Dynamic number authentication for credit/debit cards

• US 20020120583A1
• Filed: 01/11/2002
• Published: 08/29/2002
• Est. Priority Date: 01/11/2001
• Status: Active Grant

• Current Assignee: CardinalCommerce Corporation (Visa, Inc.)
• Original Assignee: CardinalCommerce Corporation (Visa, Inc.)
• Inventors: Keresman, Michael A. III, Balasubramanian, Chandra A., Hartridge, Andrew J.
• Granted Patent: US 7,606,771 B2
• Time in Patent Office: Days
• US Class Current: 705/65
• CPC Class Codes: C07D 209/88 with hetero atoms or with carbon atoms having three bonds to hetero atoms with at the most one bond to halogen, e.g. ester or nitrile radicals, directly attached to carbon atoms of the ring system
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/46 by designing passwords or checking the strength of passwords
• CPC Class Codes: G06F 21/77 in smart cards
• CPC Class Codes: G06Q 20/0855 involving a third party
• CPC Class Codes: G06Q 20/105 involving programming of a portable memory device, e.g. IC cards, "electronic purses"
• CPC Class Codes: G06Q 20/3415 Cards acting autonomously as pay-media
• CPC Class Codes: G06Q 20/367 involving electronic purses or money safes
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G06Q 2220/00 Business processing using cryptography
• CPC Class Codes: G06Q 2220/10 Usage protection of distributed data files
• CPC Class Codes: G06Q 2220/145 Specific computer ID, e.g. serial number, configuration
• CPC Class Codes: G06Q 2220/18 Licensing
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key

Abstract

A method and apparatus for conducting a commercial transaction over the Internet or other network connection are provided. The method includes the use of random numbers which are unique for each user session. These random numbers are pre-loaded onto a handheld, portable device, token, at the time of the device'"'"'s manufacture or programming. These numbers are generated by external systems. The external systems then deliver the number sets to the token for storage in the token'"'"'s internal memory and also to another random number database that is accessible by an authentication system. The random numbers are dispensed by the token to a user by pressing a button on the token or otherwise signaling the token. A simple polynomial equation may be employed in order to increase the number of codes. A dispensed number is cross referenced, by the authentication system, to the random number database that was created when the token was programmed. In this way the user or transaction can be authenticated. In its preferred configuration, it is intended that once the total number of random combinations, including the original random numbers and numbers generated by polynomial transformations, have been exhausted, the device becomes inoperable.

Claims

1. A token for conducting commercial transactions comprising:

a power source;

a unique set of predetermined random numbers;

software for selecting and dispensing an unused number from the set of random numbers;

a memory for storing the software and the set of random numbers, wherein the set of random numbers is identical to a set of numbers stored in an external authentication system;

a display device for displaying the dispensed random number; and

,

a plurality of buttons wherein each button is assigned a unique account identifier number representing a type of account for conducting a commercial transaction, wherein each selection of a button causes the software to select and dispense a previously unused number from the set of random numbers and display the dispensed number and the unique account identifier in the display device.

2. The token for conducting commercial transactions according to claim 1 wherein the token becomes inoperable when the unique set of random numbers becomes exhausted.

3. The token for conducting commercial transactions according to claim 1 further including a communications port, wherein the token may be reprogrammed via the communications port with a new set of random numbers by an external system when the unique set of random numbers becomes exhausted.

4. The token for conducting commercial transactions according to claim 1 further including 1 to N predetermined polynomial transformation equations, wherein the 1 to N predetermined polynomial transformation equations operate on each random number to provide 1 to N additional numbers for each of the predetermined random numbers.

5. The token for conducting commercial transactions according to claim 1 further including a magnetic transducer, wherein the software is configured to cause the magnetic transducer to generate magnetic pulses according to the selected button for emulating the conventional magnetic strip of a standard credit/debit card and, wherein the magnetic pulses represent one of the dispensed random number with the unique account identifier and predetermined credit/debit card identification numbers programmed for each of the buttons.

6. The token for conducting commercial transactions according to claim 1 further including a PIN number, wherein the software is configured to request a user to enter the predetermined PIN number each time the token is activated, and wherein the software is configured to not dispense a random number until the correct PIN number has been entered.

7. The token for conducting commercial transactions according to claim 6, wherein the PIN number is entered by selecting the appropriate buttons, and wherein there are sufficient buttons to represent each digit of the PIN number.

8. The token for conducting commercial transactions according to claim 6 further including a keypad, wherein the PIN number is entered by selecting appropriate keys on the keypad.

9. The token for conducting commercial transactions according to claim 1, wherein the power source includes at least one of a battery and a solar cell, and wherein the solar cell may optionally generate sufficient power from interior lighting.

10. A system for conducting commercial transactions comprising:

a power source;

a unique set of predetermined random numbers;

software for selecting and dispensing an unused number from the set of random numbers;

a memory for storing the software and the set of random numbers, wherein the set of random numbers is identical to a set of numbers stored in an external authentication system;

a display device for displaying the dispensed random number;

at least one of a keypad and a keyboard; and

,

a plurality of virtual buttons wherein each virtual button is assigned a unique account identifier number representing a type of account for conducting a commercial transaction, wherein each selection of a virtual button causes the software to select and dispense a previously unused number from the set of random numbers and display the dispensed number and the unique account identifier in the display device, and wherein selection of a virtual button is performed by one of selecting a representation of a button on the display device by means of a pointing device and selecting a key configured to represent a respective virtual button.

11. The system for conducting commercial transactions according to claim 10 further including a communications port, wherein the system may be reprogrammed via the communications port with a new set of random numbers by an external system when the unique set of random numbers becomes exhausted.

12. The system for conducting commercial transactions according to claim 11, wherein the communications port may be connected to at least one of the Internet and a cellular network.

13. The system for conducting commercial transactions according to claim 10 further including 1 to N predetermined polynomial transformation equations, wherein the 1 to N predetermined polynomial transformation equations operate on each random number to provide 1 to N additional numbers for each of the predetermined random numbers.

14. The system for conducting commercial transactions according to claim 10 further including a PIN number, wherein the software is configured to request a user to enter the predetermined PIN number each time the system is activated, and wherein the software is configured to not dispense a random number until the correct PIN number has been entered.

16. The method for conducting commercial transactions according to claim 15, further including the step of resynchronizing the authentication system with the transaction device after at least one dispensed number is not received by the authentication system.

17. The method for conducting commercial transactions according to claim 16, wherein the step of resynchronizing the authentication system with the transaction device includes the steps of:

locating and verifying that the dispensed number exists in the set of unused random numbers stored on the authentication system;

requesting a second number to be dispensed from the transaction device;

comparing the second dispensed number to the number in the authentication set of numbers subsequent to the previously located number; and

,

allowing the resynchronization if the second dispensed number matches the subsequent authentication system number or rejecting the transaction otherwise.

18. The method for conducting commercial transactions according to claim 15 further including reprogramming the transaction device with a new set of random numbers from an external system when the unique set of random numbers becomes exhausted or on request from a user.

19. The method for conducting commercial transactions according to claim 15 further including providing 1 to N additional numbers for each of the predetermined random numbers by means of 1 to N polynomial transformation equations, wherein the 1 to N predetermined polynomial transformation equations operate on each random number to generate 1 to N additional numbers for each random number.

20. The method for conducting commercial transactions according to claim 15 further including providing a PIN number, wherein the software is configured to request a user to enter the predetermined PIN number each time the transaction device is activated, and wherein the software is configured to not dispense a random number until the correct PIN number has been entered.

15. A method for conducting commercial transactions comprising the steps of:

providing an authentication system;

providing a transaction device including;

a power source;

a unique set of predetermined random numbers;

software for selecting and dispensing an unused number from the set of random numbers;

a memory for storing the software and the set of random numbers, wherein the set of random numbers is identical to a set of numbers stored in the external authentication system;

a display device for displaying the dispensed random number; and

,

an account selection means;

selecting via the account selection means a unique account identifier number representing a type of account for conducting a commercial transaction;

invoking the software, for each activation of the selection means, to select and dispense a previously unused number from the set of random numbers and display the dispensed number and the unique account identifier in the display device; and

,

providing the authentication system with the account identifier and the dispensed number, wherein the authentication system;

compares the dispensed number to the next unused number stored on the authentication system; and

,

accepts the transaction if the dispensed number matches the next unused number stored on the authentication system or rejects the transaction if the dispensed number does not match the next unused number stored on the authentication system.

21. A code dispensing device comprising:

storage means for storing a set of codes;

signaling means for signaling the dispensing device to dispense one of the codes from the set upon each activation of the signaling means; and

,

display means for displaying the dispensed codes.

22. The code dispensing device according to claim 21, further comprising:

a power source for powering the dispensing device.

23. The code dispensing device according to claim 22, wherein said power source includes a photo-electric device.

24. The code dispensing device according to claim 21, further comprising:

indicator means for indicating to a user of the dispensing device an amount of undispensed codes remaining in the storage means.

25. The code dispensing device according to claim 21, wherein each code is only dispensed once.