Method and device for generating a single-use financial account number

• US 6,163,771 A
• Filed: 08/28/1997
• Issued: 12/19/2000
• Est. Priority Date: 08/28/1997
• Status: Expired due to Term

• Current Assignee: PayPal, Inc. (PayPal Holdings, Inc.)
• Original Assignee: Walker Digital LLC (Walker Innovation Inc. (f/k/a Patent Properties, Inc.))
• Inventors: Tedesco, Daniel E., Jindal, Sanjay K., Schneier, Bruce, Walker, Jay S.
• Primary Examiner(s): Teska, Kevin J.
• Assistant Examiner(s): SMITH-STEWART, DEMETRA R
• Application Number:
  US08/919,339
• Time in Patent Office: 1,209 Days
• Field of Search: 705/18, 705/1, 705/17, 705/35, 705/41, 380/4, 380/23, 380/24, 380/25, 380/29, 380/30
• US Class Current: 705/18
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/10 specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
• CPC Class Codes: G06Q 20/105 involving programming of a portable memory device, e.g. IC cards, "electronic purses"
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: G06Q 40/02 Banking, e.g. interest calculation or account maintenance credit or loans G06Q40/03
• CPC Class Codes: G06Q 40/03 Credit; Loans; Processing thereof
• CPC Class Codes: G07F 7/1016 Devices or methods for securing the PIN and other transaction-data, e.g. by encryption arrangements for secret communication, see H04L9/00

Abstract

A device for facilitating financial account transactions is described which includes a processing unit including a cryptographic processor. The device also includes an input unit, a display unit and a memory device connected to the processing unit. The memory device contains a private cryptographic key, a first data element and a second data element. The processing unit encrypts the first data element using the private cryptographic key and the second data element, modifies the second data element, combines the encrypted first data element and the second data element to generate a single-use financial account identifier, and displays the single-use financial account identifier. This identifier is then transmitted to a central processor for authorization of the transaction. The central processor extracts and decrypts data elements from the transmitted identifier using the private cryptographic key, compares those data elements with data elements stored in a memory, and verifies the single-use financial account identifier in accordance with the comparison.

Claims

1. A method for providing a second account identifier for use in place of a first account identifier, comprising the steps of:

accessing a first data element, specific to an account having a first account identifier;

accessing a second data element including transaction-specific data; and

combining said first data element and said second data element to produce a second account identifier for use in place of said first account identifier.

2. The method of claim 1 wherein the step of accessing said first data element includes

accessing the first account identifier.

3. The method of claim 2 wherein said first account identifier comprises alpha-numeric characters.

4. The method of claim 1 wherein the step of accessing said second data element includes accessing a time.

5. The method of claim 1 wherein the step of accessing said second data element includes accessing a payment amount.

6. The method of claim 1 wherein the step of accessing said second data element includes accessing a merchant identifier.

7. The method of claim 1 wherein the step of accessing said first data element includes encrypting said first data element.

8. The method of claim 7 wherein the encrypting step is based on a private key encryption technique.

9. The method of claim 1 wherein the combining step is based on a hashing function.

10. The method of claim 1 wherein the combining step includes encrypting at least one of said first data element and said second data element.

11. The method of claim 10 wherein the encrypting step is based on a private key encryption technique.

12. The method of claim 1, further comprising the step of accessing a third data element including a static account identifier, and wherein said combining step includes combining said third data element with said first data element and said second data element.

13. The method of claim 1, further comprising the step of updating said second data element to initialize for a future transaction.

14. A device for providing a second account identifier for use in place of a first account identifier, comprising:

a processing unit, said processing unit including a cryptographic processor;

an input unit, connected to said processing unit, operable to input information thereto;

a display unit, connected to said processing unit, operable to display a processing result therefrom; and

a memory device connected to said processing unit, said memory device containing

a private cryptographic key,

a first data element,

a second data element and

a program, adapted to be executed by said processing unit, to

encrypt the first data element using the private cryptographic key and the second data element,

modify the second data element,

combine the encrypted first data element and the second data element to generate an account identifier that indicates another account identifier, and

display the generated account identifier using said display unit.

15. A method for providing a second account identifier for use in place of a first account identifier, comprising the steps of:

providing a memory device containing a private cryptographic key, a first data element, and a second data element;

encrypting the first data element using the private cryptographic key and the second data element;

modifying the second data element;

combining the encrypted first data element and the second data element to generate a second account identifier for use in place of a first account identifier; and

displaying the second account identifier.

16. A device for providing a second account identifier for use in place of a first account identifier, said device comprising:

a memory storing

data representing a plurality of predetermined account identifiers,

data representing a status for each of said plurality of predetermined account identifiers, and

data representing a pointer to one of said plurality of predetermined account identifiers;

an output device operable to present said one of said plurality of predetermined account identifiers; and

a processor coupled to said memory and to said output device, said processor being configured to identify said one of said plurality of predetermined account identifiers based on said data representing a pointer, said processor being further configured to transmit a signal to said output device directing said output device to present said one of said plurality of predetermined account identifiers.

17. A device according to claim 16, further comprising an input device adapted to transmit an input signal representing a request to present said one of said plurality of predetermined account identifiers, wherein said processor is coupled to said input device and said processor is further configured to receive said input signal from said input device.

18. A device according to claim 16, wherein said processor is further configured to update said data representing a pointer and to update said data representing a status.

19. A method for providing a second account identifier for use in place of a first account identifier, comprising the steps of:

providing a memory storing

data representing a plurality of predetermined account identifiers,

data representing a status for each of said plurality of predetermined account identifiers, and

data representing a pointer to one of said plurality of predetermined account identifiers;

identifying said one of said plurality of predetermined account identifiers based on said data representing a pointer; and

transmitting a signal to an output device to present said one of said plurality of predetermined account identifiers.

20. A method for providing a second account identifier for use in place of a first account identifier, comprising the steps of:

receiving a plurality of requests to produce second account identifiers, each second account identifier for use in place of a first account identifier; and

outputting, in response to each request, a respective second account identifier, each output second account identifier indicating the first account identifier, each second account identifier being different from remaining second account identifiers.

21. The method of claim 20, in which the first account identifier and each second account identifier respectively comprise sixteen digits.