Smartcard authentication and authorization unit attachable to a PDA, computer, cell phone, or the like

• US 20040149827A1
• Filed: 12/30/2003
• Published: 08/05/2004
• Est. Priority Date: 08/09/2002
• Status: Active Grant

• Current Assignee: Patrick Zuili
• Original Assignee: Patrick Zuili
• Inventors: Zuili, Patrick
• Granted Patent: US 7,481,363 B2
• Time in Patent Office: Days
• US Class Current: 235/439
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G07F 7/0886 the card reader being portable for interacting with a POS or ECR in realizing a payment transaction
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system

Abstract

An autonomous and portable smartcard reader device incorporates a high level of embedded security countermeasures. Data transfers are encrypted with two specific input devices, namely a light sensor and PIN or other keyboard entry, and at the output through the use of a dual-tone encoder-decoder. The unit may be used alone or as a plug-in to another device such as a PDA, cell phone, or remote control. The reader may further be coupled to various biometric or plug-in devices to achieve at least five levels of authentication, namely, (1) the smartcard itself; (2) the smartcard reader; (2) the PIN; (3) private-key cryptography (PKI); and (5) the (optional) biometric device. These five levels account for an extremely strong authentication applicable to public networking on public/private computers, and even on TV (satellite, cable, DVD, CD AUDIO, software applications. Transactions including payments may be carried out without any risk of communication tampering, authentication misconduct or identity theft. In essence, the device is a closed box with only two communication ports. The emulation of the device is therefore extremely complex due to the fact that it involves PKI, hardware serialization for communication and software implementation, in conjunction with a specific hardware embodiment and service usage infrastructure component that returns a response necessary for each unique transaction.

Claims

1. A method of authenticating a transaction, comprising the steps of:

connecting a card reader unit to a device having a keypad and display;

initiating a transaction request using the device;

communicating the transaction request to a third party through the device; and

receiving a signal at the device to authenticate the transaction.

2. The method of claim 1, wherein the portable card reader unit is capable of reading a smartcard.

3. The method of claim 1, wherein the portable card reader unit is capable of reading an optical card.

4. The method of claim 1, wherein the device is a personal digital assistant (PDA).

5. The method of claim 1, wherein the device is a telephone.

6. The method of claim 5, wherein the telephone is a cellular telephone.

7. The method of claim 1, wherein the signal used to authenticate the transaction is a high-contrast optical signal.

8. The method of claim 1, wherein the step of communicating the transaction request to a device or third party involves the use of a dual-tone audio signal.

9. The method of claim 8, wherein the signal is a dual-tone, multi-format (DTMF) signal.

10. The method of claim 8, wherein the signal is an audio frequency shift keying (AFSK) signal.

11. The method of claim 8, wherein the signal is a private line (PL) signal.

12. The method of claim 1, wherein the step of initiating a transaction request at the card reader unit includes the entry of a personal identification number (PIN) through the keyboard of the device.

13. The method of claim 12, wherein the operation of the portable card reader unit is terminated if a PIN entry is attempted more than a predetermined number of times.

14. The method of claim 1, wherein:

the card reader unit further includes a biometric input; and

the step of initiating a transaction request at the card reader unit includes the receipt of biometric data through the biometric input.

15. The method of claim 14, wherein the biometric input is a fingerprint.

16. The method of claim 1, wherein the transaction request, authentication signal, or both are encrypted.

17. The method of claim 16, wherein the encryption is based on public-key cryptography.

18. The method of claim 1, wherein:

the card reader or device includes a memory;

the transaction request and authentication signal constitute a session; and

information regarding the session is stored in the memory.