# US 10,311,436 B2 · User authentication method and device for credentials back-up service to mobile devices

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,311,436 B2
- Document ID: US10311436B2
- Status: Granted
- Kind: B2
- Application number: 16/165,180
- Filed: 2018-10-19
- Published: 2019-02-14
- Granted: 2019-06-04
- Earliest claimed: 2015-03-03
- Assignees: Mastercard International Incorporated
- Applicants: Mastercard International Incorporated
- Inventors: Simon Phillips; Mark Britten; Mehdi Collinge
- Web page: https://patentgrep.com/patent/US10311436B2

## CPC

- G06F 21/35: communicating wirelessly
- G06Q 20/322: {Aspects of commerce using mobile devices [M-devices]}
- G06Q 20/327: {Short range or proximity payments by means of M-devices}
- G06Q 20/38215: {Use of certificates or encrypted proofs of transaction rights}
- G06Q 20/3825: {Use of electronic signatures}
- G06Q 20/40: Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
- G06Q 20/4012: {Verifying personal identification numbers [PIN]}
- G06Q 20/4014: {Identity check for transactions}
- G06Q 20/40145: {Biometric identity checks}
- H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)}
- H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)}
- H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)}
- H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)}
- H04W 12/065: Continuous authentication
- H04W 12/068: {using credential vaults, e.g. password manager applications or one time password [OTP] applications}
- G06Q 2220/00: Business processing using cryptography
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

Back-up credentials data is stored for a user. A communication channel is established with a mobile device. A cryptogram is received from the mobile device, such that the cryptogram is relayed by the mobile device from an authentication device that interacted with the mobile device. The authentication device is associated with the user. The cryptogram is verified. In response to the verification of the cryptogram, the stored back-up credentials data is made accessible to the mobile device.

## Claims

### Claim 1

An authentication device, comprising:
a processor;
a memory in communication with the processor; and
a short-range data communication transceiver controlled by the processor;
the memory storing program instructions, the processor operative with the program instructions to perform functions as follows:
receiving user authentication data via the transceiver from a mobile device in proximity to the authentication device;
verifying the received user authentication data;
receiving challenge data from the mobile device;
in response to a result of the verifying function, generating a cryptogram by digitally signing the challenge data with a cryptographic key; and
transmitting the cryptogram via the transceiver to the mobile device.

### Claim 2 (depends on 1)

The authentication device of claim 1, wherein the received user authentication data includes a PIN (personal identification number).

### Claim 3 (depends on 1)

The authentication device of claim 1, wherein the received user authentication data includes user biometric data.

### Claim 4 (depends on 3)

The authentication device of claim 3, wherein the user biometric data represents a scan of the user's fingerprint.

### Claim 5 (depends on 3)

The authentication device of claim 3, wherein the user biometric data is suitable for voice recognition processing.

### Claim 6 (depends on 1)

The authentication device of claim 1, wherein the authentication device is card-shaped.

### Claim 7 (depends on 1)

The authentication device of claim 1, wherein the mobile device is a smartphone.

### Claim 8

A method comprising:
receiving user authentication data, via a short-range data communication transceiver in an authentication device, from a mobile device in proximity to the authentication device;
verifying, in the authentication device, the received user authentication data;
receiving, in the authentication device, challenge data from the mobile device;
in response to a result of the verifying function, generating a cryptogram in the authentication device by digitally signing the challenge data with a cryptographic key; and
transmitting the cryptogram via the transceiver from the authentication device to the mobile device.

### Claim 9 (depends on 8)

The method of claim 8, wherein the received user authentication data includes a PIN (personal identification number).

### Claim 10 (depends on 8)

The method of claim 8, wherein the received user authentication data includes user biometric data.

### Claim 11 (depends on 10)

The method of claim 10, wherein the user biometric data represents a scan of the user's fingerprint.

### Claim 12 (depends on 10)

The method of claim 10, wherein the user biometric data is suitable for voice recognition processing.

### Claim 13 (depends on 8)

The method of claim 8, wherein the authentication device is card-shaped.

### Claim 14 (depends on 8)

The method of claim 8, wherein the mobile device is a smartphone.

### Claim 15

An apparatus for confirming authentication of a user of a mobile device, the apparatus comprising:
a processor; and
a memory in communication with the processor, the memory storing program instructions, the processor operative with the program instructions to perform functions as follows:
storing back-up credentials data for a user;
establishing a communications channel with the mobile device;
receiving a cryptogram and challenge data from the mobile device, the cryptogram relayed by the mobile device from an authentication device that interacted with the mobile device to support authentication of a user of the mobile device and the authentication device, the authentication device different from the mobile device, the authentication device associated with the user;
verifying the cryptogram; and
in response to a result of the step of verifying the cryptogram, making the stored back-up credentials data accessible to the mobile device.

### Claim 16 (depends on 15)

The apparatus of claim 15, wherein the communications channel is at least partially constituted by a mobile communications network.

### Claim 17 (depends on 15)

The apparatus of claim 15, wherein the stored back-up credentials data is made accessible to the mobile device by downloading the stored back-up credentials data to the mobile device.

### Claim 18 (depends on 15)

The apparatus of claim 15, wherein the stored back-up credentials data include payment account credentials data.

### Claim 19 (depends on 15)

The apparatus of claim 15, wherein the stored back-up credentials data include transit system access credentials data.

### Claim 20 (depends on 15)

The apparatus of claim 15, wherein the stored back-up credentials data include building or room access credentials data.