# US 2020/0394331 A1 · Embedded third-party application programming interface to prevent transmission of sensitive data > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2020/0394331 A1 - Document ID: US20200394331A1 - Status: Published application - Kind: A1 - Application number: 16/772,568 - Filed: 2018-12-13 - Published: 2020-12-17 - Earliest claimed: 2017-12-14 - Assignees: Equifax Inc. - Applicants: Equifax Inc. - Inventors: Hrishi TALWAR - Web page: https://patentgrep.com/patent/US20200394331A1 ## CPC - G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - G06F 21/31: User authentication - H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity} - H04L 63/18: {using different networks or channels, e.g. using out of band channels (cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215)} - G06F 2221/2115: Third party - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Aspects and examples are disclosed for improving security of authentication elements for validating a user of a user device. In one example, a processor of a user device establishes a first communication channel with a host computing system, and a user interface capable of transmitting information to the host computing system via the first channel. An API on the user device establishes a second communication channel with an identification-and-authentication system. The API receives sensitive information entered in the user interface and prevents transmission of the sensitive information to the host computing systems via the first channel. The API also transmits to the identification-and-authentication system, via the second channel, a signal including the sensitive information. The identification-and-authentication system may use the signal to send to the host computing system an additional signal verifying that the user of the user device is authenticated. ## Claims ### Claim 1 A device comprising: a processing device; and a non-transitory computer-readable medium storing an application comprising a set of instructions executable by the processing device to: establish a first communication channel for communicatively coupling the device to a host computing system; and generate an interface usable by a user associated with the device for transmitting, to the host computing system and via the first communication channel, information required for accessing one or more functions of an interactive computing environment provided by the host computing system, the set of instructions including an embedded application programming interface (“API”) that is executable by the processing device to: establish a second communication channel for communicatively coupling the device to an identification-and-authentication system, the second channel being out-of-band with respect to the first channel; receive sensitive data input to a portion of the interface and prevent the sensitive data from being transmitted to the host computing system via the first communication channel; and transmit a first signal to the identification-and-authentication system via the second communication channel, the first signal having the sensitive data and being usable by the identification-and-authentication system to transmit a second signal to the host computing system verifying that the user is authenticated for accessing the one or more functions of the interactive computing environment. ### Claim 3 (depends on 1) The device of claim 1, wherein the API is embedded in the user interface by the host computing system based on a third signal transmitted to the host computing system from the identification-and-authentication system. ### Claim 4 (depends on 1) The device of claim 1, wherein the second signal includes validation data generated by the identification-and-authentication system, the validation data usable by the host computing system to provide access to the one or more functions and avoid receiving the sensitive data. ### Claim 5 (depends on 1) The device of claim 1, wherein the second channel is established based on one or more protocols specified by the API. ### Claim 6 (depends on 1) The device of claim 1, wherein the one or more functions are usable for completing an electronic transaction between the host computing system and the device. ### Claim 7 (depends on 6) The device of claim 6, wherein the first signal includes transaction data for identifying the electronic transaction. ### Claim 8 An identification-and-authentication system comprising: a processing device; a network communications port communicatively coupleable to a user device via a first communication channel and communicatively coupleable to a host computing system via a second communication channel that is out-of-band with respect to the first communication channel, the first communication channel being established via an application programming interface (“API”) embedded in a user interface, the user interface configured for being provided from the host computing system to the user device for accessing one or more functions of an interactive computing environment provided by the host computing system; and a non-transitory computer-readable medium included in or communicatively coupled to the processing device, the non-transitory computer-readable medium storing a data structure for storing user data records and instructions that are executable by the processing device to cause the identification-and-authentication system to: receive, by the network communications port via the first communication channel, a first signal from the user device via the API, the first signal including sensitive data that is associated with a user of the user device and that is used to request access to the one or more functions of the interactive computing environment, the sensitive data received by the API as part of information being provided to complete the electronic transaction; authenticate, by the processing device, the user based on the sensitive data; and transmit, by the network communications port via the second communication channel, a second signal to the host computing system, the second signal including validation data representing that the user is authenticated for accessing the one or more functions of an interactive computing environment. ### Claim 9 (depends on 8) The identification-and-authentication system of claim 8, wherein the non-transitory computer-readable medium includes further instructions that are executable by the processing device to cause the identification-and-authentication system to transmit, by the network communications port, a third signal to the host computing system, the third signal usable by the host computing system to embed the API in the interface provided by the host computing system to the user device. ### Claim 10 (depends on 8) The identification-and-authentication system of claim 8, wherein the non-transitory computer-readable medium includes further instructions that are executable by the processing device to cause the identification-and-authentication system to store the sensitive data in the non-transitory computer readable medium, wherein the instructions for causing the identification-and-authentication system to transmit the second signal comprises additional instructions for causing the identification-and-authentication system to generate the validation data based on the sensitive data, the validation data being usable by the host computing system to provide access to the one or more functions and avoid receiving the sensitive data. ### Claim 11 (depends on 8) The identification-and-authentication system of claim 8, wherein the network communications port is communicatively coupleable to a telecommunication provider via a third communication channel that is out-of-band with respect to the first communication channel and the second communication channel, wherein the host computing system is remote from the identification-and-authentication system and from the telecommunication provider, the non-transitory computer-readable medium further comprising instructions executable by the processing device for causing the identification-and-authentication system to: obtain credential data associated with the user device by communicating with the telecommunication provider; retrieve identification data from a credit file associated with the credential data, the credit file stored on the non-transitory computer-readable medium and the identification data being usable for accessing the one or more functions; and transmit, via the second communication channel and prior to the electronic transaction being completed, an identification signal including the identification data to the host computing system. ### Claim 12 (depends on 8) The identification-and-authentication system of claim 8, wherein the sensitive data received by the API is received by the API from a portion of the user interface. ### Claim 13 (depends on 8) The identification-and-authentication system of claim 8, wherein the first channel is established based on one or more protocols specified by the API. ### Claim 14 (depends on 8) The identification-and-authentication system of claim 8, wherein the one or more functions are usable for completing an electronic transaction between the host computing system and the user device. ### Claim 15 (depends on 14) The identification-and-authentication system of claim 14, wherein the first signal includes transaction data for identifying the electronic transaction. ### Claim 16 A method for authenticating a user of a user device, the method including operations executed by one or more processing devices included in an identification-and-authentication system, the operations comprising: establishing a first communication channel to the user device and a second communication channel to a host computing system, wherein: the first communication channel is established via an application programming interface (“API”) embedded in a user interface, the user interface configured for being provided from the host computing system to the user device for accessing one or more functions of an interactive computing environment provided by the host computing system, and the second communication channel is out-of-band with respect to the first communication channel; receiving, via the first communication channel, a first signal from the user device via the API, the first signal including sensitive data that is associated with the user of the user device and that is used to request access to the one or more functions of the interactive computing environment, the sensitive data received by the API as part of information being provided to complete the electronic transaction; authenticating the user based on the sensitive data; and transmitting, via the second communication channel, a second signal to the host computing system, the second signal including validation data representing that the user is authenticated for accessing the one or more functions of an interactive computing environment. ### Claim 17 (depends on 16) The method of claim 16, the operations further comprising transmitting a third signal to the host computing system, the third signal usable by the host computing system to embed the API in the interface provided by the host computing system to the user device. ### Claim 18 (depends on 16) The method of claim 16, the operations further comprising generating the validation data based on the sensitive data, the validation data being usable by the host computing system to provide access to the one or more functions and avoid receiving the sensitive data. ### Claim 19 (depends on 16) The method of claim 16, wherein the one or more functions are usable for completing an electronic transaction between the host computing system and the user device. ### Claim 20 (depends on 19) The method of claim 19, wherein the first signal includes transaction data for identifying the electronic transaction.