# US 2021/0344672 A1 · Techniques for token proximity transactions

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2021/0344672 A1
- Document ID: US20210344672A1
- Status: Published application
- Kind: A1
- Application number: 17/282,375
- Filed: 2019-10-08
- Published: 2021-11-04
- Earliest claimed: 2018-10-08
- Assignees: Visa International Service Association
- Applicants: Visa International Service Association
- Inventors: Kyle Joseph Drechsler; Christopher Jones; Gayathri Venkat; Gavin Shenker; Raul Leyva; Janardana Sarma; Phillip Lavender; Leila Movahedian; Pinesh Roy; Eduardo Lopez
- Web page: https://patentgrep.com/patent/US20210344672A1

## CPC

- G06Q 20/3226: {Use of secure elements separate from M-devices}
- H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)}
- G06Q 20/02: involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
- G06Q 20/202: {Interconnection or interaction of plural electronic cash registers [ECR] or to host computer, e.g. network details, transfer of information from host to ECR or from ECR to ECR}
- G06Q 20/3821: {Electronic credentials}
- G06Q 20/3829: {involving key management}
- G06Q 20/385: {using an alias or single-use codes}
- G06Q 20/401: {Transaction verification}
- G06Q 20/40975: {using encryption therefor}
- H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)}
- H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)}
- H04L 63/0838: {using one-time-passwords}
- H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)}
- G06Q 20/204: {comprising interface for record bearing medium or carrier for electronic funds transfer or payment credit}
- G06Q 20/327: {Short range or proximity payments by means of M-devices}
- H04W 12/06: Authentication
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

Systems and methods are provided to enable a user to conduct a transaction using their credentials stored on a secure server computer (e.g., a computer associated with a partner such as another merchant) by merely presenting their authentication data at a physical location via an auxiliary device. An auxiliary device may be provided for interfacing with a partners backend server (e.g., the secure server computer). In some embodiments, biometric authentication may provide a mechanism for a true seamless and potentially frictionless (in the case of modalities that do not require physical contact) interaction. Payment can occur without any need for a card, phone, wearable, or any other user device as long as the auxiliary device is able to recognize the user and retrieve a credential that can be linked to that user.

## Claims

### Claim 1

A method, comprising:
receiving, by an auxiliary device in communication with an access device, authentication data from a user;
initiating, by the auxiliary device, verifying the authentication data;
requesting, by the auxiliary device, a token from a secure server computer;
receiving, by the auxiliary device, the token and a transaction authentication verification value; and
providing, by the auxiliary device, the token and the transaction authentication verification value to the access device, wherein the access device generates an authorization request message.

### Claim 2 (depends on 1)

The method of claim 1, wherein requesting the token from the secure server computer causes the secure server computer to:
generate a request for the token from a token provider computer, wherein the token provider computer generates a one-time password and provides the one-time password to an authorizing entity computer that then provides the one-time password to a client device.

### Claim 3 (depends on 2)

The method of claim 2, wherein the token provider computer activates the token in response to receiving, from the authorizing entity computer, an indication the user has been authenticated using the one-time password.

### Claim 4 (depends on 2)

The method of claim 2, further comprising:
receiving, by the auxiliary device from the secure server computer, an indication that the user has yet to be authenticated according to a supplementary authentication scheme;
prompting, by the auxiliary device, the user for user input;
receiving, by the auxiliary device, subsequent user input; and
transmitting, by the auxiliary device, the subsequent user input to the secure server computer, that then transmits the subsequent user input to the token provider computer, wherein the token provider computer activates the token based at least in part on determining that the subsequent user input matches the one-time password.

### Claim 5 (depends on 2)

The method of claim 2, wherein the auxiliary device provides the token and the transaction authentication verification value to the access device in response to receiving an indication from the secure server computer that the user has been authenticated using the one-time password.

### Claim 6 (depends on 1)

The method of claim 1, wherein requesting the token from the secure server computer causes the secure server computer to:
generate a request for a plurality of cryptograms for transactions involving tokens;
transmit the request to a token provider computer;
receive the plurality of cryptograms; and
store the plurality of cryptograms.

### Claim 7 (depends on 1)

The method of claim 1, wherein the authentication data is biometric data of the user, and wherein verifying the authentication data comprises:
transmitting, by the auxiliary device, the biometric data to a secure server computer; and
receiving, by the auxiliary device, an indication that the biometric data was verified by the secure server computer, wherein the auxiliary device generates the authorization request message based at least in part on receiving the indication that the biometric data was verified by the secure server computer

### Claim 8 (depends on 1)

The method of claim 1, wherein the authorization request message is generated in a first data format, wherein the access device transmits the authorization request message to a processing network computer, the processing network computer converting the authorization request message from the first data format to a second data format.

### Claim 9 (depends on 1)

The method of claim 1, further comprising:
receiving, by the auxiliary device from the secure server computer, a single use value, the secure server computer receiving the single use value from a token provider computer;
receiving, by the auxiliary device, an unpredictable value from the access device,
generating, by the auxiliary device, an authorization request cryptogram using the unpredictable value and the single use value, and
transmitting, by the auxiliary device, the authorization request cryptogram to the access device, wherein the access device generates the authorization request message to comprise the authorization request cryptogram and transmits the authorization request message to a payment processing network through an acquirer computer, wherein the payment processing network obtains the single use value from the token provider computer, computes a new cryptogram using the unpredictable value and the single use value, and processes the authorization request message if the new cryptogram matches the authorization request cryptogram.

### Claim 10 (depends on 1)

The method of claim 1, wherein the access device is a POS system.

### Claim 11

An auxiliary device in communication with an access device, the auxiliary device comprising:
a processor; and
a computer readable medium coupled to the processor, the computer readable medium comprising code executable by the processor to cause the auxiliary device to:
receive authentication data associated with a user;
verify the authentication data;
request a token from a secure server computer;
receive the token from the secure server computer;
obtain a verification value for the token; and
provide the token and the verification value to the access device, wherein the access device generates an authorization request message.

### Claim 12 (depends on 11)

The auxiliary device of claim 11, wherein executing the code further causes the auxiliary device to receive, with the token, a cryptogram of a plurality of cryptograms stored at the secure server computer, the plurality of cryptograms being requested and stored at the secure server computer in response to receiving the request for the token.

### Claim 13 (depends on 11)

The auxiliary device of claim 11, wherein executing the code further causes the auxiliary device to provide payment credentials from the secure server computer, wherein the auxiliary device provides the payment credentials to the access device with the token and the verification value.

### Claim 14 (depends on 11)

The auxiliary device of claim 11, wherein executing the code further causes the auxiliary device to:
identify that a one-time password authentication process is required;
prompt the user for a one-time password, the one-time password being communicated to the user utilizing a user device associated with the user; and
authenticate the user based at least in part on the one-time password.

### Claim 15 (depends on 14)

The auxiliary device of claim 14, wherein the token is limited for use in a threshold number of transactions until the user is authenticated with the one-time password.

### Claim 16 (depends on 11)

The auxiliary device of claim 11, wherein executing the code further causes the auxiliary device to:
obtain, from the secure server computer, a cryptographic key;
receive, from the access device, terminal data comprising an amount and an identifier; and
encrypt, by the auxiliary device, the terminal data utilizing the cryptographic key to generate an interaction cryptogram.

### Claim 17 (depends on 16)

The auxiliary device of claim 16, wherein the interaction cryptogram is included in the authorization request message.

### Claim 18 (depends on 16)

The auxiliary device of claim 16, wherein the cryptographic key is a limited use key.

### Claim 19 (depends on 16)

The auxiliary device of claim 16, wherein the authorization request message is authorized based at least in part on verifying, by a remote server, the interaction cryptogram.

### Claim 20 (depends on 16)

The auxiliary device of claim 16, wherein the verification value is a transaction authentication verification value.

### Claim at position 21

-100. (canceled)