# US 2021/0241266 A1 · Enhancing 3d secure user authentication for online transactions > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0241266 A1 - Document ID: US20210241266A1 - Status: Published application - Kind: A1 - Application number: 17/162,604 - Filed: 2021-01-29 - Published: 2021-08-05 - Earliest claimed: 2020-01-31 - Assignees: Mastercard International Incorporated - Applicants: Mastercard International Incorporated - Inventors: Ashfaq Kamal; Rahul Deshpande; Manash Bhattacharjee - Web page: https://patentgrep.com/patent/US20210241266A1 ## CPC - G06F 21/31: User authentication - G06Q 20/3821: {Electronic credentials} - G06Q 20/12: specially adapted for electronic shopping systems - G06Q 20/3223: {Realising banking transactions through M-devices} - G06Q 20/38215: {Use of certificates or encrypted proofs of transaction rights} - G06Q 20/3825: {Use of electronic signatures} - G06Q 20/3829: {involving key management} - G06Q 20/40145: {Biometric identity checks} - G06Q 20/4016: {involving fraud or risk level assessment in transaction processing} - G06Q 20/405: {Establishing or using transaction specific rules} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR ## Abstract An enhanced 3D Secure user authentication process and system. In some embodiments, a consumer device processor of a consumer device running a Web Authentication application programming interface (API) transmits a request to a relying party device requesting use of an enhanced 3D Secure authentication service. The consumer device processor then receives a request to authenticate a consumer from the relying party device by using a specific customer verification method (CVM), prompts, by running the Web Authentication API, the consumer to provide input in accordance with the CVM, receives input data in accordance with the CVM from an authenticator of the consumer device, verifies the consumer based on the input data, generates an authentication data package and transmits to the relying party device the authentication data package for processing and forwarding to a 3D Requestor environment. ## Claims ### Claim 1 An enhanced 3D Secure user authentication process, comprising: transmitting, by a consumer device processor of a consumer device running a Web Authentication application programming interface (API), a request to a relying party device during a transaction requesting use of an enhanced 3D Secure authentication service; receiving, by the consumer device processor from the relying party device, a request to authenticate a consumer by using a specific customer verification method (CVM); prompting, by the consumer device processor running the Web Authentication API, the consumer to provide input in accordance with the CVM; receiving, by the consumer device processor from an authenticator of the consumer device, input data in accordance with the CVM; verifying, by the consumer device processor, the consumer based on the input data; generating, by the consumer device processor running the Web Authentication API, an authentication data package; and transmitting, by the consumer device processor via the Web Authentication API to the relying party device, the authentication data package for processing and forwarding to a 3D Requestor environment. ### Claim 2 (depends on 1) The method of claim 1, wherein generating the authentication data package comprises assembling, by the consumer device processor, credential information data and assertion data. ### Claim 3 (depends on 2) The method of claim 2, further comprising, prior to transmitting the authentication data package to the relying party device, signing, by the consumer device processor, the authentication data package. ### Claim 4 (depends on 3) The method of claim 3, further comprising: receiving, by the relying party device, the signed authentication package; and transmitting, by the relying party device running a relying party Web client to a 3D Server computer of a Requestor environment, the singed authentication package, wherein the signed authentication package is stored for use in future consumer transactions. ### Claim 5 (depends on 1) The method of claim 1, further comprising, prior to transmitting the request to a relying party device requesting use of an enhanced 3D Secure authentication service, registering, by the consumer of the consumer mobile device, to participate in an enhanced 3D Secure service. ### Claim 6 (depends on 5) The method of claim 5, wherein registering for the 3D Secure authentication service comprises: downloading, by the mobile device processor of the consumer mobile device from a relying party, the Web Authentication API; generating, by the mobile device processor running the Web Authentication API, a credentials request; receiving, by the mobile device processor via an authenticator of the consumer mobile device, biometric data of the consumer in response to a credentials request; generating, by the mobile device processor running the Web Authentication API, a user private key and a user public key; and transmitting, by the mobile device processor running the Web Authentication API, the user private key and the user public key to the relying party device. ### Claim 7 (depends on 6) The method of claim 6, further comprising: generating, by the mobile device processor running the Web Authentication API, a credential data package; signing, by the mobile device processor running the Web Authentication API, the credential data package; and transmitting, by the mobile device processor to the relying party device, the signed credential data package to complete consumer registration. ### Claim 8 An enhanced 3D Secure user authentication system comprising: a consumer mobile device comprising a mobile device processor operably connected to a memory, at least one biometric sensor, and a communication module; and a relying party device operably connected to the consumer mobile device, wherein the relying party device comprises a processor operably connected to a memory; wherein the memory of the consumer mobile device includes instructions and a Web Authentication application programming interface (API) which when executed cause the mobile device processor to: transmit a request to a relying party device during a transaction requesting use of an enhanced 3D Secure authentication service; receive, from the relying party device, a request to authenticate a consumer by using a specific customer verification method (CVM); prompt the consumer to provide input in accordance with the CVM; receive input data in accordance with the CVM from an authenticator of the consumer device; verify the consumer based on the input data; generate an authentication data package; and transmit the authentication data package to the relying party device for processing and forwarding to a 3D Requestor environment. ### Claim 9 (depends on 8) The system of claim 8, wherein the instructions for generating the authentication data package further comprises instructions which when executed cause the mobile device processor to assemble credential information data and assertion data. ### Claim 10 (depends on 9) The system of claim 9, further comprising, prior to the instructions for transmitting the authentication data package to the relying party device, instructions stored in the memory of the consumer mobile device which when executed cause the mobile device processor to sign the authentication data package. ### Claim 11 (depends on 10) The system of claim 10, further comprising a 3D Server computer of a Requestor environment operably connected to the relying party device, and wherein instructions stored in the relying party memory of the relying party device which when executed cause the processor of the relying party device to: receive the signed authentication package; and transmit, via a relying party Web client to the 3D Server computer, the signed authentication package, wherein the signed authentication package is stored for use in future consumer transactions. ### Claim 12 (depends on 8) The system of claim 8, further comprising, prior to the instructions for transmitting the request to a relying party device requesting use of an enhanced 3D Secure authentication service, instructions stored in the memory of the consumer mobile device which when executed cause the mobile device processor to register to participate in an enhanced 3D Secure service. ### Claim 13 (depends on 12) The system of claim 12, wherein the instructions for registering for the 3D Secure authentication service comprises instructions stored in the memory of the consumer mobile device which when executed cause the mobile device processor to: download the Web Authentication API from a relying party; generate a credentials request; receive, via an authenticator of the consumer mobile device, biometric data of the consumer in response to a credentials request; generate a user private key and a user public key; and transmit the user private key and the user public key to the relying party device. ### Claim 14 (depends on 13) The system of claim 13, further comprising instructions stored in the memory of the consumer mobile device which when executed cause the mobile device processor to: generate a credential data package; sign the credential data package; and transmit the signed credential data package to complete consumer registration. ### Claim 15 A computer-readable medium storing processor-executable instructions which when executed cause a mobile device processor to: transmit a request to a relying party device during a transaction to use an enhanced 3D Secure authentication service; receive a request from the relying party device to authenticate a consumer by using a specific customer verification method (CVM); prompt the consumer to provide input in accordance with the CVM; receive, from an authenticator of a consumer device, input data in accordance with the CVM; verify the consumer based on the input data; generate an authentication data package; and transmit the authentication data package to the relying party device to process and forward to a 3D Requestor environment. ### Claim 16 (depends on 15) The computer-readable medium of claim 15, wherein the instructions for generating the authentication data package comprises instructions which when executed cause the mobile device processor to assemble credential information data and assertion data. ### Claim 17 (depends on 16) The computer-readable medium of claim 16, further comprising, prior to the instructions for transmitting the authentication data package to the relying party device, instructions which when executed cause the mobile device processor to sign the authentication data package. ### Claim 18 (depends on 17) The computer-readable medium of claim 17, further comprising, prior to the instructions for transmitting the request to a relying party device requesting use of an enhanced 3D Secure authentication service, instructions which when executed cause the mobile device processor to register to participate in an enhanced 3D Secure service. ### Claim 19 (depends on 18) The computer-readable medium of claim 18, wherein the instructions for registering for the 3D Secure authentication service comprise instructions, which when executed, cause the mobile device processor to: download a Web Authentication API from a relying party; generate a credentials request using the Web Authentication API; receive, via an authenticator of the consumer mobile device, biometric data of the consumer in response to a credentials request; generate a user private key and a user public key using the Web Authentication API; and transmit the user private key and the user public key to the relying party device. ### Claim 20 (depends on 16) The computer-readable medium of claim 16 further comprising processor-executable instructions which when executed cause the mobile device processor to: generate a credential data package using the Web Authentication API; sign the credential data package using the Web Authentication API; and transmit the signed credential data package to the relying party device to complete consumer registration.