System and Method for Secure Transactions Manageable by a Transaction Account Provider

• US 20090125446A1
• Filed: 01/15/2009
• Published: 05/14/2009
• Est. Priority Date: 07/10/2001
• Status: Active Grant

• Current Assignee: Liberty Peak Ventures, LLC (Dominion Harbor Enterprises, LLC)
• Original Assignee: American Express Travel Related Services Company, Inc. (American Express Company)
• Inventors: Saunders, Peter D., Barnes, Brian T.
• Granted Patent: US 8,418,918 B2
• Time in Patent Office: Days
• US Class Current: 705/67
• CPC Class Codes: G06F 18/00 Pattern recognition
• CPC Class Codes: G06Q 20/00 Payment architectures, schemes or protocols apparatus for performing or posting payment transactions G07F7/08, G07F19/00; electronic cash registers G07G1/12
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/14 specially adapted for billing systems
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/327 Short range or proximity payments by means of M-devices
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/388 using mutual authentication without cards, e.g. challenge-response
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G06V 40/14 Vascular patterns
• CPC Class Codes: G06V 40/40 Spoof detection, e.g. liveness detection
• CPC Class Codes: G07C 9/257 electronically G07C9/26 takes precedence
• CPC Class Codes: G07C 9/28 the pass enabling tracking or indicating presence
• CPC Class Codes: G07C 9/29 the pass containing active electronic elements, e.g. smartcards
• CPC Class Codes: G07G 1/14 Systems including one or more distant stations co-operating with a central processing unit data transmission in general H04L; telemetry systems for selectively calling a substation from a main station H04Q9/00

Abstract

A system and method for securing a financial transaction using a proxy code, which is assigned a transaction account number. An account issuer permanently assigns the proxy code to a transaction account correlated to the transaction device. The proxy code is uploaded onto the transaction device for later use in completing a transaction request. During transaction completion, the proxy code is provided to a merchant system in lieu of any sensitive account information. Since the proxy code is permanently assigned, the number need not be changed or updated on the merchant system once uploaded into a payment device or merchant database. The account issuer may manipulate the sensitive account information without need to alter the information stored on the merchant database. Since the proxy code contains no sensitive information, the sensitive information related to the transaction account is secured from theft.

Claims

1. A method for securely completing a transaction, comprising:

receiving a proxy code from a transaction device, wherein said transaction device generates said proxy code;

associating said proxy code to a transaction account code, wherein said proxy code is provided to a merchant system for transaction completion, wherein said proxy code is absent of sensitive information, and includes a similar format as said transaction account code, wherein said transaction account and user personal information include sensitive information;

receiving from said merchant system a transaction request, said transaction request including said proxy code;

locating said transaction account code associated with said proxy code;

locating said transaction account using said transaction account code; and

processing said transaction request in accordance with said transaction account.

2. The method of claim 1, further comprising assigning said transaction account to a user according to said user personal information.

3. The method of claim 1, further comprising assigning said transaction account code to said transaction account.

4. The method of claim 1, further comprising associating said proxy code to said sensitive information stored in a database.

5. The method of claim 1, further comprising holding said proxy code fixed and altering said sensitive information to form altered sensitive information, and associating said altered sensitive information to said proxy code in said database.

6. The method of claim 1, further comprising issuing said proxy code via a network authorization message containing said proxy code.

7. The method of claim 1, wherein said locating said transaction account code includes generating said transaction account code from said proxy code.

8. The method of claim 1, further comprising associating said proxy code with a secondary form of identification for use in validating said proxy code.

9. The method of claim 1, further comprising providing said proxy code to said transaction device, wherein said transaction device is presented to said merchant system for transaction completion.

10. The method of claim 9, wherein said proxy code is presented to said merchant system in an ISO 7816 magnetic stripe compatible format.

11. The method of claim 9, wherein said transaction device is operable to present said proxy code to said merchant system in a contactless environment.

12. The method of claim 9, wherein said transaction device is operable to present said proxy code to said merchant system via radio frequency identification (RFID) technology.

13. The method of claim 1, wherein said transaction device is configured to interface with a transponder/reader system comprising:

a Radio Frequency Identification (RFID) reader configured to provide a first radio frequency (RF) interrogation signal for powering a transponder system, to receive a transponder system RF signal, and to communicate transponder system account data related to said transponder system RF signal to a merchant system, said RFID reader including, a first interrogator for providing said first RF interrogation signal;

an RFID reader authentication circuit in communication with said first interrogator for authenticating said transponder system RF signal;

an RFID reader database for storing RFID reader data, said RFID reader database in communication with said RFID reader authentication circuit;

an RFID reader protocol/sequence controller in communication with at least one of said first interrogator, said RFID reader authentication circuit, and said RFID reader database, said RFID reader protocol/sequence controller configured to facilitate control of an order of operation of said first interrogator, said RFID reader authentication circuit, and said RFID reader database;

an RFID reader communications interface configured to communicate with said merchant system, said RFID reader communications interface configured to provide said transponder system account data, wherein said transponder system is configured to receive said first RF interrogation signal, to authenticate said first RF interrogation signal, and to transmit said transponder system account data, said transponder system further comprising;

a first transponder responsive to said first RF interrogation signal;

a transponder system authentication circuit in communication with said first transponder, said transponder system authentication circuit configured to authenticate said first RF interrogation signal;

a transponder system database for storing said transponder system account data, said transponder system database in communication with said transponder system authentication circuit; and

a transponder system protocol/sequence controller in communication with at least one of said first transponder, said transponder system authentication circuit, and said transponder system database, said transponder system protocol/sequence controller configured to control the order of operation of said first transponder, said transponder system authentication circuit, and said transponder system database, wherein said transponder system protocol/sequence controller is configured to activate said transponder system authentication circuit in response to said first RF interrogation signal having an RFID reader authentication code, said transponder system authentication circuit configured to encrypt said RFID reader authentication code to provide an encrypted RFID reader authentication code, said transponder system authentication circuit configured to provide said encrypted RFID reader authentication code to said first transponder for providing to said RFID reader, wherein said RFID reader is configured to receive said encrypted RFID reader authentication code, and wherein said RFID reader protocol/sequence controller is configured to activate said RFID reader authentication circuit in response to said encrypted RFID reader authentication code, wherein said RFID reader database is configured to provide a transponder system decryption security key to said RFID reader authentication circuit in response to said encrypted RFID reader authentication code, said transponder system decryption security key for use in decrypting said encrypted RFID reader authentication code to form a decrypted RFID reader authentication code, said transponder system decryption security key provided to said RFID reader based on an unique transponder identification code, wherein said RFID reader authentication circuit is configured to compare said decrypted RFID reader authentication code and said RFID reader authentication code to determine whether a match exists, and wherein said RFID reader protocol/sequence controller is configured to activate said RFID reader communications interface where said RFID reader authentication circuit matches said decrypted RFID reader authentication code and said RFID reader authentication code.

14. A system for securely completing a transaction, said system configured to:

receive a proxy code from a transaction device, wherein said transaction device generates said proxy code;

associate said proxy code to a transaction account code, wherein said proxy code is provided to a merchant system for transaction completion, wherein said proxy code is absent of sensitive information, and includes a similar format as said transaction account code, wherein said transaction account and user personal information include sensitive information;

receive from said merchant system a transaction request, said transaction request including said proxy code;

locate said transaction account code associated with said proxy code;

locate said transaction account using said transaction account code; and

process said transaction request in accordance with said transaction account.

15. A computer-readable storage medium containing a set of instructions for a general-purpose computer comprising:

instructions to receive a proxy code from a transaction device, wherein said transaction device generates said proxy code;

instructions to associate said proxy code to a transaction account code, wherein said proxy code is provided to a merchant system for transaction completion, wherein said proxy code is absent of sensitive information, and includes a similar format as said transaction account code, wherein said transaction account and user personal information include sensitive information;

instructions to receive from said merchant system a transaction request, said transaction request including said proxy code;

instructions to locate said transaction account code associated with said proxy code;

instructions to locate said transaction account using said transaction account code; and

instructions to process said transaction request in accordance with said transaction account.