Granted Patent B2

US 12,689,622 · App. 18/444,105 · Granted Jul 21, 2026

Inventor: Weston Thackeray Thompson (Claremont, CA)

Assignee: Wells Fargo Bank, N.A.

H04L63/0838H04L63/0853

Abstract

Claims (56)

1 . An authentication method, comprising:

using a hardware processor of a first computing device:

generating a one-time passcode using a shared secret value, the shared secret value shared between the first computing device and a second computing device, the second computing device providing a network-based service;

detecting a Near Field Communications (NFC) enabled card using an NFC reader communicatively coupled to the hardware processor;

transmitting the one-time passcode to the NFC enabled card;

receiving an encrypted token from the NFC enabled card, the encrypted token generated by the NFC enabled card using the one-time passcode and a cryptographic key of the NFC enabled card;

outputting a value based upon the encrypted token on a display of the first computing device; and

providing login credentials input by a user and the value as separate authentication factors to the second computing device to authenticate the user of the first computing device to the second computing device to access an account of the user on the network-based service.

2 . The authentication method of claim 1 , further comprising:

using a second hardware processor of the second computing device:

generating a second one-time passcode using the shared secret value;

receiving, as part of an authentication of the user, the encrypted token;

decrypting the encrypted token using a cryptographic key corresponding to the cryptographic key of the NFC enabled card to generate decrypted data;

determining whether the decrypted data corresponds to the second one-time passcode; and

responsive to determining whether the decrypted data corresponds to the second one-time passcode, granting access to the network-based service or operation of the network-based service.

3 . The authentication method of claim 2 , wherein the decrypted data comprises card specified data and wherein determining whether the decrypted data corresponds to the second one-time passcode comprises:

utilizing a cryptographic hash of the second one-time passcode and the card specified data and comparing the cryptographic bash with a portion of the decrypted data.

4 . The method of claim 1 , wherein the NFC enabled card is a bank card issued by a financial institution and wherein the network-based service is a banking application providing access to a financial account of the user.

5 . The method of claim 1 , wherein the one-time passcode is a time-based one-time-passcode (TOTP).

6 . An authentication device, comprising:

a hardware processor configured to perform operations comprising:

generating a one-time passcode using a shared secret value, the shared secret value shared between the authentication device and a second computing device, the second computing device providing a network-based service;

detecting a Near Field Communications (NFC) enabled card using an NFC reader communicatively coupled to the hardware processor;

transmitting the one-time passcode to the NFC enabled card;

receiving an encrypted token from the NFC enabled card, the encrypted token generated by the NFC enabled card using the one-time passcode and a cryptographic key of the NFC enabled card;

outputting a value based upon the encrypted token on a display of the authentication device; and

providing login credentials input by a user and the value as separate authentication factors to the second computing device to authenticate the user of the authentication device to the second computing device to access an account of the user on the network-based service.

7 . The authentication device of claim 6 , wherein the operations further comprise:

using a second hardware processor of the second computing device:

generating a second one-time passcode using the shared secret value;

receiving, as part of an authentication of the user, the encrypted token;

decrypting the encrypted token using a cryptographic key corresponding to the cryptographic key of the NFC enabled card to generate decrypted data;

determining whether the decrypted data corresponds to the second one-time passcode; and

responsive to determining whether the decrypted data corresponds to the second one-time passcode, granting access to the network-based service or operation of the network-based service.

8 . The authentication device of claim 7 , wherein the decrypted data comprises card specified data and wherein the operations of determining whether the decrypted data corresponds to the second one-time passcode comprises:

utilizing a cryptographic hash of the second one-time passcode and the card specified data and comparing the cryptographic hash with a portion of the decrypted data.

9 . The authentication device of claim 6 , wherein the NFC enabled card is a bank card issued by a financial institution and wherein the network-based service is a banking application providing access to a financial account of the user.

10 . The authentication device of claim 6 , wherein the one-time passcode is a time-based one-time-passcode (TOTP).

11 . A non-transitory, machine-readable medium, storing instructions, which when performed by an authentication device, causes the authentication device to perform operations comprising:

generating a one-time passcode using a shared secret value, the shared secret value shared between the authentication device and a second computing device, the second computing device providing a network-based service;

detecting a Near Field Communications (NFC) enabled card using an NFC reader communicatively coupled to the authentication device;

transmitting the one-time passcode to the NFC enabled card;

receiving an encrypted token from the NFC enabled card, the encrypted token generated by the NFC enabled card using the one-time passcode and a cryptographic key of the NFC enabled card;

outputting a value based upon the encrypted token on a display of the authentication device; and

providing login credentials input by a user and the value as separate authentication factors to the second computing device to authenticate the user to the second computing device to access an account of the user on the network-based service.

12 . The non-transitory, machine-readable medium of claim 11 , wherein the operations further comprise:

using a second hardware processor of the second computing device:

generating a second one-time passcode using the shared secret value;

receiving, as part of an authentication of the user, the encrypted token;

decrypting the encrypted token using a cryptographic key corresponding to the cryptographic key of the NFC enabled card to generate decrypted data;

determining whether the decrypted data corresponds to the second one-time passcode; and

responsive to determining whether the decrypted data corresponds to the second one-time passcode, granting access to the network-based service or operation of the network-based service.

13 . The non-transitory, machine-readable medium of claim 12 , wherein the decrypted data comprises card specified data and wherein the operations of determining whether the decrypted data corresponds to the second one-time passcode comprises:

utilizing a cryptographic hash of the second one-time passcode and the card specified data and comparing the cryptographic hash with a portion of the decrypted data.

14 . The non-transitory machine-readable medium of claim 12 , wherein the NFC enabled card is a bank card issued by a financial institution and wherein the network-based service is a banking application providing access to a financial account of the user.

15 . The non-transitory machine-readable medium of claim 12 , wherein the one-time passcode is a time-based one-time-passcode (TOTP).

Assignments (1)

Continuity (1)

References Cited (49)