Back to results
US 12,613,952 B2Granted
Enhanced consumer device validation
AssigneeVisa International Service Association
InventorsSanjeev Sharma, Manjush Menon, Dmitri Bannikov
Life of this patent
Estimating the term…
Abstract
Unknown devices may be bound to an identity using a four step process that involves trusted relationships only between known partner entities and a known user attribute. The identity may be an account, such as a personal account number (PAN). The PAN may be abstracted using a token for use with the device. The unknown device may first be enrolled at a service to establish a cryptographically verifiable identity. A binding request for the enrolled device may be sent to an issuer of the PAN resulting in the issuer generating a challenge. After a successful authentication of the challenge at the token service provider, the binding of the token to the device is complete.
Claims20
A method comprising:
- generating, by a wallet application configured on a computing device, an authentication key, wherein the authentication key comprises a public key and a secret key;
- sending, by the wallet application, an enrollment request to a service provider for an enrollment request, wherein the enrollment request comprises the authentication key, a personal account number (PAN) associated with a user of the computing device, and a device ID, wherein the device ID corresponds to the computing device;
- receiving, by the wallet application, a tokenID from the service provider in response to the enrollment request, wherein the service provider maintains an association between a generated token and the PAN;
- sending, by the wallet application, a binding request to the service provider, wherein the binding request binds the computing device through the device ID to the PAN at an issuer via the tokenID;
- receiving, by the wallet application, a channel selection request from the service provider in response to a validation of the binding request, wherein the channel selection request is associated with a communication channel for use by the issuer to send a challenge request directly to the computing device;
- determining, by the wallet application, a user selection in response to the channel selection request, wherein the user selection is responsive to the channel selection request being provided by the issuer to the computing device;
- sending, by the wallet application, a user selection to the service provider, wherein the user selection is validated by the service provider allowing the issuer to respond directly to the computing device;
- receiving, by the wallet application, a one-time passcode, wherein the one-time passcode was received by the computing device from the issuer through the communication channel associated with the user selection;
- encrypting, by the wallet application, the one-time passcode with the public key to create an encrypted payload;
- signing, by the wallet application, the encrypted payload with the device ID to create an encrypted and signed payload;
- and
- sending, by the wallet application, the encrypted and signed payload to the service provider, wherein the service provider validates the encrypted and signed payload with the public key and binds the device ID to the token ID.
9 more elements
A non-transitory computer readable medium comprising instructions stored thereon, when executed by a processor of a computing device associated with a user, cause the processor to:
- generate an authentication key, wherein the authentication key comprises a public key and a secret key;
- send an enrollment request to a service provider, wherein the enrollment request comprises the authentication key, a personal account number (PAN) associated with the user of the computing device, and a device ID, and wherein the device ID corresponds to the computing device;
- receive a tokenID from the service provider in response to the enrollment request, wherein the service provider maintains an association between a generated token and the PAN;
- send a binding request to the service provider, wherein the binding request binds the computing device through the device ID to the PAN at an issuer via the tokenID;
- receive a channel selection request from the service provider in response to a validation of the binding request, wherein the channel selection request is associated with a communication channel for use by the issuer to send a challenge request directly to the computing device;
- determine a user selection in response to the channel selection request being provided by the issuer to the computing device, wherein the user selection is an issuer application, and wherein the user selection is validated by the service provider allowing the issuer to respond directly to the computing device;
- authenticate the PAN through the issuer application;
- receive a one-time passcode, wherein the one-time passcode was received by the computing device from the issuer application;
- encrypt the one-time passcode with the public key to create an encrypted payload;
- sign the encrypted payload with the device ID to create an encrypted and signed payload;
- and
- send the encrypted and signed payload to the service provider, wherein the service provider validates the encrypted and signed payload and binds the device ID to the tokenID.
9 more elements
A non-transitory computer readable medium comprising instructions stored thereon, when executed by a processor of a computing device associated with a user, cause the processor to:
- generate an authentication key, wherein the authentication key comprises a public key and a secret key;
- send an enrollment request to a service provider, wherein the enrollment request comprises the authentication key, a personal account number (PAN) associated with the user of the computing device, and a device ID, and wherein the device ID corresponds to a computing device;
- receive a tokenID from the service provider in response to the enrollment request, wherein the service provider maintains an association between a generated token and the PAN;
- send a binding request to the service provider, wherein the binding request binds the computing device through the device ID to the PAN at an issuer via the tokenID;
- receive a channel selection request from the service provider in response to a validation of the binding request, wherein the channel selection request is associated with a communication channel for use by the issuer to send a challenge request directly to the computing device;
- determine a user selection in response to the channel selection request being provided by the issuer to the computing device;
- send the user selection to the service provider, wherein the user selection is validated by the service provider allowing the issuer to respond directly to the computing device;
- receive a one-time passcode, wherein the one-time passcode was received by the computing device from the issuer through the communication channel associated with the user selection;
- encrypt the one-time passcode with the public key to create an encrypted payload;
- sign the encrypted payload with the device ID to create an encrypted and signed payload;
- and
- send the encrypted and signed payload to the service provider, wherein the service provider validates the encrypted and signed payload and binds the device ID to the tokenID.
9 more elements
Dependencies are inferred from the claim text.