Verification of portable consumer device for secure services

• US 9,105,027 B2
• Filed: 05/13/2011
• Issued: 08/11/2015
• Est. Priority Date: 05/15/2009
• Status: Active Grant

• Current Assignee: Visa International Service Association (Visa, Inc.)
• Original Assignee: Visa International Service Association (Visa, Inc.)
• Inventors: Hammad, Ayman, Faith, Patrick, Koganti, Krishna Prasad, Rewis, Ben, Louis, Brendan Xavier, Weller, Kevin, Dominguez, Benedicto Hernandez
• Primary Examiner(s): Lee, Michael G
• Assistant Examiner(s): CHEDEKEL, TABITHA F
• Application Number:
  US13/107,715
• Publication Number:
  US 20120018506A1
• Time in Patent Office: 1,551 Days
• Field of Search: 235/375, 235/379, 235/380, 235/487, 235/492, 705/1.1, 705/44, 705/50, 705/64, 705/75, 726/2, 726/36, 726/37, 713/168, 713/189, 713/300
• US Class Current: 1/1
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user
• CPC Class Codes: G06Q 20/12 specially adapted for electronic shopping systems
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/409 Device specific authentication in transaction processing
• CPC Class Codes: G06Q 20/42 Confirmation, e.g. check or permission by the legal debtor of payment
• CPC Class Codes: G06Q 20/425 using two different networks, one for transaction and one for security confirmation
• CPC Class Codes: G06Q 2220/00 Business processing using cryptography
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 9/0866 involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3273 for mutual authentication network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869

Abstract

Apparatuses, methods, and systems pertaining to the verification of portable consumer devices for 3-D Secure Systems are disclosed. In one implementation, a verification token is coupled to a computer by a USB connection so as to use the computer'"'"'s networking facilities. The verification token reads identification information from a user'"'"'s portable consumer device (e.g., credit card) and sends the information to a validation entry over a communications network using the computer'"'"'s networking facilities. The validation entity applies one or more validation tests to the information that it receives from the verification token. If a selected number of tests are passed, the validation entity sends a 3-D Secure datum to the verification token. The verification token may enter the 3-D Secure datum into a hidden field of a Purchase Authentication Page appearing on the computer'"'"'s display.

Claims

1. A computer program product embodied on a computer-readable medium, the product comprising:

code that directs a data processor to receive a request for a secure datum for a portable consumer device associated with a user, the request comprising identification information pertaining to the portable consumer device, the identification information including an account number that was assigned to the portable consumer device by an issuer, and that was embedded in the portable consumer device prior to receiving the request for the secure datum, wherein the account number is configured to be read and directly used by a payment processing network to identify an account of the user that the payment processing network can use to process payment transactions for the user;

code that directs the data processor to apply at least one validation test pertaining to the received request, wherein the validation test is a test that determines whether the verification token is authentic or whether the verification token has been involved in fraudulent transactions; and

code that directs the data processor to send, if the at least one validation test is passed, a secure datum to a verification token associated with the user or to an entity configured to forward the secure datum to the token, wherein the secure datum is configured to be entered onto a Purchase Authentication Page by the verification token.

2. The computer program product of claim 1, further comprising code that directs the data processor to send, if the at least one validation test is passed, the secure datum to an entity of a 3-D Secure System.

3. The computer program product of claim 1, further comprising code that directs the data processor to receive a serial number of the verification token and a test message encrypted by the verification token with an encryption key;

and

wherein the code that directs the data processor to apply at least one validation test comprises code that directs the data processor to access a database to obtain a key and one or more acceptable messages, and code that direct the data processor to validate the encrypted test message using the encrypted test message, the obtained key, and the obtained one or more acceptable messages.

4. The computer program product of claim 3, wherein the code that directs the data processor to validate the encrypted test message comprises code that directs the data processor to decrypt the encrypted test message using the obtained key, and code that directs the data processor to compare the decrypted test message to the one or more acceptable messages for a match.

5. The computer program product of claim 3, wherein the code that directs the data processor to validate the encrypted test message comprises code that directs the data processor to encrypt the obtained one or more acceptable messages with the obtained key, and to compare the encrypted test message to the one or more encrypted acceptable messages for a match.

6. The computer program product of claim 1, further comprising code that directs the data processor to receive a serial number of the verification token;

and

code that directs the data processor to have the received serial number compared with serial numbers stored in a database that stores serial numbers of suspicious tokens.

7. The computer program product of claim 1 wherein the verification token is coupled to a computer to access a networking facility of the computer, and wherein the product further comprises:

code that directs the data processor to receive one or more data messages having information specific to the computer, the information being obtained by the token, and

code that directs the data processor to have the received information compared with information stored in a database that stores computer-specific information of suspicious computers for a match.

8. The computer program product of claim 1 wherein the request for a secure datum is conveyed by way of a network packet on a communications network, and wherein the code that directs the data processor to apply at least one validation test comprises:

code that directs the direct processor to obtain a source IP address from the network packet; and

code that directs the data processor to have the obtained source IP address compared with suspect IP addresses stored in a database for a match.

9. The computer program product of claim 1, wherein the received identification information further includes a digital fingerprint of a magnetic stripe of the portable consumer device;

and

wherein the code that directs the data processor to apply at least one validation test comprises instructions that direct the data processor to obtain a valid digital fingerprint for the portable consumer device having the account number in the received identification information, and to compare the digital fingerprint in the received identification information to the valid digital fingerprint.

10. The computer program product of claim 1, wherein the received identification information further includes a variable datum that varies each time the portable consumer device is read for its identification information;

and

wherein the code that directs the data processor to apply at least one validation test comprises instructions that direct the data processor to obtain one or more acceptable datum values for the portable consumer device having the account number in the received identification information, and to compare the variable datum in the received identification information to the obtain one or more acceptable datum values for a match.

11. The computer program product of claim 1, wherein the received identification information further includes a variable datum that varies each time the portable consumer device is read for its identification information;

and

wherein the code that directs the data processor to apply at least one validation test comprises instructions that direct the data processor to send the account number and the variable datum to an issuing bank with a request for the bank to determine if the variable datum is valid, and instructions that direct the data processor to receive the issuing bank'"'"'s determination.

12. The computer program product of claim 1, wherein the code that directs the data processor to apply at least one validation test comprises instructions that direct the data processor to apply at least two validation tests pertaining to the received request.

13. The computer program product of claim 1, further comprising code that directs the data processor to communicate with the verification token over a communications network with a computer disposed between the verification token and the communications network, the verification token being communicatively coupled to the computer by way of a peripheral interface of the computer and configured to access a networking facility of the computer.

14. The computer program product of claim 13, further comprising code that directs the data processor to establish a communications session with the computer that is secured by one or more encryption keys;

and

wherein the request for the secure datum is received through the communications session; and

wherein the secure datum is provided through the communications session.

15. The computer program product of claim 1, further comprising code that directs the data processor to send, if the at least one validation test is passed, a device verification value to the token or to an entity configured to forward the device verification value to the token.

16. The computer program product of claim 15, further comprising code that directs the data processor to send, if the at least one validation test is passed, a dynamic account number to the token or to an entity configured to forward the dynamic account number to the token.

17. The computer program product of claim 1, further comprising code that directs the data processor to send, if the at least one validation test is passed, address information to the token or to an entity configured to forward the address information to the token.

18. The computer program product of claim 1, further comprising code that directs that data processor to identify a mobile phone number or universal resource identifier of a portable communications device associated with the portable consumer device indicated in the received identification information, and

code that directs that data processor to send a message to the identified mobile phone number or universal resource identifier indicating that a request has been made for a secure datum for the user'"'"'s portable consumer device.

19. The computer program product of claim 1, further comprising:

code that directs that data processor to identify an email address associated with the portable consumer device indicated in the received identification information; and

code that directs that data processor to send a message to the identified email address indicating that a request has been made for a secure datum for the user'"'"'s portable consumer device.

20. A validation entity incorporating the computer program product of claim 1, the validation entity comprising a data processor, a networking facility coupled to the processor, a computer-readable medium coupled to the processor, and the computer program product embodied on the computer-readable medium.

21. A method of providing secure datums, the method comprising:

receiving, at a server, a request for a secure datum for a portable consumer device associated with a user, the request comprising identification information pertaining to the portable consumer device, the identification information including an account number that was assigned to the portable consumer device by an issuer, and that was embedded in the portable consumer device prior to receiving the request for the secure datum, wherein the account number is configured to be read and directly used by a payment processing network to identify an account of the user that the payment processing network can use to process payment transactions for the user;

applying at least one validation test pertaining to the received request, wherein the validation test is a test that determines whether the verification token is authentic or whether the verification token has been involved in fraudulent transactions; and

sending, if the at least one validation test is passed, a secure datum to a verification token associated with the user or to an entity configured to forward the secure datum to the token, wherein the secure datum is configured to be entered onto a Purchase Authentication Page by the verification token.

22. The method of claim 21 further comprising:

sending the secure datum to an entity of a 3-D Secure System if the at least one validation test is passed.

23. The method of claim 21 further comprising:

receiving a serial number of the verification token and comparing the serial number of the verification token with other serial numbers of suspicious verification tokens.

24. The method of claim 21 further comprising:

receiving a serial number of the verification token and a test message encrypted by the verification token with an encryption key,

wherein applying at least one validation test comprises accessing a database to obtain a key and one or more acceptable messages, and validating the encrypted test message using the encrypted test message, the obtained key, and the obtained one or more acceptable messages.

25. The method of claim 24, wherein validating the encrypted test message comprises decrypting the encrypted test message using the obtained key, and comparing the decrypted test message to the one or more acceptable messages for a match.

26. The method of claim 24, wherein validating the encrypted test message comprises encrypting the obtained one or more acceptable messages with the obtained key, and comparing the encrypted test message to the one or more encrypted acceptable messages for a match.