Continuous authentication for digital services based on contactless card positioning
Various embodiments are generally directed to continuous authentication of a user to a digital service based on activity of a contactless card positioned proximate to a computing device on which the digital service operates. For example, a series of periodic status messages may be provided between a client device and the contactless card to verify whether the contactless card remains active, wherein authorization to access the digital service continues while the contactless card is active, and terminates when the contactless card is inactive.
1. A non-transitory computer-readable storage medium having computer-readable program code stored thereon, the computer-readable program code including instructions which when executed by a processor circuit of a client device cause the processor circuit to perform operations comprising:
receiving, by an application executing on the processor circuit, a request to access a digital service;
performing, by the application, a first authentication by verifying that a first set of encrypted data is associated with a user account;
requesting, by the application based on the first authentication, a second authentication from a contactless card, wherein the contactless card is activated by a magnetic field of the client device;
receiving, by a card reader of the client device, a second set of encrypted data from the contactless card in response to the contactless card being activated, wherein the second set of encrypted data is based on a cryptographic algorithm and a diversified key stored in a memory of the contactless card, the diversified key based on a master key and a counter value of the contactless card, wherein the second set of encrypted data is associated with the user account and is received from the contactless card in a near-field communication (NFC) data exchange format (NDEF) message in response to the contactless card coming into a communication range of the client device;
performing, by the application, the second authentication based on the second set of encrypted data;
authorizing, by the application, access to the digital service in response to the first authentication and the second authentication;
transmitting, by the application at each of a plurality of time intervals, a respective status message of a plurality of status messages to the contactless card by energizing an NFC interface and an antenna to verify that the contactless card is active;
receiving, by the application, a first response of a plurality of responses in response a first status message of the plurality of status messages, wherein each of the plurality of responses are received in one or more NDEF messages communicated by the contactless card;
providing, by the application based on the first response, access to the digital service, without requiring re-authentication;
determining, by the application, that a response to a second status message of the plurality of status messages is not received from the contactless card; and
terminating, by the application, access to the digital service based on the determination that the response to the second status message is not received from the contactless card.
2. The non-transitory computer-readable storage medium of claim 1 , further comprising computer-readable program code including instructions which when executed by the processor circuit cause the processor circuit to perform operations further comprising:
determining, by the application, that a signal strength of the contactless card is below a threshold value, wherein the application determines that the second status message is not received based on the determination that the signal strength of the contactless card is below the threshold value.
3. The non-transitory computer-readable storage medium of claim 2 , further comprising computer-readable program code including instructions which when executed by the processor circuit cause the processor circuit to perform operations further comprising displaying, via a graphical user interface of the client device, the signal strength of the contactless card.
4. The non-transitory computer-readable storage medium of claim 1 , further comprising computer-readable program code including instructions which when executed by the processor circuit cause the processor circuit to perform operations comprising providing the second authentication to a second client device to enable access to a digital service operating on the second client device.
5. The non-transitory computer-readable storage medium of claim 1 , further comprising computer-readable program code including instructions which when executed by the processor circuit cause the processor circuit to perform operations comprising:
sending, by the application, the second set of encrypted data to a server; and
receiving, by the application from the server, the second authentication based on the second set of encrypted data, wherein the counter value of the contactless card is synchronized with a counter value maintained the server.
6. The non-transitory computer-readable storage medium of claim 1 , wherein processing circuitry of the communications interface of the contactless card supports at least one of near field communication (NFC), Bluetooth, and Wi-Fi, and wherein the second set of encrypted data includes at least one of: an encrypted expiration date, an encrypted billing address, and an encrypted card verification value (CVV) associated with the user account.
7. A system, comprising:
a client device operable with a contactless card, the client device including a processor circuit; and
a memory storing instructions which when executed by the processor circuit, cause the processor circuit to perform operations comprising:
receiving, by an application executing on the processor circuit, a request to access a digital service;
performing, by the application, a first authentication by verifying that a first set of encrypted data is associated with a user account;
requesting, by the application based on the first authentication, a second authentication from the contactless card, wherein the contactless card is activated by a magnetic field of the client device;
receiving, by a card reader of the client device, a second set of encrypted data from the contactless card in response to the contactless card being activated, wherein the second set of encrypted data is based on a cryptographic algorithm and a diversified key stored in a memory of the contactless card, the diversified key based on a master key and a counter value of the contactless card, wherein the second set of encrypted data is associated with the user account and is received from the contactless card in a near-field communication (NFC) data exchange format (NDEF) message in response to the contactless card coming into a communication range of the client device;
performing, by the application, the second authentication based on the second set of encrypted data;
authorizing, by the application, access to the digital service in response to the first authentication and the second authentication;
transmitting, by the application at each of a plurality of time intervals, a respective status message of a plurality of status messages to the contactless card by energizing an NFC interface and an antenna to verify that the contactless card is active;
receiving, by the application, a first response of a plurality of responses in response a first status message of the plurality of status messages, wherein each of the plurality of responses are received in one or more NDEF messages communicated by the contactless card;
providing, by the application based on the first response, access to the digital service, without requiring re-authentication;
determining, by the application, that a response to a second status message of the plurality of status messages is not received from the contactless card; and
terminating, by the application, access to the digital service based on the determination that the response to the second status message is not received from the contactless card.
8. The system of claim 7 , the memory storing instructions which when executed by the processor circuit, cause the processor circuit to perform operations further comprising:
determining, by the application, that a signal strength of the contactless card is below a predetermined threshold value or that the client device entered a sleep mode, wherein the application determines that the second status message is not received based on the determination that the signal strength of the contactless card is below the threshold value or that the client device has entered the sleep mode.
9. The system of claim 8 , the memory storing instructions which when executed by the processor circuit, cause the processor circuit to perform operations further comprising displaying the signal strength of the contactless card via a graphical user interface of the client device.
10. The system of claim 7 , further comprising a second client device, wherein the memory stores instructions which when executed by the processor circuit, cause the processor circuit to perform operations further comprising providing the second authentication to a second client device to enable access to a digital service operating on the second client device.
11. The system of claim 10 , wherein the client device is a mobile device, and wherein the second client device is a personal computer.
12. The system of claim 11 , the memory storing instructions which when executed by the processor circuit, cause the processor circuit to perform operations further comprising:
sending, by the application the second set of encrypted data to a server; and
receiving, by the application from the server, the second authentication based on the second set of encrypted data, wherein the counter value of the contactless card is synchronized with a counter value maintained the server.
13. The system of claim 7 , further comprising a physical covering over the client device, the physical covering including a slot through an end wall of the physical covering, the slot defining a set of walls operable to house the contactless card, wherein the slot is disposed along a backside of the client device.
14. A method, comprising:
receiving, by an application executing on a processor circuit of a client device, a request to access a digital service;
performing, by the application, a first authentication by verifying that a first set of encrypted data is associated with a user account;
requesting, by the application based on the first authentication, a second authentication from a contactless card, wherein the contactless card is activated by a magnetic field of the client device;
generating, by the contactless card in response to the contactless card being activated, a second set of encrypted data based on a cryptographic algorithm and a diversified key, wherein the diversified key is generated by the contactless card based on a master key and a counter value of the contactless card;
receiving, by a card reader of the client device and from the contactless card, the second set of encrypted data, wherein the second set of encrypted data is associated with the user account and is received from the contactless card in a near-field communication (NFC) data exchange format (NDEF) message in response to the contactless card coming into a communication range of the client device;
performing, by the application, the second authentication based on the second set of encrypted data;
authorizing, by the application, access to the digital service in response to the first authentication and the second authentication;
transmitting, by the application at each of a plurality of time intervals, a respective status message of a plurality of status messages to the contactless card by energizing an NFC interface and an antenna to verify that the contactless card is active;
receiving, by the application, a first response of a plurality of responses in response a first status message of the plurality of status messages, wherein each of the plurality of responses are received in one or more NDEF messages communicated by the contactless card;
providing, by the application based on the first response, access to the digital service, without requiring re-authentication;
determining, by the application, that a response to a second status message of the plurality of status messages is not received from the contactless card; and
terminating, by the application, access to the digital service based on the determination that the response to the second status message is not received from the contactless card.
15. The method of claim 14 , further comprising:
determining, by the application, that a signal strength of the contactless card is below a threshold value, wherein the application determines that the second status message is not received based on the determination that the signal strength of the contactless card is below the threshold value.
16. The method of claim 15 , further comprising displaying the signal strength of the contactless card via a graphical user interface of the client device.
17. The method of claim 14 , further comprising:
sending, by the application, the second set of encrypted data to a server; and
receiving, by the application from the server, the second authentication based on the second set of encrypted data wherein the counter value of the contactless card is synchronized with a counter value maintained the server.
18. The method of claim 14 , further comprising receiving the contactless card within a slot through an end wall of a physical covering, the slot defining a set of walls operable to house the contactless card, and the slot disposed along a backside of the client device when the client device is coupled with the physical covering.
19. The method of claim 14 , further comprising, based on the termination of the access to the digital service:
receiving, by the application, a third authentication based on verification of a third set of encrypted data associated with the user account;
receiving, by the application via the card reader, a fourth set of encrypted data from the contactless card;
performing, by the application, a fourth authentication based on the second set of encrypted data; and
authorizing, by the application, access to the digital service in response to the third authentication and the fourth authentication.
20. The method of claim 19 , further comprising:
transmitting, by the application at each of an additional plurality of time periods, a respective additional status message of a plurality of additional status messages to the contactless card to verify that the contactless card is active;
receiving, by the application, a first additional response of a plurality of additional responses from the contactless card in response to a first additional status message of the plurality of additional status messages;
providing, by the application based on the first additional response, access to the digital service without requiring re-authentication;
determining, by the application, that an additional response to a second additional status message of the plurality of additional status messages is not received from the contactless card; and
terminating, by the application, access to the digital service based on the determination that the response to the second additional status message is not received from the contactless card.