DEVICE, SYSTEM AND METHOD FOR REDUCING AN INTERACTION TIME FOR A CONTACTLESS TRANSACTION

• US 20070118483A1
• Filed: 09/28/2006
• Published: 05/24/2007
• Est. Priority Date: 09/28/2005
• Status: Active Grant

• Current Assignee: Visa International Service Association (Visa, Inc.)
• Original Assignee: Visa International Service Association (Visa, Inc.)
• Inventors: Aabye, Christian, Sahota, Jagdeep, Hill, Trudy, Oppenlander, Carole, Wagner, Kim, Ochieano, Anita, Chan, William, Glendenning, Craig
• Granted Patent: US 7,798,394 B2
• Time in Patent Office: Days
• US Class Current: 705/64
• CPC Class Codes: G06K 7/0008 General problems related to the reading of electronic memory record carriers, independent of its reading method, e.g. power transfer
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/352 Contactless payments by cards
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/38215 Use of certificates or encrypted proofs of transaction rights
• CPC Class Codes: G06Q 20/3825 Use of electronic signatures
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G06Q 20/409 Device specific authentication in transaction processing
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: G07F 7/0826 Embedded security module
• CPC Class Codes: G07F 7/088 the card reader being part of the point of sale [POS] terminal or electronic cash register [ECR] itself
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: G07F 7/1016 Devices or methods for securing the PIN and other transaction-data, e.g. by encryption arrangements for secret communication, see H04L9/00

Abstract

A method. The method comprises, at a reader, performing at least one transaction-based risk management process prior to energizing a contactless interface, initiating communication with a card utilized for the contactless transaction, receiving information associated with the card, and terminating communication with the card to authorizing the contactless transaction.

Claims

1. A reader, comprising:

a contactless interface; and

a transaction module coupled to the contactless interface, wherein the transaction module is structured and arranged to process a contactless transaction with less than one-half second of interaction time between a card and the reader.

2. The reader of claim 1, wherein the transaction mode is structured and arranged to perform static data authentication.

3. The reader of claim 1, wherein the transaction mode is structured and arranged to perform dynamic data authentication.

4. The reader of claim 1, wherein the reader further comprises a security module coupled to the transaction module, wherein the security module is structured and arranged to prevent a man in the middle attack on the contactless transaction.

5. A card, comprising:

a transaction module structured and arranged for wireless communication, wherein the card is structured and arranged to operate in a chip-mode and a magnetic stripe data mode.

6. The card of claim 5, wherein the transaction module is further structured and arranged to cooperate with a reader to execute a contactless transaction with less than one-half second of interaction time between the card and the reader.

7. The card of claim 6, wherein the card further comprises a security module structured and arranged to cooperate with the a reader to prevent a man in the middle attack on a contactless transaction.

8. A system, comprising:

a reader, comprising;

a contactless interface; and

a transaction module coupled to the contactless interface; and

a card structured and arranged to communicate with the reader via the contactless interface, wherein the transaction module is structured and arranged to process a contactless transaction with less than one-half second of interaction time between a card and the reader.

9. The system of claim 8, wherein the reader further comprises a security module coupled to the transaction module, wherein the security module is structured and arranged to prevent a man in the middle attack on the contactless transaction.

10. The system of claim 8, wherein the card comprises a transaction module structured and arranged to cooperate with the reader to execute the contactless transaction.

11. The system of claim 10, wherein the card further comprises a security module structured and arranged to cooperate with the reader to prevent a man in the middle attack on the contactless transaction.

12. The system of claim 8, further comprising a network coupled to the reader.

13. The system of claim 12, wherein the network is further coupled to an issuer.

14. A method for reducing an interaction time for a contactless transaction, the method comprising:

at a reader;

performing at least one transaction-based risk management process prior to energizing a contactless interface;

initiating communication with a card utilized for the contactless transaction;

receiving information associated with the card; and

terminating communication with the card prior to authorizing the contactless transaction.

15. The method of claim 14, wherein the interaction time is between the card and the reader.

16. The method of claim 14, wherein performing the at least one transaction-based risk process comprises comparing a transaction amount to a predetermined value.

17. The method of claim 14, wherein receiving information associated with the card comprises receiving information associated with at least one application supported by the card.

18. The method of claim 14, wherein receiving information associated with the card comprises receiving at least one of the following:

a cryptogram; and

a dynamic signature.

19. The method of claim 14, wherein terminating communication with the card comprises terminating communication with the card prior to performing an online authorization.

20. The method of claim 14, wherein terminating communication with the card comprises terminating communication with the card prior to performing an offline authorization.

21. The method of claim 14 further comprising completing the contactless transaction with less than one-half second of interaction between the card and the reader.

22. The method of claim 19, further comprising:

receiving a request for a second contactless transaction;

re-establishing communication with the card; and

completing the second contactless transaction with less than one-half second of interaction between the card and the reader.

23. The method of claim 22, wherein receiving the request comprises receiving a request for a non-financial transaction.

24. The method of claim 22, wherein completing the second transaction comprises transmitting a message which changes at least one card risk parameter.

25. The method of claim 22, wherein completing the second transaction comprises transmitting a message which changes at least one card counter.

26. The method of claim 22, wherein completing the second transaction comprises transmitting a message which changes at least one card status.

27. A method for preventing a man in the middle attack on a contactless transaction, the method comprising:

receiving a dynamic signature that comprises and application transaction counter, a terminal unpredictable number, a transaction amount, a transaction currency code, and a card unpredictable number;

receiving a card unpredictable number;

recalculating the dynamic signature utilizing the card unpredictable number; and

authorizing the contactless transaction offline if the dynamic signature is validated.

28. The method of claim 27 further comprising:

receiving a cryptogram that comprises an application transaction counter, a transaction amount, and a terminal unpredictable number; and

requesting the transaction be processed online with the cryptogram if the dynamic signature is not validated.

29. The method of claim 27, further comprising completing the contactless transaction with less than one-half second of interaction between the card and the reader.