Secure Mobile Device Credential Provisioning Using Risk Decision Non-Overrides

摘要

Embodiments are directed to optimizing the secure provisioning of credentials to mobile devices through use of risk decision non-overrides. In some embodiments, a service provider receives a request from a wallet provider to provision a credential associated with an account to a mobile device. The request includes a first risk level associated with the provisioning. The service provider receives a second risk level associated with the provisioning request from an issuer of the account. Based upon determining that a non-override condition exists, the service provider uses the first risk level from the wallet provider and accordingly causes a user authentication to occur. A non-override condition may be determined based upon scenario indicators received within the provisioning request. In some embodiments, the non-override condition may be ignored when the first risk level indicates medium risk and the second risk level indicates high risk.

主权项

1. A method, comprising:
receiving, at a server computer, a provisioning request to provision a credential to a user device, wherein the credential is associated with an account of a user, and wherein the provisioning request includes a first risk level indicating a perceived risk of provisioning the credential to the user device; determining, by the server computer, that the provisioning request includes a non-override condition, wherein the non-override condition recommends setting the first risk level as a final risk decision value; determining, by the server computer, a second risk level associated with the provisioning request, wherein the second risk level indicates a second perceived risk of provisioning the credential to the user device different than the first perceived risk; comparing, at the server computer, the first risk level to the second risk level; when the first risk level is lower than the second risk level:
setting the second risk level as the final risk decision value even when the non-override condition exists; andpreventing the credential from being provisioned onto the user device without further authentication; when the first risk level is higher than the second risk level:
setting the first risk level as the final risk decision value; andcausing the credential to be provisioned onto the user device.