Authentication system and method

• US 10,148,659 B2
• Filed: 02/28/2017
• Issued: 12/04/2018
• Est. Priority Date: 10/23/2011
• Status: Active Grant

• Current Assignee: Textile Computer Systems, Inc.
• Original Assignee: Textile Computer Systems, Inc.
• Inventors: Nandakumar, Gopal
• Primary Examiner(s): Potratz, Daniel B
• Application Number:
  US15/444,564
• Publication Number:
  US 20170237739A1
• Time in Patent Office: 644 Days
• CPC Class Codes: G06F 21/30 Authentication, i.e. establishing the identity or authorisation of security principals
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: G06F 21/40 by quorum, i.e. whereby two or more security principals are required
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: G06Q 20/24 Credit schemes, i.e. "pay after"
• CPC Class Codes: G06Q 20/34 using cards, e.g. integrated circuit [IC] cards or magnetic cards
• CPC Class Codes: G06Q 20/383 Anonymous user system
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

An authentication system for authenticating the identity of a requester of access by an unauthorized service client to a secured resource. The system has a messaging gateway having a first set of instructions operable to receive from a requester purporting to be an authorized user of a secured resource a request for limited access to the secured resource by an unauthorized service client for a particular transaction; a server having a second set of instructions operable to determine a key string known to both the secured resource and the authorized user the requestor purports to be, the key string being adapted to provide a basis for authenticating the identity of the requester as the authorized account holder; and a service user interface having a third set of instructions embodied in a computer readable medium operable to receive transaction specific information input into the request by the unauthorized service client.

Claims

1. A computer-implemented method for a credit or debit card account holder to authorize a resource provider to use a credit or debit card account number to pay a specific merchant for a specific transaction without transmitting or otherwise providing the credit or debit card account number to the merchant, the computer-implemented method comprising the steps of:

providing at least one interface adapted to receive and transmit data in communication with a credit or debit card account holder'"'"'s mobile device, a merchant'"'"'s payment application, or both;

receiving registration information received from the credit or debit card account holder through the at least one interface, the registration information comprising a credit or debit card account holder identifier and at least one credit or debit card account number having an associated unique account identifier wherein the credit or debit card account number and unique account identifier are not the same;

receiving an authorization request message to pay the specific merchant for the specific transaction from a given debit or credit card account, the authorization request message having been received through the at least one interface and originating from the credit or debit card account holder'"'"'s mobile device and comprising;

a first merchant identifier;

a first transaction specific information selected from the group consisting of a first transaction amount and first client reference identifier;

the credit or debit card account holder identifier; and

a designated unique account identifier selected from the at least one unique account identifiers; and

generating a first transaction specific authentication credential associated with the authorization request, whereby the first transaction specific authentication credential comprises a key string wherein the key string is not a temporary credit or debit card account number and does not include or reveal the credit or debit card account number associated with the designated unique account identifier;

receiving a payment request message from the merchant'"'"'s payment application through the at least one interface, the payment request message comprising;

a second merchant identifier;

a second transaction specific information selected from the group consisting of a second transaction amount and second client reference identifier; and

a second transaction specific authentication credential whereby the second authentication credential was received by the merchant application from the credit or debit card account holder'"'"'s mobile device; and

validating the credit or debit card account holder'"'"'s request to use the credit or debit card account number associated with the designated unique account identifier for payment to the specific merchant for the specific transaction and authorizing the resource provider to use the credit or debit card account number associated with the designated unique account identifier to pay a specific merchant for a specific transaction without transmitting or otherwise providing the credit or bank account number to the specific merchant by determining that;

the first merchant identifier matches the second merchant identifier;

the first transaction specific information matches the second transaction specific information; and

the first transaction specific authentication credential matches the second transaction specific authentication credential.

2. The computer-implemented authentication method of claim 1 wherein the first transaction specific authentication credential is generated before receipt of the payment request message.

3. The computer-implemented authentication method of claim 1 further comprising the steps of storing the first transaction specific authentication credential for the authorization request message.

4. The computer-implemented authentication method of claim 1 further comprising the steps of transmitting the transaction specific authentication credential to the credit or debit card account holder'"'"'s mobile device through the at least one interface.

5. The computer-implemented authentication method of claim 1 further comprising the steps of completing the payment process using the credit or debit card account number for the designated unique account identifier without transmitting or otherwise providing the credit or debit card account number to the merchant.

6. The computer-implemented authentication method of claim 1 wherein the validation step must take place within a given time period.

7. The computer-implemented authentication method of claim 1 further comprising the step of determining whether the second authentication credential should be deemed invalid based upon passage of time.

8. The computer-implemented authentication method of claim 1 wherein the credit or debit card account number comprises an issuer identifier portion and the first transaction specific authentication credential value includes the issuer identifier portion of the account number associated with the designated account identifier.

9. A computer-implemented system for a credit or debit card account holder to authorize a resource provider to use a credit or debit card account number to pay a specific merchant for a specific transaction without transmitting or otherwise providing the credit or debit card account number to the merchant, the computer-implemented system comprising:

at least one interface adapted to receive and transmit data in communication with a credit or debit card account holder'"'"'s mobile device, a merchant'"'"'s payment application, or both;

one or more servers in secure communication with the at least one interface, the one or more servers having;

a first instruction embodied in a computer readable medium, the first instruction operable to receive registration information received from the credit or debit card account holder through the at least one interface, the registration information comprising a credit or debit card account holder identifier and at least one credit or debit card account number having an associated unique account identifier wherein the credit or debit card account number and unique account identifier are not the same;

a second instruction embodied in a computer readable medium, the second instruction operable to receive an authorization request message to pay the specific merchant for the specific transaction from a given debit or credit card account, the authorization request message having been received through the at least one interface and originating from the credit or debit card account holder'"'"'s mobile device and comprising;

a first merchant identifier;

a first transaction specific information selected from the group consisting of a first transaction amount and first client reference identifier;

the credit or debit card account holder identifier; and

a designated unique account identifier selected from the at least one unique account identifiers; and

a third instruction embodied in a computer readable medium, the third instruction operable to;

generate a first transaction specific authentication credential associated with the authorization request, whereby the first transaction specific authentication credential comprises a key string wherein the key string is not a temporary credit or debit card account number and does not include or reveal the credit or debit card account number associated with the designated unique account identifier;

receive a payment request message from the merchant'"'"'s payment application through the at least one interface, the payment request message comprising;

a second merchant identifier;

a second transaction specific information selected from the group consisting of a second transaction amount and second client reference identifier; and

a second transaction specific authentication credential whereby the second authentication credential was received by the merchant application from the credit or debit card account holder'"'"'s mobile device; and

validate the credit or debit card account holder'"'"'s request to use the credit or debit card account number associated with the designated unique account identifier for payment to the specific merchant for the specific transaction and authorize the resource provider to use the credit or debit card account number associated with the designated unique account identifier to pay a specific merchant for a specific transaction without transmitting or otherwise providing the credit or bank account number to the specific merchant by determining if;

the first merchant identifier matches the second merchant identifier;

the first transaction specific information matches the second transaction specific information; and

the first transaction specific authentication credential matches the second transaction specific authentication credential.

10. The computer-implemented authentication system of claim 9 wherein the first transaction specific authentication credential is generated before receipt of the payment request message.

11. The computer-implemented authentication system of claim 9 wherein the third instruction is further operable to store the first transaction specific authentication credential for the authorization request message.

12. The computer-implemented authentication system of claim 9 wherein the third instruction is further operable to transmit the transaction specific authentication credential to the credit or debit card account holder'"'"'s mobile device through the at least one interface.

13. The computer-implemented authentication system of claim 9 wherein the third instruction is further operable to complete the payment process using the credit or debit card account number for the designated unique account identifier without transmitting or otherwise providing the credit or debit card account number to the merchant.

14. The computer-implemented authentication system of claim 9 wherein the validation step must take place within a given time period.

15. The computer-implemented authentication system of claim 9 wherein the third instruction is further operable to determine whether the second authentication credential should be deemed invalid based upon passage of time.

16. The computer-implemented authentication system of claim 9 wherein the credit or debit card account number comprises an issuer identifier portion and the first transaction specific authentication credential value includes the issuer identifier portion of the account number associated with the designated account identifier.