ONE-TIME CREDIT CARD NUMBERS

• US 20120254041A1
• Filed: 05/17/2011
• Published: 10/04/2012
• Est. Priority Date: 03/31/2011
• Status: Abandoned Application

• Current Assignee: Infosys Technologies Limited (Infosys Limited)
• Original Assignee: Infosys Technologies Limited (Infosys Limited)
• Inventors: Saxena, Ashutosh, Ponnapalli, Harigopal K.B.
• Application Number:
  US13/109,946
• Publication Number:
  US 20120254041A1
• Time in Patent Office: Days
• US Class Current: 705/64
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes

Abstract

Various technologies related to one-time credit card numbers are presented. One-time credit card numbers can originate from a customer device and be independently generated by the customer device without online communication with an issuer. Signed transaction details can also be sent, providing non-repudiation of the purchase transaction. Merchant infrastructure need not be changed to accommodate the one-time credit card numbers. The technologies can be particularly resilient to replay, forgery, man-in-the-middle, and guessing attacks for credit card number generation or other usage by an attacker.

Claims

1. A method, implemented at least in part by a computing device, the method comprising:

receiving a one-time credit card number for a purchase transaction being made via a customer device;

receiving signed purchase transaction details of the purchase transaction originating from the customer device;

via a shared secret shared with the customer device and the signed purchase transaction details, determining whether the one-time credit card number is valid; and

responsive to determining that the one-time credit card number is valid, outputting an indication of validity of the purchase transaction.

2. One or more computer-readable storage devices having encoded therein computer-executable instructions causing a computer to perform the method of claim 1.

3. The method of claim 1, wherein:

the one-time credit card number originates from the customer device.

4. The method of claim 1, wherein:

the one-time credit card number is of a format and syntax of a conventional credit card number.

5. The method of claim 1, wherein:

determining whether the one-time credit card number is valid comprises;

generating, via the shared secret shared with the customer device, a check one-time credit card number; and

determining whether the one-time credit card number and the check one-time credit card number match.

6. The method of claim 1, wherein:

determining whether the one-time credit card number is valid comprises;

verifying the signed transaction details with a public key of a customer engaging in the purchase transaction.

7. The method of claim 1, wherein:

the signed purchase transaction details are signed with a private key of a customer engaging in the purchase transaction.

8. The method of claim 1, wherein:

the one-time credit card number is not provided to the customer device by a device controlled by an issuer.

9. The method of claim 1, wherein:

the one-time credit card number is not provided to the customer device before generation by the customer device.

10. The method of claim 1, wherein:

the purchase transaction is conducted offline.

11. The method of claim 1, wherein:

the one-time credit card number and the signed transaction details are sent via different communication channels.

12. The method of claim 1, wherein:

the signed purchase transaction details comprise;

the one-time credit card number; and

an identifier identifying a customer operating the customer device.

13. A method, implemented at least in part by a computing device, the method comprising:

in a customer controlled device, generating, with a one-time credit card number generation application having as input shared secret shared with an issuer, a one-time credit card number;

outputting the one-time credit card number for use in a purchase being made by a customer from a merchant;

generating signed purchase transaction information, the generating comprising signing, with the shared secret, purchase transaction information for the purchase being made by the customer from the merchant; and

outputting the signed purchase transaction information.

14. The method of claim 13 wherein the one-time credit card number originates from the customer controlled device.

15. The method of claim 13 wherein:

the one-time credit card number is generated by an application authorized by an issuer but without receiving additional information from the issuer.

16. The method of claim 13 wherein:

the one-time credit card number and the signed purchase transaction information are sent via different channels.

17. The method of claim 13 wherein:

the one-time credit card number and the signed purchase transaction information are sent via a same channel.

18. The method of claim 13 wherein:

the one-time credit card number has a format of a convention credit card number.

19. One or more computer-readable storage devices comprising:

an infrastructure-transparent one-time credit card number;

wherein the infrastructure-transparent one-time credit card number is generated by a customer device responsive to a request for a new one-time credit card number without receiving information from an issuer after receipt of the request.

20. One or more computer-readable storage devices comprising computer-executable instructions for performing a method comprising:

receiving a request to generate a new one-time credit card number;

responsive to the request, generating, at a customer device, the one-time credit card number, wherein the one-time credit card number is of a format of a standard credit card number, wherein the generating is based at least on a shared secret shared with an issuer, and wherein the one-time credit card number is generated without receiving information from the issuer after receiving the request to generate the new one-time credit card number;

generating signed details of a purchase transaction conducted between a customer and a merchant, wherein the generating comprises signing details of the purchase transaction with a private key of the customer, wherein the details comprise an identity of the customer and the one-time credit card number;

sending the one-time credit card number to the merchant for the purchase transaction conducted between the customer and the merchant; and

sending the signed details of the purchase transaction to the issuer.

21. The one or more computer-readable storage devices of claim 20 wherein the method further comprises:

receiving a one-time credit card number generation application from the issuer;

wherein generating the one-time credit card number comprises;

generating the one-time credit card number with the one-time credit card number generation application.