Method and system for securing a transaction using a card generator, a RFID generator, and a challenge response protocol

• US 8,397,988 B1
• Filed: 09/11/2009
• Issued: 03/19/2013
• Est. Priority Date: 08/09/2002
• Status: Expired due to Fees

• Current Assignee: Brite Smart Corporation
• Original Assignee: Brite Smart Corporation
• Inventors: Zuili, Patrick Joseph
• Primary Examiner(s): LEE, SEUNG H
• Application Number:
  US12/557,762
• Time in Patent Office: 1,285 Days
• Field of Search: 235/380, 235/382, 235/492
• US Class Current: 235/383
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: G06F 2221/2151 Time stamp
• CPC Class Codes: G06Q 20/3278 RFID or NFC payments by means of M-devices
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/351 Virtual cards
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/409 Device specific authentication in transaction processing
• CPC Class Codes: G07F 7/0886 the card reader being portable for interacting with a POS or ECR in realizing a payment transaction
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent

Abstract

A system for securing a transaction comprises an authentication unit capable of processing an input and generating a dynamic card transaction code/virtual card code which is valid for a single transaction upon authentication; and a RFID generator capable of generating at least a dynamic RFID key for a predefined limited time period by using the dynamic card transaction code for the single transaction. The authentication of the input is performed locally with the authentication unit through an encrypted and unique RFID communication between the authentication unit and a third party by using a challenge response protocol. The authentication unit is capable of working alone and as a plug-in with at least any one of a personal digital assistant (PDA), a hand-held remote control, a cellular telephone, a fax machine, and a printer is used for securing the transaction.

Claims

1. A system for securing a transaction, comprising:

an authentication unit capable of processing an input, the authentication unit is capable of generating a dynamic card transaction code valid for a single transaction; and

a RFID generator capable of generating at least a dynamic RFID key for a predefined limited time period by using the dynamic card transaction code for the single transaction,

wherein the authentication of the input is performed locally with the authentication unit through an encrypted and unique RFID communication between the authentication unit and a third party by using a challenge response protocol.

2. The system of claim 1, wherein the authentication unit is having a transponder which is capable of communicating with the third party using a desired present range of frequencies and the challenge response protocol.

3. The system of claim 1, wherein the input includes at least any one of:

biometric characteristics physically representing the user, non-biometric characteristics, a magnetic card, a smart card, a credit card, a debit card, a master card, a contactless smart card including a RFID card, a card template, a biometric template, a password, SID, a signature, personal identification number (PIN), complete identification, picture, movie, music, video, personal preferences, payment information, shipping information, billing information, medical records, insurance information, travel documents, forms of identification, wherein the biometric characteristics include but not limited to fingerprint, veins, palm, voice, eyes, voice print, and card holder'"'"'s iris scan.

4. The system of claim 1, wherein the authentication unit is capable of registering and storing the input during a preliminary setup and pre-registration process before usage, the authentication unit capable of generating the dynamic card transaction code according to the stored and registered inputs.

5. The system of claim 1, wherein the RFID generator is coupled internally with the authentication unit which is capable of preventing Radio Frequency to heat-up the RFID generator directly.

6. The system of claim 1, wherein the authentication unit is capable of communicating an ID code of the transaction to the third party through the RFID generator upon validation of the transaction.

7. The system of claim 1, wherein the communication subsequent to the validation of the input are encrypted using one of public-key cryptography, and Identity-Based-Encryption (IBE) cryptography.

8. The system of claim 1, wherein the third party includes at least any one of:

point of sale (POS), ATM, a server, wherein the third party is connected with the authentication unit through a network, wherein the network includes public network, private network, shared network, Internet, Intranet, LAN, WAN, wired network, and wireless network, transmission lines.

9. The system of claim 1, wherein the authentication unit is capable of communicating the dynamic RFID key to a third party for validating the transaction by using the challenge response protocol.

10. The system of claim 1, a GPS [Global positioning system with embedded atomic clock] to verify the accurate time of the transaction with the third party, is connected with the authentication unit through the network.

11. The system of claim 1, wherein the authentication unit includes at least any one of:

a portable smartcards reader, a mobile smart card reader, a biometric reader capable of reading the biometric information stored into a smartcard, a USB key, a biometric characteristic reader for reading the biometric characteristic of the user, at least a biometric characteristics sensor for sensing biometric characteristics of the user locally with the authentication unit, a storage unit for storing the input.

12. The system of claim 11, wherein the biometric characteristics sensor includes at least any one of:

a fingerprint sensor to acquire a fingerprint of the user, a microphone to acquire a voice of the user, a vein sensor for sensing the veins of the user, a palm sensor for sensing the palm of the user, a face detection sensor for detecting eyes, iris, and any body identity feature of the user.

13. The system of claim 1, wherein any one of a personal digital assistant (PDA), a hand-held remote control, a wireless phone, wired phone, cellular mobile telephone, a head set, a fax machine, and a printer is used for securing a transaction.

14. The system of claim 1, wherein the authenticating unit includes an inbuilt central-processing unit for transaction management and input-output capability for reading and writing information to a plurality of cards including magnetic cards, optical cards, and smart cards, wherein the smart cards includes EPROM cards, random-access memory (RAM) cards, and read-on memory (ROM) cards, and contactless cards.

15. The system of claim 14, wherein the public key includes at least any one of:

an Identity-Based-Encryption (IBE), a pairing-based encryption, and a quadratic residues encryption scheme.

16. The system of claim 1, wherein the transaction is authenticated locally with the authentication unit with the third party by using at least one of the dynamic RFID key, the dynamic card transaction code, and the challenge response protocol, generic card code, virtual card code.

17. The system of claim 1, wherein a private key generator (PKG) is capable of using the biometric characteristics as a master private key.

18. The system of claim 1, wherein time information is used as a public key.

19. The system of claim 1, wherein the authentication unit is capable of securing:

voting by permitting a right voter to vote and refusing a wrong voter, access control, airport security checkpoint, buying goods via the Internet, in a department store, credit card transactions and billings.

20. A method for securing a transaction, comprising the steps of:

receiving an input from a user;

authenticating the input by an authentication unit, wherein the input is authenticated by pairing the input stored in the authentication unit with the input extracted from the user;

generating a dynamic card transaction code for a single transaction upon authentication of the input;

generating a dynamic RFID key for the single transaction by using the dynamic card transaction code;

communicating the dynamic RFID key to a third party for validating the transaction by using a challenge response protocol; and

communicating an ID of the transaction to the third party by the RFID generator upon validation of the transaction,

wherein the transaction is authenticated locally by the authentication unit with the third party by using at least one of the dynamic RFID key, the dynamic card transaction code, and the challenge response protocol.

21. The method of claim 20, wherein the authentication unit is having a transponder which is capable of communicating with the third party using a preset frequency and a challenge response protocol.

22. The method of claim 20, wherein the input includes at least any one of:

biometric characteristics physically representing the user, a magnetic card, a smart card, a credit card, a debit card, a master card, a RFID card, a card template, a PIN, a password, SID, a signature, personal identification numbers, complete identification, picture, movie, music, video, personal preferences, payment information, shipping information, billing information, medical records, insurance information, travel documents, forms of identification, wherein the biometric characteristics include fingerprint, veins, palm, voice, eyes, voice print, and card holder'"'"'s iris scan.

23. The method of claim 20, wherein the authentication unit is capable of registering and the input during a preliminary setup and pre-registration process before usage, the authentication unit capable of generating the dynamic card transaction code according to the stored and registered inputs.

24. The method of claim 20, wherein the RFID generator is coupled internally with the authentication unit which is capable of preventing Radio Frequency to heat-up the RFID generator directly.

25. The method of claim 20, wherein the authentication unit is capable of communicating an ID of the transaction to the third party through the RFID generator upon validation of the transaction.

26. The method of claim 20, wherein the communication subsequent to the validation of the input are encrypted using one of public-key cryptography, and identity-based encryption (IBE) cryptography.

27. The method of claim 20, wherein the third party includes at least any one of:

point of sale (POS), ATM, a server, wherein the third party is connected with the authentication unit through a network, wherein the network includes public network, private network, shared network, Internet, Intranet, LAN, WAN.

28. The method of claim 20, wherein the authentication unit is capable of communicating the dynamic RFID key to a third party for validating the transaction by using a challenge response protocol.

29. The method of claim 20, a GPS with embedded atomic clock to verify the accurate time of the transaction with the third party, is connected with the authentication unit through the network.

30. The method of claim 20, wherein the authentication unit includes at least any one of:

a portable smartcards reader, a biometric reader capable of reading the biometric information stored into a smartcard, USB key, at least a biometric characteristics sensor for sensing biometric characteristics of the user locally with the authentication unit, a storage unit for storing the input.

31. The system of claim 30, wherein the biometric characteristics sensor includes at least any one of:

a fingerprint sensor to acquire a fingerprint of the user, a microphone to acquire a voice of the user, a vein sensor for sensing the veins of the user, a palm sensor for sensing the palm of the user, a face detection sensor for detecting eyes and iris of the user.

32. The method of claim 20, wherein any one of a personal digital assistant (PDA), a hand-held remote control, a cellular telephone, a fax machine, and a printer is used for securing the transaction.

33. The method of claim 20, wherein the authenticating unit includes an inbuilt central-processing unit for transaction management and input-output capability for reading and writing information to a plurality of cards including magnetic cards, optical cards, and smart cards, wherein the smart cards includes EPROM cards, random-access memory (RAM) cards, and read-on memory (ROM) cards.

34. The method of claim 20, wherein the transaction is authenticated locally at the authentication unit with the third party by using at least one of the dynamic RFID key, the dynamic card transaction code, and a challenge response protocol.

35. The method of claim 20, wherein a private key generator (PKG) is capable of using the biometric characteristics as a master private key.

36. The method of claim 20, wherein time information is used as a public key.

37. The system of claim 36, wherein the public key includes at least anyone of:

an Identity-Based-Encryption (IBE), a pairing based encryption, and a quadratic residues encryption scheme.

38. The method of claim 20, wherein the authentication unit is capable of securing:

voting by permitting a right voter to vote and refusing a wrong voter, airport security checkpoint, buying goods via the Internet, in a department store, credit card transactions and billings.

39. The method of claim 20, wherein a private key generator (PKG) is capable of using the biometric information as a master private key.

40. A method of authenticating a transaction, comprising the steps of:

obtaining the biometric characteristics input locally with the authentication unit of the user from the biometric reader sensor;

comparing the biometric characteristics and templates input with the stored biometric characteristics and templates to authenticate the transaction;

generating a dynamic card transaction code for a single transaction by the authentication unit if the biometric characteristics input match with the stored biometric characteristics;

generating a dynamic RFID key for the single transaction by using the dynamic card transaction code;

sending the encrypted dynamic RFID key to the third party through the authenticating unit using a challenge response protocol, wherein the atomic time is used as a serialization and challenge response protocol variable;

receiving a confirmation for validating the transaction by the third party at the authentication unit; and

communicating an ID of the transaction to the third party by the RFID generator upon validation of the transaction.