Secure generation of one-time passcodes using a contactless card
Systems, methods, apparatuses, and computer-readable media for secure generation of one-time passcodes using a contactless card. In one example, an operating system (OS) of a device may receive a uniform resource locator (URL) and a cryptogram from a contactless card. The OS may launch an application associated with the URL. The application may transmit the cryptogram to an authentication server. The application may receive a decryption result from the authentication server indicating the authentication server decrypted the cryptogram. Based on the decryption result, the application may request an OTP. The processor may receive an OTP from an OTP generator. The application may receive an input value and compare the input value to a copy of the OTP. The application may determine that the comparison results in a match, and display, based on the determination that the comparison results in the match, one or more attributes of the account.
1. A method, comprising:
receiving, by an operating system (OS) executing on a processor of a device, a uniform resource locator (URL) and a cryptogram from a contactless card associated with an account;
transmitting, by an application associated with the URL, the cryptogram to an authentication server;
receiving, by the application, a decryption result from the authentication server indicating the authentication server decrypted the cryptogram;
transmitting, by the application based on the decryption result, a request for a one-time passcode (OTP) comprising an identifier to an OTP generator;
receiving, by the device, the OTP from the OTP generator;
receiving, by the application, an input value; and
permitting, by the application based on a determination that the input value matches a copy of the OTP received from the OTP generator, performance of a requested operation associated with the account on the device.
2. The method of claim 1 , further comprising:
launching, by the OS, the application responsive to receiving the URL.
3. The method of claim 1 , wherein the requested operation comprises one or more of: (i) viewing one or more attributes of the account, (ii) transferring funds from the account, (iii) receiving funds, or (iv) processing a purchase using funds from the account.
4. The method of claim 3 , further comprising:
receiving, by the application, a request to perform the operation.
5. The method of claim 1 , wherein the URL is registered to launch the application in the OS, wherein the URL is directed to an application programming interface (API) endpoint for the OTP generator.
6. The method of claim 1 , further comprising:
comparing, by the application, the input value to the copy of the OTP received from the OTP generator.
7. The method of claim 1 , further comprising:
providing, by the OS, the received OTP to an autofill service of the OS; and
autofilling, by the autofill service, the OTP into a form field of the application.
8. A non-transitory computer-readable storage medium, the computer-readable storage medium including instructions that when executed by a processor, cause the processor to:
receive, by an operating system (OS), a uniform resource locator (URL) and a cryptogram from a contactless card associated with an account;
transmit, by an application associated with the URL, the cryptogram to an authentication server;
receive, by the application, a decryption result from the authentication server indicating the authentication server decrypted the cryptogram;
transmit, by the application based on the decryption result, a request for a one-time passcode (OTP) comprising an identifier to an OTP generator;
receive the OTP from the OTP generator;
receive, by the application, an input value; and
permit, by the application based on a determination that the input value matches a copy of the OTP received from the OTP generator, performance of a requested operation associated with the account.
9. The computer-readable storage medium of claim 8 , wherein the instructions further cause the processor to:
launch, by the OS, the application responsive to receiving the URL.
10. The computer-readable storage medium of claim 8 , wherein the requested operation comprises one or more of: (i) view one or more attributes of the account, (ii) transferring funds from the account, (iii) receiving funds, or (iv) processing a purchase using funds from the account.
11. The computer-readable storage medium of claim 10 , wherein the instructions further cause the processor to:
receive, by the application, a request to perform the operation.
12. The computer-readable storage medium of claim 8 , wherein the URL is registered to launch the application in the OS, wherein the URL is directed to an application program interface (API) endpoint for the OTP generator.
13. The computer-readable storage medium of claim 8 , wherein the instructions further cause the processor to:
compare, by the application, the input value to the copy of the OTP received from the OTP generator.
14. The computer-readable storage medium of claim 8 , wherein the instructions further cause the processor to:
provide, by the OS, the received OTP to an autofill service of the OS; and
autofilling, by the autofill service, the OTP into a form field of the application.
15. A computing apparatus comprising:
a processor; and
a memory storing instructions that, when executed by the processor, cause the processor to:
receive, by an operating system (OS), a uniform resource locator (URL) and a cryptogram from a contactless card associated with an account;
transmit, by an application associated with the URL, the cryptogram to an authentication server;
receive, by the application, a decryption result from the authentication server indicating the authentication server decrypted the cryptogram;
transmit, by the application based on the decryption result, a request for a one-time passcode (OTP) comprising an identifier to an OTP generator;
receive the OTP from the OTP generator;
receive, by the application, an input value; and
permit, by the application based on a determination that the input value matches a copy of the OTP received from the OTP generator, performance of a requested operation associated with the account.
16. The computing apparatus of claim 15 , wherein the instructions further cause the processor to:
launch, by the OS, the application responsive to receiving the URL.
17. The computing apparatus of claim 15 , wherein the requested operation comprises one or more of: (i) view one or more attributes of the account, (ii) transferring funds from the account, (iii) receiving funds, or (iv) processing a purchase using funds from the account.
18. The computing apparatus of claim 17 , wherein the instructions further cause the processor to:
receive, by the application, a request to perform the operation.
19. The computing apparatus of claim 15 , wherein the URL is registered to launch the application in the OS, wherein the URL is directed to an application program interface (API) endpoint for the OTP generator.
20. The computing apparatus of claim 15 , wherein the instructions further cause the processor to:
provide, by the OS, the received OTP to an autofill service of the OS; and
autofilling, by the autofill service, the OTP into a form field of the application.