Secure authentication system and method
Apparatuses, methods, and systems pertaining to the verification of portable consumer devices for 3-D Secure Systems are disclosed. In one implementation, a verification token is coupled to a computer by a USB connection so as to use the computer's networking facilities. The verification token reads identification information from a user's portable consumer device (e.g., credit card) and sends the information to a validation entry over a communications network using the computer's networking facilities. The validation entity applies one or more validation tests to the information that it receives from the verification token. If a selected number of tests are passed, the validation entity sends a 3-D Secure datum to the verification token. The verification token may enter the 3-D Secure datum into a hidden field of a Purchase Authentication Page appearing on the computer's display.
1 . A method performed by a user device including a verification token component, the method comprising:
reading, by a card reader of the verification token component removably coupled to the user device, identification information from a payment card based on an interaction between the verification token component and the payment card;
transmitting the identification information to a validation entity, wherein the identification information is used to validate the payment card;
receiving, by the verification token component from the validation entity, a first secure datum when the payment card is validated;
displaying a communication frame received from a merchant server;
displaying an authentication page received on the communication frame;
modifying the authentication page by inserting, by the verification token component, the first secure datum into a posting field of the authentication page;
transmitting, to an access control server, the authentication page filled in with the first secure datum, wherein the access control server receives a second secure datum from the validation entity, and determines if the first secure datum matches the second secure datum; and
transmitting, to the merchant server through the communication frame, an authentication response generated by the access control server in response to the authentication page, wherein the authentication response indicates whether the payment card was physically presented to the verification token component removably coupled to the user device.
2 . The method of claim 1 , wherein the first secure datum is different from a previous or subsequent first secure datum obtained with the verification token component.
3 . The method of claim 1 , wherein the communication frame on the user device is controlled by the merchant server to transmit the authentication page to the access control server.
4 . The method of claim 1 , wherein the first secure datum is received by the verification token component from the validation entity after the validation entity validates information received from the verification token component.
5 . The method of claim 1 , wherein the verification token component comprises a data processor and a computer readable medium comprising code, executable by the data processor, for causing the verification token component to read payment card identification information from the payment card, the payment card being used by a user of the user device.
6 . The method of claim 1 , wherein the access control server is configured to receive the authentication page filled in with the first secure datum, the authentication page having a user response disposed in a user response posting field, compare at least a portion of the user response to a stored user response to make a first determination of whether a match exists, compare the first secure datum to a stored secure datum to make a second determination of whether a match exists, and generate the authentication response based on at least the first and second determinations.
7 . The method of claim 1 , wherein the merchant server includes a merchant plug-in that validates a signature included in the authentication response.
8 . The method of claim 1 , further comprising:
receiving, by the user device from the merchant server, the communication frame via a first communication network.
9 . The method of claim 1 , wherein the identification information includes a PAN.
10 . The method of claim 1 , further comprising:
retrieving, by the verification token component, transaction or merchant information from the communication frame provided by the merchant server; and
transmitting the transaction or merchant information along with a portion of the identification information to the validation entity.
11 . A user device comprising:
a verification token component,
a processor; and
a computer readable medium comprising code, executable by the processor, to implement a method comprising:
reading, by a card reader of the verification token component coupled to the user device, identification information from a payment card based on an interaction between the verification token component and the;
transmitting the identification information to a validation entity, wherein the identification information is used to validate the payment card;
receiving, by the verification token component from the validation entity, a first secure datum when the payment card is validated;
displaying a communication frame received from a merchant server;
displaying an authentication page received on the communication frame;
modifying the authentication page by inserting, by the verification token component, the first secure datum into a posting field of the authentication page;
transmitting, to an access control server, the authentication page filled in with the first secure datum, wherein the access control server receives a second secure datum from the validation entity, and determines if the first secure datum matches the second secure datum; and
transmitting, to the merchant server through the communication frame, an authentication response generated by the access control server in response to the authentication page, wherein the authentication response indicates whether the payment card was physically presented to the verification token component removably coupled to the verification token component.
12 . The user device of claim 11 , further comprising:
portable payment card, wherein the payment card is configured to generate a cryptogram using a value known to the verification token component and the validation entity.
13 . The user device of claim 11 , wherein the verification token component is physically incorporated in the user device.
14 . The user device of claim 11 , wherein the verification token component comprises a first indicator indicating that verification token component is ready to read the identification information from the payment card, and a second indicator indicating when the verification token component acquired the identification information from the payment card.
15 . The user device of claim 11 , wherein the verification token component comprises a magnetic stripe reader, a contact card reader or a contactless reader.
16 . The user device of claim 11 , wherein the verification token component comprises a peripheral interface adapted to communicatively couple to a peripheral interface of the user device.
17 . A method comprising:
receiving, by a user device including a verification token component removably coupled to the user device, identification information from a payment card based on an interaction between a card reader if the verification token component and the payment card;
transmitting, by the user device, the identification information to a server computer, wherein the identification information is used to validate the payment card;
receiving, by the verification token component of the user device from the server computer, a secure datum if the payment card is validated;
receiving, by the user device, a payer authentication request message from a merchant associated with a transaction;
modifying, by the verification token component of the user device, a purchase authentication page by inserting the secure datum into a posting field of the purchase authentication page associated with the transaction;
transmitting, by the user device, the purchase authentication page to an access control server;
receiving, by the user device from the access control server, a payer authentication response from the access control server, wherein the payer authentication response is based at least in part on a comparison of the secure datum electronically sent in the purchase authentication page to secure datum stored at the access control server; and
transmitting, by the user device, the payer authentication response to the merchant, wherein the merchant initiates an authorization exchange with an acquirer for the transaction based at least in part on the payer authentication response.
18 . The method of claim 17 , wherein the user device comprises a personal computer in operative communication with the verification token component coupled to the personal computer.
19 . The method of claim 17 , wherein the interaction with the payment card comprises near-field communication.
20 . The method of claim 17 , further comprising:
receiving a dynamic verification value; and
sending the dynamic verification value to the merchant, wherein the dynamic verification value is included in an authorization request message by the merchant for the transaction.