Integration of verification tokens with mobile communication devices

• US 8,534,564 B2
• Filed: 09/30/2011
• Issued: 09/17/2013
• Est. Priority Date: 05/15/2009
• Status: Active Grant

• Current Assignee: Visa International Service Association (Visa, Inc.)
• Original Assignee: Visa International Service Association (Visa, Inc.)
• Inventors: Hammad, Ayman
• Primary Examiner(s): Lee, Michael G
• Assistant Examiner(s): CHEDEKEL, TABITHA F
• Application Number:
  US13/250,918
• Publication Number:
  US 20120031969A1
• Time in Patent Office: 718 Days
• Field of Search: 235/375, 235/379, 235/380, 235/454, 235/455
• US Class Current: 235/492
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user
• CPC Class Codes: G06Q 20/12 specially adapted for electronic shopping systems
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/352 Contactless payments by cards
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4018 using the card verification value [CVV] associated with the card
• CPC Class Codes: G06Q 20/42 Confirmation, e.g. check or permission by the legal debtor of payment
• CPC Class Codes: G06Q 20/425 using two different networks, one for transaction and one for security confirmation
• CPC Class Codes: H04L 2209/12 Details relating to cryptographic hardware or logic circuitry
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 9/10 with particular housing, physical features or manual controls
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853

Abstract

Apparatuses, methods, and systems pertaining to the verification of portable consumer devices are disclosed. In one implementation, a verification token is communicatively coupled to a computer by a USB connection so as to use the computer'"'"'s networking facilities. The verification token reads identification information from a user'"'"'s portable consumer device (e.g., credit card) and sends the information to a validation entry over a communications network using the computer'"'"'s networking facilities. The validation entity applies one or more validation tests to the information that it receives from the verification token. If a selected number of tests are passed, the validation entity sends a device verification value to the verification token, and optionally to a payment processing network. The verification token may enter the device verification value into a CVV field of a web page appearing on the computer'"'"'s display, or may display the value to the user using the computer'"'"'s display.

Claims

1. A verification token comprising:

a peripheral interface adapted to communicatively couple to a peripheral interface of a mobile communications device;

a reader adapted to read identification information from portable consumer devices;

a computer-readable medium;

a data processor electrically coupled to the peripheral interface of the verification token, the reader, and the computer-readable medium;

code embodied on the computer-readable medium that directs the data processor to receive identification information read from a portable consumer device by the reader;

code embodied on the computer-readable medium that directs the data processor to communicate with the mobile communications device by way of the peripheral interface;

code embodied on the computer-readable medium that directs the data processor to transmit at least a portion of the received identification information to an entity; and

code embodied on the computer-readable medium that directs the data processor to receive, after transmitting said identification information, a device verification value from the entity; and

wherein the verification token is configured to be located within a housing of the mobile communications device; and

further comprising

code embodied on the computer-readable medium that directs the data processor to locate a browser web page on the mobile communications device that has a form field for the verification value, and to enter the verification value received from the entity in the form field.

2. The verification token of claim 1, wherein the peripheral interface of the verification token comprises a universal serial bus connection.

3. The verification token of claim 1, wherein the identification information is encrypted and includes an account number of the portable consumer device and at least one of the following:

a digital fingerprint of a magnetic stripe of the portable consumer device, or a variable datum that varies each time the portable consumer device is read for its identification information.

4. The verification token of claim 1, wherein the code that directs the data processor to communicate with the mobile communications device comprises code that directs the data processor to send a device driver to the mobile communications device and an instruction to install the device driver in the operating system of the mobile communications device, wherein the device driver enables the mobile communications device to recognize the verification token and communicate with the verification token.

5. The verification token of claim 1 further comprising a serial number and an encryption key, and wherein the verification token is configured to transmit the serial number and a message encrypted by the encryption key to the entity, the serial number and the encryption key being uniquely assigned to the verification token.

6. The verification token of claim 1,

the form field is a hidden field for the verification value, and the data processor enters the verification value received from the entity into the hidden field.

7. The verification token of claim 1, further comprising:

code embodied on the computer-readable medium that directs the data processor to display the verification value received from the entity to the user on a display of the mobile communications device.

8. The verification token of claim 1, wherein the code that directs the data processor to receive the verification value from the entity further directs the data processor to receive a dynamic account number from the entity.

9. The verification token of claim 8,

wherein the browser web page has an additional form field for the dynamic account number and the data processor automatically enters the dynamic account number in the additional form field.

10. The verification token of claim 8, further comprising:

code embodied on the computer-readable medium that directs the data processor to display the dynamic account number and received from the entity to the user on a display device of the mobile communications device.

11. The verification token of claim 1, further comprising the code that directs the data processor to obtain address information;

and

code embodied on the computer-readable medium that directs the data processor to fill fields in the web page with respective portions of the obtained address information.

12. The verification token of claim 1, further comprising:

code embodied on the computer-readable medium that directs the data processor to prompt a user to enter a password on a keyboard of the mobile communications device, to read a password entered by the user, and to compare the entered password against a stored password embodied on the computer-readable medium; and

code embodied on the computer-readable medium that directs the data processor to prevent identification information from at least being read or sent when the read password is not the same as the stored password.

13. The verification token of claim 1, further comprising:

code embodied on the computer-readable medium that directs the data processor to establish, a communications session with the entity; and

code embodied on the computer-readable medium that directs the data processor to transmit the at least a portion of the received identification information using the established communications session.

14. The verification token of claim 13, wherein the code that directs the data processor to establish a communications session with the entity comprises one or more function calls to an application program interface of a network services module of the mobile communications device, the one or more function calls providing a universal resource identifier of an entity and an instruction to establish a communications session with the entity, the universal resource identifier being stored in the computer-readable medium or read from the portable consumer device.

15. The verification token of claim 14, wherein the communications session is established before the data processor reads device data from the reader.

16. The verification token of claim 14, further comprising code that directs the data processor to select one of a number of universal resource identifiers stored in the token based on a bank number provided in the read identification information or embedded in the account number of the read identification information.

17. The verification token of claim 1, further comprising code that directs the processor to encrypt at least a portion of the identification information prior to transmitting it to the entity.

18. The verification token of claim 1, wherein the verification value is a second verification value, and

wherein the received identification information read by the reader includes an account number and a first verification value provided by the portable consumer device;

wherein the at least a portion of the received identification information transmitted from the verification token to the entity comprises the account number and the first verification value;

wherein the second verification value received by the verification token from the entity is different from the first verification value.

19. The method of claim 1 wherein the reader is an RF ID reader.

20. The method of claim 19 wherein the entity is a payment processing network, which is in communication with an issuer of the portable consumer device.

21. A mobile communication device comprising:

a housing;

a first processor disposed within the housing;

a first memory unit disposed within the housing;

an input-output controller coupled to the first processor;

a verification token disposed within the housing and communicatively coupled to the input-output controller, the verification token comprising a second processor separate from the first processor, a second memory unit separate from the first memory unit, and a reader coupled to the second processor, the reader configured to obtain information from a portable consumer device, the verification token receiving identification information from the portable consumer device by way of the reader, transmit at least a portion of the received identification information to an entity that can provide a verification value by way of the first processor, and receive a verification value from the entity by way of the first processor; and

a battery that supplies power to the verification token.

22. The device of claim 21, wherein the battery also supplies power to at least one of the first processor, the first memory, and the input-output controller.

23. The device of claim 21, wherein the reader has a first operating state to detect the presence of the portable consumer device within a selected distance of the reader, and a second operating state to obtain information from the portable consumer device, wherein the reader moves from its first operating state to its second operating state when the presence of the portable consumer device is detected, and wherein the second operating state of the reader consumes more power from the battery than the first operating state of the reader.

24. The device of claim 23, wherein the second processor has a first operating state where information from the portable consumer device is not processed, and a second operating state where information from the portable consumer device is processed, wherein the second processor moves from its first operating state to its second operating state in response to information being obtained from the portable consumer device by the reader, and wherein the second operating state of the second processor consumes more power from the battery than the first operating state of the second processor.

25. The device of claim 24, wherein the second processor is coupled to the battery during the first and second operating states, wherein the device further comprises clocking circuitry that drives the second processor with a first clock signal during the first operating state and with a second clock signal during the second operating state, and wherein the second clock signal has a higher clocking frequency than the first clock signal.

26. The device of claim 24, wherein the second processor is coupled to the battery during the first and second operating states, wherein the device further comprises clocking circuitry that drives the second processor with a clock signal during the second operating state and withholds the clock signal to the second processor during the first operating state.

27. The device of claim 23, wherein the second processor has a first operating state where information from a portable consumer device is not processed, and a second operating state where information from a portable consumer device is processed, wherein the second processor moves from its first operating state to its second operating state when the presence of a portable consumer device is detected, and wherein the second operating state of the second processor consumes more power from the battery than the first operating state of the second processor.

28. The device of claim 27, wherein the second processor is coupled to the battery during the first and second operating states, wherein the device further comprises clocking circuitry that drives the second processor with a first clock signal during the first operating state and with a second clock signal during the second operating state, and wherein the second clock signal has a higher clocking frequency than the first clock signal.

29. The device of claim 27, wherein the second processor is coupled to the battery during the first and second operating states, wherein the device further comprises clocking circuitry that drives the second processor with a clock signal during the second operating state and withholds the clock signal to the second processor during the first operating state.

30. The device of claim 21, further comprising:

a display screen;

code embodied on the first memory that directs the first data processor to present a web browser on the display screen, the web browser handling one or more browser sessions;

code embodied on the first memory that directs the first data processor to detect a browser session having a selected indication and to send an activation signal to the verification token when the selected indication is detected;

wherein the verification token has a first operating state where information from the portable consumer device is not obtained, and a second operating state where information from the portable consumer device is obtained and processed, and wherein the verification token enters its second operating state in response to receiving the activation signal,

wherein the second operating state of the verification token consumes more power from the battery than the first operating state of the verification token.

31. The device of claim 30, wherein the selected indication comprises an indication that information from the portable consumer device is being requested.

32. The device of claim 30, wherein the selected indication comprises a web page having a field to accept a personal account number of the portable consumer device.

33. The device of claim 30, wherein the selected indication comprises a browser session being conducted with a cryptographic protocol.

34. The device of claim 33, wherein the cryptographic protocol comprises at least one of the Transport Layer Security protocol or the Secure Sockets Layer protocol.

35. The device of claim 30, wherein the selected indication comprises a selected tag of a web page programming language.

36. The device of claim 21, further comprising:

a display screen;

code embodied on the first memory that directs the first data processor to display a first icon on the display screen;

code embodied on the first memory that directs the first data processor to detect a user'"'"'s selection of the first icon and in response there to send an activation signal to the verification token; and

wherein the verification token has a first operating state where information from a portable consumer device is not obtained, and a second operating state where information from a portable consumer device is obtained and processed, wherein the verification token enters its second operating state in response to receiving the activation signal, and wherein the second operating state of the verification token consumes more power from the battery than the first operating state of the verification token.

37. A mobile communication device comprising:

a housing;

a first processor disposed within the housing;

a first memory unit disposed within the housing;

an input-output controller coupled to the first processor;

a card reader configured to obtain information from a portable consumer device;

a second processor disposed within the housing and communicatively coupled to the input-output controller and the card reader, the second processor being separate from the first processor and configured to process information from portable consumer devices;

a battery that supplies power to the first and second processors, the first memory unit, and the card reader.

38. The device of claim 37, wherein the second processor has a first operating state where information from a portable consumer device is not processed, and a second operating state where information from a portable consumer device is processed, wherein the second processor moves from its first operating state to its second operating state when the presence of a portable consumer device is detected, and wherein the second operating state of the second processor consumes more power from the battery than the first operating state of the second processor.

39. The device of claim 38, wherein the second processor is coupled to the battery during the first and second operating states, wherein the device further comprises clocking circuitry that drives the second processor with a first clock signal during the first operating state and with a second clock signal during the second operating state, and wherein the second clock signal has a higher clocking frequency than the first clock signal.

40. The device of claim 38, wherein the second processor is coupled to the battery during the first and second operating states, wherein the device further comprises clocking circuitry that drives the second processor with a clock signal during the second operating state and withholds the clock signal to the second processor during the first operating state.