Secure Communication of payment information to merchants using a verification token

• US 8,893,967 B2
• Filed: 09/09/2010
• Issued: 11/25/2014
• Est. Priority Date: 05/15/2009
• Status: Active Grant

• Current Assignee: Visa International Service Association (Visa, Inc.)
• Original Assignee: Visa International Service Association (Visa, Inc.)
• Inventors: Hammad, Ayman
• Primary Examiner(s): HESS, DANIEL A
• Application Number:
  US12/878,947
• Publication Number:
  US 20100327054A1
• Time in Patent Office: 1,538 Days
• Field of Search: 235/375, 235/382, 235/380
• US Class Current: 235/382
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/42 using separate channels for security data
• CPC Class Codes: G06Q 20/105 involving programming of a portable memory device, e.g. IC cards, "electronic purses"
• CPC Class Codes: G06Q 20/12 specially adapted for electronic shopping systems
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/3226 Use of secure elements separate from M-devices
• CPC Class Codes: G06Q 20/3255 using mobile network messaging services for payment, e.g. SMS
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G06Q 20/4018 using the card verification value [CVV] associated with the card
• CPC Class Codes: G06Q 20/425 using two different networks, one for transaction and one for security confirmation

Abstract

Disclosed are apparatuses, systems, and methods pertaining to the secure communication of payment information from portable consumer devices, such as credit cards, to online merchants using verification tokens.

Claims

1. A method comprising:

establishing a communication link between a verification token and a computer, the computer having a networking facility, an Internet browser, and a display having a merchant web page of a merchant displayed thereon by the Internet browser;

reading identification information from a portable consumer device into the verification token;

obtaining a merchant identifier that identifies the merchant of the web page; and

transmitting, using the networking facility of the computer, at least a portion of the read identification information and the obtained merchant identifier from the verification token to a validation entity, wherein the validation entity thereafter provides at least a portion of the read identification information to the merchant webpage via a communication channel between the merchant webpage and the validation entity.

2. The method of claim 1, wherein transmitting the at least a portion of the read identification information comprises:

establishing a communication link between the verification token and the validation entity using the networking facility of the computer.

3. The method of claim 1, wherein obtaining the merchant identifier comprises displaying a dialog box on a display with a request for a user to enter the merchant identifier.

4. The method of claim 1, wherein obtaining the merchant identifier comprises obtaining the universal resource locator of the merchant page and extracting the merchant identifier from the obtained universal resource locator.

5. The method of claim 1, wherein obtaining the merchant identifier comprises reading a field on the merchant web page.

6. The method of claim 1, further comprising:

obtaining a transaction identifier that identifies the transaction related to the merchant page; and

transmitting, using the networking facility of the computer, the obtained transaction identifier from the verification token to the entity that can provide at least a portion of the read identification information to the merchant.

7. The method of claim 6, wherein the transaction identifier comprises an IP address assigned to the computer.

8. The method of claim 1, further comprising:

encrypting, in the verification token, at least a portion of the identification information read from the portable consumer device.

9. The method of claim 1 further comprising:

prompting a user to enter a password into the computer;

reading a password entered by the user;

comparing the entered password against a password stored in the verification token; and

preventing identification information from at least being read or sent when the read password is not the same as the stored password.

10. The method of claim 1 further comprising:

transmitting from the verification token to the entity through the networking facility of the computer a serial number stored in the verification token and a message encrypted by an encryption key stored in the verification token, the serial number and the encryption key being uniquely assigned to the verification token.

11. The method of claim 1 further comprising:

after transmitting the at least a portion of the read identification information, receiving, at the verification token, a device verification value from the entity by way of the networking facility of the computer.

12. The method of claim 11 further comprising at least one of the actions of:

displaying the device verification value received from the entity to the user on the display of the computer; and

locating a browser web page on the computer that has a form field for a device verification value, and entering the device verification value received from the entity in the form field.

13. A system comprising a verification token and a computer, the system being configured to:

establish a communication link between the verification token and the computer, the computer having a networking facility, an Internet browser, and a display having a merchant web page of a merchant displayed thereon by the Internet browser;

read identification information from a portable consumer device into the verification token;

obtain a merchant identifier that identifies the merchant of the web page; and

transmit, using the networking facility of the computer, at least a portion of the read identification information and the obtained merchant identifier from the verification token to a validation entity, wherein the validation entity thereafter provides at least a portion of the read identification information to the merchant webpage via a communication channel between the merchant webpage and the validation entity.

14. The system of claim 13, wherein the system is further configured to display a dialog box on a display with a request for a user to enter the merchant identifier.

15. The system of claim 13, wherein the system is further configured to obtain the universal resource locator of the merchant page and extract the merchant identifier from the obtained universal resource locator.

16. The system of claim 13, wherein the system is further configured to:

obtain a transaction identifier that identifies the transaction related to the merchant page; and

transmit, using the networking facility of the computer, the obtained transaction identifier from the verification token to the entity that can provide at least a portion of the read identification information to the merchant.

17. The system of claim 16, wherein the transaction identifier comprises an IP address assigned to the computer.

18. The system of claim 13, wherein the system is further configured to:

encrypt, in the verification token, at least a portion of the identification information read from the portable consumer device.

19. The system of claim 13 wherein the system is further configured to:

prompt a user to enter a password into the computer;

read a password entered by the user;

compare the entered password against a password stored in the verification token; and

prevent identification information from at least being read or sent when the read password is not the same as the stored password.

20. The system of claim 13 wherein the system is further configured to:

transmit from the verification token to the entity through the networking facility of the computer a serial number stored in the verification token and a message encrypted by an encryption key stored in the verification token, the serial number and the encryption key being uniquely assigned to the verification token.

21. The method of claim 13 wherein the system is further configured to perform at least one of the actions of:

displaying the device verification value received from the entity to the user on a display of the computer; and

locating a browser web page on the computer that has a form field for a device verification value, and entering the device verification value received from the entity in the form field.