Verification of portable consumer device for 3-D secure services

• US 8,313,022 B2
• Filed: 01/10/2012
• Issued: 11/20/2012
• Est. Priority Date: 05/15/2009
• Status: Active Grant

• Current Assignee: Ayman Hammad, Benedicto Hernandez Dominguez, Ben Rewis, Brendan Xavier Louis, Kevin Weller, Krishna Prasad Koganti, Patrick Faith
• Original Assignee: Ayman Hammad, Benedicto Hernandez Dominguez, Ben Rewis, Brendan Xavier Louis, Kevin Weller, Krishna Prasad Koganti, Patrick Faith
• Inventors: Hammad, Ayman, Faith, Patrick, Koganti, Krishna Prasad, Rewis, Ben, Louis, Brendan Xavier, Weller, Kevin, Dominguez, Benedicto Hernandez
• Primary Examiner(s): Hess, Daniel
• Assistant Examiner(s): CHEDEKEL, TABITHA F
• Application Number:
  US13/347,495
• Publication Number:
  US 20120116976A1
• Time in Patent Office: 315 Days
• Field of Search: 235/375, 235/379, 235/380, 235/487, 235/492
• US Class Current: 235/380
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user
• CPC Class Codes: G06Q 20/12 specially adapted for electronic shopping systems
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/409 Device specific authentication in transaction processing
• CPC Class Codes: G06Q 20/42 Confirmation, e.g. check or permission by the legal debtor of payment
• CPC Class Codes: G06Q 20/425 using two different networks, one for transaction and one for security confirmation
• CPC Class Codes: G06Q 2220/00 Business processing using cryptography
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 9/0866 involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3273 for mutual authentication network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869

Abstract

Apparatuses, methods, and systems pertaining to the verification of portable consumer devices for 3-D Secure Systems are disclosed. In one implementation, a verification token is coupled to a computer by a USB connection so as to use the computer'"'"'s networking facilities. The verification token reads identification information from a user'"'"'s portable consumer device (e.g., credit card) and sends the information to a validation entry over a communications network using the computer'"'"'s networking facilities. The validation entity applies one or more validation tests to the information that it receives from the verification token. If a selected number of tests are passed, the validation entity sends a 3-D Secure datum to the verification token. The verification token may enter the 3-D Secure datum into a hidden field of a Purchase Authentication Page appearing on the computer'"'"'s display.

Claims

1. A first server computer comprising:

a processor; and

a computer readable medium coupled to the processor, wherein the computer readable medium comprises code executable by the processor for implementing a method comprising;

receiving at the first server computer from a verification token an electronic request for secure datum for a portable consumer device associated with a user,

wherein the electronic request comprises identification information associated with the portable consumer device, and

wherein the electronic request is based on an interaction between the portable consumer device and the verification token;

validating at the server computer the received electronic request by applying at least one validation test;

if the received electronic request is validated, electronically sending by the first server computer the secure datum to the verification token or to an entity configured to forward the secure datum to the verification token, wherein the secure datum is subsequently inserted by the verification token into a Purchase Authentication Page associated with a first transaction; and

electronically sending the secure datum to an Access Control Server, wherein the Access Control Server authenticates the user for the first transaction based at least in part on a comparison of the secure datum sent to the Access Control Server and the secure datum inserted by the verification token into the Purchase Authentication Page.

2. The first server computer of claim 1,

wherein if the user is authenticated, the Access Control Server electronically generates a Payer Authentication Response message indicating that the user is authentic;

and

wherein a first merchant initiates an authorization exchange with an acquirer for the first transaction based at least in part on the Payer Authentication Response message.

3. The first server computer of claim 2, wherein the Purchase Authentication Page is generated by the Access Control Server in response to a request received from the first merchant associated with the first transaction.

4. The first server computer of claim 2, wherein the Payer Authentication Response message is generated at least in part utilizing a digital signature associated with the Access Control Server.

5. The first server computer of claim 1, wherein the Access Control Server is located at an issuer of the first portable consumer device.

6. The first server computer of claim 1,

wherein the received electronic request comprises a serial number of the verification token and a test message encrypted by the verification token using an encryption key;

and

wherein the step of validating the received electronic request further comprises;

obtaining a key and one or more acceptable messages; and

validating the encrypted test message using the encrypted test message, the obtained key, and the obtained one or more acceptable messages.

7. The first server computer of claim 6, wherein the step of validating the encrypted test message comprises encrypting the obtained one or more acceptable messages with the obtained key, and comparing the encrypted test message to the one or more encrypted acceptable messages for a match.

8. The first server computer of claim 1, wherein the interaction between the portable consumer device and the verification token is done in response to a request received from a merchant associated with the first transaction.

9. The first server computer of claim 8, wherein the method further comprising the steps of:

generating a dynamic verification value; and

electronically sending the dynamic verification value to the verification token or to an entity configured to forward the dynamic verification value to the verification token.

10. The first server computer of claim 9, wherein the dynamic verification value is included in an authentication request by the merchant for the first transaction.

11. The first server computer of claim 1,

wherein the verification token inserts the received secure datum into the Purchase Authentication Page associated with the first transaction by providing the secure datum to the user, and

wherein the user enters the secure datum into the Purchase Authentication Page.

12. A first device comprising:

a processor; and

a computer readable medium coupled to the processor, wherein the computer readable medium comprises code executable by the processor for implementing a method comprising;

electronically receiving identification information associated with a portable consumer device from the portable consumer device based on an interaction with the portable consumer device;

electronically sending at least a portion of the identification information to a server computer, wherein the identification information is used to validate the portable consumer device;

electronically receiving from the server computer secure datum if the portable consumer device is validated;

electronically receiving a Payer Authentication Request message from a merchant associated with a first transaction;

inserting the received secure datum into a posting field of a Purchase Authentication Page associated with the first transaction;

electronically sending the Purchase Authentication Page to an Access Control Server;

electronically receiving from the Access Control Server a Payer Authentication Response from the Access Control Server, wherein the Payer Authentication Response is based at least in part on a comparison of the secure datum electronically sent in the Purchase Authentication Page to secure datum stored at the Access Control Server; and

electronically sending the Payer Authentication Response to the merchant, wherein the merchant initiates an authorization exchange with an acquirer for the first transaction based at least in part on the Payer Authentication Response message.

13. The first device of claim 12, wherein the first device comprises a personal computer in operative communication with a verification token.

14. The first device of claim 12, wherein the first device comprises a verification token.

15. The first device of claim 12, wherein the interaction with the portable consumer device comprises near-field communication.

16. The first device of claim 12, further comprising the steps of:

electronically receiving a dynamic verification value; and

electronically sending the dynamic verification value to the first merchant, wherein the dynamic verification value is included in an authorization request message by the first merchant for the first transaction.

17. A first server computer comprising

a processor;

and

a computer readable medium coupled to the processor, wherein the computer readable medium comprises code executable by the processor for implementing a method comprising;

electronically sending a Purchase Authentication Page to a computer, wherein the Purchase Authentication Page comprises a posting field to receive a secure datum;

electronically receiving a returned Purchase Authentication Page from the computer, wherein the returned Purchase Authentication Page comprises a secure datum disposed in the posting field, and wherein the secure datum was received by the computer from a validation entity based on a validation of a request generated by a verification token after an interaction between the verification token and a portable consumer device;

determining by a microprocessor whether the received secure datum matches a stored secure datum; and

generating electronically a Payer Authentication Response message based on at least the determination of whether the received secure datum matches the stored secure datum.

18. The first server computer of claim 17, wherein the method further comprises the step of:

receiving the stored secure datum from the validation entity, wherein the secure datum is electronically sent to the first server computer by the validation entity only if the computer passes at least one validation test.

19. The first server computer of claim 17, wherein the method further comprises the step of:

sending the Payer Authentication Response message to a merchant associated with a first transaction, wherein the merchant initiates an authorization exchange based at least in part on the Payer Authentication Response message.

20. A first method comprising:

receiving at a server computer an electronic request from a verification token for secure datum for a portable consumer device associated with a user,

wherein the electronic request comprises identification information associated with the portable consumer device, and

wherein the electronic request is based on an interaction between the portable consumer device and the verification token;

validating the received electronic request by applying at least one validation test; and

if the received electronic request is validated, electronically sending secure datum to the verification token or to an entity configured to forward the secure datum to the verification token,

wherein the sent secure datum is subsequently inserted by the verification token into a Purchase Authentication Page associated with a first transaction,

wherein the Purchase Authentication Page is sent to an Access Control Server; and

wherein the secure datum electronically inserted in the Purchase Authentication Page is compared to secure datum stored at the Access Control Server.