Method, system, and computer program product for authenticating digital transactions

A system comprising:

• a device configured to:
• send, via a web browser, a device attestation request comprising a first token to a server;
• and
• in response to sending the device attestation request, receive, via the web browser, a device attestation response based on the first token from the server, the device attestation response comprising a device integrity status of the device comprising an indication of tampering in the operating system of the device, wherein the indication of tampering is determined based on whether there is at least one of an emulator or a custom read-only memory on the device;
• and
• at least one payment server configured to:
• receive a device registration request, the device attestation response based on the first token, and a selection of an authentication mode of a plurality of authentication modes from the device via the web browser, wherein the plurality of authentication modes comprises at least one second factor authentication mode;
• validate the device attestation response by verifying an origin of the device attestation response using a digital signature technique based on the first token;
• verify the device integrity status of the device based on validating the device attestation response;
• determine the authentication mode is one of the at least one second factor authentication mode based on the selection of the authentication mode of the plurality of authentication modes;
• in response to validating the device attestation response, verifying the integrity status of the device, and determining that the authentication mode is the at least one second factor authentication mode, provide a device registration response to the device via the web browser, wherein the device registration response is stored on the device;
• receive a first payment transaction request and an enrolment request to authenticate a second payment transaction request using the one of the at least one second factor authentication mode from the device via the web browser;
• communicate with the device via the web browser to receive second factor authentication data from the device via the web browser, wherein communicating with the device to receive the second factor authentication data comprises:
• providing a second token and a second factor authentication uniform resource locator (URL) to the device via the web browser, wherein the second factor authentication URL redirects the web browser to a webpage at the second factor authentication URL, wherein the webpage prompts a user of the device to set the second factor authentication data, wherein the second factor authentication data is used for repeat transactions;
• and
• receiving the second factor authentication data set by the user of the device;
• and
• enroll the device based on the second factor authentication data, wherein enrolling the device based on the second factor authentication data comprises:
• associating the second factor authentication data with a payment account of the user;
• updating a state of the second token to provide an updated second token based on having received the second factor authentication data and the device registration request;
• generating a third token based on the updated second token;
• associating the third token with the second factor authentication data;
• and
• providing the third token to the device via the web browser, wherein the third token is used for subsequent transactions on the device via the web browser without the need for the user to provide second factor authentication data for the subsequent transactions.

A computer program product comprising at least one non-transitory computer readable medium comprising one or more instructions that, when executed, cause at least one processor to:

• send, by a device via a web browser, a device attestation request comprising a first token to a server;
• in response to sending the device attestation request, receive, by the device via the web browser, a device attestation response based on the first token from the server, the device attestation response comprising a device integrity status of the device comprising an indication of tampering in the operating system of the device, wherein the indication of tampering is determined based on whether there is at least one of an emulator or a custom read-only memory on the device;
• receive, by at least one payment server, a device registration request, the device attestation response based on the first token, and a selection of an authentication mode of a plurality of authentication modes from the device via the web browser, wherein the plurality of authentication modes comprises at least one second factor authentication mode;
• validate, by the at least one payment server, the device attestation response by verifying an origin of the device attestation response using a digital signature technique based on the first token;
• verify, by the at least one payment server, the device integrity status of the device based on validating the device attestation response;
• determine, by the at least one payment server, the authentication mode is one of the at least one second factor authentication mode based on the selection of the authentication mode of the plurality of authentication modes;
• in response to validating the device attestation response, verify the integrity status of the device, and determining that the authentication mode is the one of the at least one second factor authentication mode, provide, by the at least one payment server, a device registration response to the device via the web browser, wherein the device registration response is stored on the device;
• receive, by the at least one payment server, a first payment transaction request and an enrolment request to authenticate a second payment transaction request using the one of the at least one second factor authentication mode from the device via the web browser;
• communicate, by the at least one payment server, with the device via the web browser to receive second factor authentication data from the device via the web browser, wherein communicating with the device to receive the second factor authentication data comprises:
• providing a second token and a second factor authentication uniform resource locator (URL) to the device via the web browser, wherein the second factor authentication URL redirects the web browser to a webpage at the second factor authentication URL, wherein the webpage prompts a user of the device to set the second factor authentication data, wherein the second factor authentication data is used for repeat transactions;
• and
• receiving the second factor authentication data set by the user of the device;
• and
• enroll, by the at least one payment server, the device based on the second factor authentication data, wherein enrolling the device based on the second factor authentication data comprises:
• associating the second factor authentication data with a payment account of the user;
• updating a state of the second token to provide an updated second token based on having received the second factor authentication data and the device registration request;
• generating a third token based on the updated second token;
• associating the third token with the second factor authentication data;
• and
• providing the third token to the device via the web browser, wherein the third token is used for subsequent transactions on the device via the web browser without the need for the user to provide second factor authentication data for the subsequent transactions.