Authentication for third party digital wallet provisioning

Abstract

To provide an apparatus and method for securely verifying the identity of a user who is requesting to add or link a financial instrument to a third-party digital wallet using one-tap contactless card authentication.SOLUTION: A method includes receiving information related to a payment card through a first software application, and transitioning from the first software application to a second software application. The second software application includes at least one-tap authentication via a contactless card, detects the contactless card and receives a cryptogram via near-field wireless communication. The cryptogram includes card user information. The method includes: determining whether the card user information matches a user; if the identity of the user is verified, transitioning back to the first software application, the first software application being configured to add or link the payment card to a wallet of a third party.SELECTED DRAWING: Figure 9

Description

Technical Field

[0001] Related Applications This application claims priority to U.S. Patent Application No. 16 / 725,435, entitled "Authentication for Third Party Digital Wallet Provisioning," filed on December 23, 2019. The entire contents of the aforementioned application are hereby incorporated by reference in their entirety.

Background Art

[0002] A digital wallet refers to an electronic device or online service that enables an individual to conduct electronic transactions, such as purchasing goods online using a computing device or making a purchase in a store using a smartphone. Typically, various types of payment means, such as bank accounts, debit cards, and credit cards, are added or linked to the digital wallet. For example, when making a purchase in a store, the qualification information associated with an individual's preferred payment means can be wirelessly passed to the merchant's terminal via Near Field Communication (NFC).

[0003] However, there are numerous security-related issues associated with digital wallets, one of which can be to verify that an individual is actually using the payment means. For example, a fraudster can use a stolen card or identity information to fraudulently add or link a payment means and make unauthorized purchases. Therefore, it is necessary to appropriately verify and authenticate the identity of an individual who adds or links a payment means to a digital wallet in an effective and robust manner.

Summary of the Invention

[0004] Various embodiments are directed to securely verifying the identity of a user who is required to add or link a financial product to a third - party digital wallet using one - tap non - contact card authentication. The financial product can be added or linked to the third - party wallet in at least two scenarios: pull provisioning and push provisioning. In either provisioning scenario, the user must authenticate the added or linked financial product by successfully verifying their identity via one - tap non - contact card authentication in a banking application associated with the financial product.

Brief Description of the Drawings

[0005]

Figure 1A

Figure 1B

Figure 2

Figure 3A

Figure 3B

Figure 4

Figure 5

Figure 6

Figure 7

Figure 8

Figure 9

[0006] Various embodiments generally aim to verify the identity of a user attempting to add or link a financial product (e.g., a credit card) to a third-party digital wallet via one-tap contactless card authentication. In an example, a user may request the addition or linking of a financial product in at least two scenarios: pull provisioning and push provisioning.

[0007] For example, in pull provisioning, a user may first request to add or link a financial product in a third-party wallet application. The third-party wallet application may provide the user with at least the option to verify the financial product via a bank application associated with the financial product (e.g., a first-party wallet). If the bank application option is selected, the user may be directed or transferred from the wallet application to the bank application, where the user may perform one-tap contactless card authentication to complete the user identity verification process. Once the user's identity is successfully verified, the user may be returned to the third-party wallet application, where the financial product is added or linked and becomes available for use.

[0008] In push provisioning, a user can start from a banking application such as a first-party wallet application (rather than a third-party wallet application) and request to add or link a credit card to a third-party wallet. The user can perform one-touch contactless card authentication in the banking application. Once the user's identity is successfully verified, the user can be transferred from the banking application to a third-party wallet application, where financial products can be added or linked and made available for use.

[0009] As will be further described below, one-touch contactless card authentication is a very secure way to verify a user's identity. For example, a user can place, tap, or bring a contactless card close to a designated area of a user computing device (e.g., a smartphone). The user computing device can detect the contactless card via near-field communication (NFC) and receive one or more ciphertexts from the contactless card. The information contained in the ciphertext that can identify the true owner of the contactless card can be compared or matched with the authentication information related to the user signed in to the banking app. If they match, it can be confirmed that the verification of the user's identity has been successful.

[0010] In previous solutions, the mechanism for verifying whether the financial products added or linked to a third-party digital wallet actually belong to the person who requested them was typically implemented by the third-party wallet provider. As described above, these mechanisms were not secure and enabled fraudsters to add, link, or use financial products in an improper way. The embodiments and examples described herein overcome previous solutions and are advantageous in that the verification process is performed by an institution associated with the financial products added to the third-party wallet using a very secure technology for authenticating users such as one-touch contactless card authentication.

[0011] Reference is now made to the drawings, where like reference numerals are used throughout to refer to like elements. In the following description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding thereof. It may be evident, however, that the novel embodiments can be practiced without these specific details. In other instances, well-known structures and devices are shown in block diagram form in order to facilitate the description. The intention is to cover all modifications, equivalents, and alternatives within the scope of the claims.

[0012] FIG. 1A shows an exemplary data transmission system according to one or more embodiments. As will be further described below, system 100 may include a contactless card 105, a client device 110, a network 115, and a server 120. Although FIG. 1A shows a single instance of the components, system 100 may include any number of components.

[0013] System 100 may include one or more contactless cards 105, which will be further described below with reference to FIGS. 3A and 3B. In some embodiments, contactless card 105 may wirelessly communicate with client device 110, for example, using NFC.

[0014] System 100 may include a client device 110, which can be a network-enabled computer. As referred to herein, a network-enabled computer can include, but is not limited to, a computer device, or a communication device such as, for example, a server, a network appliance, a personal computer, a workstation, a telephone, a smartphone, a handheld PC, a personal digital assistant, a thin client, a fat client, an Internet browser, or other devices. The client device 110 can be a mobile computing device, such as, for example, an Apple® iPhone®, iPod®, iPad®, or any other suitable device running Apple's iOS® operating system, any device running Microsoft's Windows® Mobile operating system, any device running Google's Android® operating system, and / or any other suitable mobile computing device such as a smartphone, a tablet, or a similar wearable mobile device.

[0015] The client device 110 can include a processor and memory, and the processing circuitry can include additional components such as a processor, memory, error and parity / CRC checker, data encoder, collision avoidance algorithm, controller, command decoder, security primitive, and anti-tampering hardware as necessary to perform the functions described herein. The client device 110 can further include a display and an input device. The display can be any type of device for presenting visual information such as a computer monitor, flat panel display, and mobile device screen including a liquid crystal display, light emitting diode display, plasma panel, and cathode ray tube display. The input device can include any device for inputting information available and supported by a user's device into the user's device such as a touch screen, keyboard, mouse, cursor control device, touch screen, microphone, digital camera, video recorder or camcorder. These devices can be used to input information and interact with the software and other devices described herein.

[0016] In some examples, the client device 110 of the system 100 can execute one or more applications such as software applications that enable network communication with one or more components of the system 100 and transmit and / or receive data.

[0017] The client device 110 can communicate with one or more servers 120 via one or more networks 115 and can operate as a pair from the front end to the back end with each of the servers 120. The client device 110 can send one or more requests to the server 120, for example, from a mobile device application executed on the client device 110. The one or more requests can be associated with obtaining data from the server 120. The server 120 can receive one or more requests from the client device 110. Based on the one or more requests from the client device 110, the server 120 can be configured to obtain the requested data from one or more databases (not shown). Based on receiving the requested data from the one or more databases, the server 120 can be configured to send the received data to the client device 110, and the received data responds to the one or more requests.

[0018] The system 100 can include one or more networks 115. In some examples, the network 115 can be one or more of a wireless network, a wired network, or any combination of a wireless network and a wired network, and can be configured to connect the client device 110 to the server 120. For example, the network 115 can include one or more of an optical fiber network, a passive optical network, a cable network, an Internet network, a satellite network, a wireless local area network (LAN), a global system for mobile communications, a personal communication service, a personal area network, a wireless application protocol, a multimedia messaging service, an extended messaging service, a short message service, a time division multiplexing-based system, a code division multiple access-based system, D-AMPS, Wi-Fi, fixed wireless data, IEEE802.11b, 802.15.1, 802.11n and 802.11g, Bluetooth (registered trademark), NFC, radio frequency identification (RFID), Wi-Fi, etc.

[0019] Furthermore, network 115 may include, but is not limited to, a telephone line, optical fiber, IEEE Ethernet 802.3, wide area network, wireless personal area network, LAN, or global network such as the Internet. Further, network 115 may support an Internet network, wireless communication network, cellular network, etc., or any combination thereof. Network 115 may further include one network, or any number of the exemplary types of networks described above, operating as a stand-alone network or cooperating with each other. Network 115 may utilize one or more protocols of one or more network elements to which they are communicatively coupled. Network 115 may translate from one or more protocols of network devices to other protocols or from other protocols. Although network 115 is shown as a single network, according to one or more examples, network 115 may include, for example, multiple interconnected networks such as the Internet, a service provider's network, a cable television network, a corporate network such as a credit card association network, and a home network.

[0020] System 100 may include one or more servers 120. In some examples, server 120 may include one or more processors coupled to a memory. Server 120 may be configured as a central system, server, or platform for controlling and invoking various data at different times to execute multiple workflow actions. Server 120 may be configured to connect to one or more databases. Server 120 may be connected to at least one client device 110.

[0021] FIG. 1B shows an exemplary sequence diagram for providing authenticated access according to one or more embodiments. This figure may include a contactless card 105 and a client device 110, which may include an application 122 and a processor 124. FIG. 1B may refer to components similar to those shown in FIG. 1A.

[0022] In step 102, the application 122 communicates with the contactless card 105 (e.g., after being brought close to the contactless card 105). The communication between the application 122 and the contactless card 105 may include a contactless card 105 that is close enough to a card reader (not shown) of the client device 110 to enable NFC data transfer between the application 122 and the contactless card 105.

[0023] In step 104, after communication is established between the client device 110 and the contactless card 105, the contactless card 105 generates a message authentication code (MAC) ciphertext. In some examples, this may occur when the contactless card 105 is read by the application 122. In particular, this may occur upon reading, such as NFC reading, of a Near Field Data Exchange (NDEF) tag that may be created according to the NFC data exchange format.

[0024] For example, a reader such as application 122 may transmit a message such as an applet selection message using the applet ID of the NDEF generation applet. When the selection is confirmed, a sequence of selection file messages followed by read file messages may be transmitted. For example, the sequence may include "selection of function file", "reading of function file", and "selection of NDEF file". At this point, the counter value maintained by the contactless card 105 may be updated or incremented, and then "reading of NDEF file" may follow. At this point, a message including a header and a shared secret may be generated. Thereafter, a session key may be generated. A MAC ciphertext may be created from the message, which may include a header and a shared secret. Next, the MAC ciphertext may be concatenated with one or more blocks of random data, and the MAC ciphertext and the random number (RND) may be encrypted with the session key. Thereafter, the ciphertext and the header may be concatenated and encoded as ASCII hexadecimal and returned in the NDEF message format (in response to the "reading of NDEF file" message).

[0025] In some examples, the MAC ciphertext may be transmitted as an NDEF tag, and in other examples, the MAC ciphertext may be included together with a uniform resource indicator (e.g., a formatted string).

[0026] In some examples, application 122 may be configured to send a request to contactless card 105, and the request comprises an instruction for generating a MAC ciphertext.

[0027] In step 106, contactless card 105 transmits the MAC ciphertext to application 122. In some examples, the transmission of the MAC ciphertext is performed via NFC, but the present disclosure is not limited thereto. In other examples, this communication may be performed via Bluetooth®, Wi-Fi, or other wireless data communication means.

[0028] In step 108, application 122 communicates the MAC ciphertext to processor 124. In step 112, processor 124 verifies the MAC ciphertext according to the instructions from application 122. For example, as described below, the MAC ciphertext can be verified.

[0029] In some examples, the verification of the MAC ciphertext can be performed by a device other than client device 110, such as server 120 that is in data communication with client device 110 (as shown in FIG. 1A). For example, processor 124 can output the MAC ciphertext for transmission to server 120, which can verify the MAC ciphertext.

[0030] In some examples, the MAC ciphertext can function as a digital signature for verification purposes. To perform this verification, a public key asymmetric algorithm, such as a digital signature algorithm and RSA algorithm, or other digital signature algorithms such as zero-knowledge protocols, can be used.

[0031] In some examples, it can be understood that the contactless card 105 can start communication after the contactless card is brought close to the client device 110. As an example, the contactless card 105 can send a message to the client device 110 indicating, for example, that the contactless card has established communication. Thereafter, the application 122 of the client device 110 can proceed with communication with the contactless card in step 102 as described above.

[0032] FIG. 2 shows an exemplary system 200 that uses a contactless card. System 200 can include contactless cards 205, one or more client devices 210, network 215, servers 220, 225, one or more hardware security modules 230, and database 235. Although FIG. 2 shows a single instance of a component, system 200 can include any number of components.

[0033] System 200 may include one or more contactless cards 205, which will be further described below with respect to FIGS. 3A and 3B. In some examples, contactless card 205 may communicate wirelessly with client device 210, such as NFC communication. For example, contactless card 205 may include one or more chips, such as a radio frequency identification chip, configured to communicate via NFC or other short-range protocol. In other embodiments, contactless card 205 may communicate with client device 210 via other means including, but not limited to, Bluetooth®, satellite, Wi-Fi, wired communication, and / or any combination of wireless and wired connections. According to some embodiments, contactless card 205 may be configured to communicate via NFC with a card reader 213 of client device 210 (which may be referred to herein as an NFC reader, NFC card reader, or reader) when contactless card 205 is within the range of card reader 213. In other examples, communication with contactless card 205 may be achieved via a physical interface, such as a universal serial bus interface or a card swipe interface.

[0034] System 200 may include a client device 210, which can be a network-enabled computer. As referred to herein, a network-enabled computer can include, for example, a computer device, or, for example, a server, a network appliance, a personal computer, a workstation, a mobile device, a telephone, a handheld PC, a personal digital assistant, a thin client, a fat client, an Internet browser, or other communication devices including, but not limited to, these. One or more client devices 210 can also be mobile devices. For example, mobile devices can include Apple's iPhone (registered trademark), iPod (registered trademark), iPad (registered trademark), or other mobile devices running Apple's iOS (registered trademark) operating system, devices running Microsoft's Windows (registered trademark) mobile operating system, devices running Google's Android (registered trademark) operating system, and / or other smartphones or similar wearable mobile devices. In some examples, client device 210 can be the same as or similar to client device 110 as described with reference to FIGS. 1A or 1B.

[0035] The client device 210 can communicate with one or more servers 220 and 225 via one or more networks 215. The client device 210 can send one or more requests to one or more servers 220 and 225, for example, from an application 211 running on the client device 210. The one or more requests can be associated with obtaining data from one or more servers 220 and 225. The servers 220 and 225 can receive one or more requests from the client device 210. Based on the one or more requests from the client device 210, the one or more servers 220 and 225 can be configured to obtain the requested data from one or more databases 235. Based on receiving the requested data from the one or more databases 235, the one or more servers 220 and 225 can be configured to send the received data to the client device 210, and the received data responds to the one or more requests.

[0036] The system 200 can include one or more hardware security modules (HSMs) 230. For example, the one or more HSMs 230 can be configured to perform one or more encryption operations, as disclosed herein. In some examples, the one or more HSMs 230 can be configured as special-purpose security devices configured to perform one or more encryption operations. The HSM 230 can be configured such that the key is never disclosed outside the HSM 230 and is instead maintained within the HSM 230. For example, the one or more HSMs 230 can be configured to perform at least one of key derivation, decryption, and MAC operations. The one or more HSMs 230 can be included within the servers 220 and 225 or can communicate with them.

[0037] System 200 may include one or more networks 215. In some examples, network 215 can be one or more of a wireless network, a wired network, or any combination of a wireless network and a wired network, and can be configured to connect client device 210 to server 220 and / or 225. For example, network 215 can include an optical fiber network, a passive optical network, a cable network, a cellular network, an Internet network, a satellite network, a wireless LAN, a global system for mobile communications, a personal communication service, a personal area network, a wireless application protocol, a multimedia messaging service, an enhanced messaging service, a short message service, a time division multiplexing-based system, a code division multiple access-based system, D-AMPS, Wi-Fi, fixed wireless data, IEEE802.11b, 802.15.1, 802.11n and 802.11g, Bluetooth (registered trademark), NFC, RFID, Wi-Fi, and / or one or more of any combination of those networks. As a non-limiting example, communication from contactless card 205 and client device 210 can include NFC communication, a cellular network between client device 210 and a carrier, and the Internet between the carrier and the backend.

[0038] Furthermore, network 215 can include, but is not limited to, a telephone line, fiber optic, IEEE Ethernet 802.3, wide area network, wireless personal area network, local area network, or global network such as the Internet. Additionally, network 215 can support an Internet network, wireless communication network, cellular network, etc., or any combination thereof. Network 215 can further include one network, or any number of the exemplary types of networks described above, operating as a stand-alone network or cooperating with each other. Network 215 can utilize one or more protocols of one or more network elements to which they are communicatively coupled. Network 215 can translate from one or more protocols of network devices to other protocols or from other protocols. Although network 215 is shown as a single network, according to one or more examples, network 215 can include, for example, multiple interconnected networks such as the Internet, a service provider's network, a cable television network, a corporate network such as a credit card association network, and a home network.

[0039] In various examples according to the present disclosure, the client device 210 of the system 200 may execute one or more applications 211 and include one or more processors 212 and one or more card readers 213. For example, one or more applications 211, such as software applications, may be configured to enable network communication with one or more components of the system 200 and transmit and / or receive data. Although FIG. 2 shows only a single instance of the components of the client device 210, it is understood that any number of devices 210 may be used. The card reader 213 may be configured to read from and / or communicate with the contactless card 205. In conjunction with one or more applications 211, the card reader 213 may communicate with the contactless card 205. In the example, the card reader 213 may include a circuit or circuit component, such as an NFC reader coil, that generates a magnetic field that enables communication between the client device 210 and the contactless card 205.

[0040] Any application 211 of the client device 210 may communicate with the contactless card 205 using short-range wireless communication (e.g., NFC). The application 211 may be configured to interface with a card reader 213 of the client device 210 that is configured to communicate with the contactless card 205. It should be noted that those skilled in the art will understand that a distance of less than 20 centimeters corresponds to the NFC range.

[0041] In some embodiments, the application 211 communicates with the contactless card 205 via an associated reader (e.g., card reader 213).

[0042] In some embodiments, card activation may occur without user authentication. For example, the contactless card 205 may communicate with the application 211 via the card reader 213 of the client device 210 through NFC. The communication (e.g., tapping of the card in proximity to the card reader 213 of the client device 210) enables the application 211 to read the data associated with the card and perform activation. In some cases, the tap may activate or launch the application 211 and then initiate communication with one or more action or account servers 225 to activate the card for subsequent use. In some cases, if the application 211 is not installed on the client device 210, tapping the card on the card reader 213 may initiate the download of the application 211 (e.g., navigation to the application download page). Following the installation, tapping the card may activate or launch the application 211 and then initiate the activation of the card (e.g., via the application or other backend communication). After activation, the card may be used in various transactions including commercial transactions.

[0043] According to some embodiments, the contactless card 205 may include a virtual payment card. In those embodiments, the application 211 may obtain the information associated with the contactless card 205 by accessing a digital wallet implemented on the client device 210, and the digital wallet includes the virtual payment card. In some examples, the virtual payment card data may include one or more statically or dynamically generated virtual card numbers.

[0044] Server 220 may include a web server that communicates with database 235. Server 225 may include an account server. In some examples, server 220 may be configured to verify one or more credential information from contactless card 205 and / or client device 210 by comparing it with one or more credential information in database 235. Server 225 may be configured to approve one or more requests such as payments and transactions from contactless card 205 and / or client device 210.

[0045] FIG. 3A shows one or more contactless cards 300, which may include payment cards such as credit cards, debit cards, or gift cards issued by service provider 305 displayed on the front or back of card 300. In some examples, contactless card 300 may not be related to a payment card and may include, but is not limited to, an identification card. In some examples, the payment card may include a dual-interface contactless payment card. Contactless card 300 may include a substrate 310 that may include a single layer or one or more laminated layers composed of plastic, metal, and other materials. Exemplary substrate materials include polyvinyl chloride, polyvinyl acetate, acrylonitrile butadiene styrene, polycarbonate, polyester, anodized titanium, palladium, gold, carbon, paper, and biodegradable materials. In some examples, contactless card 300 may have physical characteristics compliant with the ID-1 format of the ISO / IEC 7810 standard; otherwise, the contactless card may comply with the ISO / IEC 14443 standard. However, it is understood that the contactless card 300 according to the present disclosure may have different characteristics, and the present disclosure does not require that the contactless card be implemented as a payment card.

[0046] The contactless card 300 may also include identification information 315 displayed on the front and / or back of the card, and contact pads 320. The contact pads 320 may be configured to establish contact with other communication devices such as user devices, smartphones, laptops, desktops, or tablet computers. The contactless card 300 may also include a processing circuit, an antenna, and other components not shown in FIG. 3A. These components may be located behind the contact pads 320 or elsewhere on the substrate 310. The contactless card 300 may also include a magnetic strip or tape that may be disposed on the back of the card (not shown in FIG. 3A).

[0047] As shown in FIG. 3B, the contact pads 320 of FIG. 3A may include a processing circuit 325 for storing and processing information, including a microprocessor 330 and a memory 335. The processing circuit 325 may include additional components as necessary to perform the functions described herein, including a processor, a memory, an error and parity / CRC checker, a data encoder, a collision avoidance algorithm, a controller, a command decoder, a security primitive, and anti-tampering hardware.

[0048] The memory 335 may be a read-only memory, a write-once / read-multiple memory, or a read / write memory, such as RAM, ROM, and EEPROM, and the contactless card 300 may include one or more of these memories. The read-only memory may be factory-read-only or programmable as a one-time programmable. With a one-time program, it can be written once and read many times. The write-once / read-multiple memory may be programmed at some point after the memory chip is shipped from the factory. The memory may not be rewritable once programmed, but can be read many times. The read / write memory may be programmed and reprogrammed many times after factory shipment. Also, it can be read many times.

[0049] Memory 335 may be configured to store one or more applets 340, one or more counters 345, and a customer identifier 350. The one or more applets 340 may include one or more software applications configured to execute on one or more contactless cards, such as Java card applets. However, it is understood that the applet 340 is not limited to Java card applets and may instead be any software application operable on a contactless card or other device having limited memory. The one or more counters 345 may include numeric counters sufficient to store integers. The customer identifier 350 may include a unique alphanumeric identifier assigned to a user of the contactless card 300, and the identifier may distinguish the user of the contactless card from users of other contactless cards. In some examples, the customer identifier 350 may identify both the customer and the account assigned to that customer and may further identify the contactless card associated with the customer's account.

[0050] The processor and memory elements of the foregoing exemplary embodiments have been described with reference to the contact pads, but the present disclosure is not limited thereto. These elements may be implemented outside of the pads 320, or may be completely separated therefrom, or may be implemented as additional elements in addition to the processor 330 and memory 335 elements disposed within the contact pads 320.

[0051] In some examples, the contactless card 300 may include one or more antennas 355. The one or more antennas 355 may be disposed within the contactless card 300 around the processing circuit 325 of the contact pads 320. For example, the one or more antennas 355 may be integral with the processing circuit 325, and the one or more antennas 355 may be used with an external booster coil. As another example, the one or more antennas 355 may be external to the contact pads 320 and the processing circuit 325.

[0052] In one embodiment, the coil of the contactless card 300 can function as the secondary side of an air-core transformer. The terminal can communicate with the contactless card 300 by blocking power or amplitude modulation. The contactless card 300 can infer data transmitted from the terminal using the gap in the power connection of the contactless card, which can be functionally maintained via one or more capacitors. The contactless card 300 can return communication by switching the load of the coil of the contactless card or modulating the load. The load modulation can be detected by the coil of the terminal due to interference.

[0053] As described above, the contactless card 300 can be built on a software platform operable on other devices with limited memory such as smart cards or JavaCards, and one or more applications or applets can be securely executed. Applets can be added to the contactless card to provide one-time passwords (OTPs) for multi-factor authentication (MFA) in various mobile application-based use cases. The applet can be configured to respond to one or more requests, such as a near-field wireless data exchange request from a reader such as a mobile NFC reader, and generate an NDEF message containing a cryptographically secure OTP encoded as an NDEF text tag.

[0054] Figure 4 shows an exemplary third-party wallet provisioning process 400 according to one or more embodiments. As shown, the provisioning process may start with a third-party wallet application 402. The term "application" is understood to be a software application and may otherwise be referred to as an "app". For example, a user may log in to the user's digital wallet via the third-party wallet application 402 and request to add or link one or more cards thereto by selecting or pressing a card activation request icon 404. Selecting or pressing the card activation request icon 404 may cause the third-party wallet application 402 to perform card verification, such as verifying that the card is a valid payment instrument and verifying that the card actually belongs to the user.

[0055] In an example, the user may be provided with an option to perform card verification via a bank application 406. If the bank application option is selected, the bank application 406 may be opened, where the user may perform identity verification 408 via, for example, one-touch contactless card authentication as further described below. Once the user's identity is verified, the third-party wallet application 402 may be opened again and an indication 410 may be displayed indicating that the card has been successfully activated.

[0056] Accordingly, it can be understood that the pull provisioning process involves, at least, migrating from a first software application (e.g., a third-party wallet app interface) to a second software application (e.g., a client bank app interface, a first-party wallet app interface) (which can otherwise be referred to as a “link out” to the second software application), and then returning from the second software application to the first software application (or a “link out” to the first software application). It can be understood that the first software application can be a mobile-based application, a native application, a web application, or a web browser. It can also be understood that the second application is a mobile-based application, a native application, a web application, or a web browser.

[0057] FIG. 5 shows an exemplary card verification flow 500 via a third-party wallet app or interface according to one or more embodiments. It can be understood that the card verification flow 500 is part of a third-party wallet pull provisioning process. A user can log in to the user's digital wallet via a third-party wallet app 502. As shown, upon logging in, at least a welcome screen 504 and an icon 506 for adding or linking one or more cards can be displayed. The user can add or link a financial product such as a credit card or any suitable payment card by selecting or pressing the icon 506.

[0058] Selecting or pressing the add or link icon 506 may provide instructions for entering information associated with a financial product. As shown, the computing device may enable the user to capture a digital image of the device (e.g., the front of a credit card, the back of a credit card) by, for example, placing the device within a "Place card here" box and selecting or pressing an "Add card" icon. It will be appreciated that other suitable ways of entering card information may be provided, such as the user manually entering the card information.

[0059] After entering information associated with a financial product, the third-party wallet application 502 may display to the user the information received for confirmation. For example, it may display various card details 508 such as the type of card (e.g., debit, credit), account balance, available credit, etc. Further, as shown, other types of information related to the financial product may be displayed, including but not limited to the name of the card owner (e.g., user - Jane Doe), the card number (e.g., 0123456789012345). When reviewing the displayed card information, the user may confirm the information by selecting or pressing a confirm icon 510.

[0060] Thereafter, the third-party wallet application 502 may provide the user with one or more card verification options. As shown, for example, the user may be given the option to perform card verification to the user's number 123 - 456 - 7890 via a text message 512, which may include the user receiving a temporary code via the text message and the user entering that temporary code into the third-party wallet application 502 to complete the verification process. Further, the user may be given the option to perform card verification via a bank application 514. As will be further described below, the bank application 514 may enable at least one-touch contactless card authentication to verify the user's identity for the user to complete the card verification process.

[0061] Figure 6 shows an exemplary user identity verification flow 600 related to a third - party wallet provisioning process according to one or more embodiments. It can be understood that the user identity verification flow 600 can be initiated, for example, when a user selects or presses a bank app card verification icon in a third - party wallet app such as the bank app icon 514 shown in FIG. 5.

[0062] When the user selects a bank app card verification option, a transition from the third - party wallet app to the bank app 602 can occur. In the example, upon transition, the bank app 602 may request that the user sign in to the user's account. The bank app 602 can receive login information from the user and determine whether to grant or deny access based on the login information. When the bank app 602 successfully logs in to the user's account, as shown, it can display one or more user identity verification options, such as a text one - time code 606, a one - tap contactless card authentication 608, an ID card verification 610. If the text one - time code 606 option is selected, the user may receive text containing the one - time code, which can then be entered by the user into the bank app 602 to complete the identity verification process. If the user ID card verification 610 option is selected, the bank app 602 can take a photo of a government ID photo belonging to the user, such as a driver's license, or receive a digital image, and that information can then be compared with existing user information to complete the identity verification process.

[0063] As shown in FIG. 6, the user selects the one - tap contactless card authentication 608 option. When selected, the banking app 602 displays the one - tap introduction screen 612 and related background information to orient the user for performing one - tap authentication. For example, the background information indicates that the user's contactless card has a technology that can be used for actions requiring higher security, and further may indicate that the card can be placed flat on the screen of the computing device to proceed with the authentication process. The user can select or press the "Yes, I understand" icon to continue.

[0064] In an example, when the user selects or presses the "Yes, I understand" icon, the banking app 602 may display a designated area enclosed by a dashed - line box where the user can place or tap the contactless card. It can be understood that the contactless card may be similar or identical to the above - mentioned contactless card 300. Further, it can be understood that the financial product the user is trying to add or link to a third - party digital wallet can be the contactless card itself, which can be a payment card. Further, it may display the one - tap authentication instruction 614, or provide an icon or link to the one - tap instruction 614. The instruction 614 may include at least step - by - step instructions for performing one - tap authentication. For example, the user may be instructed to select or press the "Read the card" icon and then place or tap the contactless card within the dashed - line guidelines of the "Place the card here" box. The placement or positioning of the contactless card for performing one - tap authentication is not limited to the front of the user computing device, but it can be understood that the user can be prompted to place or position the contactless card behind the device or at any location near the NFC reader of the device. When the "Read the card" icon is pressed, the banking app 602 may further display an indication that the user's contactless card is ready to be scanned. In some examples, if the computing device cannot read the contactless card via NFC, the banking app 602 may instruct the user to retry the card scan.

[0065] According to an embodiment, when a user computing device detects a contactless card via NFC, the computing device may receive one or more ciphertexts from the contactless card. It can be understood that the ciphertext can broadly refer to encrypted text, data, or information. Further, it can be understood that one or more ciphertexts may be received as an NFC Data Exchange Format (NDEF) message.

[0066] In an example, one or more received ciphertexts may include at least information identifying the user, or other relevant information indicating that the card belongs to a specific user, which may be referred to as "card user information". For example, the card user information is any type of data or information that associates the contactless card with the user (e.g., ID number, customer number, etc.), and can be created or established in a backend system when the contactless card is created for the user and / or when the user signs up or applies for the contactless card. Thereafter, the information included in the one or more received ciphertexts can be compared or matched with the authentication information associated with the user to verify the identity of the user. The authentication information is any type of data or information that identifies the user signed into the banking app (e.g., ID number, customer number, etc.).

[0067] In one example, the banking app 602 can be configured to decrypt one or more ciphertexts received from the contactless card using at least one key (e.g., a private key, a decryption key, a key corresponding to a specific encryption-decryption scheme). The banking app 602 can securely access or receive authentication information related to the user from one or more remote computing devices such as a backend server. The authentication information can include at least an identifier or any information indicating the identity of the user logged into the banking app 602. Next, the banking app 602 can determine whether the received authentication information matches the decrypted ciphertext information received from the contactless card to verify that the contactless card actually belongs to the user and / or to verify that the user is actually who the user claims to be.

[0068] In other examples, the banking app 602 can receive one or more ciphertexts from the contactless card, send the ciphertexts to one or more remote computing devices that can be a secure backend server to perform decryption of the ciphertexts, and determine whether the information contained in the one or more ciphertexts matches the authentication information related to the user. Next, the one or more remote computing devices can send an instruction or confirmation of the verification of the user's identity to the banking app 602. At least in that regard, most (if not all) of the identity verification process can be performed on one or more secure remote computing devices, which can be advantageous for certain applications or use cases.

[0069] When the verification and authentication of the user's identity are successful, the banking app 602 can display an indication that the contactless card has been read and the user's identity has been successfully verified. The user can continue the verification process by selecting or pressing a "Continue" icon.

[0070] In some examples, the banking app 602 may request that the user grant permission to share user-related data such as the user's name, middle name, surname, billing address, email address, phone number, card number, card expiration information, etc. with a third-party wallet. Further, in additional examples, the user may be prompted to agree to one or more terms and / or conditions related to adding or linking one or more financial products to the third-party wallet. When the user selects or presses the "Agree and Add" icon as shown, the user may proceed with adding or linking the financial product (which may be the contactless card described above). Thereafter, the user may move back and forth from the banking app 602 to the third-party wallet app, where they may be ready to use the financial product.

[0071] FIG. 7 shows an exemplary third-party wallet push provisioning process 700 according to one or more embodiments. For example, the push provisioning process 700 may differ from the pull provisioning process 400 shown in FIG. 4 in that a request to add or link a financial product to a third-party digital wallet may be initiated at a client interface (e.g., a banking app 702, a first-party digital wallet) with respect to a third-party interface (e.g., a third-party wallet app 402).

[0072] As shown in FIG. 7, the user may log in to the banking app 702, and upon successful user login, a welcome screen 704 and at least an icon 706 for adding or linking one or more financial products (e.g., a credit card) to a third-party digital wallet may be displayed. Selecting the icon 706 may prompt the user to select one or more financial products to add or link to the third-party wallet, and further, the user may be required to perform an identity verification 708 (e.g., one-tap contactless card verification) via the banking app 702. As described above, the financial product that the user wishes to add or link to the third-party wallet may be a contactless card.

[0073] When the verification of the user's identity is successful, the bank app 702 may then transition or link out to a third-party wallet app 710, where at least the confirmation of the successful identity verification may be shared with the third-party wallet app 710. Thereafter, the third-party wallet app 710 may display a graphic or indication 712 indicating that one or more financial products have been successfully activated in the third-party wallet. Thus, the push provisioning process 700 involves a one-way transition from the client interface to the third-party interface, as shown.

[0074] FIG. 8 shows an exemplary user identity verification flow 800 related to a third-party wallet push provisioning process according to one or more embodiments. Thus, the user identity verification flow 800 occurs at a client interface (e.g., a bank app) before transitioning or linking out to a third-party interface (e.g., a third-party wallet app).

[0075] As shown, the user identity verification flow 800 may be substantially similar to the identity verification flow 600 shown in FIG. 6. The bank app 802 may enable the user to perform one-tap authentication by placing, tapping, or bringing near the display "Place card here" guidelines a contactless card (similar to the contactless card 300 above). As described above, the information contained in one or more ciphertexts received from the contactless card may be compared or matched with user authentication information that may be provided by one or more secure backend server computing devices. Also, when the identity verification is successful, the bank app 802 not only shares the confirmation of the successful identity verification with the third-party wallet app, but may also share other types of information such as the user's name, middle name, surname, billing address, email address, phone number, card number, card expiration date, card code, etc., if the user permits.

[0076] FIG. 9 shows an exemplary flow diagram 900 according to one or more embodiments. Flow diagram 900 is related to authenticating and verifying the identity of a user who requests to add or link one or more financial products to a third-party digital wallet. It can be understood that the blocks of flow diagram 900 and the features described herein need not be executed in a particular order. Further, it can be understood that flow diagram 900 and the features described herein can be executed or supported by one or more processors.

[0077] At block 902, a request from the user to add or link at least one financial product (e.g., credit card, debit card, contactless card, any suitable payment card) to a third-party digital wallet may be received. As described above, in a pull-provisioning scenario, the request may be initiated in the third-party wallet app. Further, in a push-provisioning scenario, the request may be initiated at the client interface via the bank app.

[0078] Upon receiving a request to add or link one or more financial products, verification of the financial products to be added may be performed. In an example, the financial product verification process may be completed via one or more identity verification options provided by the bank app at block 904. The verification options may include at least one-touch contactless card authentication. As described above, the identity verification process may be performed by or within the bank app.

[0079] At block 906, a selection of the one-touch authentication option may be received by the bank app, and it may be determined whether a contactless card has been detected via the NFC reader. When the contactless card is successfully detected, one or more ciphertexts may be received from the contactless card.

[0080] At block 908, one or more received ciphertexts can be used to determine whether the contactless card actually belongs to or is associated with the user. As described above, the ciphertext can be decrypted by the user computing device via the banking app and compared with authentication information related to the user that can be received from one or more secure remote computing devices (e.g., a server computer, etc.). In other examples, the ciphertext can be sent to one or more secure remote computing devices, and the decryption of the ciphertext and the comparison of the information contained therein with the user authentication information can be performed by the remote computing device. Based on this determination, the verification of the user's identity can be confirmed. Thereafter, the user identity verification confirmation can be sent to a third-party wallet app so that one or more financial products can be properly added or linked to the digital wallet and used, and the card verification process can be completed.

[0081] The above-described embodiments and examples include a reader coil implemented in a mobile computing device, but it can be understood that the power to any NFC reader installed in any type of device can be dynamically adjusted to improve NFC communication. Further, the above NDEF messages and corresponding payloads can include message content or data related to various use cases of the contactless card, such as activation of the contactless card, user verification, user authentication, various transactions, sales, purchases, etc.

[0082] The components and functions of the above-described device can be implemented using any combination of discrete circuits, application-specific integrated circuits (ASICs), logic gates, and / or single-chip architectures. Further, the functions of the device can be implemented using a microcontroller, a programmable logic array and / or a microprocessor, or any combination of the foregoing where appropriate. It should be noted that hardware, firmware, and / or software elements may sometimes be referred to collectively or individually herein as "logic" or "circuitry".

[0083] At least one computer-readable storage medium may include instructions that, when executed, cause the system to perform any of the computer-implemented methods described herein.

[0084] Some embodiments may be described using the expressions "one embodiment" or "an embodiment" along with their derivatives. These terms mean that a particular feature, structure, or characteristic described in connection with the embodiments is included in at least one embodiment. The appearances of the phrase "in one embodiment" in various places in this specification are not necessarily all referring to the same embodiment. Further, unless otherwise noted, it is recognized that the above features can be used together in any combination. Thus, any features discussed separately can be used in combination with each other, unless it is noted that the features are not compatible with each other.

[0085] Referring generally to the notation and nomenclature used herein, the detailed description herein may be presented with respect to program procedures executed on a computer or a network of computers. The description and representation of these procedures are used by those skilled in the art to most effectively convey the substance of their work to those skilled in the art.

[0086] A procedure is herein, and generally is considered to be a self-consistent series of operations leading to a desired result. These operations are those requiring physical manipulation of physical quantities. Usually, though not necessarily, these quantities take the form of electrical, magnetic, or optical signals that can be stored, transferred, combined, compared, and otherwise manipulated. For primarily reasons of common usage, it may be convenient to refer to these signals as bits, values, elements, symbols, characters, terms, numbers, etc. However, it should be noted that all of these and similar terms are to be associated with the appropriate physical quantities and are merely convenient labels applied to these quantities.

[0087] Furthermore, the operations performed are often referred to in terms such as addition or comparison, which are generally associated with intellectual operations performed by a human operator. In any of the operations described herein that form part of one or more embodiments, such capabilities of a human operator are not necessary or, in most cases, desirable. Rather, the operations are machine operations.

[0088] Some embodiments may be described using the expressions "coupled" and "connected" along with their derivatives. These terms are not necessarily intended to be synonyms of each other. For example, some embodiments may be described using the terms "connected" and / or "coupled" to indicate that two or more elements are in direct physical or electrical contact with each other. However, the term "coupled" may also mean that two or more elements are not in direct contact with each other but still cooperate or interact with each other.

[0089] Various embodiments also relate to an apparatus or system for performing these operations. This apparatus is specially constructed for the required purpose and can be selectively activated or reconfigured by a computer program stored in a computer. The procedures presented herein are not inherently related to a particular computer or other apparatus. The required structures for these various machines will become apparent from the given description.

[0090] It is emphasized that a summary of the disclosure is provided so that readers can quickly confirm the nature of the technical disclosure. It is presented with the understanding that it is not used to interpret or limit the scope or meaning of the claims. Further, in the foregoing detailed description, it can be seen that various features are grouped together in a single embodiment for the purpose of streamlining the disclosure. This method of disclosure should not be construed as reflecting an intention that the embodiments described in the claims require more features than are explicitly recited in each claim. Rather, as reflected in the following claims, the subject matter of the present invention lies in fewer features than all the features of a single disclosed embodiment. Accordingly, the following claims are incorporated into the detailed description, and each claim stands on its own as a separate embodiment. In the appended claims, the terms "comprising" and "therein" are used as the plain English equivalents of the respective terms "including" and "wherein". Further, terms such as "first", "second", "third", etc. are used merely as labels and are not intended to impose numerical requirements on their objects.

[0091] What has been described above includes examples of the disclosed architecture. Of course, it is not possible to describe all possible combinations of components and / or methodologies, but those skilled in the art will recognize that many more combinations and permutations are possible. Accordingly, the novel architecture is intended to embrace all such changes, modifications, and variations that fall within the spirit and scope of the appended claims.

Claims

1. An apparatus comprising: A memory for storing instructions; and one or more processors coupled to the memory and operable to execute the instructions, which, when executed, cause the one or more processors to: receiving, via a first software application, a request to add or link at least one payment card to a third-party wallet, the at least one payment card being associated with a user; receiving, via the first software application, information related to the at least one payment card and providing one or more card verification options based on the received payment card information, the one or more card verification options including a link to a second software application for verifying the identity of the user; transitioning from the first software application to the second software application, the second software application being different from the first software application; providing one or more user identity verification options via the second software application, the one or more user identity verification options including at least one-tap authentication via a contactless card; detecting the contactless card via near field communication (NFC) and receiving one or more cryptograms from the contactless card, the one or more cryptograms including at least card user information; determining whether the card user information from the received one or more cryptograms matches or corresponds to the user, and based on a determination that the card user information matches or corresponds to the user, determining that the identity of the user has been verified; returning from the second software application to the first software application; adding or linking the at least one payment card to the third-party wallet via the first software application based at least in part on confirmation that the identity of the user has been verified; A device that performs the above.

2. 2. The apparatus of claim 1, wherein the first software application is a third party wallet application for supporting the third party wallet and the second software application is an online banking application.

3. 2. The apparatus of claim 1, wherein the first software application is a mobile-based application, a native application, a web application, or a web browser, and the second software application is a mobile-based application, a native application, a web application, or a web browser.

4. receiving, via the first software application, from the user, consent to one or more terms and / or conditions associated with adding or linking the at least one payment card to the third-party wallet; The apparatus of claim 1 , further comprising:

5. The transition from the first software application to the second software application may include instructing the one or more processors to: receiving, from the user, a selection of the link to the second software application; receiving login information from the user for accessing the second software application; determining whether the user is authorized to access the second software application based on the received login information; The apparatus of claim 1 , further comprising:

6. 2. The apparatus of claim 1, wherein determining whether the card user information from the received one or more ciphertexts matches or corresponds to the user further comprises causing the one or more processors to decrypt the one or more ciphertexts via at least one key to obtain the card user information, receive authentication information associated with the user from one or more remote computing devices, and determine whether the received authentication information and the decrypted card user information match.

7. 2. The apparatus of claim 1, wherein determining whether the card user information from the received one or more cryptograms matches or corresponds to the user further comprises causing the one or more processors to transmit the one or more cryptograms via the second software application to one or more remote computing devices and receive an indication or confirmation from the one or more remote computing devices indicating that the identity of the user has been verified.

8. 2. The device of claim 1, wherein the contactless card comprises a memory and processing circuitry for executing instructions stored in the memory to transmit the one or more cryptograms as one or more NFC Data Exchange Format (NDEF) messages.

9. An apparatus comprising: A memory for storing instructions; one or more processors coupled to the memory and operable to execute the instructions, which, when executed, cause the one or more processors to: providing, via a first software application, a link for adding or linking at least one payment card to a third party wallet, the at least one payment card being associated with a user, and receiving a selection of the link from the user; providing one or more user identity verification options via the first software application, the one or more user identity verification options including at least one-tap authentication via a contactless card; detecting the contactless card via near field communication (NFC) and receiving one or more cryptograms from the contactless card, the one or more cryptograms including at least card user information; determining whether the card user information from the received one or more cryptograms matches or corresponds to the user, and determining that the identity of the user has been verified based on the determination that the card user information matches or corresponds to the user; transmitting, via the first software application, a verification confirmation of the identity of the user to a second software application and transitioning from the first software application to the second software application; adding or linking, via the second software application based at least in part on the verification confirmation, the at least one payment card to the third-party wallet and providing a notification that the at least one payment card has been successfully added or linked; A device that performs the above.

10. 10. The apparatus of claim 9, wherein the first software application is an online banking application and the second software application is a third party wallet application for supporting the third party wallet.

11. 11. The apparatus of claim 10, wherein the one or more processors are further configured to receive permission from the user to share data with the third-party wallet application.

12. 10. The apparatus of claim 9, wherein the first software application is a mobile-based application, a native application, a web application, or a web browser, and the second software application is a mobile-based application, a native application, a web application, or a web browser.

13. 10. The apparatus of claim 9, wherein determining whether the card user information from the received one or more ciphertexts matches or corresponds to the user further comprises causing the one or more processors to decrypt the one or more ciphertexts via at least one key to obtain the card user information, receive authentication information associated with the user from one or more remote computing devices, and determine whether the received authentication information and the decrypted card user information match.

14. 10. The apparatus of claim 9, wherein determining whether the card user information from the received one or more cryptograms matches or corresponds to the user further comprises causing the one or more processors to transmit the one or more cryptograms via the second software application to one or more remote computing devices and receive an indication or confirmation from the one or more remote computing devices indicating that the identity of the user has been verified.

15. 10. The apparatus of claim 9, wherein the contactless card comprises a memory and processing circuitry for executing instructions stored in the memory to transmit the one or more cryptograms as one or more NFC Data Exchange Format (NDEF) messages.

16. 1. A method for adding or linking at least one payment card to a third party wallet application, the method comprising: receiving a request to add or link the at least one payment card to the third-party wallet application; providing, via one or more processors, one or more user identity verification options, the one or more user identity verification options including one-tap authentication via a contactless card; receiving, via the one or more processors, a selection of the one-tap authentication via the contactless card from the user; detecting, via the one or more processors, the contactless card via near field communication (NFC) and receiving at least one cryptogram from the contactless card; determining, via the one or more processors, whether the contactless card belongs to or is associated with the user based at least on determining whether information included in the at least one cryptogram matches the user; and Verifying, via the one or more processors, that the identity of the user is verified based on a determination that the contactless card belongs to or is associated with the user to add or link the at least one payment card to the third-party wallet application; and The method includes:

17. 20. The method of claim 16, wherein the request to add or link the at least one payment card is received by the third-party wallet application and the one or more user identity verification options are provided by a bank software application.

18. The method comprises: receiving information related to the at least one payment card from the user; providing one or more card verification options, the one or more card verification options including a link to a bank software application; transitioning from the third party wallet application to the bank software application if the link to the bank software application is selected; and the bank software application sending the confirmation that the identity of the user has been verified to the third-party wallet application; returning from the bank software application to the third party wallet application; and the third-party wallet application adding or linking the at least one payment card to the third-party wallet application; 20. The method of claim 17, further comprising:

19. 20. The method of claim 16, wherein the request to add or link the at least one payment card is received by a banking software application, and the one or more user identity verification options are provided by the banking software application.

20. The method comprises: the bank software application sending the confirmation that the identity of the user has been verified to the third-party wallet application; Migrating from said bank software application to said third party wallet application; the third-party wallet application adding or linking the at least one payment card to the third-party wallet application; 20. The method of claim 19, further comprising:

Images