Method and apparatus for using at least a portion of a one-time password as a dynamic card verification value

• US 9,477,959 B2
• Filed: 01/27/2016
• Issued: 10/25/2016
• Est. Priority Date: 11/15/2006
• Status: Active Grant

• Current Assignee: Bank of America Corp.
• Original Assignee: Bank of America Corp.
• Inventors: Ashfield, James M.
• Primary Examiner(s): KELLY, RAFFERTY D
• Application Number:
  US15/008,056
• Publication Number:
  US 20160217471A1
• Time in Patent Office: 272 Days
• Field of Search: 235/380
• US Class Current: 1/1
• CPC Class Codes: G06Q 20/24 Credit schemes, i.e. "pay after"
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 20/3827 Use of message hashing
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/4018 using the card verification value [CVV] associated with the card
• CPC Class Codes: G06Q 20/409 Device specific authentication in transaction processing
• CPC Class Codes: G06Q 20/40975 using encryption therefor
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system

Abstract

Method and apparatus for using at least a portion of a one-time password as a dynamic card verification value (CVV) are disclosed. A credit/debit card is able to generate a dynamic card verification value (CVV). Such a card may also include an indication that the dynamic CVV is to be used as a security code for purchasing or other transactions. A card-based financial transaction can be authorized in accordance with the use of a dynamic CVV by receiving a transaction authorization request for a specific credit/debit card, wherein the transaction authorization request includes a dynamic CVV. The dynamic CVV can be compared to at least a portion of a one-time password generated for the specific credit/debit card, and a transaction authorization can be sent to the merchant or vendor when the dynamic CVV matches all or a portion of the one-time password.

Claims

1. An apparatus for authorizing a transaction, wherein the transaction involves a credit/debit card,

wherein the credit/debit card comprises:

a visual display;

a speaker;

one or more input devices positioned on the credit/debit card configured to receive as an input a challenge response, wherein the one or more input devices comprise two or more of buttons corresponding to a plurality of alpha-numeric characters;

a processor in communication with the one or more input devices positioned on the credit/debit card, wherein the processor is configured to;

generate a challenge;

present, via the visual display and the speaker of the credit/debit card, the challenge;

receive, via the plurality of buttons on the credit/debit card, a challenge response comprising alpha-numeric characters; and

determine whether or not the challenge response received into the credit/debit card is successful; and

a one-time password generator automatically generating a one-time password or value based at least partially on receiving the challenge response into the credit/debit card and determining that the challenge response is successful,

wherein the apparatus comprises;

means for receiving a transaction authorization request associated with the transaction involving the credit/debit card, wherein the transaction authorization request comprises a prompt for a card verification value (CVV) for authenticating the transaction;

means for presenting, via the visual display and the speaker of the credit/debit card, the one-time password, wherein a portion of the one-time password comprises a dynamic card verification value (CVV) for authenticating the transaction;

means for comparing the dynamic CVV generated by the credit/debit card to at least a portion of an externally generated one-time password for the credit/debit card; and

means for sending a transaction authorization involving the credit/debit card if the dynamic CVV generated by the credit/debit card matches the at least a portion of an externally generated one-time password for the credit/debit card.

2. The apparatus of claim 1 further comprising means for sending a transaction denial when the dynamic CVV does not match the at least a portion of the one-time password.

3. The apparatus of claim 1 wherein the at least a portion of the one-time password comprises three digits of a six-digit one-time password.

4. The apparatus of claim 1 further comprising:

means for separating the dynamic CVV from credit/debit card data;

means for validating the credit/debit card data; and

means for merging the dynamic CVV with the credit/debit card data to produce the transaction authorization.

5. The apparatus of claim 3 further comprises a united authentication server wherein the means for comparing of the dynamic CVV to the three digits of the six-digit one-time password is accomplished using a united authentication server.

6. The apparatus of claim 1 wherein the dynamic CVV is based at least partially on the challenge response input by the user into the credit/debit card.

7. A system for authorizing a transaction, wherein the transaction involves a credit/debit card,

wherein the credit/debit card comprises:

a visual display;

a speaker;

one or more input devices positioned on the credit/debit configured to receive as an input a challenge response, wherein the one or more input devices comprise two or more-buttons corresponding to a plurality of alpha-numeric characters;

a processor in communication with the one or more input devices positioned on the credit/debit card, wherein the processor is configured to;

generate a challenge;

present, via the visual display and the speaker of the credit/debit card, the challenge;

receive, via the plurality of buttons on the credit/debit card, a challenge response comprising alpha-numeric characters; and

determine whether or not the challenge response received into the credit/debit card is successful; and

a one-time password generator automatically generating a one-time password or value based at least partially on receiving the challenge response into the credit/debit card and determining that the challenge response is successful,

wherein the system comprises;

a card approval server configured to receive a transaction authorization request associated with a transaction involving the credit/debit card, wherein the transaction authorization request comprises a prompt for a card verification value (CVV) for authenticating the transaction;

the visual display and the speaker of the credit/debit card to present the one-time password, wherein a portion of the one-time password comprises a dynamic card verification value (CVV) for authenticating the transaction;

an intermediate server configured to identify the dynamic CVV from a static CVV and to separate the dynamic CVV from credit/debit card data;

a database interconnected with the card approval server and the intermediate server and configured to validate the credit/debit card data; and

an authentication server interconnected with the intermediate server and configured to compare the dynamic CVV with at least a portion of an externally generated one-time password to authenticate the dynamic CVV.

8. The system of claim 7 wherein the database further comprises:

a credit card database; and

a debit card database.

9. The system of claim 7 wherein the intermediate server is disposed within a middleware layer.

10. The system of claim 7 wherein the at least a portion of the one-time password comprises three digits of a six-digit one-time password.

11. The system of claim 10 further comprising a united authentication server wherein the comparing of the dynamic CVV to the three digits of the six-digit one-time password is accomplished.

12. The system of claim 7 wherein the dynamic CVV is based at least partially on the challenge response input by the user into the credit/debit card.