One-time credit card number generator and single round-trip authentication

• US 20030080183A1
• Filed: 10/31/2001
• Published: 05/01/2003
• Est. Priority Date: 10/31/2001
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.), Orphangage Incorporated
• Original Assignee: Orphangage Incorporated
• Inventors: Varadarajan, Rammohan, Rajasekaran, Sanguthevar
• Granted Patent: US 6,908,030 B2
• Time in Patent Office: Days
• US Class Current: 235/379
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes

Abstract

An online transaction is effected between a user system, a merchant system and an issuer system. The user system generates a one-time number (OTN) to use as a card number for a transaction with the merchant. The user system generates the OTN as a function of various parameters and sends the OTN to the issuer and to the merchant. With the issuer communication, the user is first authenticated, so the issuer can associate the received OTN with the user even if the user'"'"'s identity cannot be fully discerned from the OTN alone. In authenticating the user with the issuer, and possibly other authentications, the user sends the issuer a signed challenge where the challenge is a sequential challenge or a function of a prior challenge provided by the issuer. The issuer responds with an approval/denial message and, in the latter case, includes the next challenge to be used.

Claims

1. A method of authenticating a client to a server comprising:

generating a challenge at the client;

signing the challenge to form a signed challenge;

sending at least the signed challenge to the server;

verifying the signature of the challenge at the server; and

if the signature is verified, sending an indication of successful authentication to the client.

2. The method of claim 1, wherein generating a challenge at the client comprises generating a random number.

3. The method of claim 1, wherein generating a challenge at the client comprises generating a sequential challenge.

4. The method of claim 1, wherein generating a challenge at the client comprises generating a challenge based on data received from the server in a prior step.

5. The method of claim 4, wherein the data received from the server is a challenge returned with a server response to a prior client query.

6. A method of using a one-time use card number for an online transaction, comprising:

generating a one-time use card number at a user system;

authenticating the user system to an issuer system;

passing the one-time use card number from the user system to the issuer system;

passing the one-time use card number from the user system to a merchant system, wherein the merchant system is programmed to present the one-time use card number to the issuer system to effect a payment;

verifying the one-time use card number received from the merchant system with the one-time use card number received from the user system; and

if the one-time use card number is verified, approving the transaction.

7. The method of claim 6, wherein passing the one-time use card number to the issuer includes passing at least one other data element related to the online transaction.

8. The method of claim 7, wherein the at least one other data element is selected from, or a function of, a user'"'"'s account number, a user'"'"'s private key, a transaction time, a transaction amount, or a merchant ID.