CONSUMER AUTHENTICATION SYSTEM AND METHOD

• US 20080005037A1
• Filed: 06/14/2007
• Published: 01/03/2008
• Est. Priority Date: 06/19/2006
• Status: Active Grant

• Current Assignee: Visa USA, Inc. (Visa, Inc.)
• Original Assignee: Visa USA, Inc. (Visa, Inc.)
• Inventors: Faith, Patrick, Hammad, Ayman
• Granted Patent: US 8,135,647 B2
• Time in Patent Office: Days
• US Class Current: 705/67
• CPC Class Codes: G06Q 20/085 involving remote charge determination or related payment systems
• CPC Class Codes: G06Q 20/105 involving programming of a portable memory device, e.g. IC cards, "electronic purses"
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/204 comprising interface for record bearing medium or carrier for electronic funds transfer or payment credit
• CPC Class Codes: G06Q 20/367 involving electronic purses or money safes
• CPC Class Codes: G06Q 20/3672 initialising or reloading thereof
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G06Q 2220/00 Business processing using cryptography
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

A method for authenticating a consumer. The method includes receiving an authorization request message associated with a consumer conducting a transaction with a portable consumer device. A challenge message is sent to the consumer, where the challenge message is dynamic or semi-dynamic. A challenge response message is received from the consumer, and an authorization response message is sent to the consumer. The authorization response message indicates whether or not the transaction is authorized.

Claims

1. A method comprising:

receiving an authorization request message associated with a consumer conducting a transaction with a portable consumer device;

sending a challenge message to the consumer, wherein the challenge message is dynamic or semi-dynamic;

receiving a challenge response message from the consumer; and

sending an authorization response message to the consumer, wherein the authorization response message indicates whether or not the transaction is authorized.

2. The method of claim 1 wherein the portable consumer device is in the form of a card or a mobile phone.

3. The method of claim 1 wherein the challenge message includes a question which is dynamic.

4. The method of claim 1 wherein the challenge question is dynamic, and uses the consumer'"'"'s transaction history to create the challenge question.

5. The method of claim 1 wherein the authorization request message is received at a payment processing network, and wherein the payment processing network sends the challenge message to the consumer, and receives the challenge response message from the consumer, and if the consumer provides a correct challenge response message:

forwarding the authorization request message to an issuer of the portable consumer device; and

receiving the authorization response message from the issuer before sending the authorization response message to the consumer.

6. The method of claim 5 wherein the transaction involves a merchant, and wherein the authorization response message is sent to the consumer via an access device operated by a merchant.

7. The method of claim 5 wherein the transaction involves a merchant, and wherein the authorization response message is sent to the portable consumer device.

8. The method of claim 1 wherein the authorization request message is received at an issuer, and the issuer sends the challenge message to the consumer, and receives the challenge response message from the consumer, and wherein the issuer further analyzes the challenge response message from the consumer to determine if the consumer provides a correct challenge response message before sending the authorization response message to the consumer.

9. The method of claim 1 wherein the challenge message includes a question which is dynamic, and uses the consumer'"'"'s location to create the challenge message.

10. A computer readable medium comprising:

code for performing the method of claim 1.

11. A server computer comprising the computer readable medium of claim 10.

12. A system comprising the server computer of claim 11.

13. A system comprising:

means for receiving an authorization request message associated with a consumer conducting a transaction with a portable consumer device;

means for sending a challenge message to the consumer, wherein the challenge question is dynamic or semi-dynamic;

means for receiving a challenge response message from the consumer; and

means for sending an authorization response message to the consumer, wherein the authorization response message indicates whether or not the transaction is authorized.

14. A method comprising:

initiating an authorization request message, wherein the authorization request message is associated with a consumer conducting a transaction with a portable consumer device and is sent to an issuer associated with the portable consumer device;

receiving a challenge message, wherein the challenge message is dynamic or semi-dynamic;

initiating a challenge response message, wherein the challenge response message is responsive to the challenge message; and

receiving an authorization response message, wherein the authorization response message indicates whether or not the transaction is authorized.

15. The method of claim 14 wherein the authorization request message and the challenge question are initiated by at least one of a merchant who is a party to the transaction or the consumer.

16. A computer readable medium comprising:

code for initiating an authorization request message, wherein the authorization request message is associated with a consumer conducting a transaction with a portable consumer device and is sent to an issuer associated with the portable consumer device;

code for receiving a challenge message, wherein the challenge message is dynamic or semi-dynamic;

code for initiating a challenge response message, wherein the challenge response message is responsive to the challenge message; and

code for receiving an authorization response message, wherein the authorization response message indicates whether or not the transaction is authorized.

17. A phone comprising the computer readable medium of claim 16.

18. A system comprising:

means for initiating an authorization request message, wherein the authorization request message is associated with a consumer conducting a transaction with a portable consumer device and is sent to an issuer associated from the portable consumer device;

means for receiving a challenge message, wherein the challenge message is dynamic or semi-dynamic;

means for initiating a challenge response message, wherein the challenge response message is responsive to the challenge message; and

means for receiving an authorization response message, wherein the authorization response message indicates whether or not the transaction is authorized.

19. An authentication method comprising:

receiving, at an issuer, an authorization request message sent from an access device; and

in response to receipt of the authorization request, providing one or more dynamic challenge questions to the consumer before authorizing a transaction.

20. The authentication method of claim 19 wherein the dynamic challenge questions are generated by the issuer and are related to past transactions conducted by a consumer.

21. A computer readable medium comprising:

code for receiving, at an issuer, an authorization request message sent from an access device; and

code for providing one or more dynamic challenge questions to the consumer before authorizing a transaction conducted by a consumer.

22. A method comprising:

receiving a first authorization request message associated with a consumer conducting a transaction with a portable consumer device;

sending a challenge message to the consumer;

receiving a second authorization request message including a challenge response message; and

sending an authorization response message, wherein the authorization response message indicates whether or not the transaction is authorized.

23. The method of claim 22 wherein the challenge message is sent to a mobile phone operated by the consumer.

24. A computer readable medium comprising code for performing the method of claim 22.

25. A server comprising the computer readable medium of claim 24.

31. The method of claim 22 wherein the challenge message is passive and does not require an active response by the consumer.

26. A method comprising:

sending a first authorization request message associated with a consumer conducting a transaction using a portable wireless device;

receiving a challenge message;

sending a second authorization request message including a challenge response message; and

receiving an authorization response message, wherein the authorization response message indicates whether or not the transaction is authorized.

27. The method of claim 26 wherein the challenge message is received at a mobile phone operated by the consumer and wherein the authorization response message is received an access device, wherein the access device comprises a point of sale terminal.

28. The method of claim 26 wherein the challenge message is a challenge question.

29. A computer readable medium comprising code for performing the method of claim 26.

30. A point of sale device comprising the computer readable medium of claim 29.