Method and system for performing two factor mutual authentication

• US 20070037552A1
• Filed: 08/11/2005
• Published: 02/15/2007
• Est. Priority Date: 08/11/2005
• Status: Abandoned Application

• Current Assignee: Visa International Service Association (Visa, Inc.)
• Original Assignee: Visa International Service Association (Visa, Inc.)
• Inventors: Aabye, Christian, Fisher, Douglas, Lee, Timothy
• Application Number:
  US11/201,554
• Publication Number:
  US 20070037552A1
• Time in Patent Office: Days
• US Class Current: 455/410
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/10 specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
• CPC Class Codes: G06Q 20/12 specially adapted for electronic shopping systems
• CPC Class Codes: G06Q 20/388 using mutual authentication without cards, e.g. challenge-response
• CPC Class Codes: H04M 3/16 with lock-out or secrecy provision in party-line systems

Abstract

A method and system for performing a secure transaction are disclosed. A service provider system may receive an account identifier and a one-time passcode from a user system via a communication network. The service provider system may determine whether the one-time passcode is valid. If the one-time passcode is valid, the service provider system may transmit a personal assurance message to the user system via the communication network. If the personal assurance message is verified, the service provider may receive a password from the user system via the communication network and determine whether the password is valid. If the password is valid, the user system and the service provider system may then perform a secure transaction.

Claims

1. A method for performing a secure transaction over a communication network, the method comprising:

receiving an account identifier and a one-time passcode from a user system via a communication network;

determining whether the one-time passcode is valid;

if the one-time passcode is valid, transmitting a personal assurance message to the user system via the communication network;

receiving a password from the user system via the communication network;

determining whether the password is valid; and

if the password is valid, performing a secure transaction.

2. The method of claim 1 wherein the account identifier comprises one or more of the following:

a credit card account number;

a name of a credit card account holder;

a debit card account number;

a name of a debit card account holder;

a bank account number;

a name of a bank account holder;

a brokerage account number;

a name of a brokerage account holder;

an insurance policy number; and

a name of an insurance policy holder.

3. The method of claim 1 wherein the account identifier comprises an alphanumeric identifier.

4. The method of claim 1 wherein the one-time passcode comprises a passcode generated based on at least a timestamp.

5. The method of claim 1 wherein the one-time passcode comprises a passcode generated based on at least a number of transactions that have previously been successfully completed using the financial account identifier.

6. The method of claim 1 wherein the one-time passcode comprises a passcode generated based on an algorithm designated prior to issuing the financial account identifier to a user.

7. The method of claim 1 wherein the one-time passcode comprises a passcode that is recomputed on a periodic basis.

8. The method of claim 1 wherein the one-time passcode comprises an alphanumeric identifier.

9. The method of claim 1 wherein the communication network comprises the Internet.

10. The method of claim 1 wherein determining whether the one-time passcode is valid comprises comparing the one-time passcode to a local passcode corresponding to the account identifier.

11. The method of claim 1 wherein the personal assurance message corresponds to the account identifier.

12. The method of claim 1 wherein determining whether the password is valid comprises comparing the password to a local password corresponding to the account identifier.

13. A system for performing a secure transaction, the system comprising:

a user system;

a communication network in operable communication with the user system; and

a service provider system in operable communication with the communication network,

wherein;

the user system transmits an account identifier and a one-time passcode to the service provider system via the communication network,

the service provider system determines whether the one-time passcode is valid,

if valid, the service provider system transmits a personal assurance message to the user system via the communication network,

the user system determines whether the personal assurance message is valid,

if valid, the user system transmits a password to the service provider system via the communication network,

the service provider system determines whether the password is valid, and

if valid, the user system and the service provider system perform a transaction via the communication network.

14. The system of claim 13 wherein the communication network comprises the Internet.

15. The system of claim 13 wherein determining whether the one-time passcode is valid comprises comparing the one-time passcode to a local passcode corresponding to the account identifier.

16. The system of claim 13 wherein determining whether the personal assurance message is valid comprises presenting the personal assurance message to a user of the user system.

17. The system of claim 13 wherein the personal assurance message corresponds to the account identifier.

18. The system of claim 13, further comprising:

a one-time passcode generator, wherein the one-time passcode generator generates the one-time passcode, and wherein the user system receives the one-time passcode.

19. The system of claim 18 wherein the one-time passcode generator comprises one or more of:

a screen for displaying the one-time passcode; and

a speaker for announcing the one-time passcode.

20. The system of claim 18 wherein the one-time passcode generator is in operable communication with the user system.