# US 11,451,401 B2 · User device gated secure authentication computing systems and methods

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,451,401 B2
- Document ID: US11451401B2
- Status: Granted
- Kind: B2
- Application number: 17/188,391
- Filed: 2021-03-01
- Published: 2022-01-27
- Granted: 2022-09-20
- Earliest claimed: 2020-07-25
- Assignees: Login Id Inc.
- Applicants: Login Id Inc.
- Inventors: Simon Law; Pasan Chankama Hapuarachchi
- Web page: https://patentgrep.com/patent/US11451401B2

## CPC

- H04L 9/3231: {Biological data, e.g. fingerprint, voice or retina (network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861)}
- H04L 9/3247: {involving digital signatures}
- G06Q 20/02: involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
- G06Q 20/3227: {using secure elements embedded in M-devices}
- G06Q 20/38215: {Use of certificates or encrypted proofs of transaction rights}
- G06Q 20/3825: {Use of electronic signatures}
- G06Q 20/3829: {involving key management}
- G06Q 20/385: {using an alias or single-use codes}
- G06Q 20/40145: {Biometric identity checks}
- G06Q 20/4016: {involving fraud or risk level assessment in transaction processing}
- G06Q 20/42: Confirmation, e.g. check or permission by the legal debtor of payment
- H04L 9/3236: {using cryptographic hash functions}
- H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)}
- H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)}
- G06Q 20/202: {Interconnection or interaction of plural electronic cash registers [ECR] or to host computer, e.g. network details, transfer of information from host to ECR or from ECR to ECR}
- G06Q 20/321: {using wearable devices}
- G06Q 20/3278: {RFID or NFC payments by means of M-devices}
- G06Q 2220/00: Business processing using cryptography
- H04L 2209/56: Financial cryptography, e.g. electronic payment or e-cash
- H04L 2463/082: applying multi-factor authentication
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR

## Abstract

A system is provided that allows users to execute a secure transaction that is authenticated by their user device. Personally identifiable information (PII), such as, but not limited to, biometric authentication data, is locally stored on the user's device so as to protect the PII. A user device private key is associated with the particular user device and the user, and the corresponding public key is registered with a User Device Authentication Alliance server (UDAAS) system. In an online transaction, a LoginID server or an Access Control server interact with the UDAAS to confirm the user is authentic and has confirmed the transaction.

## Claims

### Claim 1

A system for executing a secure action, the system comprising:
a user device, a service provider server, an attestation server, a client server, a directory server, and an access control server in data communication with a data network;
the user device comprising a device authenticator that comprises a secure execution and secure storage device, the device authenticator configured to generate a device authenticator private key and a device authenticator public key, wherein the device authenticator private key is stored on the device authenticator and the device authenticator public key is stored on the attestation server;
the user device further comprising a user agent, the user agent comprising at least one of a web browser and a native application, and the user agent configured to generate and send a transaction request to the service provider server;
the service provider server configured to transmit transaction confirmation data to the attestation server after receiving the transaction request;
the attestation server configured to generate and transmit a transaction confirmation request to the user device;
the user device configured to activate the device authenticator to obtain a user input verification in response to the transaction confirmation request, and, after obtaining the user input verification, the device authenticator configured to generate a transaction confirmation response comprising a device authentication signature signed by the device authenticator private key;
the user device configured to transmit the transaction confirmation response to the attestation server;
the attestation server configured to verify the transaction confirmation response, comprising verifying the device authentication signature using the device authenticator public key; and,
after verifying the transaction confirmation response, the attestation server further configured to redirect the user agent to the service provider server, and the attestation server further configured to generate and transmit a payload to the client server, the payload comprising an attestation signature of successfully verifying the transaction confirmation response, the attestation signature generated using at least a private key of the attestation server;
the client server comprising a merchant plugin, the client server configured to receive the payload from the attestation server and transmit the payload to the directory server;
the directory server comprising a public key of the attestation server and a directory database that includes the access control server, the directory database used to route messages between the merchant plugin and the access control server, and the directory server is configured to, responsive to receiving the payload from the attestation server, use the public key of the attestation server to verify the attestation signature in the payload;
the directory server is further configured to, responsive to verifying the attestation signature, transmit the payload and a verification result to the access control server;
the access control server configured to, responsive to receiving the payload and the verification result from the directory server, generate a reply message that comprises at least one of a cardholder authentication verification value (CAVV), an electronic commerce indicator (ECI), and an acknowledgement value indicating that the attestation server is an entity that has previously verified the transaction confirmation response; and
the access control server is configured to transmit the reply message to the directory server, the directory server is configured to transmit the reply message to the client server, the client server is configured to transmit the reply message to the attestation server, and the attestation server is configured to transmit the reply message to the service provider server.

### Claim 2 (depends on 1)

The system of claim 1 wherein the transaction confirmation response comprises a value derived from the transaction confirmation data that is signed using the device authenticator private key, and the attestation server verifying the transaction confirmation response further comprises verifying the value using the transaction confirmation data.

### Claim 3 (depends on 2)

The computing system of claim 2 wherein the value is a hash of the transaction confirmation data.

### Claim 4 (depends on 1)

The system of claim 1 wherein the payload further comprises the transaction confirmation data.

### Claim 5 (depends on 1)

The system of claim 1 wherein a Fast Identity Online (FIDO) protocol is used for originating and storing the device authenticator public key and the device authenticator private key; and, the device authenticator public key is a FIDO public key and the device authenticator private key is a FIDO private key.

### Claim 6 (depends on 1)

The system of claim 1 wherein the transaction confirmation data further comprises a primary account number.

### Claim 7 (depends on 1)

The system of claim 1 wherein, after receiving the transaction confirmation data, the attestation server is further configured to at least: generate and send a transaction ID for receipt by the user device, the transaction ID corresponding to the transaction confirmation data; receive a transaction ID originating from the user device; and, after verifying the transaction ID originating from the user device matches the transaction ID generated by the attestation server, generate and send the transaction confirmation request to the user device.

### Claim 8 (depends on 1)

The system of claim 1 wherein, after the user device receives the transaction confirmation request, the user agent displays transaction content for review, the transaction content comprising one or more of: name of product or service being purchased, an amount of money, and payment method.

### Claim 9 (depends on 1)

The system of claim 1 wherein: the device authenticator stores first biometric authentication data; the user device further comprises a scanner configured to obtain the user input verification, the user input verification comprising second biometric authentication data; and, the device authenticator is further configured to compare the second biometric authentication data with the first biometric data.

### Claim 10 (depends on 1)

The system of claim 1 wherein the CAVV comprises the acknowledgement value.

### Claim 11 (depends on 1)

The system of claim 1 wherein the attestation server redirecting the user agent to the service provider server further comprises transmitting via the user agent to the service provider server a transaction confirmation token.

### Claim 12 (depends on 11)

The system of claim 11 wherein, after receiving the transaction confirmation token, the service provider server is further configured to transmit the transaction confirmation token to the attestation server, and the attestation server is further configured to verify the transaction confirmation token.