Financial transaction method and system having an update mechanism

• US 10,147,077 B2
• Filed: 09/21/2010
• Issued: 12/04/2018
• Est. Priority Date: 09/21/2010
• Status: Active Grant

• Current Assignee: Mastercard International Incorporated (MasterCard Incorporated)
• Original Assignee: Mastercard International Incorporated (MasterCard Incorporated)
• Inventors: Mestre, Patrick, Radu, Cristian, Roberts, David A., Van de Velde, Edward L. H.
• Primary Examiner(s): Hayles, Ashford S
• Application Number:
  US13/825,115
• Publication Number:
  US 20130185167A1
• Time in Patent Office: 2,996 Days
• Field of Search: 705 21
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/202 Interconnection or interaction of plural electronic cash registers [ECR] or to host computer, e.g. network details, transfer of information from host to ECR or from ECR to ECR
• CPC Class Codes: G06Q 20/4033 Local solvency checks
• CPC Class Codes: G06Q 20/4037 Remote solvency checks
• CPC Class Codes: G07F 7/10 together with a coded signal , e.g. in the form of personal identification information, like personal identification number [PIN] or biometric data
• CPC Class Codes: G07F 7/127 in which both online and offline card verification can take place

Abstract

A payment device and method and system for using the payment device is described capable of utilizing a pre-authorized amount on existing infrastructure, including POS terminals or for using offline pre-paid products on this infrastructure. The updates for the pre-authorized or offline prepaid products can be sent by the issuer and applied by the card contemporaneously with the card'"'"'s processing of the issuer authentication data but without requiring any additional bytes in the issuer authentication data. The updates performed by the issuer can be larger and more extensive than could be achieved by using any available space in the issuer authentication data.

Claims

1. A method of managing a payment device in a financial transaction between an issuer node and the payment device via a terminal across a payment network, the payment device being issued by an issuer or an agent of the issuer, the financial transaction being routed at an application layer from the issuer node to the terminal, comprising:

determining, by the issuer node, Issuer Authentication Data and extended Issuer Authentication Data associated with the payment device, wherein the extended Issuer Authentication Data comprises one or more updates to one or more updated values stored in a non-volatile memory of the payment device;

packaging, by the issuer node, the extended Issuer Authentication Data in a first component configured to be executed by the payment device prior to receipt of a second component, wherein the first component comprises a first byte capacity;

packaging, by the issuer node, the Issuer Authentication Data in a second component configured for completing the financial transaction and applying the Issuer Authentication Data, wherein the second component comprises a second byte capacity which is less than the first byte capacity of the first component;

routing, by the issuer node, the first component through the payment network to the payment device;

causing the payment device, upon receiving the first component, to provisionally store the extended Issuer Authentication Data in a volatile memory of the payment device without losing prior values corresponding to the extended Issuer Authentication Data stored in the non-volatile memory of the payment device; and

causing the payment device, upon receiving the second component, to apply the extended Issuer Authentication Data to the non-volatile memory on the payment device to replace the prior values with the one or more updated values when the payment device has issued a confirmation that the financial transaction has been completed in accordance with the outcome requested by the issuer or the agent and upon successful verification of the Issuer Authentication Data.

2. The method of claim 1, wherein the replacement is only carried out when the payment device has successfully authenticated instructions from the issuer or the agent in accordance with an authentication process.

3. The method of claim 1, wherein the confirmation is an application cryptogram.

4. The method of claim 1, wherein the outcome requested by the issuer or the agent is approval or denial.

5. The method of claim 2 further comprising:

storing on said payment device a pre-authorized limit representing a maximum value which is utilized with said payment device for at least one off-line transaction without communication with said issuer or said agent via said payment network for authorization of said at least one off-line transaction;

storing on said payment device a pre-authorized balance representing a value of transactions conducted with said payment device without on-line communication with said payment network;

utilizing said payment device for conducting said at least one off-line transaction and reading from said payment device said pre-authorized balance, or said pre-authorized limit, and an account number associated with an account;

initiating an on-line authorization request when the value of said at least one off-line transaction is greater than the difference between said pre-authorized limit and said pre-authorized balance;

initiating an on-line authorization request by communicating with said payment network; and

receiving authorization to conduct said at least one off-line transaction and updating said pre-authorized balance and said pre-authorized limit, wherein the issuer or the agent, through said payment device, updates the pre-authorized limit.

6. The method of claim 5, wherein the issuer or the agent, through said payment device, updates the pre-authorized balance.

7. The method of claim 5, further comprising:

receiving a denial prohibiting said at least one off-line transaction and updating said pre-authorized balance and said pre-authorized limit, wherein the issuer or the agent, through said payment device, is able to update the pre-authorized limit.

8. The method of claim 3, wherein the payment device receives a response code, and the extended Issuer Authentication Data is applied when the application cryptogram is the one defined by the response code.

9. The method of claim 8 wherein the response code has an indication whether the financial transaction should be declined when the extended Issuer Authentication Data was not received or whether the financial transaction should be processed independently of the presence of the extended Issuer Authentication Data.

10. The method of claim 1, wherein at least one of the first and second components is transferred securely from the terminal to the payment device.

11. The method of claim 10, wherein the secure transfer includes an error detection mechanism.

12. The method of claim 1, wherein the extended Issuer Authentication Data is calculated when the financial transaction has been completed successfully.

13. A system for managing a payment device in a financial transaction between an issuer node and the payment device via a terminal across a payment network, the payment device being issued by an issuer or an agent of the issuer, the financial transaction being routed at an application layer from the issuer node to the terminal, comprising:

the issuer node, configured for, determining Issuer Authentication Data and extended Issuer Authentication Data, associated with the payment device, wherein the extended Issuer Authentication Data comprises one or more updates to one or more updated values stored in a non-volatile memory of the payment device;

packaging the extended Issuer Authentication Data in a first component configured to be executed by the payment device prior to receipt of a second component, wherein the first component comprises a first byte capacity;

packaging the Issuer Authentication Data in a second component configured for completing the financial transaction and applying the Issuer Authentication Data, wherein the second component comprises a second byte capacity which is less than the first byte capacity of the first component;

routing the first component through the payment network to the payment device;

the payment device, configured for,

upon receiving the first component, to provisionally store the extended Issuer Authentication Data in a volatile memory of the payment device without losing prior values corresponding to the extended Issuer Authentication Data stored in the non-volatile memory of the payment device; and

upon receiving the second component, to apply the extended Issuer Authentication Data to the non-volatile memory on the payment device to replace the prior values with the one or more updated values when the payment device has issued a confirmation that the financial transaction has been completed in accordance with the outcome requested by the issuer or the agent and upon successful verification of the Issuer Authentication Data.

14. The system of claim 13, wherein the payment device is adapted to apply the extended Issuer Authentication Data when the payment device has successfully authenticated instructions from the issuer or the agent in accordance with an authentication process.

15. The system of claim 13, wherein the confirmation is an application cryptogram.

16. The system of claim 13, wherein the outcome requested by the issuer or the agent is approval or denial.

17. The system of claim 14, further comprising:

the payment device having stored thereon a pre-authorized limit representing a maximum value which is utilized with said payment device for at least one off-line transaction without communication with said issuer or the agent via said payment network for authorization of said at least one off-line transaction;

the payment device having stored thereon a pre-authorized balance representing a value of transactions conducted with said payment device without on-line communication with said payment network;

means for reading from said payment device said pre-authorized balance or said pre-authorized limit, and an account number associated with an account;

means for determining to initiating an on-line authorization request when the value of said at least one off-line transaction is greater than the difference between said preauthorized limit and said pre-authorized balance;

the means for determining being adapted to initiate an online authorization request by communicating with said payment network; and

means for receiving authorization to conduct said transaction and for updating by said payment device of said pre-authorized balance and said pre-authorized limit, wherein the issuer or the agent, through said payment device, updates the pre-authorized limit.

18. The system of claim 17, wherein the issuer or the agent, through said payment device, updates the pre-authorized balance.

19. The system of claim 17, further comprising:

the payment device being adapted to receive a denial prohibiting said at least one off-line transaction and updating by said payment device said pre-authorized balance and said pre authorized limit, wherein the issuer or the agent, through said payment device, is able to update the pre-authorized limit.

20. The system of claim 15, wherein the payment device is adapted to receive a response code, and the extended Issuer Authentication Data is applied when the application cryptogram is the one defined by the response code.

21. The system of claim 20 wherein the response code has an indication whether the financial transaction should be declined if the extended Issuer Authentication Data was not received or be processed independently of the presence of the extended Issuer Authentication Data.

22. The system of claim 13, wherein a connection between the terminal and the payment device is adapted such that at least one of the first and second components is transferred securely from the terminal to the payment device.

23. The system of claim 22, wherein the connection for securely transferring includes an error detection mechanism.

24. The system of claim 13, wherein the system is adapted to calculate the extended Issuer Authentication Data when the financial transaction has been completed successfully.

25. A payment device having a volatile memory and a nonvolatile memory, the payment device being for use in a financial transaction between an issuer node and the payment device via a terminal across a payment network, the payment device being issued by an issuer or an agent of the issuer, the financial transaction being routed at an application layer from the issuer node to the terminal, wherein the payment device is configured for:

receiving, from the issuer node, a first component through the payment network to the payment device, wherein, the issuer node determined Issuer Authentication Data and extended Issuer Authentication Data, associated with the payment device, wherein the extended Issuer Authentication Data comprises one or more updates to one or more updated values stored in a non-volatile memory of the payment device, and

wherein the issuer node packaged the extended Issuer Authentication Data in a first component configured to be executed by the payment device prior to receipt of a second component, wherein the first component comprises a first byte capacity, and

wherein the issuer node packaged the Issuer Authentication Data in a second component configured for completing the financial transaction and applying the Issuer Authentication Data, wherein the second component comprises a second byte capacity which is less than the first byte capacity of the first component;

upon receiving the first component, provisionally storing the extended Issuer Authentication Data in a volatile memory of the payment device without losing prior values corresponding to the extended Issuer Authentication Data stored in the non-volatile memory of the payment device; and

upon receiving the second component, applying the extended Issuer Authentication Data to the non-volatile memory on the payment device to replace the prior values with the one or more updated values when the payment device has issued a confirmation that the financial transaction has been completed in accordance with the outcome requested by the issuer or the agent and upon successful verification of the Issuer Authentication Data.