Online payer authentication service

• US 20030212642A1
• Filed: 03/11/2003
• Published: 11/13/2003
• Est. Priority Date: 04/24/2000
• Status: Abandoned Application

• Current Assignee: Visa International Service Association (Visa, Inc.)
• Original Assignee: Visa International Service Association (Visa, Inc.)
• Inventors: Lewis, Tony D., Ryan, Stephen W., Weller, Kevin D., Dominguez, Benedicto H., Bray, Peter, Manessis, Thomas J., Hill, Peter R.
• Application Number:
  US10/384,735
• Publication Number:
  US 20030212642A1
• Time in Patent Office: Days
• US Class Current: 705/67
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: G06Q 20/027 involving a payment switch or gateway
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/0855 involving a third party
• CPC Class Codes: G06Q 20/12 specially adapted for electronic shopping systems
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/355 Personalisation of cards for use
• CPC Class Codes: G06Q 20/367 involving electronic purses or money safes
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: G07F 7/1016 Devices or methods for securing the PIN and other transaction-data, e.g. by encryption arrangements for secret communication, see H04L9/00

Abstract

A payment authentication service authenticates the identity of a payer during online transactions. The authentication service of the present invention allows a card issuer to verify a cardholder'"'"'s identity using a variety of authentication methods, such as the use of passwords. Also, the only system participant requiring a certificate is the issuing financial institution. One embodiment of the invention for authenticating the identity of a cardholder during an online transaction involves querying an access control server to determine if a cardholder is enrolled in the payment authentication service, requests a password from the cardholder, verifies the password, and notifies a merchant whether the cardholder'"'"'s authenticity has been verified. In another aspect of the invention, a chip card and the authentication service independently generate cryptograms that must match in order for the service to verify that the correct chip card is being used by the cardholder.

Claims

1. A method for authenticating the identity of a cardholder during an online transaction comprising:

querying an access control server to determine if said cardholder is enrolled in a payment authentication service;

requesting a password from said cardholder;

verifying said password; and

notifying a merchant of the authenticity of the cardholder if the password entered by said cardholder is verified.

2. A method for authenticating the identity of a cardholder utilizing a chip card comprising:

verifying that said cardholder client device includes a chip card reader;

prompting said cardholder to enter said chip card into said chip card reader;

receiving a chip card cryptogram that was generated by said chip card based upon information in said chip card;

receiving a password entered by said cardholder;

independently generating a second cryptogram based upon information in said chip card;

comparing the chip card cryptogram to the second cryptogram to determine the authenticity of the chip card; and

verifying said password to authenticate the identity of said cardholder.