memory for storing instructions, The instructions, when executed by the processor circuit, cause the processor circuit to: a first application executing on the processor circuit outputs a payment form having an account number field, an expiration date field, and a card verification value (CVV) field; an operating system (OS) executing on the processor circuit receiving from a communication interface of a contactless card a uniform resource locator (URL) comprising encrypted data generated by the contactless card based at least in part on a private key of the contactless card stored in a memory of the contactless card; executing a second application on the processor circuit, the second application being received by the OS from the URL; the second application transmitting the encrypted data to an authentication server, the authentication server verifying the encrypted data by decrypting the encrypted data based at least in part on the private key of the contactless card stored in a memory of the authentication server; the second application receiving a virtual account number from a virtual account number server based on verification of the encrypted data by the authentication server; the second application receiving an expiration date associated with the virtual account number and a CVV associated with the virtual account number; the second application providing the virtual account number, expiration date, and CVV to an autofill service of the OS; the auto-fill service of the OS auto-fills the virtual account number into the account number field, the expiration date into the expiration date field, and the CVV into the CVV field; To carry out the Device.

2. the first application comprises at least one of (i) a web browser, (ii) a native OS application, and (iii) an application available in an application store; the second application comprises at least one of (i) a progressive web application running in a web browser, (ii) an instant application, and (iii) an application available outside of an application store; the second application comprises a subset of pages of an account management application; and the expiration date and the CVV comprise one or more of (i) an expiration date and a CVV generated by the virtual account number server, and (ii) an expiration date and a CVV received from an account database for the contactless card; and the memory, when executed by the processor circuit, causes the processor circuit to: submitting the form with the virtual account number in the account number field, the expiration date in the expiration date field, and the CVV in the CVV field; The apparatus of claim 1 , further comprising instructions stored therein to cause the apparatus to:

3. The memory, when executed by the processor circuit, causes the processor circuit to: the OS sending at least one attribute of the OS to an application server hosting the second application at the URL; the application server selects, based on the at least one attribute and required functionality of the OS, one of the progressive web application and the instant application as being compatible with the OS and configured to perform the required functionality; the application server transmitting a selection of the progressive web application and the instant application to the device; The apparatus of claim 2 storing instructions to cause the apparatus to perform the steps of:

4. The second application is the progressive web application and, when executed by the processor circuit, causes the processor circuit to: the OS receiving the progressive web application in response to receiving the URL, the URL comprising a universal link URL to the progressive web application; executing the progressive web application on the web browser; The progressive web application determines to receive the instant application; receiving the instant application; The instant application is executed on the OS, receiving said virtual account number, expiration date, and CVV; providing the virtual account number, expiration date, and CVV to the autofill service; and a memory storing instructions for causing the device to perform the steps of:

5. The memory, when executed by the processor circuit, causes the processor circuit to: the second application receives the URL with the encrypted data, the encrypted data being encoded into an encoded format; the second application decrypts the encrypted data into an unencoded format; the second application transmits the decrypted encrypted data to the authentication server; The apparatus of claim 1 , further comprising instructions stored therein to cause the apparatus to:

6. The applet executing in the memory of the contactless card comprises: generating said encrypted data; encoding the encrypted data in accordance with the encoded format; generating the URL comprising the encrypted data encoded according to the encoding format; 6. The apparatus of claim 5.

7. 2. The apparatus of claim 1, wherein the virtual account number, expiration date, and CVV are provided to an application programming interface (API) of the autofill service, and the communication interface of the contactless card is configured to support at least one of Near Field Communication (NFC), Bluetooth, and Wi-Fi.

8. a first application executing on a processor circuit of the device outputting a payment form having an account number field, an expiration date field, and a card verification value (CVV) field; an operating system (OS) executing on the processor circuit receiving from a communication interface of a contactless card a uniform resource locator (URL) comprising encrypted data generated by the contactless card based at least in part on a private key of the contactless card stored in a memory of the contactless card; executing a second application on the processor circuit, the second application being received by the OS from the URL; and the second application transmitting the encrypted data to an authentication server, where the authentication server verifies the encrypted data by decrypting the encrypted data based at least in part on the private key of the contactless card stored in a memory of the authentication server; receiving, by the second application, from a virtual account number server based on verification of the encrypted data by the authentication server; the second application receiving an expiration date associated with the virtual account number and a CVV associated with the virtual account number; the second application providing the virtual account number, expiration date, and CVV to an autofill service of the OS; the auto-fill service of the OS auto-fills the virtual account number into the account number field, the expiration date into the expiration date field, and the CVV into the CVV field; The method includes:

9. the first application comprises at least one of (i) a web browser, (ii) a native OS application, and (iii) an application available in an application store; the second application comprises at least one of (i) a progressive web application running in a web browser, (ii) an instant application, and (iii) an application available outside of an application store; the second application comprises a subset of pages of an account management application; and the expiration date and the CVV comprise one or more of (i) an expiration date and a CVV generated by the virtual account number server, and (ii) an expiration date and a CVV for the contactless card received from an account database; and the method further comprises: submitting said form with said virtual account number in said account number field, said expiration date in said expiration date field, and said CVV in said CVV field; The method of claim 8 further comprising:

10. The method comprises: sending at least one attribute of the OS to an application server hosting the second application at the URL; The application server selects one of the progressive web application and the instant application as being compatible with the OS and configured to perform the required functionality based on the at least one attribute and required functionality of the OS; the application server transmitting the selected one of the progressive web application and the instant application to the device; The method of claim 9 further comprising:

11. The second application comprises the progressive web application, and the method further comprises: receiving the progressive web application in response to receiving the URL, the URL comprising a universal link URL to the progressive web application; executing the progressive web application in the web browser; determining that the progressive web application receives the instant application; receiving the instant application; Executing the instant application on the OS, the instant application comprising: receiving said virtual account number, expiration date, and CVV; providing the virtual account number, expiration date, and CVV to the autofill service; The method of claim 9 further comprising:

12. The method comprises: the second application receiving the URL with the encrypted data, the encrypted data being encoded into an encoded format; the second application decrypting the encrypted data into an unencoded format; the second application transmitting the decrypted encrypted data to the authentication server; The method of claim 8 further comprising:

13. The applet executing in the memory of the contactless card comprises: generating said encrypted data; encoding the encrypted data in accordance with the encoded format; generating the URL comprising the encrypted data encoded according to the encoding format; The method of claim 12.

14. The method of claim 8, wherein the communication interface of the contactless card is configured to support at least one of Near Field Communication (NFC), Bluetooth, and Wi-Fi.

15. A non-transitory computer readable storage medium having computer readable program code embodied therein, the computer readable program code being executable by a processor circuit to cause the processor circuit to: a first application executing on the processor circuit outputting a payment form having an account number field, an expiration date field, and a card verification value (CVV) field; an operating system (OS) executing on the processor circuit receiving from a communication interface of a contactless card a uniform resource locator (URL) comprising encrypted data generated by the contactless card based at least in part on a private key of the contactless card stored in a memory of the contactless card; executing a second application on the processor circuit, the second application being received by the OS from the URL; and the second application transmitting the encrypted data to an authentication server, where the authentication server verifies the encrypted data by decrypting the encrypted data based at least in part on the private key of the contactless card stored in a memory of the authentication server; receiving, by the second application, from a virtual account number server based on verification of the encrypted data by the authentication server; the second application receiving an expiration date associated with the virtual account number and a CVV associated with the virtual account number; the second application providing the virtual account number, expiration date, and CVV to an autofill service of the OS; the auto-fill service of the OS auto-fills the virtual account number into the account number field, the expiration date into the expiration date field, and the CVV into the CVV field; A non-transitory computer-readable storage medium for causing a program to be executed.

16. the first application comprises at least one of (i) a web browser, (ii) a native OS application, and (iii) an application available in an application store; the second application comprises at least one of (i) a progressive web application running in a web browser, (ii) an instant application, and (iii) an application available outside of an application store; the second application comprises a subset of pages of an account management application; and the expiration date and the CVV comprise one or more of: (i) an expiration date and a CVV generated by the virtual account number server, and (ii) an expiration date and a CVV of the contactless card received from an account database; and computer readable program code executable by the processor circuit, the computer readable program code causing the processor circuit to: submitting said form with said virtual account number in said account number field, said expiration date in said expiration date field, and said CVV in said CVV field; 20. The non-transitory computer readable storage medium of claim 15, further comprising computer readable program code for causing the computer to execute:

17. The non-transitory computer-readable storage medium includes computer-readable program code executable by the processor circuit, the computer-readable program code including: sending, by the OS, at least one attribute of the OS to an application server hosting the second application at the URL; The application server selects one of the progressive web application and the instant application as being compatible with the OS and configured to perform the required functionality based on the at least one attribute and required functionality of the OS; the application server sending the selected one of the progressive web application and the instant application to the processor circuit; 20. The non-transitory computer readable storage medium of claim 16, further comprising computer readable program code for causing the computer to execute:

18. The second application comprises the progressive web application, and computer readable program code executable by the processor circuit, the computer readable program code including: receiving the progressive web application in response to receiving the URL, the URL comprising a universal link URL to the progressive web application; executing the progressive web application in the web browser; determining that the progressive web application receives the instant application; receiving the instant application; Executing the instant application on the OS, the instant application comprising: receiving said virtual account number, expiration date, and CVV; providing the virtual account number, expiration date, and CVV to the autofill service; 20. The non-transitory computer readable storage medium of claim 16, further comprising computer readable program code for causing the computer to execute:

19. The non-transitory computer-readable storage medium includes computer-readable program code executable by the processor circuit, the computer-readable program code including: the second application receiving the URL with the encrypted data, the encrypted data being encoded into an encoded format; the second application decrypting the encrypted data into an unencoded format; the second application transmitting the decrypted encrypted data to the authentication server; 20. The non-transitory computer readable storage medium of claim 15, further comprising computer readable program code for causing the computer to execute:

20. The communication interface of the contactless card is configured to support at least one of Near Field Communication (NFC), Bluetooth, and Wi-Fi, and an applet executing in the memory of the contactless card comprises: generating said encrypted data; encoding the encrypted data in accordance with the encoded format; generating the URL comprising the encrypted data encoded according to the encoding format; 20. The non-transitory computer-readable storage medium of claim 19, configured to:

Images