DYNAMIC NUMBER AUTHENTICATION FOR CREDIT/DEBIT CARDS

• US 20100023453A1
• Filed: 10/08/2009
• Published: 01/28/2010
• Est. Priority Date: 01/11/2001
• Status: Active Grant

• Current Assignee: CardinalCommerce Corporation (Visa, Inc.)
• Original Assignee: CardinalCommerce Corporation (Visa, Inc.)
• Inventors: HARTRIDGE, ANDREW J., BALASUBRAMANIAN, CHANDRA A., KERESMAN, MICHAEL A. III
• Granted Patent: US 10,296,903 B2
• Time in Patent Office: Days
• US Class Current: 705/41
• CPC Class Codes: C07D 209/88 with hetero atoms or with carbon atoms having three bonds to hetero atoms with at the most one bond to halogen, e.g. ester or nitrile radicals, directly attached to carbon atoms of the ring system
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/46 by designing passwords or checking the strength of passwords
• CPC Class Codes: G06F 21/77 in smart cards
• CPC Class Codes: G06Q 20/0855 involving a third party
• CPC Class Codes: G06Q 20/105 involving programming of a portable memory device, e.g. IC cards, "electronic purses"
• CPC Class Codes: G06Q 20/3415 Cards acting autonomously as pay-media
• CPC Class Codes: G06Q 20/367 involving electronic purses or money safes
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G06Q 2220/00 Business processing using cryptography postage metering system using cryptography G06Q2250/05
• CPC Class Codes: G06Q 2220/10 Usage protection of distributed data files
• CPC Class Codes: G06Q 2220/145 Specific computer ID, e.g. serial number, configuration
• CPC Class Codes: G06Q 2220/18 Licensing
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key

Abstract

A method and apparatus for conducting a commercial transaction over the Internet or other network connection are provided. The method includes the use of random numbers which are unique for each user session. These random numbers are pre-loaded onto a handheld, portable device, token, at the time of the device'"'"'s manufacture or programming. These numbers are generated by external systems. The external systems then deliver the number sets to the token for storage in the token'"'"'s internal memory and also to another random number database that is accessible by an authentication system. The random numbers are dispensed by the token to a user by pressing a button on the token or otherwise signaling the token. A simple polynomial equation may be employed in order to increase the number of codes. A dispensed number is cross referenced, by the authentication system, to the random number database that was created when the token was programmed. In this way the user or transaction can be authenticated. In its preferred configuration, it is intended that once the total number of random combinations, including the original random numbers and numbers generated by polynomial transformations, have been exhausted, the device becomes inoperable.

Claims

1. A method for conducting commercial transactions comprising the steps of:

providing an authentication system;

providing a transaction device including;

a power source;

a unique set of predetermined random numbers, said set including at least a plurality of numbers;

software for selecting and dispensing an unused number from the set of random numbers;

a memory for storing the software and the set of random numbers, wherein the set of random numbers is identical to a set of numbers stored in the external authentication system;

a display device for displaying the dispensed random number; and

,

an account selection means;

selecting via the account selection means a unique account identifier number representing a type of account for conducting a commercial transaction;

invoking the software, for each activation of the selection means, to select and dispense a previously unused number from the set of random numbers and display the dispensed number and the unique account identifier in the display device; and

,

providing the authentication system with the account identifier and the dispensed number, wherein the authentication system;

compares the dispensed number to the next unused number stored on the authentication system; and

,

accepts the transaction if the dispensed number matches the next unused number stored on the authentication system or rejects the transaction if the dispensed number does not match the next unused number stored on the authentication system.

2. The method for conducting commercial transactions according to claim 1, further including the step of resynchronizing the authentication system with the transaction device after at least one dispensed number is not received by the authentication system.

3. The method for conducting commercial transactions according to claim 2, wherein the step of resynchronizing the authentication system with the transaction device includes the steps of:

locating and verifying that the dispensed number exists in the set of unused random numbers stored on the authentication system;

requesting a second number to be dispensed from the transaction device;

comparing the second dispensed number to the number in the authentication set of numbers subsequent to the previously located number; and

,

allowing the resynchronization if the second dispensed number matches the subsequent authentication system number or rejecting the transaction otherwise.

4. The method for conducting commercial transactions according to claim 1 further including reprogramming the transaction device with a new set of random numbers from an external system when the unique set of random numbers becomes exhausted or on request from a user.

5. The method for conducting commercial transactions according to claim 1 further including providing 1 to N additional numbers for each of the predetermined random numbers by means of 1 to N polynomial transformation equations, wherein the 1 to N predetermined polynomial transformation equations operate on each random number to generate 1 to N additional numbers for each random number.

6. The method for conducting commercial transactions according to claim further including providing a PIN number, wherein the software is configured to request a user to enter the predetermined PIN number each time the transaction device is activated, and wherein the software is configured to not dispense a random number until the correct PIN number has been entered.