Systems and methods for hosted authentication service
Systems and methods for authenticating an electronic transaction using a hosted authentication service. The systems and methods determine whether an authentication is required based on a first electronic message received from a first data system. Upon determining the authentication is required, the systems and methods transmit a dummy authentication request and a hosted authentication service uniform resource locator to the first data system. The systems and methods further determine or receive an indication whether a user authentication challenge is required based on a transaction risk analysis by a second data system. Upon determining the user authentication challenge is required, the systems and methods provide, at a user interface, an electronic form including a challenge request. The systems and methods transmit, to the first data system, another electronic form including a dummy authentication response generated based on a challenge result.
1. A method for authenticating an electronic transaction using a hosted data service, comprising:
determining whether an authentication is required based on a first electronic message received from a first data system,
upon determining the authentication is required, transmitting a dummy authentication request and a hosted authentication service (HAS) uniform resource locator (URL) to the first data system;
receiving, from the first data system, a first electronic form generated based on the HAS URL, the first electronic form comprising a first data system return URL and the dummy authentication request;
upon receiving the first electronic form, collecting user transaction data from the first data system for a transaction risk analysis by a second data system;
determining or receiving an indication of whether a user authentication challenge is required based on the transaction risk analysis;
upon determining the user authentication challenge is required, providing, at a user interface, a second electronic form generated based on a second data system return URL, the second electronic form comprising a challenge request;
receiving, from the second data system, a third electronic form generated based on the HAS URL, the third electronic form comprising a challenge result based on a user authentication credential; and
transmitting, to the first data system, a fourth electronic form generated based on the first data system return URL, the fourth electronic form comprising a dummy authentication response generated based on the challenge result.
2. The method of claim 1 , further comprising:
upon determining the authentication is not required, performing the authorization process with the second data system.
3. The method of claim 1 , further comprising:
upon determining the user authentication challenge is not required, receiving a cryptogram from the second data system for a frictionless authentication.
4. The method of claim 1 , further comprising:
performing a risk assessment to confirm whether the authentication is required.
5. The method of claim 1 , the collecting the user transaction data from the first data system comprises:
running a JavaScript in a user browser to collect the user transaction data.
6. The method of claim 1 , wherein the user transaction data comprises at least one of a user transaction history, a browser user agent, and a browser time zone.
7. The method of claim 1 , wherein the user authentication credential comprises at least one of a password, a PIN, and a biometric authentication response.
8. A system for authenticating an electronic transaction using a hosted data service, comprising:
a data storage device storing instructions for authenticating the electronic transaction with the hosted data service; and
a processor configured to execute the instructions to perform a method comprising:
determining or receiving an indication of whether an authentication is required based on a first electronic message received from a first data system,
upon determining the authentication is required, transmitting a dummy authentication request and a hosted authentication service (HAS) uniform resource locator (URL) to the first data system;
receiving, from the first data system, a first electronic form generated based on the HAS URL, the first electronic form comprising a first data system return URL and the dummy authentication request;
upon receiving the first electronic form, collecting user transaction data from the first data system for a transaction risk analysis by a second data system;
determining or receiving whether a user authentication challenge is required based on the transaction risk analysis;
upon determining the user authentication challenge is required, providing, at a user interface, a second electronic form generated based on a second data system return URL, the second electronic form comprising a challenge request;
receiving, from the second data system, a third electronic form generated based on the HAS URL, the third electronic form comprising a challenge result based on a user authentication credential; and
transmitting, to the first data system, a fourth electronic form generated based on the first data system return URL, the fourth electronic form comprising a dummy authentication response generated based on the challenge result.
9. The system of claim 8 , wherein the method further comprises:
upon determining the authentication is not required, performing the authorization process with the second data system.
10. The system of claim 8 , wherein the method further comprises:
upon determining the user authentication challenge is not required, receiving a cryptogram from the second data system for a frictionless authentication.
11. The system of claim 8 , further comprising:
performing a risk assessment to confirm whether the authentication is required.
12. The system of claim 8 , wherein the collecting the user transaction data from the first data system comprises:
running a JavaScript in a user browser to collect the user transaction data.
13. The system of claim 8 , wherein the user transaction data comprises at least one of a user transaction history, a browser user agent, and a browser time zone.
14. The system of claim 8 , wherein the user authentication credential comprises at least one of a password, a PIN, and a biometric authentication response.
15. A non-transitory computer-readable medium storing instructions that, when executed by one or more processors of a computer system, cause the one or more processors to perform a method for authenticating an electronic transaction using a hosted data service, the method comprising:
determining or receiving an indication whether an authentication is required based on a first electronic message received from a first data system,
upon determining the authentication is required, transmitting a dummy authentication request and a hosted authentication service (HAS) uniform resource locator (URL) to the first data system;
receiving, from the first data system, a first electronic form generated based on the HAS URL, the first electronic form comprising a first data system return URL and the dummy authentication request;
upon receiving the first electronic form, collecting user transaction data from the first data system for a transaction risk analysis by a second data system;
determining whether a user authentication challenge is required based on the transaction risk analysis;
upon determining the user authentication challenge is required, providing, at a user interface, a second electronic form generated based on a second data system return URL, the second electronic form comprising a challenge request;
receiving, from the second data system, a third electronic form generated based on the HAS URL, the third electronic form comprising a challenge result based on a user authentication credential; and
transmitting, to the first data system, a fourth electronic form generated based on the first data system return URL, the fourth electronic form comprising a dummy authentication response generated based on the challenge result.
16. The computer-readable medium of claim 15 , wherein the method further comprises:
upon determining the authentication is not required, performing the authorization process with the second data system.
17. The computer-readable medium of claim 15 , wherein the method further comprises:
upon determining the user authentication challenge is not required, receiving a cryptogram from the second data system for a frictionless authentication.
18. The computer-readable medium of claim 15 , further comprising:
performing a risk assessment to confirm whether the authentication is required.
19. The computer-readable medium of claim 15 , wherein the collecting the user transaction data from the first data system comprises:
running a JavaScript in a user browser to collect the user transaction data.
20. The computer-readable medium of claim 15 , wherein the user transaction data comprises at least one of a user transaction history, a browser user agent, and a browser time zone.