METHODS AND APPARATUS FOR A SECURE PROXIMITY INTEGRATED CIRCUIT CARD TRANSACTIONS

• US 20050033688A1
• Filed: 07/23/2004
• Published: 02/10/2005
• Est. Priority Date: 07/09/2002
• Status: Active Grant

• Current Assignee: Liberty Peak Ventures, LLC (Dominion Harbor Enterprises, LLC)
• Original Assignee: American Express Travel Related Services Company, Inc. (American Express Company)
• Inventors: Saunders, Peter D., Peart, Lee J.
• Granted Patent: US 7,587,756 B2
• Time in Patent Office: Days
• US Class Current: 705/39
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/10 specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
• CPC Class Codes: G06Q 20/14 specially adapted for billing systems
• CPC Class Codes: G06Q 20/18 involving self-service terminals [SST], vending machines, kiosks or multimedia terminals
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/327 Short range or proximity payments by means of M-devices
• CPC Class Codes: G06Q 20/352 Contactless payments by cards
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G07F 7/127 in which both online and offline card verification can take place

Abstract

Methods and apparatus for a smartcard system are provided which securely and conveniently provides for secure transaction completion in a contact or contactless environment. The invention utilizes selection of processing applications based on the account issuer parameters and risk factors (stored on a smartcard) and merchant system parameters and risk factors (stored on a merchant system database). The invention permits a merchant system and smartcard to exchange information useful for determining if particular transactions should be completed online or offline.

Claims

1. A method for securing a transaction initiated with a proximity integrated circuit (PIC) transaction device comprising:

a. selecting an application data with the highest priority from amongst the plurality of applications stored on a PIC transaction device database, the selected application data being supported by the PIC transaction device and a PIC transaction device reader, the application data including a list of process functions to perform and a list of transaction issuer predetermined transaction processing rules;

b. authenticating the PIC transaction device using Offline Data Authentication (ODA);

c. determining multiple merchant risk management factors using at least one of the plurality of application data;

d. determining multiple issuer risk management factors using at least one of the plurality of application data; and

e. determining the transaction disposition of a transaction request, the transaction request disposition detailing whether to process a transaction for authorization offline, authorization online, no authorization offline, the determination the transaction request disposition being performed by analyzing at least one of the results of ODA, the list of transaction issuer predetermined transaction processing rules, the merchant risk management factors, and a set of merchant predetermined transaction processing rules.

2. A method of claim 1, comprising authenticating the plurality of PIC application data offline.

3. A method of claim 1, comprising authorizing the transaction request online.

4. A method of claim 1, comprising authorizing the transaction request offline.

5. A method of claim 4, comprising authenticating the transaction device issuer online.

6. A method of claim 5, comprising authorizing the transaction request by requesting a second application data from the plurality of application data.

7. A method of claim 5, comprising receiving a response to a request for transaction device issuer authentication online, using the response to the request for authorization of the transaction device issuer to determine the disposition of the transaction request.

8. A method for authorizing a transaction initiated with a proximity integrated circuit (PIC) transaction device comprising:

a. receiving at a merchant system a plurality of application data from the PIC transaction device;

b. selecting a transaction processing application from the plurality of application data by the merchant system, the transaction processing application being supported by the PIC transaction device and the merchant system;

c. receiving at the merchant system of a list of functions from the PIC transaction device, the list of functions being supported by the merchant system and the PIC transaction device, the list of functions corresponding to the transaction processing application supported by the PIC transaction device and the merchant system;

d. receiving at a merchant system a dataset for use with processing the list of functions, the dataset being provided by the PIC transaction device;

e. authenticating the PIC transaction device at the merchant system, the merchant system authenticating the PIC transaction device offline;

f. authenticating of a merchant transaction request at the merchant system, the merchant system producing an first offline authentication result t in accordance with merchant risk management analysis;

g. receiving at the merchant system a list of PIC transaction device management rules from the PIC transaction device;

h. determining a first disposition of a transaction request at the merchant system, the determination of the disposition of the transaction request being done in accordance with an analysis by the merchant system of the first offline authentication result, the merchant risk management analysis, PIC transaction device management rules, and a result of a merchant risk management analysis, the transaction request being one of an action to approve the transaction request offline, seeking approving for the transaction request online, declining the transaction request offline; and

i. receiving of a first cryptogram application at the merchant system, the first cryptogram application being received in response to a 1st application request provided from the merchant system to the PIC transaction device, the first cryptogram being one of a transaction certificate (TC) to indicate that the transaction request may be completed online, an application request cryptogram (ARQC) to indicate that the transaction is to be completed online, an application authentication cryptogram (AAC) to indicate that the transaction request is to be declined.

9. A method of claim 8, comprising transmitting of the first cryptogram application, a portion of a dataset used to generate the first cryptogram, and the first offline authentication result to a PIC transaction device issuer for online authorization.

10. A method of claim 9, comprising validating the first cryptogram to authenticate the PIC transaction device at a PIC transaction device issuer, the PIC transaction device issuer providing an issuer authorization response to the merchant system.

11. A method of claim 10, comprising authorizing the transaction request in accordance with the issuer authorization response.

12. A method according to claim 9, comprising authorizing the transaction request at the merchant system when the cryptogram is not authenticated by a PIC transaction device issuer.

13. A method of claim 12, comprising receiving a second cryptogram application at the merchant system, the second cryptogram application being provided by the PIC transaction device in response to a second cryptogram application request from the merchant system.

14. A method of claim 13, comprising authorizing a transaction by the merchant system when no second cryptogram application is received.

15. A system for securing a transaction initiated with a proximity integrated circuit (PIC) transaction device, comprising:

a. a PIC transaction device including a PIC transaction device database, the database storing a plurality of cryptogram applications, a plurality of issuer predetermine transaction processing rules, a issuer defined dataset for use in performing an issuer defined risk management analysis, and plurality of transaction disposition cryptograms; and

b. a merchant system in communication with the PIC transaction device, the merchant system comprising a merchant system database, the merchant system database storing a merchant system risk management application, a command dataset for use in communicating with said PIC transaction device and a PIC transaction device issuer.

16. A system of claim 15, wherein said PIC transaction device is operable to provide said plurality of cryptogram applications, said plurality of issuer predetermine transaction processing rules, said issuer defined dataset for use in performing an issuer defined risk management analysis, and said plurality of transaction disposition cryptograms in response to said command dataset.

17. A system of claim 15, wherein said merchant system is operable to generate a merchant transaction disposition in accordance with a merchant risk management analysis performed by said merchant risk management application.

18. A system of claim 17, wherein said merchant system is operable to authenticate said PIC transaction device in response to receipt of at least one of said PIC transaction device cryptogram applications, said plurality of issuer predetermine transaction processing rules, said issuer defined dataset for use in performing an issuer defined risk management analysis, and said plurality of transaction disposition cryptograms, and said merchant risk management analysis.

19. A system of claim 18, wherein said merchant system is operable to authorize said transaction request in response to receipt of at least one of said PIC transaction device cryptogram applications, said plurality of issuer predetermine transaction processing rules, said issuer defined dataset for use in performing an issuer defined risk management analysis, an issuer provided authentication cryptogram, and said plurality of transaction disposition cryptograms, and said merchant risk management analysis.

20. A system of claim 18, wherein said wherein said merchant system is operable to authorize said transaction request in response to receipt of at least one of said PIC transaction device cryptogram applications, said plurality of issuer predetermine transaction processing rules, said issuer defined dataset for use in performing an issuer defined risk management analysis, and said plurality of transaction disposition cryptograms, and said merchant risk management analysis, and a second transaction device cryptogram application.