# US 12,003,508 B2 · Systems, methods, and computer program products for authenticating devices

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,003,508 B2
- Document ID: US12003508B2
- Status: Granted
- Kind: B2
- Application number: 17/680,827
- Filed: 2022-02-25
- Published: 2022-06-09
- Granted: 2024-06-04
- Earliest claimed: 2019-08-23
- Assignees: Visa International Service Association
- Applicants: Visa International Service Association
- Inventors: William Joseph Leddy, III
- Web page: https://patentgrep.com/patent/US12003508B2

## CPC

- H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint}
- G06F 21/44: Program or device authentication
- G06Q 20/12: specially adapted for electronic shopping systems
- G06Q 20/38215: {Use of certificates or encrypted proofs of transaction rights}
- G06Q 20/388: {using mutual authentication without cards, e.g. challenge-response}
- G06Q 20/401: {Transaction verification}
- G06Q 20/4014: {Identity check for transactions}
- G06Q 20/4016: {involving fraud or risk level assessment in transaction processing}
- G06Q 20/40975: {using encryption therefor}
- G06F 2221/2103: Challenge-response
- H04L 2463/102: applying security measure for e-commerce
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR

## Abstract

Disclosed are non-limiting methods for authenticating devices, including receiving a request for a device authentication identifier, transmitting a device authentication request message via a frame embedded in a webpage of a merchant website, the device authentication request message including challenge data associated with a challenge, receiving a device authentication response message via the frame embedded in the webpage of the merchant website based on the device authentication request message, the device authentication response message including challenge response data associated with a challenge response, transmitting the device authentication identifier message based on the device authentication response message, receiving a transaction request message for a transaction, including the device authentication identifier and transaction data associated with the transaction, determining the device score based on the device authentication identifier, and generating an authorization request message based on the transaction data and the device score. Systems and computer program products are also disclosed.

## Claims

### Claim 1

A computer-implemented method for authenticating devices, the computer-implemented method comprising:
receiving, with at least one processor, a request for a device authentication identifier associated with an account of a user;
transmitting, with at least one processor, a device authentication identifier request message to a user device via a frame embedded in a webpage of a merchant website displayed on the user device, the frame comprising a second website hosted by a domain different than a domain of the merchant website, the device authentication identifier request message comprising challenge data associated with a challenge;
receiving, with at least one processor, a device authentication response message via the frame embedded in the webpage of the merchant website based on the device authentication identifier request message, the device authentication response message comprising challenge response data generated with the user device based on a key of the user device;
transmitting, with at least one processor, a device authentication identifier message comprising the device authentication identifier associated with the account of the user based on the device authentication response message;
receiving, with at least one processor, a transaction request message associated with a transaction, the transaction request message comprising:
the device authentication identifier, and
transaction data associated with the transaction;
determining that a device score associated with the account of the user corresponds to the device authentication identifier; and
generating, with at least one processor, an authorization request message based on the transaction data and the device score.

### Claim 2 (depends on 1)

The computer-implemented method according to claim 1, further comprising transmitting, with at least one processor, second webpage data to render a second webpage within the frame embedded in the webpage of the merchant website.

### Claim 3 (depends on 1)

The computer-implemented method according to claim 1, further comprising:
receiving, with at least one processor, a public key from a computing device associated with a user to register the computing device with the account associated with the user, the account further associated with the device score,
wherein, when registering the computing device with the account associated with the user, the device score is set to a default value associated with a default score.

### Claim 4 (depends on 3)

The computer-implemented method according to claim 3, further comprising:
determining, with at least one processor, that a second computing device was previously registered with the account associated with the user;
transmitting, with at least one processor, a new device registration message to the second computing device including a prompt to verify that the computing device is permitted to be registered;
receiving, with at least one processor, a registration response message including an indication as to whether the computing device is permitted to be registered in association with the second computing device; and
determining, with at least one processor, that the computing device is permitted to be registered based on the indication included in the registration response message,
wherein, when registering the computing device with the account associated with the user, the device score is set to a value based on a value of an existing device score of the second computing device after determining that the computing device is permitted to be registered in association with the second computing device.

### Claim 5 (depends on 2)

The computer-implemented method according to claim 2, wherein the second webpage comprises an invisible second webpage configured to silently authenticate the user device.

### Claim 6 (depends on 1)

The computer-implemented method according to claim 1, further comprising:
receiving, with at least one processor, an authorization response message;
determining, with at least one processor, that the transaction is not approved based on the authorization response message; and
updating, with at least one processor, the device score based on determining that the transaction is declined based on the authorization response message.

### Claim 7 (depends on 1)

The computer-implemented method according to claim 1, further comprising:
determining, with at least one processor, that a fraudulent transaction is associated with an authentication application; and
updating, with at least one processor, the device score based on determining the fraudulent transaction is associated with the authentication application.

### Claim 8 (depends on 3)

The computer-implemented method according to claim 3, wherein the computing device associated with the user is configured to:
display, on a display of the computing device associated with the user, a local authentication request in response to receiving the device authentication identifier request message;
receive a local authentication response as input at the computing device associated with the user; and
transmit a device authentication response based on receiving the local authentication response.

### Claim 9

A system for authenticating devices, the system comprising:
at least one memory storing instructions;
at least one processor in communication with the at least one memory, the at least one processor programmed or configured to execute the instructions to:
receive a request for a device authentication identifier associated with an account of a user;
transmit a device authentication request message to a user device via a frame embedded in a webpage of a merchant website displayed on the user device, the frame comprising a second website hosted by a domain different than a domain of the merchant website, the device authentication request message comprising challenge data associated with a challenge;
receive a device authentication response message via the frame embedded in the webpage of the merchant website based on the device authentication request message, the device authentication response message comprising challenge response data generated with the user device based on a key of the user device;
transmit a device authentication identifier message comprising the device authentication identifier associated with the account of the user based on the device authentication response message;
receive a transaction request message associated with a transaction, the transaction request message comprising:
the device authentication identifier, and
transaction data associated with the transaction;
determine a device score associated with the account of the user based on the device authentication identifier; and
generate an authorization request message including the transaction data and the device score.

### Claim 10 (depends on 9)

The system according to claim 9, wherein the at least one processor is programmed or configured to transmit second webpage data to render a second webpage within the frame embedded in the webpage of the merchant website.

### Claim 11 (depends on 9)

The system according to claim 9, wherein the at least one processor is programmed or configured to:
receive a public key from a computing device associated with a user to register the computing device with the account associated with the user, the account further associated with the device score,
wherein, when registering the computing device with an account associated with the user, the at least one processor is programmed or configured to set the device score to a default value associated with a default score.

### Claim 12 (depends on 11)

The system according to claim 11, wherein the at least one processor is programmed or configured to:
determine that a second computing device was previously registered with the account associated with the user,
wherein, when registering the computing device with the account associated with the user, the at least one processor is programmed or configured to set the device score to a value based on an existing device score of the second computing device.

### Claim 13 (depends on 10)

The system according to claim 10, wherein the second webpage comprises an invisible second webpage configured to silently authenticate the user device.

### Claim 14 (depends on 9)

The system according to claim 9, wherein the at least one processor is programmed or configured to:
receive an authorization response message;
determine that the transaction is declined or approved based on the authorization response message; and
update the device score based on determining that the transaction is declined or approved based on the authorization response message.

### Claim 15 (depends on 9)

The system according to claim 9, wherein the at least one processor is programmed or configured to:
determine that a fraudulent transaction is associated with a device associated with the user; and
update the device score based on determining the fraudulent transaction is associated with the device associated with the user.

### Claim 16 (depends on 9)

The system according to claim 9, wherein a computing device associated with the user comprises at least one processor programmed or configured to:
display, on a display of the computing device associated with the user, a local authentication request in response to receiving the device authentication request message;
receive a local authentication response as input at the computing device associated with the user; and
transmit a device authentication response based on receiving the local authentication response.

### Claim 17

A computer program product for authenticating devices, the computer program product comprising at least one non-transitory computer-readable medium comprising one or more instructions that, when executed by at least one processor, cause the at least one processor to:
receive a request for a device authentication identifier associated with an account of a user;
transmit a device authentication request message to a user device via a frame embedded in a webpage of a merchant website displayed on the user device, the frame comprising a second website hosted by a domain different than a domain of the merchant website, the device authentication request message comprising challenge data associated with a challenge;
receive a device authentication response message via the frame embedded in the webpage of the merchant website based on the device authentication request message, the device authentication response message comprising challenge response data generated with the user device based on a key of the user device;
transmit a device authentication identifier message comprising the device authentication identifier associated with the account of the user based on the device authentication response message;
receive a transaction request message associated with a transaction, the transaction request message comprising:
the device authentication identifier, and
transaction data associated with the transaction;
determine a device score associated with the device authentication identifier; and
generate an authorization request message based on the transaction data and the device score.

### Claim 18 (depends on 17)

The computer program product according to claim 17, wherein the one or more instructions further cause the at least one processor to transmit second webpage data to render a second webpage within the frame embedded in the webpage of the merchant website.

### Claim 19 (depends on 17)

The computer program product according to claim 17, wherein the one or more instructions further cause the at least one processor to:
receive a public key from a computing device associated with a user to register the computing device with the account associated with the user, the account further associated with the device score,
wherein, when registering the computing device with an account associated with the user, the at least one processor is programmed or configured to set the device score to a default value associated with a default score.

### Claim 20 (depends on 19)

The computer program product according to claim 19, wherein the one or more instructions further cause the at least one processor to:
determine that a second computing device was previously registered with the account associated with the user,
wherein, when registering the computing device with the account associated with the user, the at least one processor is programmed or configured to set the device score to a value of an existing device score of the second computing device.