Offline one time credit card numbers for secure e-commerce

• US 20010056409A1
• Filed: 05/15/2001
• Published: 12/27/2001
• Est. Priority Date: 05/15/2000
• Status: Abandoned Application

• Current Assignee: AT&T Corporation (AT&T, Inc.)
• Original Assignee: AT&T Corporation (AT&T, Inc.)
• Inventors: Krishnamurthy, Balachander, Bellovin, Steven Michael, Korn, Jeffrey
• Application Number:
  US09/855,908
• Publication Number:
  US 20010056409A1
• Time in Patent Office: Days
• US Class Current: 705/64
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/3823 combining multiple encryption tools for a transaction
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes

Abstract

It is an object of the invention to reduce the risk of misuse of a user'"'"'s credit card number while avoiding having to securely contact and authenticate with a card-issuer before each transaction. In accordance with an aspect of the invention, the card-holder/user has access to a temporary authorization number generator, which is capable of accepting data from the user, such as the user'"'"'s credit card number, and generating a cryptographically-secure temporary authorization number that is used in lieu of the user'"'"'s credit card number in transactions. The card-issuer need not know the temporary authorization number before receiving the request for authorization from a merchant presented with it during a transaction. The present invention, while not limited to electronic commerce transactions, is especially suited for electronic commerce transactions occurring over a telecommunication network where the user cannot trust the integrity of either the network or the merchant receiving the credit card number.

Claims

1. A method for facilitating credit card transactions, comprising the steps of:

receiving from a merchant, desiring to receive authorization for a transaction with a user having an account with a credit card issuer, a transaction authorization number and information regarding the transaction;

retrieving secret information shared with a transaction authorization number generator utilized by the user; and

verifying the temporary authorization number by using the shared secret information and information regarding the transaction.

2. The invention of

claim 1

wherein the secret information further comprises a credit card number associated with the user.

3. The invention of

claim 1

wherein the secret information is utilized as a cryptographic key to decrypt information regarding the transaction encoded in the temporary authorization number.

4. The invention of

claim 1

wherein the temporary authorization number is a message authentication code generated from the information regarding the transaction using the secret information as a cryptographic key.

5. The invention of

claim 1

wherein the temporary authorization number is a one-time password generated from the shared secret information.

7. The invention of

claim 5

wherein the secret information further comprises a credit card number associated with the user which is also used as the authentication information.

8. The invention of

claim 5

wherein the secret information is utilized as a cryptographic key to decrypt information regarding the transaction encoded in the temporary authorization number.

9. The invention of

claim 5

wherein the temporary authorization number is a message authentication code generated from the information regarding the transaction using the secret information as a cryptographic key.

10. The invention of

claim 5

wherein the temporary authorization number is a one-time password generated from the shared secret information.

11. The invention of

claim 5

wherein the temporary authorization number has a format similar to a credit card number.

13. The invention of

claim 5

wherein the secret information further comprises a credit card number associated with the user which is also used as the authentication information.

14. The invention of

claim 5

wherein the secret information is utilized as a cryptographic key to decrypt information regarding the transaction encoded in the temporary authorization number.

15. The invention of

claim 5

wherein the temporary authorization number is a message authentication code generated from the information regarding the transaction using the secret information as a cryptographic key.

16. The invention of

claim 5

wherein the temporary authorization number is a one-time password generated from the shared secret information.

17. The invention of

claim 5

wherein the temporary authorization number has a format similar to a credit card number.

6. A method for facilitating credit card transactions, comprising the steps of:

receiving authentication information from a user having an account with a credit card issuer; and

generating a temporary authorization number for the user using secret information shared with a credit card issuer whereby the temporary authorization number may be utilized in a transaction and verified by the credit card issuer using the shared secret information and information regarding the transaction.

12. A processor readable medium containing executable program instructions for performing a method on a device comprising the steps of:

receiving authentication information from a user having an account with a credit card issuer; and

generating a temporary authorization number for the user using secret information stored on the device and shared with a credit card issuer whereby the temporary authorization number may be utilized in a transaction and verified by the credit card issuer using the shared secret information and information regarding the transaction.