Systems and methods for using multi-factor authentication

A computer-implemented method providing a computer system for using multi-factor authentication to gain access to data stored within a data processing computing device, the computer system using authentication resources of an interoperability domain that is secure and separate from authentication resources of the data processing computing device, the computer system including an online architecture including the interoperability domain, the interoperability domain in communication over a first communication channel with an acquirer domain and an issuer domain and over a second communication channel with the data processing computing device, the interoperability domain including an Access Control Server (ACS) associated with a payment processing network, wherein the computer system further includes an authentication computing device, separate from the data processing computing device, the authentication computing device communicatively coupled over the second communication channel to the data processing computing device, wherein the authentication computing device includes at least one processor in communication with the payment processing network, and wherein the authentication computing device further includes a memory in communication with the at least one processor, the computer-implemented method comprising:

• electronically receiving, by the ACS, response authentication data from a user device;
• electronically determining, by the ACS, an authentication status of the user device by comparing the response authentication data to electronically encrypted trusted authentication data of a user profile stored in a database system associated with the interoperability domain, wherein the trusted authentication data of the user profile includes personal data that is securely used within the interoperability domain and is not received at the data processing computing device;
• electronically registering a first user into an authentication service in response to at least one of (i) receiving permission from the first user or (ii) detecting activation of at least one of a payment account or a payment card associated with the first user, wherein the payment account and the payment card are associated with the payment processing network, wherein registering the first user comprises receiving a plurality of elements including a device identifier and the trusted authentication data associated with the first user, and wherein the first user is authenticated by the trusted authentication data when initiating payment transactions initiated using the payment account or the payment card and received via the payment processing network from the acquirer domain, and wherein the personal data of the first user is not received at the data processing computing device;
• electronically securely storing, in response to registering the first user, a user profile associated with the first user in the database system, wherein the user profile associated with the first user includes the plurality of elements including the personal data;
• electronically receiving, via an API call from the data processing computing device over the second communication channel an authentication request in response to a candidate user attempting to gain access to data stored within the data processing computing device, wherein the authentication request includes a unique identifier associated with the candidate user, and wherein the data the candidate user is attempting to access is associated with the first user thereby the authentication request is directed to authenticating the candidate user as the first user;
• electronically querying, in response to the authentication request, by the at least one processor, the database system using the unique identifier to match the unique identifier to at least one element included in the user profile associated with the first user;
• electronically generating, in response to matching the unique identifier with the at least one element, an identity challenge requesting authentication data associated with the first user;
• electronically transmitting the identity challenge to a user device associated with the first user and having a same device identifier as the device identifier stored in the user profile associated with the first user, for presentation of the identity challenge at the user device associated with the first user;
• electronically receiving in response to the identity challenge, a challenge response including response authentication data from the user device associated with the first user, wherein the challenge response includes at least a portion of the personal data of the first user;
• electronically comparing, by the ACS, the response authentication data to the trusted authentication data returning a match;
• based on the match, electronically (i) authenticating the authentication request based on the comparison without any of the personal data of the first user being received at the data processing computing device, and (ii) determining the authentication status for the authentication request;
• electronically transmitting to the data processing computing device, the determined authentication status for the authentication request via the second communication channel without providing any of the personal data of the first user to the data processing computing device, thereby authenticating the candidate user as the first user to access data associated with the first user stored within the data processing computing device by using the authentication resources of the interoperability domain without any of the personal data of the first user being received at the data processing computing device;
• and
• electronically preventing another candidate user from adjusting electronic security parameters associated with the data associated with the first user via a digital interface associated with the data processing computing device based on application of at least one of:
• (i) a first layer of electronic security applied between the user device and the authentication computing device, the first layer of electronic security including at least the device identifier and the identity challenge, wherein the another candidate user is unable to be verified as the first user and is denied access to the data associated with the first user at least due to the identity challenge being received at the user device that is associated with the first user and that has the same device identifier as the stored device identifier, irrespective of a user device used by the another candidate user to attempt to access the data associated with the first user;
• and
• (ii) a second layer of electronic security applied between the data processing computing device and the authentication computing device, the second layer of electronic security including the authentication resources of the interoperability domain being separate from the authentication resources of the data processing computing device, wherein an authentication status of the user device used by the another candidate user is determined by the data processing computing device to not satisfy an authentication threshold set in accordance with the authentication resources of the interoperability domain, such that the another candidate user is denied access to the data associated with the first user.

At least one non-transitory computer-readable storage medium having computer-executable instructions embodied thereon for execution by at least one processor of an authentication computing device including a memory, wherein the authentication computing device is associated with a computer system for providing multi-factor authentication to gain access to data stored within a data processing computing device, the computer system using authentication resources of an interoperability domain that is secure and separate from authentication resources of the data processing computing device, the computer system including an online architecture comprising the interoperability domain, the interoperability domain in communication over a first communication channel with an acquirer domain and an issuer domain and over a second communication channel with the data processing computing device, the interoperability domain comprising the authentication computing device separate from the data processing computing device and communicatively coupled over the second communication channel to the data processing computing device and an Access Control Server (ACS) associated with a payment processing network, wherein the ACS is configured to electronically (i) receive response authentication data from a user device, and (ii) determine an authentication status of the user device by comparing the response authentication data to electronically encrypted trusted authentication data of a user profile stored in a database system associated with the interoperability domain, wherein the trusted authentication data of the user profile includes personal data that is securely used within the interoperability domain and is not received at the data processing computing device, wherein the at least one processor of the authentication computing device is in communication with the ACS associated with the payment processing network, and wherein the computer-executable instructions cause the at least one processor to:

• electronically register a first user into an authentication service in response to at least one of (i) receiving-permission from the first user or (ii) detecting activation of at least one of a payment account or a payment card associated with the first user, wherein the payment account and the payment card are associated with the payment network, wherein registering the first user includes receiving a plurality of elements including a device identifier and the trusted authentication data associated with the first user including personal data of the first user, and wherein the first user is authenticated by the trusted authentication data when initiating payment transactions initiated using the payment account or the payment card and received via the payment processing network from the acquirer domain, and wherein the personal data of the first user is not received at the data processing computing device;
• electronically store, in response to registering the first user, a user profile associated with the first user in the database system, wherein the user profile associated with the first user includes the plurality of elements including the personal data;
• electronically receive, via an API call from the data processing computing device over the second communication channel an authentication request in response to a candidate user attempting to gain access to data stored within the data processing computing device, wherein the authentication request includes a unique identifier associated with the candidate user, and wherein the data the candidate user is attempting to access is associated with the first user thereby the authentication request is directed to authenticating the candidate user as the first user;
• electronically query, in response to the authentication request, the database system using the unique identifier to match the unique identifier to at least one element included in the user profile associated with the first user;
• electronically generate, in response to matching the unique identifier with the at least one element, an identify challenge requesting authentication data associated with the first user;
• electronically transmit the identity challenge to a user device associated with the first user and having a same identifier as the device identifier stored in the user profile associated with the first user, for presentation of the identity challenge at the user device associated with the first user;
• electronically receive, in response to the identity challenge, a challenge response including response authentication data from the user device associated with the first user, wherein the challenge response includes at least a portion of the personal data of the first user;
• electronically compare, by the ACS, the response authentication data to the trusted authentication data returning a match;
• based on the match, electronically (i) authenticate the authentication request based on the comparison without any of the personal data of the first user being received at the data processing computing device, and (ii) determine the authentication status for the authentication request;
• electronically transmit, to the data processing computing device, the determined authentication status for the authentication request via the second communication channel without providing any of the personal data of the first user to the data processing computing device, thereby authenticating the candidate user as the first user to access data associated with the first user stored within the data processing computing device by using the authentication resources of the interoperability domain without any of the personal data of the first user being received at the data processing computing device;
• and
• electronically prevent another candidate user from adjusting electronic security parameters associated with the data associated with the first user via a digital interface associated with the data processing computing device based on application of at least one of:
• (i) a first layer of electronic security applied between the user device and the authentication computing device, the first layer of electronic security including at least the device identifier and the identity challenge, wherein the another candidate user is unable to be verified as the first user and is denied access to the data associated with the first user at least due to the identity challenge being received at the user device that is associated with the first user and that has the same device identifier as the stored device identifier, irrespective of a user device used by the another candidate user to attempt to access the data associated with the first user;
• and
• (ii) a second layer of electronic security applied between the data processing computing device and the authentication computing device, the second layer of electronic security including the authentication resources of the interoperability domain being separate from the authentication resources of the data processing computing device, wherein an authentication status of the user device used by the another candidate user is determined by the data processing computing device to not satisfy an authentication threshold set in accordance with the authentication resources of the interoperability domain, such that the another candidate user is denied access to the data associated with the first user.