# US 12,112,315 B2 · Multi-device authentication process and system utilizing cryptographic techniques > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,112,315 B2 - Document ID: US12112315B2 - Status: Granted - Kind: B2 - Application number: 16/312,231 - Filed: 2016-07-29 - Published: 2019-09-12 - Granted: 2024-10-08 - Earliest claimed: 2016-07-29 - Assignees: Visa International Service Association - Applicants: Visa International Service Association - Inventors: John F. Sheets; Kim Wagner; Christian Aabye; Jing Jin - Web page: https://patentgrep.com/patent/US12112315B2 ## CPC - G06Q 20/3674: {involving authentication} - G06F 21/30: Authentication, i.e. establishing the identity or authorisation of security principals - G06F 21/44: Program or device authentication - G06Q 20/3227: {using secure elements embedded in M-devices} - G06Q 20/3278: {RFID or NFC payments by means of M-devices} - G06Q 20/3672: {initialising or reloading thereof} - H04L 9/3236: {using cryptographic hash functions} - H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)} - H04L 63/18: {using different networks or channels, e.g. using out of band channels (cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215)} - H04W 12/128: Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware - H04W 12/63: Location-dependent; Proximity-dependent - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract In a system for verifying transactions, when a user with a portable communication device nears a resource provider location, the portable communication device provides an indication to a transaction processing system of its proximity to the location. The portable communication device then provides a universally unique identifier (UUID) of a base station of the resource provider to the transaction processing system, which generates a hash using the UUID and a primary account number (PAN) of a portable transaction device that is associated with the portable communication device. When the user conducts a transaction with the portable transaction device at the provider, the provider generates a separate hash from the UUID and the PAN and sends the hash to the transaction processing system, A match between the hashes is taken into account as a positive indicator that the transaction is not fraudulent and the resource provider is complying with the system. ## Claims ### Claim 1 A method comprising: generating, by a server computer, a first cryptographic pattern by hashing at least a credential or token, and a nonce; sending, by the server computer to a portable communication device of a user, the first cryptographic pattern and the nonce, causing the portable communication device to perform scanning for nearby base stations and receive a base station identifier from a base station, the base station identifier comprising a universally unique identifier (UUID), wherein the portable communication device transmits the nonce to an access device via the base station; receiving, by the server computer and from the portable communication device of the user, the base station identifier, the base station identifier comprising the universally unique identifier (UUID) uniquely identifying a resource provider location; generating, by the server computer, a second cryptographic pattern, by hashing, by the server computer, at least the first cryptographic pattern and the base station identifier; storing, by the server computer, the second cryptographic pattern; receiving, by the server computer, from the access device in a transaction, an authorization request message comprising the second cryptographic pattern, after the access device forms the second cryptographic pattern by receiving the credential or token from a portable transaction device of the user, forming the first cryptographic pattern by hashing the credential or token, and the nonce, and then forming the second cryptographic pattern by hashing the first cryptographic pattern and the base station identifier comprising the universally unique identifier (UUID); analyzing, by the server computer, the authorization request message by determining that the user of the portable communication device and the portable transaction device are conducting the transaction at the access device by determining that the second cryptographic pattern in the authorization request message matches the second cryptographic pattern stored by the server computer; and at least in response to determining that the second cryptographic pattern in the authorization request message matches the second cryptographic pattern stored by the server computer, transmitting, by the server computer an authorization response message to the access device indicating that the transaction is approved, wherein the portable communication device, the base station, the user, and the portable transaction device are within the resource provider location which is a merchant store. ### Claim 2 (depends on 1) The method of claim 1, wherein the method further comprises, prior to receiving the base station identifier from the portable communication device: associating, by the server computer, the credential or the token with device information within a database; receiving, by the server computer, the device information from the portable communication device; and searching, by the server computer, the database for the credential or the token associated with the device information. ### Claim 3 (depends on 1) The method of claim 1, wherein the authorization request message comprises a transaction amount. ### Claim 4 (depends on 1) The method of claim 1, wherein the transaction is a payment transaction. ### Claim 5 (depends on 1) The method of claim 1, wherein the portable transaction device is in the form of a card and the portable communication device is a phone. ### Claim 6 (depends on 1) The method of claim 1, wherein the portable transaction device and the portable communication device are the same device. ### Claim 7 (depends on 1) The method of claim 1, wherein the portable communication device also forms the second cryptographic pattern by hashing at least the first cryptographic pattern and the base station identifier. ### Claim 8 A system comprising: a server computer comprising: a processor; and a computer readable medium comprising code, executable by the processor, for implementing a method comprising: generating, by the server computer, a first cryptographic pattern by hashing at least a credential or token, and a nonce; sending, by the server computer to a portable communication device of a user, the first cryptographic pattern and the nonce, thereby causing the portable communication device to perform scanning for nearby base stations and receive a base station identifier from a base station, the base station identifier comprising a universally unique identifier (UUID), wherein the portable communication device transmits the nonce to an access device via the base station; receiving, by the server computer and from the portable communication device of the user, the base station identifier, the base station identifier comprising the universally unique identifier (UUID) uniquely identifying a resource provider location; generating, by the server computer, a second cryptographic pattern, by hashing, by the server computer, at least the first cryptographic pattern and the base station identifier; storing, by the server computer, the second cryptographic pattern; receiving, by the server computer, from the access device in a transaction, an authorization request message comprising the second cryptographic pattern, after the access device forms the second cryptographic pattern by receiving the credential or token from a portable transaction device of the user, forming the first cryptographic pattern by hashing the credential or token, and the nonce, and then forming the second cryptographic pattern by hashing the first cryptographic pattern and the base station identifier comprising the universally unique identifier (UUID); analyzing, by the server computer, the authorization request message by determining that the user of the portable communication device and the portable transaction device are conducting the transaction at the access device by determining that the second cryptographic pattern in the authorization request message matches the second cryptographic pattern stored by the server computer; and at least in response to determining that the second cryptographic pattern in the authorization request message matches the second cryptographic pattern stored by the server computer, transmitting, by the server computer an authorization response message to the access device indicating that the transaction is approved, wherein the portable communication device, the base station, the user, and the portable transaction device are within the resource provider location which is a merchant store. ### Claim 9 (depends on 8) The system of claim 8, wherein the method further comprises, prior to receiving the base station identifier from the portable communication device: associating, by the server computer, the credential or the token with device information within a database; receiving, by the server computer, the device information from the portable communication device; and searching, by the server computer, the database for the credential or the token associated with the device information. ### Claim 10 (depends on 8) The system of claim 8, wherein the authorization request message is an ISO 8583 message. ### Claim 11 (depends on 8) The system of claim 8, wherein the server computer is programmed to perform authorization and clearing and settlement. ### Claim 12 (depends on 8) The system of claim 8, wherein the portable transaction device is in the form of a card and the portable communication device is a phone. ### Claim 13 (depends on 8) The system of claim 8, wherein the portable transaction device and the portable communication device are the same device. ### Claim 14 (depends on 1) The method of claim 1, wherein the first cryptographic pattern is formed by: formatting, by the server computer, at least the credential into a compressed numeric, wherein the compressed numeric comprise two numeric digits per byte; generating, by the server computer, the nonce; concatenating, by the server computer, the compressed numeric and the nonce; and hashing, by the server computer, a result of the concatenation to form the first cryptographic pattern. ### Claim 15 (depends on 1) The method of claim 1, wherein the access device comprises the base station storing the base station identifier. ### Claim 16 (depends on 1) The method of claim 1, wherein the server computer stores a link between the portable communication device and the portable transaction device of the user. ### Claim 17 (depends on 1) The method of claim 1, wherein the second cryptographic pattern times out after a time window associated with the resource provider location. ### Claim 18 (depends on 1) The method of claim 1, wherein the first cryptographic pattern is formed using the token, wherein the token is a payment token. ### Claim 19 (depends on 1) The method of claim 1, wherein the universally unique identifier (UUID) is a 128-bit value that is assigned to the base station at a time of manufacture of the base station. ### Claim 20 (depends on 19) The method of claim 19, wherein the universally unique identifier (UUID) is unique to all other base stations.