Secure authentication of user and mobile device

A mobile device, comprising:

• a processor;
• and
• a non-transitory computer readable medium, the non-transitory computer readable medium comprising code, executable by the processor, for implementing a method:
• receiving a user request to access a service provider application;
• in response to the user request to access the service provider application, requesting identification and verification from the user via an identification and verification application residing within the mobile device;
• receiving a positive identification and verification response;
• generating a cryptogram using a user identification (ID) associated with the user, a timestamp, a device ID associated with the mobile device, and a service provider application ID;
• and
• transmitting the generated cryptogram, the user ID, the timestamp, the device ID, and the service provider application ID, to a service provider computer associated with the service provider application,
• wherein the service provider computer verifies the cryptogram.

A method for authentication, comprising:

• receiving, by a service provider computer associated with a service provider application, a generated cryptogram, a user ID, a timestamp, a device ID, and a service provider application ID, wherein the generated cryptogram was generated by a mobile device and encrypts the user ID, the timestamp, the device ID, and the service provider application ID;
• decrypting, by the service provider, the received generated cryptogram;
• and
• verifying, by the service provider computer, the cryptogram by determining a plurality of data elements encoded within the cryptogram, and then comparing the determined plurality of data elements to the user ID, the timestamp, the device ID, the service provider application ID, and the service provider device ID received by the service provider computer.