Systems and methods for time variable financial authentication

• US 7,899,753 B1
• Filed: 04/21/2003
• Issued: 03/01/2011
• Est. Priority Date: 03/25/2002
• Status: Active Grant

• Current Assignee: JP Morgan Chase Bank, N.A. (JP Morgan Chase & Co)
• Original Assignee: JP Morgan Chase Bank, N.A. (JP Morgan Chase & Co)
• Inventors: Everhart, Glenn Cobourm
• Primary Examiner(s): Worjloh; Jalatee
• Application Number:
  US10/419,107
• Time in Patent Office: 2,871 Days
• Field of Search: 705 64- 79, 713/185, 726/9, 726/10
• US Class Current: 705/67
• CPC Class Codes: G06Q 20/00 Payment architectures, schemes or protocols apparatus for performing or posting payment transactions G07F7/08, G07F19/00; electronic cash registers G07G1/12
• CPC Class Codes: G06Q 20/08 Payment architectures
• CPC Class Codes: G06Q 20/0855 involving a third party
• CPC Class Codes: G06Q 20/10 specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/388 using mutual authentication without cards, e.g. challenge-response
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G06Q 20/40975 using encryption therefor
• CPC Class Codes: G06Q 99/00 Subject matter not provided for in other groups of this subclass
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: G07F 7/1016 Devices or methods for securing the PIN and other transaction-data, e.g. by encryption arrangements for secret communication, see H04L9/00

Abstract

The systems and methods of the invention provide a technique for authenticating a finance related transaction. The method may include providing a token which contains a token counter, the token counter periodically advancing to generate a changing token value, the token counter being synchronized to a base counter that generates an authenticating value; transforming the token value into a token output sequence using logic; and outputting at least part of the token output sequence to an authenticating authority, the authenticating authority having access to the authenticating value. Further, the method includes the authenticating authority verifying the validity of the transaction based on the token output sequence and the authenticating value, from which the authenticating authority obtains a verification sequence using the logic, the verifying the validity including the authenticating authority comparing the token output sequence to the verification sequence to determine if there is a match between the token output sequence and the verification sequence.

Claims

1. A method for authenticating a finance related transaction for a customer, the customer being a person, comprising:

providing a token which contains a token counter, the token counter periodically advancing to generate a changing token value, the token counter being synchronized to a base counter that generates an authenticating value;

transforming, by the token, the token value into a token output sequence using logic;

outputting, by the token, at least part of the token output sequence to the customer, such outputting to the customer consisting of the at least part of the token output sequence;

inputting from the customer, by an authenticating authority, the at least part of the token output sequence, such inputting from the customer consisting of the at least part of the token output sequence, the authenticating authority having access to the authenticating value, the authenticating authority constituted by a processing system, the at least part of the token output sequence being input by the authenticating authority via a merchant; and

verifying, by the authenticating authority, the validity of the transaction based on the token output sequence and the authenticating value, from which the authenticating authority obtains a verification sequence using the logic, the verifying the validity including the authenticating authority comparing the token output sequence to the verification sequence to determine if there is a match between the token output sequence and the verification sequence; and

the method further including;

generating a time stamp value at a time of the transaction; and

the authenticating authority inputting the time stamp value, and the base counter, which is in the authenticating authority determining the value of the authenticating value based on the time stamp value.

2. The method of claim 1, wherein the logic includes a process that is known to the authenticating authority such that the token output sequence cannot be predicted without possession of the logic.

3. The method of claim 1, wherein a display on the token displays at least a part of the token output sequence.

4. The method of claim 1, wherein the token output sequence is output to the authenticating authority, along with other information from the token, and the other information is used by the authenticating authority to verify the validity of the transaction.

5. The method of claim 1, wherein the token output sequence is output to the authenticating authority along with other information, which is memorized by a holder of the token, and the other information is used by the authenticating authority to verify the validity of the transaction.

6. The method of claim 5, wherein the authenticating authority duplicates the logic that transforms the token value into the token output sequence in such as manner so as to transform the authenticating value into the verification sequence.

7. The method of claim 1, wherein the authenticating authority compares only a part of the token output sequence with a corresponding part of the verification sequence.

8. The method of claim 1, wherein the authenticating authority uses equality of at least a part of the token output sequence as compared with a corresponding part of the verification sequence to verify the validity of the transaction.

9. The method of claim 1 wherein the token is at least one of a credit card and debit card and the token output sequence is displayed on a display, the display being a human readable display.

10. The method of claim 1, wherein the token is used for authentication for payment processing, the transaction relating to a monetary exchange.

11. The method of claim 1, wherein the token is not internally secure and wherein a second identifier built into the token is used by the authenticating authority for verifying the validity of the transaction.

12. The method of claim 11, wherein the second identifier is input by the authenticating authority along with the token output sequence.

13. The method of claim 1, wherein the token output sequence is at least one of numbers, letters and symbols.

14. The method of claim 1, wherein the outputting at least part of the token output sequence to an authenticating authority includes using at least one of a radio frequency signal, an infrared signal, an audio signal, a magnetic pattern signal and a data signal.

15. The method of claim 1, wherein the token counter periodically advancing to generate a changing token value includes the token counter advancing through a sequential progression of numbers.

16. The method of claim 15, wherein the token counter includes a clock.

17. The method of claim 16, wherein the clock is a 24 hour time clock, and wherein the token value changes based on progression of the clock, but at a slower rate than the clock.

18. The method of claim 1, further including:

the token possessing a device identification;

the authenticating authority inputting the device identification, and the authenticating authority determining the logic to apply based on the device identification.

19. The method of claim 1, wherein the authenticating value is a first authenticating value, the method further including:

the authenticating authority comparing the token output sequence to the verification sequence and determining that there is not a match between the token output sequence and the verification sequence;

the authenticating authority recalculating a second authenticating value based on a previous base counter setting, the authenticating authority using the logic to generate a second verification sequence based on the second authenticating value; and

the authenticating authority comparing the token output sequence to the second verification sequence to determine a match between the token output sequence and the second verification sequence.

20. The method of claim 1, wherein the authenticating value is a first authenticating value, the method further including:

the authenticating authority comparing the token output sequence to the verification sequence and determining that there is not a match between the token output sequence and the verification sequence;

the authenticating authority recalculating a second authenticating value based on a subsequent base counter setting, the authenticating authority using the logic to generate a second verification sequence based on the second authenticating value; and

the authenticating authority comparing the token output sequence to the second verification sequence to determine a match between the token output sequence and the second verification sequence.

21. The method of claim 1, wherein the outputting being performed through the person of the customer includes the authenticating authority receiving the at least part of the token output sequence by the customer verbally conveying the at least part of the token output sequence to a merchant.

22. The method of claim 1, wherein the inputting from the customer consisting of part of the token output sequence.

23. The method of claim 1, the input by the authenticating authority via a merchant is performed using at least one selected from the group consisting of:

an LED (light emitting diode), an LCD (liquid crystal display), a magnetic strip, an audio signal, a magnetic pattern.

24. The method of claim 1, the input by the authenticating authority via a merchant is performed using at least one selected from the group consisting of:

a radio frequency signal and an infrared signal.

25. A system for authenticating a finance related transaction, the system comprising:

an authenticating authority; and

a token that includes a token counter, the token counter periodically advancing to generate a changing token value in conjunction with the transaction, the token transforming the token value into a token output sequence using logic in a logic portion, the token outputting at least part of the token output sequence to the authenticating authority using a display, the token outputting a time of the transaction to the authenticating authority;

the authenticating authority determining a base counter based on the time of the transaction, the authenticating authority verifying the validity of the transaction based on the token output sequence and the base counter, the authenticating authority obtaining a verification sequence based on the base counter using the logic; and

the authenticating authority verifying the validity of the transaction includes comparing the token output sequence to the verification sequence to determine if there is a match between the token output sequence and the verification sequence.

26. The system of claim 25, wherein the token possesses a device identification;

and

the authenticating authority inputting the device identification, and the authenticating authority determining the logic to apply based on the device identification.

27. The system of claim 25, wherein the display of the token is one of a magnetic strip, a radio frequency generating device, an infrared signal generating device, an audio signal generating device, and a magnetic pattern generating device.

28. The system of claim 25, wherein the token is included in a flashlight, the flashlight including a lighting portion and a battery.

29. The system of claim 25, wherein the token is included in a device selected from the group consisting of a key chain, cellular phone, a personal digital assistant, and a watch.

30. The system of claim 25, wherein the token possesses a device identification;

and

the authenticating authority inputting the device identification, and the authenticating authority using the device identification in the logic to obtain the verification sequence.

31. The system of claim 25, the authenticating authority verifying the validity of the transaction includes checking the time of the transaction vis-à

-vis an expected value.

32. The system of claim 25, the authenticating authority verifying the validity of the transaction includes generating respective verification sequences for at least one of (1) times before the time of transaction and (2) times after the time of transaction.

33. A method for authenticating a finance related transaction for a customer, the customer being a person, comprising:

providing a token which includes a token counter, the token counter periodically advancing to generate a changing token value, the token counter being synchronized to a base counter in an authenticating authority;

the token transforming the token value into a token output sequence using logic;

the token outputting at least part of the token output sequence to the person of the customer, and

token outputting a time of the transaction to the authenticating authority; and

inputting, by the authenticating authority, the time of the transaction, the authenticating authority inputting at least part of the token output sequence from the person of the customer, the inputting being performed via a communication through a merchant processing portion; and

the authenticating authority determining the base counter based on the time of the transaction, the authenticating authority generating the authenticating value based on the base counter;

verifying, by the authenticating authority, the validity of the transaction based on the token output sequence and the authenticating value, from which the authenticating authority obtains a verification sequence using the logic, the verifying the validity including the authenticating authority comparing the token output sequence to the verification sequence to determine if there is a match between the token output sequence and the verification sequence.