METHOD AND SYSTEM FOR CONDUCTING SECURE PAYMENTS OVER A COMPUTER NETWORK

• US 20080065554A1
• Filed: 11/20/2007
• Published: 03/13/2008
• Est. Priority Date: 04/11/2000
• Status: Abandoned Application

• Current Assignee: Carl Campbell, Edward Hogan
• Original Assignee: Carl Campbell, Edward Hogan
• Inventors: Hogan, Edward, Campbell, Carl
• Application Number:
  US11/943,062
• Publication Number:
  US 20080065554A1
• Time in Patent Office: Days
• US Class Current: 705/64
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/102 Bill distribution or payments
• CPC Class Codes: G06Q 20/14 specially adapted for billing systems
• CPC Class Codes: G06Q 20/24 Credit schemes, i.e. "pay after"
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/3823 combining multiple encryption tools for a transaction
• CPC Class Codes: G06Q 20/3825 Use of electronic signatures
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G06Q 20/403 Solvency checks
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: G07F 7/08 by coded identity card or credit card or other personal identification means without personal verification means G07F7/02
• CPC Class Codes: G07F 7/12 Card verification
• CPC Class Codes: G07F 7/122 Online card verification

Abstract

A method is provided for conducting a financial transaction by a purchaser with a merchant having an acquirer bank, over a communications network. The method includes the steps of sending a first authorization request using a pseudo account number associated with a real account number to a service provider which forwards a second authorization request to the issuer using the real account number and preferably a pseudo acquirer code associated with the service provider such that the response to the second request is based on the real account number and sent back to the service provider who preferably forwards a response to the first request preferably to the “real” acquirer. A message authentication code is further provided which includes transaction data, and where the authorization request is formatted as a standard payment card track having one or more fields including a discretionary field in which the message authentication code is placed.

Claims

1. A method of conducting a transaction involving a merchant over an electronic payment network, the method comprising:

receiving data related to the transaction from the merchant;

computing a message authentication code based on the data related to the transaction;

placing the message authentication code in a portion of the discretionary data field of a standard payment card magnetic stripe track format to form a track image; and

transmitting the track image including the message authentication code, over the payment network, before or without first storing the message authentication code on a magnetic stripe of a payment card.

2. The method of claim 1, wherein computing a message authentication code results in binary data, further comprising truncating and converting the message authentication code to decimal digits.

3. The method of claim 1, wherein computing a message authentication code is further based on a transaction sequence number.

4. The method of claim 3, further comprising inserting at least a portion of the transaction sequence number in a portion of the discretionary data field of the track image, and wherein transmitting the track image further includes transmitting at least the portion of the transaction sequence number over the payment network.

5. The method of claim 4, further comprising inserting a payment account number in a payment account number field of the standard payment card magnetic stripe track format image, wherein transmitting the track image further includes transmitting the payment account number over the payment network.

6. The method of claim 5, further comprising providing a card-unique secret key calculated using at least a derivation key and the payment account number, wherein computing the message authentication code comprises applying the card-unique secret key to the transaction sequence number and the data related to the transaction to compute the message authentication code.

7. An apparatus for conducting a transaction involving a cardholder and merchant having a merchant device over an electronic payment network, the apparatus comprising:

a cardholder memory device containing at least a card-unique secret key;

a receiver module capable of receiving data from the merchant device related to the transaction;

a message authentication code calculator coupled to the receiver module and the cardholder memory device for calculating a message authentication code using at least the data related to the transaction received from the merchant device and the secret key;

a track image data formatter coupled to the message authentication code calculator for placing at least a portion of the message authentication code in a portion of the discretionary data field of a track image data formatted as a standard payment card magnetic stripe data track;

a transmitter coupled to the track image data formatter for transmitting the track image data formatted as a standard payment card magnetic stripe data track to the merchant device for subsequent transmission over the payment network before or without first storing the message authentication code on a magnetic stripe of a payment card.

8. The apparatus of claim 7, wherein the message authentication code calculator further includes a decimalization module for truncating and converting the message authentication code to a shortened decimal digit representation.

9. The apparatus of claim 7, wherein the cardholder memory device additionally has a transaction sequence number, and wherein the message authentication code calculator is further configured to compute the message authentication code based on the transaction sequence number.

10. The apparatus of claim 9, wherein the track image data formatter is further configured to insert at least a portion of the transaction sequence number in a portion of the discretionary data field of the track image data formatted as a standard payment card magnetic stripe data track.

11. The apparatus of claim 10, wherein the cardholder memory device additionally stores a payment account number, and wherein the track image data formatter is further configured to insert the payment account number in a payment account number field of the track image data formatted as a standard payment card magnetic stripe data track.

12. The apparatus of claim 10, wherein the message authentication code calculator is configured to compute a message authentication code by applying the card-unique secret key to the transaction sequence number and the data related to the transaction.

13. The apparatus of claim 7, further comprising a processor, wherein the message authentication code calculator and the track image data formatter are implemented within the processor.