# US 11,909,736 B2 · Systems and methods for authenticating an electronic transaction using hosted authentication service

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,909,736 B2
- Document ID: US11909736B2
- Status: Granted
- Kind: B2
- Application number: 17/537,324
- Filed: 2021-11-29
- Published: 2022-03-17
- Granted: 2024-02-20
- Earliest claimed: 2020-01-15
- Assignees: Worldpay, LLC
- Applicants: Worldpay Limited
- Inventors: Christopher S. Dee
- Web page: https://patentgrep.com/patent/US11909736B2

## CPC

- H04L 9/3271: {using challenge-response}
- H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity}
- G06F 9/45529: {Embedded in an application, e.g. JavaScript in a Web browser}
- G06F 21/31: User authentication
- G06F 21/34: involving the use of external additional devices, e.g. dongles or smart cards
- G06F 21/44: Program or device authentication
- G06Q 20/10: specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
- G06Q 20/12: specially adapted for electronic shopping systems
- G06Q 20/20: Point-of-sale [POS] network systems
- G06Q 20/3825: {Use of electronic signatures}
- G06Q 20/401: {Transaction verification}
- G06Q 20/4014: {Identity check for transactions}
- G06Q 20/4016: {involving fraud or risk level assessment in transaction processing}
- G06Q 20/405: {Establishing or using transaction specific rules}
- H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)}
- H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)}
- H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)}
- G06F 2221/2103: Challenge-response
- G06Q 2220/00: Business processing using cryptography
- H04L 2209/56: Financial cryptography, e.g. electronic payment or e-cash
- H04L 2463/082: applying multi-factor authentication
- H04L 2463/102: applying security measure for e-commerce
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR

## Abstract

Systems and methods for authenticating an electronic transaction using a hosted authentication service. The systems and methods determine whether an authentication is required based on a first electronic message received from a first data system. Upon determining the authentication is required, the systems and methods transmit a dummy authentication request and a hosted authentication service uniform resource locator to the first data system. The systems and methods further determine or receive an indication whether a user authentication challenge is required based on a transaction risk analysis by a second data system. Upon determining the user authentication challenge is required, the systems and methods provide, at a user interface, an electronic form including a challenge request. The systems and methods transmit, to the first data system, another electronic form including a dummy authentication response generated based on a challenge result.

## Claims

### Claim 1

A method for authenticating an electronic transaction using a hosted authentication service, comprising:
receiving, by a requestor system, an authorization request for the electronic transaction from a POS terminal;
determining, by the requestor system, a requirement of a security assessment for the authorization request based, at least in part, on a security protocol that supports the electronic transaction;
receiving, by the requestor system, a markup language form based on a hosted authentication page of the hosted authentication service, wherein the hosted authentication page is generated by the requestor system, and wherein the markup language form includes a system return web address and a dummy authentication request;
generating, by the requestor system, a second markup language form based upon determining a requirement of an authentication challenge, wherein the second markup language form includes a request for user transaction data; and
generating, by the requestor system, a dummy authentication response to authorize the electronic transaction, wherein the dummy authentication response includes a result of the authentication challenge.

### Claim 2 (depends on 1)

The method of claim 1, wherein the security protocol includes multi-factor authentication, risk-based authentication, and frictionless authentication for requesting additional consumer transaction information.

### Claim 3 (depends on 1)

The method of claim 1, wherein determining the requirement of the authentication challenge further comprising:
collecting, by the requestor system, the user transaction data for a transaction risk analysis, wherein the user transaction data includes browser user agent information, a browser time zone information, a transaction history information, a consumer device identifier, or a combination thereof;
processing, by the requestor system, the user transaction data for the transaction risk analysis; and
determining, by the requestor system, the requirement of the authentication challenge based on the transaction risk analysis.

### Claim 4 (depends on 3)

The method of claim 3, further comprising:
running a JavaScript in a browser of a user device to collect the user transaction data.

### Claim 5 (depends on 1)

The method of claim 1, wherein generating the dummy authentication response further comprising:
cross-referencing, by the requestor system, the authorization request with the dummy authentication response;
unpacking, by the requestor system, the dummy authentication response to obtain an authentication response, a result response, challenge response data, transaction analysis exemption data generated in accordance with the security protocol, or a combination thereof; and
performing, by the requestor system, an authorization verification to complete the electronic transaction.

### Claim 6 (depends on 5)

The method of claim 5, wherein the authorization verification further comprising:
transmitting, by the requestor system, an authentication data for the electronic transaction, wherein the authentication data includes a cryptogram.

### Claim 7 (depends on 1)

The method of claim 1, further comprising:
skipping, by the requestor system, the security assessment for the authorization request to the electronic transaction based, at least in part, on a blanket exemption, a predetermined merchant preference, a low risk associated with the electronic transaction, or a combination thereof; and
generating, by the requestor system, a payment authorization response message.

### Claim 8 (depends on 1)

The method of claim 1, wherein the hosted authentication page mimics an existing security protocol authentication challenge page while undertaking a user transaction data collection.

### Claim 9 (depends on 1)

The method of claim 1, wherein the dummy authentication request mimics an authentication request of a previous security protocol.

### Claim 10

A system for authenticating an electronic transaction using a hosted authentication service, comprising:
receiving, by a requestor system, an authorization request for the electronic transaction from a POS terminal;
determining, by the requestor system, a requirement of a security assessment for the authorization request based, at least in part, on a security protocol that supports the electronic transaction;
receiving, by the requestor system, a markup language form based on a hosted authentication page of the hosted authentication service, wherein the hosted authentication page is generated by the requestor system, and wherein the markup language form includes a system return web address and a dummy authentication request;
generating, by the requestor system, a second markup language form based upon determining a requirement of an authentication challenge, wherein the second markup language form includes a request for user transaction data; and
generating, by the requestor system, a dummy authentication response to authorize the electronic transaction, wherein the dummy authentication response includes a result of the authentication challenge.

### Claim 11 (depends on 10)

The system of claim 10, wherein the security protocol includes multi-factor authentication, risk-based authentication, and frictionless authentication for requesting additional consumer transaction information.

### Claim 12 (depends on 10)

The system of claim 10, wherein determining the requirement of the authentication challenge further comprising:
collecting, by the requestor system, the user transaction data for a transaction risk analysis, wherein the user transaction data includes browser user agent information, a browser time zone information, a transaction history information, a consumer device identifier, or a combination thereof;
processing, by the requestor system, the user transaction data for the transaction risk analysis; and
determining, by the requestor system, the requirement of the authentication challenge based on the transaction risk analysis.

### Claim 13 (depends on 10)

The system of claim 10, wherein generating the dummy authentication response further comprising:
cross-referencing, by the requestor system, the authorization request with the dummy authentication response;
unpacking, by the requestor system, the dummy authentication response to obtain an authentication response, a result response, challenge response data, transaction analysis exemption data generated in accordance with the security protocol, or a combination thereof; and
performing, by the requestor system, an authorization verification to complete the electronic transaction.

### Claim 14 (depends on 13)

The system of claim 13, wherein the authorization verification further comprising:
transmitting, by the requestor system, an authentication data for the electronic transaction, wherein the authentication data includes a cryptogram.

### Claim 15 (depends on 10)

The system of claim 10, further comprising:
skipping, by the requestor system, the security assessment for the authorization request to the electronic transaction based, at least in part, on a blanket exemption, a predetermined merchant preference, a low risk associated with the electronic transaction, or a combination thereof; and
generating, by the requestor system, a payment authorization response message.

### Claim 16 (depends on 10)

The system of claim 10, wherein the hosted authentication page mimics an existing security protocol authentication challenge page while undertaking a user transaction data collection.

### Claim 17

A non-transitory computer-readable medium storing instructions that, when executed by one or more processors of a computer system, cause the one or more processors to perform a method for authenticating an electronic transaction using a hosted authentication service, the method comprising:
receiving, by a requestor system, an authorization request for the electronic transaction from a POS terminal;
determining, by the requestor system, a requirement of a security assessment for the authorization request based, at least in part, on a security protocol that supports the electronic transaction;
receiving, by the requestor system, a markup language form based on a hosted authentication page of the hosted authentication service, wherein the hosted authentication page is generated by the requestor system, and wherein the markup language form includes a system return web address and a dummy authentication request;
generating, by the requestor system, a second markup language form based upon determining a requirement of an authentication challenge, wherein the second markup language form includes a request for user transaction data; and
generating, by the requestor system, a dummy authentication response to authorize the electronic transaction, wherein the dummy authentication response includes a result of the authentication challenge.

### Claim 18 (depends on 17)

The computer-readable medium of claim 17, wherein the security protocol includes multi-factor authentication, risk-based authentication, and frictionless authentication for requesting additional consumer transaction information.

### Claim 19 (depends on 17)

The computer-readable medium of claim 17, wherein determining the requirement of the authentication challenge further comprising:
collecting, by the requestor system, the user transaction data for a transaction risk analysis, wherein the user transaction data includes browser user agent information, a browser time zone information, a transaction history information, a consumer device identifier, or a combination thereof;
processing, by the requestor system, the user transaction data for the transaction risk analysis; and
determining, by the requestor system, the requirement of the authentication challenge based on the transaction risk analysis.

### Claim 20 (depends on 17)

The computer-readable medium of claim 17, wherein generating the dummy authentication response further comprising:
cross-referencing, by the requestor system, the authorization request with the dummy authentication response;
unpacking, by the requestor system, the dummy authentication response to obtain an authentication response, a result response, challenge response data, transaction analysis exemption data generated in accordance with the security protocol, or a combination thereof; and
performing, by the requestor system, an authorization verification to complete the electronic transaction.