Security in use of bankcards that protects bankcard data from merchant systems in a payment card system

• US 20080147564A1
• Filed: 02/01/2008
• Published: 06/19/2008
• Est. Priority Date: 06/26/2001
• Status: Abandoned Application

• Current Assignee: Internet Promise Group LLC
• Original Assignee: Internet Promise Group LLC
• Inventors: Singhal, Tara Chand
• Application Number:
  US12/012,345
• Publication Number:
  US 20080147564A1
• Time in Patent Office: Days
• US Class Current: 705/67
• CPC Class Codes: G06K 19/00 Record carriers for use with machines and with at least a part designed to carry digital markings
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/24 Credit schemes, i.e. "pay after"
• CPC Class Codes: G06Q 20/342 Cards defining paid or billed services or quantities
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G07F 7/025 by means, e.g. cards, providing billing information at the time of purchase, e.g. identification of seller or purchaser, quantity of goods delivered or to be delivered

Abstract

A method and apparatus for security that protects bankcard data from merchant systems and uses a payment card (30) and payment system (12) that can be used by a customer (20) to perform a transaction with a merchant (22) using an existing bankcard (31) of the customer (20). In some of the embodiments, the payment card (30) provides a level of security to the customer (20) because the payment card (30) does not identify the customer (20) by name. Further, the card number and/or expiration date of the bankcard (31) is not disclosed to the merchant (22).

Claims

1. A payment system that protects private data of customer from potential theft from merchant and merchant systems in payment transactions, comprising:

a wireless point-of-sale (WPOS) merchant terminal with a wireless interface to a third party payment system, bypassing the merchant system, for processing of a payment transaction originating from the WPOS.

2. The system as in claim 1, comprising:

a. the WPOS is portable and thus movable to be close to a customer when using the WPOS by the customer;

b. the WPOS has card reader mechanism, a keypad, a display screen, and foldable privacy shields around the keypad and the display screen for receiving customer payment card data;

c. the WPOS has temporary memory means for temporarily holding payment authorization data record and payment approval data record.

3. The system as in claim 1, comprising:

the WPOS is portable and movable and has a docking station with a wire line interface to the merchant system for receiving merchant id data and a payment amount for a specific transaction and for transfer of payment approval data to the merchant system.

4. The system as in claim 1, comprising:

the WPOS terminal provides a secure wireless connection for transfer of a payment authorization transaction record directly to the payment system and receive payment approval data, the payment system having received it from a merchant gateway, the gateway having received it from card authorization network.

5. The system as in claim 1, comprising:

the WPOS has a means for receiving merchant id data and a payment amount for a specific transaction.

6. The system as in claim 5, further comprising:

the WPOS receives a customer identifier that is without a name and bankcard data, from a payment card and a card specific PIN from the card owner at the time of payment transaction, combines that with the merchant id data, the payment amount and a transaction identifier and encrypts the record before wirelessly transmitting to the payment system.

7. A merchant point-of-sale terminal that protects customer identity data from potential theft, comprising:

a. a wireless point-of-sale (WPOS) terminal that protects customer identity data from potential theft, by providing a secure wireless connection for the transfer of a payment authorization transaction record directly to a payment system that is not a merchant system and receive payment approval data, the payment system having received it from a prior card authorization network;

b. the WPOS has a wire line merchant interface for receiving merchant id data and a payment amount for a specific transaction and for transfer of the payment approval data to the merchant system.

8. A payment security system that protects customer identity data from theft in merchant systems, comprising:

a. a server capable of high volume storage and database searches;

b. the server maintains a database having a permanent customer-identifier for a customer and tied to this customer identifier, at least two bankcard accounts data of the customer and for each bankcard account, a customer selected card specific personal identification number (CPIN);

c. the system receives a data record from a merchant point of sale (POS) for a payment transaction, where a payment card is swiped and a specific CPIN entered by the customer in the point of sale, the record having an encrypted customer-identifier from the card and the entered CPIN;

d. the payment system decrypts the customer identifier and identifies and verifies the customer in the database and retrieves the specific bankcard data of the customer that is identified by the CPIN, and submits a payment transaction record to a prior art card processor network, thereby the payment system enables a customer to carry this one payment card only and use it in lieu of his one or the other bankcard in the payment system, and protect customer identity data from potential theft in merchant systems.

9. The payment security system as in claim 8, further comprising:

a. a logic for storing bankcard data that transforms the original bankcard number data string into a transformed data string, the transformed data string having format attributes making it indistinguishable from the original data string, wherein the transforming means include (i) parsing the bankcard number into its parts of bank identification number, card number and expiration date, (ii) having a table A of bank identification numbers and a table B of expiration dates, (iii) looking up the bank identification number location in the table A, applying a random number (RN1) to the location, using the new location looking up a transformed bank identification number, (iv) applying a random number (RN3) to the card number to get transformed card number, (v) looking up the expire date location in the table B, applying a random number (RN2) to the location, using new location looking up a transformed date, (vi) composing a transformed bankcard number made from transformed bank identification number, transformed card number and transformed expiration date;

b. the logic saves the transformed bankcard number and the transform sequence of RN1, RN2, and RN3 in data storage by a reference number.

10. The payment security system as in 9, comprising:

the logic stores the transform sequence in separate data storage means than the transformed bankcard number.

11. The payment security system as in claim 10, comprising:

the logic on being supplied the reference number, reads the transformed bankcard number and transform sequence, and performing reverse steps to assemble the original bankcard number.