# US 12,008,570 B2 · Systems and methods for intelligent step-up for access control systems

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,008,570 B2
- Document ID: US12008570B2
- Status: Granted
- Kind: B2
- Application number: 17/977,323
- Filed: 2022-10-31
- Published: 2023-02-16
- Granted: 2024-06-11
- Earliest claimed: 2018-10-29
- Assignees: Mastercard International Incorporated
- Applicants: Mastercard International Incorporated
- Inventors: Mohamed Abouelenin
- Web page: https://patentgrep.com/patent/US12008570B2

## CPC

- G06Q 20/401: {Transaction verification}
- G06Q 20/4014: {Identity check for transactions}
- G06Q 20/12: specially adapted for electronic shopping systems
- G06Q 20/3226: {Use of secure elements separate from M-devices}
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint}
- H04L 63/10: {for controlling access to devices or network resources}
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Some embodiments may provide systems, methods and computer program code to method to facilitate an interaction involving a user which include determining that a user authentication is required to complete the interaction, identifying at least a first verified device associated with the user, and transmitting an authentication message to the at least first verified device.

## Claims

### Claim 1

A method for operating an authentication service to authenticate a user in a transaction involving the user and a merchant, the method comprising:
receiving, by the authentication service, an authorization request, the authorization request including information identifying the merchant, information identifying the transaction and information identifying a selected payment device;
determining that an issuer of the payment device is a registered participant of the authentication service;
identifying, based on the information identifying the selected payment device, a list of registered authentication devices associated with the user;
generating, a list of registered authentication devices for display to the user;
receiving a selection of a registered authentication device from the user;
identifying, for each registered authentication device, a payment token;
identifying, for each payment token, a payment application identifier;
transmitting a request for authentication from the user using the selected registered authentication device; wherein transmitting the request for authentication from the user using the selected registered authentication device further includes transmitting the information identifying the transaction to the payment application identified by the payment application identifier of the selected registered authentication device;
receiving an authentication response from the selected registered authentication device; and
causing the information identifying the transaction to be displayed to the user on the selected registered authentication device.

### Claim 2 (depends on 1)

The method of claim 1,
wherein transmitting the request for authentication from the user using the selected registered authentication device is performed using a push notification.

### Claim 3 (depends on 1)

The method of claim 1, wherein the transaction involving the user and the merchant is initiated by the user operating a first user device and wherein the list of registered authentication devices for display to the user is for display on the first user device.

### Claim 4 (depends on 3)

The method of claim 3, wherein the first user device is different than the selected registered authentication device.

### Claim 5 (depends on 3)

The method of claim 3, further comprising:
determining that the request for authentication from the user using the selected registered authentication device has failed;
generating an updated html list of registered authentication device for display to the user on the first user device;
receiving a selection of a second registered authentication device from the user; and
initiating an updated request for authentication from the user using the second registered authentication device.

### Claim 6 (depends on 1)

The method of claim 1, wherein each registered authentication device in the list of registered authentication devices has been authenticated by the user using a verified device of the user.

### Claim 7 (depends on 6)

The method of claim 6, wherein each registered authentication device in the list of registered authentication devices stores a token issued by a tokenization service, wherein the token is associated with the payment device of the user and the registered authentication device.

### Claim 8

An authentication system, comprising:
a memory storing data associated with payment accounts; and
a processor configured to
receive an authorization request, the authorization request including information identifying a merchant, information identifying a transaction and information identifying a payment device selected by a user;
determine that an issuer of the payment device is a registered participant in a service provided by the authentication system;
identify, based on the information identifying the selected payment device, a list of registered authentication devices associated with the user;
generate, a list of registered authentication devices for display to the user;
receive a selection of a registered authentication device from the user;
identify, for each registered authentication device, a payment token;
identify, for each payment token, a payment application identifier;
transmit a request for authentication from the user using the selected registered authentication device; wherein transmitting the request further includes transmitting the information identifying the transaction to the payment application identified by the payment application identifier of the selected registered authentication device;
receive an authentication response from the selected registered authentication device; and
cause the information identifying the transaction to be displayed to the user on the selected registered authentication device.

### Claim 9 (depends on 8)

The system of claim 8,
wherein the transmission of the request for authentication from the user using the selected registered authentication device is performed using a push notification.

### Claim 10 (depends on 8)

The system of claim 8, wherein the transaction involving the user and the merchant is initiated by the user operating a first user device and wherein the list of registered authentication devices for display to the user is for display on the first user device.

### Claim 11 (depends on 10)

The system of claim 10, wherein the first user device is different than the selected registered authentication device.

### Claim 12 (depends on 10)

The system of claim 10, wherein the processor is further configured to:
determine that the request for authentication from the user using the selected registered authentication device has failed;
generate an updated list of registered authentication device for display to the user on the first user device;
receive a selection of a second registered authentication device from the user; and
transmit an updated request for authentication from the user using the second registered authentication device.

### Claim 13

A non-transitory, computer-readable medium storing instructions that, when executed by a processor, cause the processor to:
receive an authorization request, the authorization request including information identifying a merchant, information identifying a transaction and information identifying a payment device selected by a user;
determine that an issuer of the payment device is a registered participant in a service provided by the authentication system;
identify, based on the information identifying the selected payment device, a list of registered authentication devices associated with the user;
generate, a list of registered authentication devices for display to the user;
receive a selection of a registered authentication device from the user;
identify, for each registered authentication device, a payment token;
identify, for each payment token, a payment application identifier;
transmit a request for authentication from the user using the selected registered authentication device; wherein transmitting the request further includes transmitting the information identifying the transaction to the payment application identified by the payment application identifier of the selected registered authentication device;
receive an authentication response from the selected registered authentication device; and
cause the information identifying the transaction to be displayed to the user on the selected registered authentication device.

### Claim 14 (depends on 13)

The medium of claim 13 wherein the transaction involving the user and the merchant is initiated by the user operating a first user device and wherein the list of registered authentication devices for display to the user is for display on the first user device.

### Claim 15 (depends on 14)

The medium of claim 14 further comprising instructions that, when executed by the processor, cause the processor to:
determine that the request for authentication from the user using the selected registered authentication device has failed;
generate an updated list of registered authentication device for display to the user on the first user device;
receive a selection of a second registered authentication device from the user; and
transmit an updated request for authentication from the user using the second registered authentication device.