A system for executing a secure action, the system comprising:
- a user device, a service provider server, an attestation server, a client server, a directory server, and an access control server in data communication with a data network;
- the user device comprising a device authenticator that comprises a secure execution and secure storage device, the device authenticator configured to generate a device authenticator private key and a device authenticator public key, wherein the device authenticator private key is stored on the device authenticator and the device authenticator public key is stored on the attestation server;
- the user device further comprising a user agent, the user agent comprising at least one of a web browser and a native application, and the user agent configured to generate and send a transaction request to the service provider server;
- the service provider server configured to transmit transaction confirmation data to the attestation server after receiving the transaction request;
- the attestation server configured to generate and transmit a transaction confirmation request to the user device;
- the user device configured to activate the device authenticator to obtain a user input verification in response to the transaction confirmation request, and, after obtaining the user input verification, the device authenticator configured to generate a transaction confirmation response comprising a device authentication signature signed by the device authenticator private key;
- the user device configured to transmit the transaction confirmation response to the attestation server;
- the attestation server configured to verify the transaction confirmation response, comprising verifying the device authentication signature using the device authenticator public key;
- and,
- after verifying the transaction confirmation response, the attestation server further configured to redirect the user agent to the service provider server, and the attestation server further configured to generate and transmit a payload to the client server, the payload comprising an attestation signature of successfully verifying the transaction confirmation response, the attestation signature generated using at least a private key of the attestation server;
- the client server comprising a merchant plugin, the client server configured to receive the payload from the attestation server and transmit the payload to the directory server;
- the directory server comprising a public key of the attestation server and a directory database that includes the access control server, the directory database used to route messages between the merchant plugin and the access control server, and the directory server is configured to, responsive to receiving the payload from the attestation server, use the public key of the attestation server to verify the attestation signature in the payload;
- the directory server is further configured to, responsive to verifying the attestation signature, transmit the payload and a verification result to the access control server;
- the access control server configured to, responsive to receiving the payload and the verification result from the directory server, generate a reply message that comprises at least one of a cardholder authentication verification value (CAVV), an electronic commerce indicator (ECI), and an acknowledgement value indicating that the attestation server is an entity that has previously verified the transaction confirmation response;
- and
- the access control server is configured to transmit the reply message to the directory server, the directory server is configured to transmit the reply message to the client server, the client server is configured to transmit the reply message to the attestation server, and the attestation server is configured to transmit the reply message to the service provider server.