IP Library › Granted Patent US 12,651,263
Granted Patent B2
US 12,651,263 · App. 16/448,596 · Granted Jun 9, 2026

Systems and methods for authenticating online users

Inventors: Julia Sharon Gosset (Tarrytown, NY); Robert Albert Ederle (Chesterfield, MO); Ranjita Shankar Iyer (Chappaqua, NY); Brian Piel (Ballwin, MO); Christopher John Merz (Wildwood, MO); Felix Johannes Flory (Wildwood, MO)
Assignee: Mastercard International Incorporated
G06Q20/4016G06Q20/12G06Q20/3226G06Q20/405H04L63/08H04L63/083H04L63/101H04W12/67
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 12,651,263
App. No.
16/448,596
Filed
Jun 21, 2019
Granted
Jun 9, 2026
Kind
B2
Art Unit
3699
USPC
705/67
Abstract

An authentication platform for authenticating an online user is provided. The authentication platform includes a memory device including an authentication profile and at least one processor coupled to the memory device. The at least one processor is programmed to receive an authentication request message. The authentication request message includes authentication data. The at least one processor is also programmed to extract the authentication data from the authentication request message, generate, based at least in part on the extracted authentication data, risk-based authentication (RBA) result data including a risk score, and route the RBA result data based on the authentication profile and the RBA result data.

Claims (88)

1 . An authentication platform for authenticating an online user, the authentication platform comprising:

a risk-based authentication (RBA) enabled directory server communicatively coupled to i) an authentication request message source computing device, ii) an access control server (ACS), and iii) an issuer computing device;

an RBA engine communicatively coupled to the RBA enabled directory server, the RBA enabled directory server and the RBA engine implemented using at least one processor; and

a memory device communicatively coupled to the RBA enabled directory server and the RBA engine, wherein the at least one processor is programmed to:

receive, at the RBA enabled directory server from the issuer computing device, and store in the memory device an authentication profile including routing rules indicating where RBA result data should be routed;

receive, at the RBA enabled directory server from the authentication request message source computing device, an authentication request message associated with an unauthenticated data transmission, the authentication request message including authentication data;

extract, at the RBA enabled directory server, the authentication data from the authentication request message;

generate, at the RBA engine, based at least in part on the extracted authentication data, RBA result data including a risk score, wherein the RBA result data is generated by:

building a machine learning model that utilizes a neural network;

training the machine learning model on historical authentication data to improve an ability of the machine learning model to determine risk levels associated with transactions; and

applying the trained machine learning model to the extracted authentication data to generate the RBA result data including the risk score;

generate, at the RBA enabled directory server, an authentication decision based on the RBA result data and the authentication profile; and

route, from the RBA enabled directory server, the RBA result data based on the routing rules included in the authentication profile and the RBA result data by:

determining, from the routing rules, whether the RBA result data should be routed to the authentication request message source computing device, the issuer computing device, or the ACS, wherein the routing rules include i) a first set of criteria specifying when the RBA result data should be routed to the authentication request message source computing device, ii) a second set of criteria specifying when the RBA result data should be routed to the issuer computing device, and iii) a third set of criteria specifying when the RBA result data should be routed to the ACS;

generating, at the RBA enabled directory server, an RBA result data message;

formatting, at the RBA enabled directory server, the RBA result data message according to a set of proprietary communications standards promulgated by a computer network for processing electronic payment transactions;

appending, at the RBA enabled directory server, the RBA result data to the formatted RBA result data message as an extensible markup language (XML) extension; and

routing, via the computer network, the formatted RBA result data message including the appended RBA result data from the RBA enabled directory server to the authentication request message source computing device, the issuer computing device, or the ACS, wherein, when routing the formatted RBA result data message to the authentication request message source computing device, the authentication platform appends a denial data element to the formatted RBA result data message such that the formatted RBA result data message overrides further processing of the unauthenticated data transmission.

2 . The authentication platform of claim 1 , wherein the RBA result data further include at least one reason code that indicates at least one factor that influenced the generated risk score.

3 . The authentication platform of claim 1 , wherein the unauthenticated data transmission is associated with an online payment card transaction, and wherein the authentication request message source computing device is one of the issuer computing device and a merchant computing device.

4 . The authentication platform of claim 1 , wherein the routing rules cause the at least one processor to:

embed the RBA result data into the authentication request message to generate an enhanced authentication request message; and

transmit the enhanced authentication request message to the ACS to enable the ACS to make an authentication decision based on the RBA result data.

5 . The authentication platform of claim 1 , wherein the routing rules cause the at least one processor to determine a risk level based on the RBA result data and the authentication profile.

6 . The authentication platform of claim 5 , wherein the at least one processor is programmed to transmit an authentication approval if the risk level is low.

7 . The authentication platform of claim 5 , wherein the at least one processor is programmed to:

transmit a step-up challenge to the online user if the risk level is medium;

receive a response to the step-up challenge from the online user; and

determine an authentication decision based on the response to the step-up challenge and the RBA result data.

8 . The authentication platform of claim 5 , wherein the at least one processor is programmed to, based on the routing rules, transmit the RBA result data to the ACS if the risk level is medium, wherein the ACS is configured to perform a step-up challenge.

9 . The authentication platform of claim 5 , wherein the at least one processor is programmed to transmit an authentication denied message if the risk level is high.

10 . The authentication platform of claim 1 , wherein to generate RBA result data, the at least one processor is programmed to compare the authentication data to at least one of one or more long term variables and one or more short term variables, wherein the one or more long term variables include historical authentication data and historical authorization data.

11 . A computer-implemented method for authenticating an online user, the method implemented on an authentication platform comprising i) a risk based authentication (RBA) enabled directory server communicatively coupled to a) an authentication request message source computing device, b) an access control server (ACS), and c) an issuer computing device, ii) an RBA engine communicatively coupled to the RBA enabled directory server, the RBA enabled directory server and the RBA engine implemented using at least one processor, and iii) a memory device communicatively coupled to the RBA enabled directory server and the RBA engine, wherein the method comprises:

receiving, at the RBA enabled directory server from the issuer computing device, and storing in the memory device an authentication profile including routing rules indicating where RBA result data should be routed;

receiving, at the RBA enabled directory server from the authentication request message source computing device, an authentication request message associated with an unauthenticated data transmission, the authentication request message including authentication data;

extracting, at the RBA enabled directory server, the authentication data from the authentication request message;

generating, at the RBA engine, based at least in part on the extracted authentication data, RBA result data including a risk score, wherein generating the RBA result data comprises:

building a machine learning model that utilizes a neural network;

training the machine learning model on historical authentication data to improve an ability of the machine learning model to determine risk levels associated with transactions; and

applying the trained machine learning model to the extracted authentication data to generate the RBA result data including the risk score;

generating, at the RBA enabled directory server, an authentication decision based on the RBA result data and the authentication profile; and

routing, from the RBA enabled directory server, the RBA result data based on the routing rules included in the authentication profile and the RBA result data by:

determining, from the routing rules, whether the RBA result data should be routed to the authentication request message source computing device, the issuer computing device, or the ACS, wherein the routing rules include i) a first set of criteria specifying when the RBA result data should be routed to the authentication request message source computing device, ii) a second set of criteria specifying when the RBA result data should be routed to the issuer computing device, and iii) a third set of criteria specifying when the RBA result data should be routed to the ACS;

generating, at the RBA enabled directory server, an RBA result data message;

formatting, at the RBA enabled directory server, the RBA result data message according to a set of proprietary communications standards promulgated by a computer network for processing electronic payment transactions;

appending, at the RBA enabled directory server, the RBA result data to the formatted RBA result data message as an extensible markup language (XML) extension; and

routing, via the computer network, the formatted RBA result data message including the appended RBA result data from the RBA enabled directory server to the authentication request message source computing device, the issuer computing device, or the ACS, wherein, when routing the formatted RBA result data message to the authentication request message source computing device, the routing further comprises appending a denial data element to the formatted RBA result data message such that the formatted RBA result data message overrides further processing of the unauthenticated data transmission.

12 . The method of claim 11 , wherein the RBA result data further include at least one reason code that indicates at least one factor that influenced the generated risk score.

13 . The method of claim 11 , further comprising:

receiving a second authentication request message, the second authentication request message including second authentication data;

generating, based at least in part on the second authentication data, second RBA result data including a second risk score; and

routing the second RBA result data including:

embedding the second RBA result data into the second authentication request message to generate an enhanced second authentication request message; and

transmitting the second enhanced authentication request message to the ACS to enable the ACS to make an authentication decision based on the second RBA result data.

14 . The method of claim 11 , wherein routing the RBA result data further comprises:

determining a risk level based on the RBA result data and the authentication profile; and

transmitting an authentication approval if the risk level is low.

15 . The method of claim 11 , wherein routing the RBA result data further comprises:

determining a risk level based on the RBA result data and the authentication profile;

transmitting a step-up challenge to the online user if the risk level is medium;

receiving a response to the step-up challenge from the online user; and

determining an authentication decision based on the response to the step-up challenge and the RBA result data.

16 . The method of claim 11 , wherein routing the RBA result data further comprises:

determining a risk level based on the RBA result data and the authentication profile; and

generating the authentication decision comprises generating an authentication denial in response to the risk level being high.

17 . At least one non-transitory computer-readable storage media having computer-executable instructions embodied thereon for authenticating an online user, wherein when executed by at least one processor of an authentication platform including i) a risk based authentication (RBA) enabled directory server communicatively coupled to a) an authentication request message source computing device, b) an access control server (ACS), and c) an issuer computing device, ii) an RBA engine communicatively coupled to the RBA enabled directory server, the RBA enabled directory server and the RBA engine implemented using at least one processor, and iii) a memory device communicatively coupled to the RBA enabled directory server and the RBA engine, the computer-executable instructions cause the at least one processor to:

receive, at the RBA enabled directory server from issuer computing device, and store, in the memory device, an authentication profile including routing rules indicating where RBA result data should be routed;

receive, at the RBA enabled directory server from the authentication request message source computing device, an authentication request message associated with an unauthenticated data transmission, the authentication request message including authentication data;

extract, at the RBA enabled directory server, the authentication data from the authentication request message;

generate, at the RBA engine, based at least in part on the extracted authentication data, RBA result data including a risk score, wherein the RBA result data is generated by:

building a machine learning model that utilizes a neural network;

training the machine learning model on historical authentication data to improve an ability of the machine learning model to determine risk levels associated with transactions; and

applying the trained machine learning model to the extracted authentication data to generate the RBA result data including the risk score;

generate, at the RBA enabled directory server, an authentication decision based on the RBA result data and the authentication profile; and

route, from the RBA enabled directory server, the RBA result data based on the routing rules included in the authentication profile and the RBA result data by:

determining, from the routing rules, whether the RBA result data should be routed to the authentication request message source computing device, the issuer computing device, or the ACS, wherein the routing rules include i) a first set of criteria specifying when the RBA result data should be routed to the authentication request message source computing device, ii) a second set of criteria specifying when the RBA result data should be routed to the issuer computing device, and iii) a third set of criteria specifying when the RBA result data should be routed to the ACS;

generating, at the RBA enabled directory server, an RBA result data message;

formatting, at the RBA enabled directory server, the RBA result data message according to a set of proprietary communications standards promulgated by a computer network for processing electronic payment transactions;

appending, at the RBA enabled directory server, the RBA result data to the formatted RBA result data message as an extensible markup language (XML) extension; and

routing, via the computer network, the formatted RBA result data message including the appended RBA result data from the RBA enabled directory server to the authentication request message source computing device, the issuer computing device, or the ACS, wherein, when routing the formatted RBA result data message to the authentication request message source computing device, the computer-executable instructions further cause the at least one processor to append a denial data element to the formatted RBA result data message such that the formatted RBA result data message overrides further processing of the unauthenticated data transmission.

18 . The computer-readable storage media of claim 17 , wherein to route the RBA result data, the computer-executable instructions cause the at least one processor to:

determine a risk level based on the RBA result data and the authentication profile;

generate the authentication decision as an authentication approval in response to the risk level being low;

in response to the risk level being medium, the computer-executable instructions cause the at least one processor to:

transmit a step-up challenge to the online user if the risk level is medium;

receive a response to the step-up challenge from the online user; and

determine the authentication decision based on the response to the step-up challenge and the RBA result data; and

generate the authentication decision as an authentication denied message in response to the risk level being high.

Assignments (1)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Oct 25, 2019
From: GOSSET, JULIA SHARON; IYER, RANJITA SHANKAR; FLORY, FELIX JOHANNES; EDERLE, ROBERT ALBERT; MERZ, CHRISTOPHER JOHN; PIEL, BRIAN
To: MASTERCARD INTERNATIONAL INCORPORATED
Reel/Frame 050831/0843 →
Continuity (5)
Provisional Application 62688532 · Jun 22, 2018
Provisional Application 62688528 · Jun 22, 2018
Provisional Application 62688546 · Jun 22, 2018
Provisional Application 62688529 · Jun 22, 2018
Related Publication 20190392449A1 · Dec 26, 2019
References Cited (104)
US 7290288B2 · Gregg et al. · 2007 [cited by applicant]
US 7314167B1 · Kiliccote · 2008 [cited by applicant]
US 7614078B1 · Stieglitz · 2009 [cited by examiner]
US 7913300B1 · Flank et al. · 2011 [cited by applicant]
US 8020763B1 · Kowalchyk et al. · 2011 [cited by applicant]
US 8150762B1 · Reed · 2012 [cited by applicant]
US 8170953B1 · Tullis et al. · 2012 [cited by applicant]
US 8256664B1 · Balfanz et al. · 2012 [cited by applicant]
US 8271395B2 · Dominguez et al. · 2012 [cited by applicant]
US 8423466B2 · Lanc · 2013 [cited by applicant]
US 9160742B1 · Ackerman · 2015 [cited by applicant]
US 9330416B1 · Zaslavsky et al. · 2016 [cited by applicant]
US 9390445B2 · Sheets et al. · 2016 [cited by applicant]
US 9779236B2 · Abrams · 2017 [cited by applicant]
US 10366378B1 · Han et al. · 2019 [cited by applicant]
US 10515366B1 · Gorelik · 2019 [cited by applicant]
US 10614452B2 · Tomasofsky et al. · 2020 [cited by applicant]
US 10867303B1 · Manapat et al. · 2020 [cited by applicant]
US 20020194138A1 · Dominguez et al. · 2002 [cited by applicant]
US 20040054622A1 · Strayer et al. · 2004 [cited by examiner]
US 20040199456A1 · Flint et al. · 2004 [cited by applicant]
US 20040199462A1 · Starrs · 2004 [cited by applicant]
US 20040249767A1 · Perrin · 2004 [cited by applicant]
US 20050097320A1 · Golan et al. · 2005 [cited by applicant]
US 20060179007A1 · Davis · 2006 [cited by applicant]
US 20060277185A1 · Sato et al. · 2006 [cited by applicant]
US 20080034092A1 · Kikuchi et al. · 2008 [cited by applicant]
US 20080288299A1 · Schultz · 2008 [cited by applicant]
US 20090144213A1 · Patil · 2009 [cited by applicant]
US 20100057622A1 · Faith et al. · 2010 [cited by applicant]
US 20100114776A1 · Weller et al. · 2010 [cited by applicant]
US 20110023857A1 · Grace · 2011 [cited by applicant]
US 20110196791A1 · Dominguez · 2011 [cited by applicant]
US 20110218879A1 · Roche et al. · 2011 [cited by applicant]
US 20110270756A1 · Tullis et al. · 2011 [cited by applicant]
US 20120101930A1 · Li et al. · 2012 [cited by applicant]
US 20120144461A1 · Rathbun · 2012 [cited by applicant]
US 20120197802A1 · Smith et al. · 2012 [cited by applicant]
US 20130197998A1 · Buhrmann et al. · 2013 [cited by applicant]
US 20130218769A1 · Pourfallah et al. · 2013 [cited by applicant]
US 20140279477A1 · Sheets et al. · 2014 [cited by applicant]
US 20150019410A1 · Canis · 2015 [cited by applicant]
US 20150120560A1 · Fisher et al. · 2015 [cited by applicant]
US 20150161608A1 · Gilbert et al. · 2015 [cited by applicant]
US 20150206146A1 · Siddens · 2015 [cited by applicant]
US 20150269578A1 · Subramanian et al. · 2015 [cited by applicant]
US 20150269579A1 · Subramanian et al. · 2015 [cited by examiner]
US 20150339477A1 · Abrams et al. · 2015 [cited by applicant]
US 20150379515A1 · Hammad et al. · 2015 [cited by applicant]
US 20160034900A1 · Nelsen et al. · 2016 [cited by applicant]
US 20160042354A1 · Canis et al. · 2016 [cited by applicant]
US 20160078436A1 · Tomasofsky et al. · 2016 [cited by applicant]
US 20160078443A1 · Tomasofsky et al. · 2016 [cited by applicant]
US 20160078444A1 · Tomasofsky · 2016 [cited by examiner]
US 20160104163A1 · Aquino · 2016 [cited by examiner]
US 20160140558A1 · Groarke et al. · 2016 [cited by applicant]
US 20160203490A1 · Gupta et al. · 2016 [cited by applicant]
US 20160210633A1 · Epelman · 2016 [cited by examiner]
US 20160239771A1 · Gukal et al. · 2016 [cited by applicant]
US 20160260100A1 · Wiesman · 2016 [cited by applicant]
US 20160364728A1 · DeLawter et al. · 2016 [cited by applicant]
US 20160379216A1 · Wang et al. · 2016 [cited by applicant]
US 20170046701A1 · Hey et al. · 2017 [cited by applicant]
US 20170076288A1 · Awasthi · 2017 [cited by applicant]
US 20170109752A1 · Hubbard et al. · 2017 [cited by applicant]
US 20170228635A1 · Diev et al. · 2017 [cited by applicant]
US 20170344964A1 · Garlick et al. · 2017 [cited by applicant]
US 20170357957A1 · Mehta et al. · 2017 [cited by applicant]
US 20180089665A1 · Wright · 2018 [cited by applicant]
US 20180108012A1 · Kohli · 2018 [cited by applicant]
US 20180232694A1 · Boding et al. · 2018 [cited by examiner]
US 20180374152A1 · Dominguez · 2018 [cited by examiner]
US 20190188715A1 · Hey et al. · 2019 [cited by applicant]
US 20190392440A1 · Ederle et al. · 2019 [cited by applicant]
US 20190392448A1 · Gosset et al. · 2019 [cited by applicant]
US 20190392450A1 · Gosset et al. · 2019 [cited by applicant]
US 20210090074A1 · Powell · 2021 [cited by examiner]
US 20220122087A1 · Gosset · 2022 [cited by applicant]
AU 2005266964B2 · 2011 [cited by applicant]
CN 1407426A · 2003 [cited by applicant]
CN 105814592A · 2016 [cited by applicant]
CN 106575400A · 2017 [cited by applicant]
CN 107533705A · 2018 [cited by applicant]
CN 108140190A · 2018 [cited by applicant]
JP 2017021816A · 2017 [cited by applicant]
WO 2005004026A1 · 2005 [cited by applicant]
WO 2017035460A1 · 2017 [cited by applicant]
EP Search Report in EP Application No. 19182075.2, dated Oct. 18, 2019. 11 pages. [cited by applicant]
IN First Examination Report; App. No. 201914024764, Jun. 10, 2021; 7 pages. [cited by applicant]
IN First Examination Report; App. No. 201914024865, Mar. 23, 2021; 5 pages. [cited by applicant]
IN First Examination Report; App. No. 201914024867, Feb. 24, 2021; 5 pages. [cited by applicant]
China First Office Action, Application No. 201910548590.4, dated Sep. 30, 2022, 29 pps.: with English translation. [cited by applicant]
China First Office Action, Application No. 201910549310.1, dated Sep. 30, 2022, 20 pps.: with English translation. [cited by applicant]
China First Office Action, Application No. 201910548622.0, dated Sep. 28, 2022, 16 pps.: with English translation. [cited by applicant]
China First Office Action, Application No. 201910548602.3, dated Sep. 30, 2022, 23 pps.: with English translation. [cited by applicant]
China Second Office Action, Application No. 201910548622.0, dated Jan. 18, 2023, 9 pps.: with English translation. [cited by applicant]
PCT International Search Report and Written Opinion, Application No. PCT/US2022/052201, dated Apr. 13, 2023, 11 pages. [cited by applicant]
China Second Office Action, Application No. 201910549310.1, dated Apr. 22, 2023, 19 pps.: with English translation. [cited by applicant]
Huang Xuan, “Research on Mobile Security and Smart Systems: Fuzzy Logic and Identity Recognition”, Xidian University Press, May 31, 2016, pp. 29-31.: with English Abstract. [cited by applicant]
China Second Office Action, Application No. 201910548602.3, dated Apr. 29, 2023, 37 pps.: with English translation. [cited by applicant]
China Rejection Decision, Application No. 201910549310.1, dated Aug. 5, 2023, 19 pps.: with English translation. [cited by applicant]
Yao Qian, “A Glimpse of Digital Money”, China Finance Publishing House, May 31, 2018, 6 pps.: with English Abstract. [cited by applicant]
CA Viewpoint, “Summary of 3D Secure 2.0 and How CA Can Help”, CA Technologies, 2016, 3 pages. [cited by applicant]
“Frictionless Authentication with 3D Secure 2”, 3DSecure2, The Wayback Machine dated Apr. 23, 2018, https://3dsecure2.com/frictionless-flow/, 2018, 6 pages. [cited by applicant]