Method and system for conducting secure payments over a computer network without a pseudo or proxy account number

• US 7,177,848 B2
• Filed: 06/22/2001
• Issued: 02/13/2007
• Est. Priority Date: 04/11/2000
• Status: Expired due to Term

• Current Assignee: Mastercard International Incorporated (MasterCard Incorporated)
• Original Assignee: Mastercard International Incorporated (MasterCard Incorporated)
• Inventors: Campbell, Carl M., Hogan, Edward J.
• Primary Examiner(s): Worjloh; Jalatee
• Application Number:
  US09/886,486
• Publication Number:
  US 20020120584A1
• Time in Patent Office: 2,062 Days
• Field of Search: 705 50- 80, 713/150, 713/155, 713/182, 713200-202, 713/50, 713/156, 380277-285, 380/255, 726 2- 10
• US Class Current: 705/67
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: G06Q 20/027 involving a payment switch or gateway
• CPC Class Codes: G06Q 20/14 specially adapted for billing systems
• CPC Class Codes: G06Q 20/24 Credit schemes, i.e. "pay after"
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/367 involving electronic purses or money safes
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 20/3823 combining multiple encryption tools for a transaction
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G06Q 20/403 Solvency checks
• CPC Class Codes: G06Q 20/40975 using encryption therefor
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system

Abstract

A method is provided for conducting an electronic transaction with a payment account number having a certain amount of available funds, using a payment network and a “check site”. The method comprises the following steps: (a) generating a secret key associated with the payment account number; (b) using the secret key to generate a message authentication code (“MAC”) specific to the transaction; (c) generating an authorization request message including the message authentication code; (d) forwarding the authorization request message over the payment network to the check site for verifying the authenticity of the MAC; (e) verifying the message authentication code by the check site using the secret key; (f) responding to the authorization request message over the payment network based on the available funds and the transaction amount.

Claims

1. A computerized method of conducting an electronic transaction over a public communications network, with a payment account number having a certain amount of available funds, using a payment network linked to a check site, comprising:

(a) computer generating a secret key associated with said payment account number;

(b) using said secret key to computer generate a message authentication code specific to said transaction;

(c) computer generating an authorization request message including said message authentication code;

(d) forwarding said authorization request message over said payment network to said check site for computer verification of the authenticity of said message authentication code;

(e) verifying the message authentication code by said check site using said secret key; and

(f) responding by computer to said authorization request message over said payment network based on said available funds and said transaction amount,

wherein said authorization request message is routed over said payment network based on a special bank identification number corresponding to said check site,

wherein said authorization request message includes an expiration date field and said message authentication code is placed in said expiration date field,

wherein said payment account number is issued by an issuer and said response is provided by said issuer; and

further comprising, providing software at a user location for generating said secret key.

2. A computerized method of conducting an electronic transaction over a public communications network with a check site and a payment account number having a bank identification number (BIN) associated with said check site comprising:

(a) computer generating a per-card key associated with said payment account number;

(b) computer generating a message authentication code (MAC) using said per-card key;

(c) computer generating a MAC verification request including said payment account number and said MAC;

(d) verifying said MAC;

(e) based on said verification, and based on a transaction sequence number associated with the electronic transaction, creating an expected transaction sequence number (ETSN) for said MAC;

(f) providing said check site with reference data associated with said ETSN;

(g) computer generating a second message authentication code using said ETSN and said per-card key;

(h) routing said second message authentication code to said check site based on said BIN associated with said check site;

(i) determining said per-card key associated with the payment account number of an unverified message authentication code having associated ETSN and reference data;

computer verifying said second message authentication code by said check site using said determined per-card key, and said associated ETSN and reference data;

wherein step (g) further comprises;

(j) converting said second message authentication code into a pseudo expiration date using said reference data;

(k) generating an authorization request having an expiration date field containing said pseudo expiration date; and

(l) responding to said authorization request and verifying said second message authentication code based on said pseudo expiration date.

3. The method of claim 2 wherein the step of generating a message authentication code further includes using an expiration date, application version number and transaction sequence number associated with said payment account number.

4. The method of claim 3 wherein said MAC verification request further includes said application version number and said expiration date.

5. The method of claim 4, wherein said step of verifying said MAC includes using said per-card key.

6. The method of claim 2, wherein said reference data includes a reference data and a number of months indicator.