Methods and systems for electromagnetic initiation of secure transactions

• US 7,831,519 B2
• Filed: 11/23/2004
• Issued: 11/09/2010
• Est. Priority Date: 12/17/2003
• Status: Expired due to Fees

• Current Assignee: First Data Corporation (Fiserv Incorporated)
• Original Assignee: First Data Corporation (Fiserv Incorporated)
• Inventors: Kean, Brian T.
• Primary Examiner(s): Augustin; Evens J
• Application Number:
  US10/997,770
• Publication Number:
  US 20050137986A1
• Time in Patent Office: 2,177 Days
• Field of Search: 705/64, 705/67, 714/4
• US Class Current: 705/64
• CPC Class Codes: G06Q 20/327 Short range or proximity payments by means of M-devices
• CPC Class Codes: G06Q 20/367 involving electronic purses or money safes
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 30/0238 at point-of-sale [POS]
• CPC Class Codes: G07F 7/1016 Devices or methods for securing the PIN and other transaction-data, e.g. by encryption arrangements for secret communication, see H04L9/00

Abstract

Methods and systems are provided for processing secure transactions. An electromagnetic transmission packet is received from a portable device at a processing device. The electromagnetic transmission packet includes an encrypted magnetic-stripe image and an encrypted version of an alphanumerical identifier. A keyed nonencrypted version of the alphanumerical identifier is received at the processing device, and the encrypted version of the alphanumerical identifier is decrypted. The decryption of the encrypted version of the alphanumerical identifier is compared with the nonencrypted version of the alphanumerical identifier. Thereafter, a decryption of the encrypted magnetic-stripe image is transmitted to a host system for processing the secure transaction using an account identified by the decryption of the magnetic-stripe image.

Claims

1. A method for processing a secure transaction between a customer and a merchant, the method comprising:

receiving, at a merchant processing device, an electromagnetic transmission packet from a customer portable device, wherein the electromagnetic transmission packet includes an encrypted magnetic-stripe image and an encrypted version of an alphanumerical identifier;

transmitting an identification of the merchant processing device and a transaction identifier to the customer portable device, wherein the electromagnetic transmission packet received from the customer portable device further includes an encryption of the transaction identifier and the identification of the merchant processing device;

comparing, at the merchant processing device, the identification of the merchant processing device and transaction identifier received from the customer portable device with those transmitted to the customer portable device;

receiving a keyed nonencrypted version of the alphanumerical identifier at the merchant processing device;

decrypting, with the merchant processing device, the encrypted version of the alphanumerical identifier;

comparing, with the merchant processing device, the decryption of the encrypted version of the alphanumerical identifier with the nonencrypted version of the alphanumerical identifier; and

thereafter, transmitting a decryption of the encrypted magnetic-stripe image from the merchant processing device to a host system for executing the secure transaction with the host system using an account identified by the decryption of the magnetic-stripe image;

wherein the comparing steps are performed offline by the merchant processing system before transaction approval is requested from the remote host system, and is performed without involvement from the host system.

2. The method recited in claim 1 wherein the electromagnetic transmission packet is received at a radio frequency.

3. The method recited in claim 1 further comprising:

receiving a barcode scan of a barcode; and

transmitting a barcode value corresponding to the barcode with the decryption of the encrypted magnetic-stripe image.

4. The method recited in claim 3 further comprising verifying a validity of the barcode.

5. The method recited in claim 4 further comprising:

activating an antenna to receive the electromagnetic transmission packet after verifying the validity of the barcode; and

deactivating the antenna after receiving the electromagnetic transmission packet.

6. The method recited in claim 4 wherein verifying the validity of the barcode comprises:

calculating a check digit from characters comprised by the scanned barcode; and

comparing the calculated check digit with a comparison check digit comprised by the scanned barcode.

7. The method recited in claim 1 further comprising transmitting the alphanumerical identifier with the decryption of the encrypted magnetic-stripe image.

8. The method recited in claim 1 further comprising:

decrypting the encryption of the transaction identifier and the identification of the merchant processing device; and

comparing the decryption of the transaction identifier and the identification of the merchant processing device with the identification of the merchant processing device and the transaction identifier transmitted to the customer portable device.

9. The method recited in claim 8 further comprising:

receiving a symmetric-key encrypted portable-device transaction counter and incremented processing-device transaction counter;

decrypting the portable-device transaction counter and the incremented processing-device transaction counter;

calculating a difference between the decrypted portable-device transaction counter and the decrypted incremented processing-device transaction counter.

10. The method recited in claim 9 further comprising transmitting the portable-device transaction counter to a host for fraud detection.

11. The method recited in claim 1 wherein the electromagnetic transmission packet further includes a digital signature, the method further comprising verifying an authenticity of the digital signature.

12. The method recited in claim 1 wherein the encrypted magnetic-stripe image is encrypted using an elliptic-curve cryptographic technique.

13. The method recited in claim 1 further comprising incrementing a counter at the merchant processing device.

14. The method recited in claim 1 wherein the electromagnetic transmission packet further includes nonencrypted information.

15. The method recited in claim 14 wherein the nonencrypted information comprises a key identification, the method further comprising decrypting the encrypted magnetic-stripe image using a key identified by the key identification.

26. The method of claim 1, further comprising transmitting to the host system a flag that indicates that the alphanumerical identifier has been confirmed offline, the method performed without transmitting the alphanumerical identifier to the host system.

16. A merchant processing device for processing a secure transaction between a customer and a merchant, the merchant processing device comprising:

a radio-frequency antenna;

a keypad equipped for receipt of entry of alphanumerical strings;

a communications system;

secure-access memory; and

a processor in communication with the radio-frequency antenna, the keypad, and the communications system, the processor coupled with a computer-readable storage medium having a computer-readable program embodied therein for directing operation of the processor in accordance with the following;

receiving, with the radio-frequency antenna, a radio-frequency transmission packet from a customer portable device, wherein the radio-frequency transmission packet includes an encrypted magnetic-stripe image and an encrypted version of an alphanumerical identifier;

transmitting, with the radio-frequency antenna, an identification of the merchant processing device and a transaction identifier to the customer portable device, wherein the radio-frequency transmission packet received from the customer portable device further includes an encryption of the transaction identifier and the identification of the merchant processing device;

comparing, at the merchant processing device, the identification of the merchant processing device and transaction identifier received from the customer portable device with those transmitted to the customer portable device;

receiving a keyed nonencrypted version of the alphanumerical identifier with the keypad;

decrypting the encrypted version of the alphanumerical identifier with the processor;

comparing, with the processor, the decryption of the encrypted version of the alphanumerical identifier with the nonencrypted version of the alphanumerical identifier; and

thereafter, transmitting, with the communications system, a decryption of the encrypted magnetic-stripe image to a host system for processing the secure transaction using an account identified by the decryption of the magnetic-stripe image;

wherein comparing the decryption of the encrypted version of the alphanumerical identifier with the nonencrypted version of the alphanumerical identifier is performed offline by the merchant processing device before transaction approval is requested from the remote host system, and is performed without involvement of the host system.

17. The merchant processing device recited in claim 16 further comprising a barcode reader, wherein the computer-readable program further includes:

instructions for receiving a barcode scan of a barcode with the barcode reader; and

instructions for transmitting, with the communications system, a barcode value corresponding to the barcode with the decryption of the encrypted magnetic-stripe image.

18. The merchant processing device recited in claim 16 wherein the computer-readable program further includes instructions for transmitting the alphanumerical identifier with the decryption of the encrypted magnetic-stripe image.

19. The merchant processing device recited in claim 16 further comprising an input device in communication with the processor, the computer-readable program further including instructions for receiving data from the input device.

20. The merchant processing device recited in claim 19 wherein the input device comprises a smart-card reader.

21. The merchant processing device recited in claim 16 further comprising an interface with a point-of-sale terminal equipped for processing the secure transaction with the magnetic-stripe image.

27. The system of claim 16, wherein the computer-readable program further directs operation of the processor in accordance with the following:

without transmitting the alphanumerical identifier to the host system, transmitting to the host system a flag that indicates that the alphanumerical identifier has been confirmed offline.

22. A system for processing secure transactions between customers and merchants, the system comprising:

a host system;

a plurality of merchant processing devices in communication with the host system, each of the merchant processing devices comprising;

a processing-device radio-frequency antenna;

a keypad equipped for receipt of entry of alphanumerical strings;

a communications system; and

a processing-device processor in communication with the processing-device radio-frequency antenna, the keypad, and the communications system; and

a plurality of customer portable devices, each of the customer portable devices comprising;

a portable-device radio-frequency antenna;

a memory device;

an activation switch; and

a portable-device processor in communication with the portable-device radio-frequency antenna, the memory device, and the activation switch,

wherein the merchant processing devices are configured to process the secure transactions by;

exchanging electromagnetic transmission packets between the customer portable devices and the merchant processing devices, each such electromagnetic transmission packet including an encrypted magnetic-stripe image and an encrypted version of an alphanumerical identifier;

decrypting the encrypted version of the alphanumerical identifier;

comparing the decryption of the alphanumerical identifier with a purported alphanumerical identifier keyed with the keypad, and

thereafter, exchanging a decryption of the encrypted magnetic-stripe image with the host system;

wherein during at least one transaction, comparing the decryption of the alphanumerical identifier with the purported alphanumerical identifier is performed offline by the merchant processing device before approval of a transaction is requested from the host system, and is performed without involvement of the host system;

wherein the processors are further configured to exchange an identification of a respective merchant processing device and a respective transaction identifier for each transaction between the respective merchant processing device and a respective customer portable device used to initiate the transaction;

and wherein the merchant processing devices are further configured to compare each identification of the respective merchant processing device and respective transaction identifier received from a respective customer portable device with those sent to the respective customer portable device.

23. The system recited in claim 22 wherein:

at least some of the merchant processing devices further include a barcode reader; and

the processors are further configured to receive a scan of a barcode and to exchange a barcode value corresponding to the barcode with the host system.

24. The system recited in claim 22 wherein the processors are further configured to exchange the alphanumerical identifier with the host system.

25. The system recited in claim 22 wherein at least the identification of the respective merchant processing device and respective transaction identifier are unencrypted during a first portion of the exchange and encrypted during a second portion of the exchange.

28. The system of claim 22, wherein the exchanges of information between the merchant processing devices and the host system do not include the alphanumerical identifier, and wherein the merchant processing devices are configured to, during the processing of at least one of the secure transactions, transmit to the host system a flag that indicates that the alphanumerical identifier has been confirmed offline.