Token based transaction authentication

• US 8,346,666 B2
• Filed: 01/19/2011
• Issued: 01/01/2013
• Est. Priority Date: 01/19/2010
• Status: Active Grant

• Current Assignee: Visa International Service Association (Visa, Inc.)
• Original Assignee: VISA Intellectual Service Association
• Inventors: Lindelsee, Mike, Brand, Olivier, Dimmick, James, Dominguez, Benedicto
• Primary Examiner(s): Poinvil, Frantzy
• Application Number:
  US13/009,162
• Publication Number:
  US 20110178925A1
• Time in Patent Office: 713 Days
• Field of Search: 705 4- 44
• US Class Current: 705/44
• CPC Class Codes: G06Q 20/00 Payment architectures, schemes or protocols apparatus for performing or posting payment transactions G07F7/08, G07F19/00; electronic cash registers G07G1/12
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists

Abstract

A token based transaction authentication system is disclosed. Issuer, merchants, and a payment processing network generate unique tokens or keys to authenticate messages between themselves and to authenticate a sending entity or consumer as they are redirected between entities. The tokens are also used to identify the particular authentication thread a message or sending entity is associated with. The sending entity authentication occurs over a web-based channel or a mobile based channel.

Claims

1. A method comprising:

sending a message comprising a first payment reference identifier to a participant;

receiving from the participant a second payment reference identifier and a merchant key;

determining, by a computer, if the second payment reference identifier matches the first payment reference identifier and determining an authorizing entity;

communicating to the authorizing entity a message comprising the first payment reference identifier and the merchant key;

receiving from the authorizing entity an authentication address, an issuer key, and a third payment reference identifier; and

determining if the third payment reference identifier matches the first payment reference identifier.

2. The method of claim 1, further comprising:

sending the authentication address, issuer key, merchant key, and first payment reference identifier to the participant, wherein the participant sends the authentication address, issuer key, merchant key, and first payment reference identifier to a sending entity and redirects the sending entity to the authentication address, wherein the sending entity authenticates with the authorizing entity by providing the issuer key and a passcode, wherein the authorizing entity determines if the issuer key received from the sending entity matches the issuer key the authorizing entity sent, and where after the sending entity is redirected to the participant with the first payment reference identifier and wherein the sending entity authenticates with the participant by providing the merchant key and wherein the participant determines if the merchant key received from the sending entity matches the merchant key the participant sent.

3. The method of claim 2, further comprising

receiving a message from the participant comprising the first payment reference identifier;

querying the authorizing entity to determine if the sending entity authenticated with the authorizing entity; and

communicating whether the sending entity authenticated with the authorizing entity to the participant.

4. The method of claim 1, wherein the method further comprises receiving from the participant a customer payment nickname that is analyzed to determine the authorizing entity.

5. The method of claim 1, wherein the participant is a merchant and the authorizing entity is an issuer.

6. The method of claim 1, wherein the authorizing entity communicates via a third party authenticator.

7. The method of claim 1, wherein the method further comprises receiving from the participant a consumer identity alias and sending the participant a plurality of consumer payment nicknames associated with consumer identity alias.

8. The method of claim 7, wherein the participant received the consumer identity alias from the sending entity.

9. The method of claim 7, wherein the participant provides the plurality of consumer payment nicknames to the sending entity and wherein the consumer payment nickname received from the participant is one of the plurality of consumer payment nicknames that is selected by the sending entity.

10. The method of claim 4, wherein the consumer payment nickname is analyzed to derive a primary account number.

11. The method of claim 10, wherein the primary account number is analyzed to determine the authorizing entity.

12. The method of claim 10, wherein the sending entity also provides the payment reference identifier to authenticate with the authorizing entity.

13. A method comprising:

receiving a merchant key, by a computer, from a participant and an issuer key from an authorizing entity and generating a payment reference identifier; and

sending to the participant a message comprising the merchant key by the computer, the issuer key, and the payment reference identifier, where participant sends the merchant key, issuer key, and payment reference identifier to the sending entity and redirects the sending entity to the authorizing entity, where the sending entity authenticates with the authorizing entity by providing the issuer key, and afterwards the authorizing entity redirects the sending entity to the participant, where the sending entity authenticates with the participant by providing the merchant key.

14. The method of claim 13, wherein the sending entity also provides the payment reference identifier to authenticate with the participant.

15. The method of claim 13, wherein the sending entity also provides a passcode to the authorizing entity.

16. The method of claim 13, wherein the authorizing entity also provides an issuer authentication address, which is sent to the participant and is where the participant redirects the sending entity.

17. A system comprising:

a processor; and

a computer-readable non-transitory medium coupled to the processor, the computer readable medium comprising code executable by the processor for implementing a method comprising;

sending a message comprising a first payment reference identifier to a participant;

receiving from the participant a second payment reference identifier and a merchant key;

determining if the second payment reference identifier matches the first payment reference identifier and determining an authorizing entity;

communicating to the authorizing entity a message comprising the first payment reference identifier and the merchant key;

receiving from the authorizing entity an authentication address, an issuer key, and a third payment reference identifier; and

determining if the third payment reference identifier matches the first payment reference identifier.

18. The system of claim 17, wherein the method further comprises sending the authentication address, issuer key, merchant key, and first payment reference identifier to the participant, wherein the participant sends the authentication address, issuer key, merchant key, and first payment reference identifier to a sending entity and redirects the sending entity to the authentication address, wherein the sending entity authenticates with the authorizing entity by providing the issuer key and a passcode, wherein the authorizing entity determines if the issuer key received from the sending entity matches the issuer key the authorizing entity sent, and where after the sending entity is redirected to the participant with the first payment reference identifier and wherein the sending entity authenticates with the participant by providing the merchant key and wherein the participant determines if the merchant key received from the sending entity matches the merchant key the participant sent.

19. The system of claim 17, wherein the method further comprises

receiving a message from the participant comprising the first payment reference identifier;

querying the authorizing entity to determine if the sending entity authenticated with the authorizing entity; and

communicating whether the sending entity authenticated with the authorizing entity to the participant.

20. The system of claim 17, wherein the method further comprises receiving from the participant a consumer identity alias and sending the participant a plurality of consumer payment nicknames associated with consumer identity alias.