Mastercard International Incorporated

Visa International Service Association

Gregory D Williamson

John F Sheets

Glenn Leon Powell

Bruce John Rutherford

James John Anderson

Ashfaq Kamal

Robert D Reany

Sherri Haymond

Salman H Syed

Bob Reany

Brian John Piel

Craig Gilbert

Paul Baker

Brian Piel

Mark Hey

Steve Hubbard

Embodiments of the invention are directed to methods, apparatuses, computer readable media and systems for providing, along with a token, a token assurance level and data used to generate the token assurance level. At the time a token is issued, one or more Identification and Verification (ID&V) methods may be performed to ensure that the token is replacing a PAN that was legitimately used by a token requestor. A token assurance level may be assigned to a given token in light of the type of ID&V that is performed and the entity performing the ID&V. Different ID&Vs may result in different token assurance levels. An issuer may wish to know the level of assurance and the data used in generating the level of assurance associated with a token prior to authorizing a payment transaction that uses the token.

Network token system

A cardholder authentication method includes receiving, at an authentication network, an authentication request involving an account. The method further includes determining, based at least in part on a portion of an account identifier associated with said account, an authentication service. In addition, the method includes determining, based at least on said authentication service and a portion of said account identifier, an authentication response. The method also includes transmitting, to a merchant associated with a transaction involving said account, said authentication response.

Systems, apparatus and methods for improved authentication

A computer-implemented method for verifying cardholder authenticity when provisioning a token is provided. The method uses an authentication server system having a processor and a memory. The method includes receiving, by the processor, a payment card account identifier provided by a payment requestor. The payment card account identifier for identifying a payment account associated with a cardholder. The method also includes determining a plurality of authentication data associated with the payment requestor, and performing an authentication process using the plurality of authentication data. The authentication process is configured to determine if the payment requestor is the cardholder. The method further includes determining an assurance level associated with the authentication process. The assurance level represents a level of confidence in the authentication process. Moreover, the method includes generating a token for the payment account, and storing the token with the payment card account identifier and the assurance level.

Methods and systems for verifying cardholder authenticity when provisioning a token

A secure on-device cardholder authentication method and system. In an embodiment, a consumer's mobile device uses a mobile application to receive a user authentication request from an entity. A biometric data capture request is then transmitted to a biometric sensor of the mobile device, and a determination made that the mobile application is authorized to use an authenticator API. Next, the mobile device processor prompts the user to provide at least one form of biometric data in accordance with business rules, receives a user authentication response when the user provided biometric data matches locally stored biometric data, generates a positive user authentication response message, and transmits the positive user authentication response message to the entity.

Secure on device cardholder authentication using biometric data

According to some embodiments, a requesting application executing on a mobile device may request a transport layer security key pair in connection with a payment transaction. Responsive to the request, a trusted execution environment client of the mobile device may route a request to a payment application executing in a secure trusted execution environment of the mobile device. It may then be arranged, within the secure trusted execution environment, to create the transport layer security key pair and provide key pair to the requesting application. Moreover, in some embodiments, the mobile device may transmit payment transaction information to an access control server and receive a request for biometric authentication. It may then be arranged for hardware within the mobile device to biometrically authenticate a user of the mobile device.

Trusted execution environment for transport layer security key pair associated with electronic commerce and card not present transactions

Growing community of inventors

Stamford, CT, United States of America

Gregory D Williamson