Integration of verification tokens with mobile communication devices

• US 10,387,871 B2
• Filed: 05/11/2018
• Issued: 08/20/2019
• Est. Priority Date: 05/15/2009
• Status: Active Grant

• Current Assignee: Visa International Service Association (Visa, Inc.)
• Original Assignee: Visa International Service Association (Visa, Inc.)
• Inventors: Hammad, Ayman
• Primary Examiner(s): Lee, Michael G
• Assistant Examiner(s): Tardif, David
• Application Number:
  US15/977,921
• Publication Number:
  US 20180262334A1
• Time in Patent Office: 466 Days
• Field of Search: 235375
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user
• CPC Class Codes: G06Q 20/12 specially adapted for electronic shopping systems
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/352 Contactless payments by cards
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4018 using the card verification value [CVV] associated with the card
• CPC Class Codes: G06Q 20/42 Confirmation, e.g. check or permission by the legal debtor of payment
• CPC Class Codes: G06Q 20/425 using two different networks, one for transaction and one for security confirmation
• CPC Class Codes: H04L 2209/12 Details relating to cryptographic hardware or logic circuitry
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 9/10 with particular housing, physical features or manual controls
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853

Abstract

Apparatuses, methods, and systems pertaining to the verification of portable consumer devices are disclosed. In one implementation, a verification token is communicatively coupled to a computer by a USB connection so as to use the computer'"'"'s networking facilities. The verification token reads identification information from a user'"'"'s portable consumer device (e.g., credit card) and sends the information to a validation entry over a communications network using the computer'"'"'s networking facilities. The validation entity applies one or more validation tests to the information that it receives from the verification token. If a selected number of tests are passed, the validation entity sends a device verification value to the verification token, and optionally to a payment processing network. The verification token may enter the device verification value into a CVV field of a web page appearing on the computer'"'"'s display, or may display the value to the user using the computer'"'"'s display.

Claims

1. A method comprising:

receiving, by a validation entity computer, encrypted or signed identification information from a mobile communication device comprising (i) a housing, (ii) a first processor disposed within the housing, (iii) a first memory unit disposed within the housing, (iv) an input-output controller coupled to the first processor, (iv) a verification token disposed within the housing and communicatively coupled to the input-output controller, (v) a second processor separate from the first processor, and (vi) a second memory unit that is separate from the first memory unit and stores an encryption key, wherein the encrypted or signed identification information from the mobile communication device was encrypted or signed by the second processor using the encryption key;

validating, by the validation entity computer, the encrypted or signed identification information; and

after the validation entity computer validates the encrypted or signed identification, then transmitting a dynamic account number or verification value to the mobile communication device.

2. The method of claim 1, wherein the encryption key is a symmetric encryption key.

3. The method of claim 1, wherein the mobile communication device is a mobile phone.

4. The method of claim 1, wherein the verification token is protected from attacks from hackers.

5. The method of claim 1, wherein the second memory unit is a security module.

6. The method of claim 1, wherein the verification token stores a uniform resource identifier for the validation entity computer.

7. The method of claim 1, wherein the encryption key is a first encryption key, and validating comprises:

decrypting, by the validation entity computer, the encrypted identification information using a second key that corresponds to the first encryption key; and

applying a validation test to the decrypted information.

8. The method of claim 1, wherein the validation entity computer transmits the dynamic account number to the mobile communication device, wherein the dynamic account number is used by the mobile communication device to conduct a transaction.

9. The method of claim 1, wherein the validation entity computer communicates with an issuer to obtain the dynamic account number, and wherein the validation entity computer transmits the dynamic account number to the mobile communication device.

10. The method of claim 1, wherein validating the encrypted or signed identification information is one of a plurality of validation tests that are performed by the validation entity computer before transmitting the dynamic account number or the verification value to the mobile communication device.

11. A validation entity computer comprising:

a processor; and

a computer readable medium, the computer readable medium comprising code, executable by the processor, to implement a method comprising;

receiving encrypted or signed identification information from a mobile communication device comprising (i) a housing, (ii) a first processor disposed within the housing, (iii) a first memory unit disposed within the housing, (iv) an input-output controller coupled to the first processor, (iv) a verification token disposed within the housing and communicatively coupled to the input-output controller, (v) a second processor separate from the first processor, and (vi) a second memory unit that is separate from the first memory unit and stores an encryption key, wherein the encrypted or signed identification information from the mobile communication device was encrypted or signed by the second processor using the encryption key;

validating the encrypted or signed identification information; and

after validating, transmitting a dynamic account number or verification value to the mobile communication device.

12. The validation entity computer of claim 11, wherein the encryption key is a symmetric encryption key.

13. The validation entity computer of claim 11, wherein the mobile communication device is a mobile phone.

14. The validation entity computer of claim 11, wherein the verification token is protected from attacks from hackers.

15. The validation entity computer of claim 11, wherein the second memory unit is a security module.

16. The validation entity computer of claim 11, wherein the verification token stores a uniform resource identifier for the validation entity computer.

17. The validation entity computer of claim 11, wherein the encryption key is a first encryption key, and validating comprises:

decrypting, by the validation entity computer, the encrypted identification information using a second key that corresponds to the first encryption key; and

applying a validation test to the decrypted information.

18. The validation entity computer of claim 11, wherein the validation entity computer is configured to transmit the dynamic account number to the mobile communication device, wherein the dynamic account number is used by the mobile communication device to conduct a transaction.

19. The validation entity computer of claim 11, wherein the validation entity computer is configured to communicate with an issuer to obtain the dynamic account number, and wherein the validation entity computer is configured to transmit the dynamic account number to the mobile communication device.

20. The validation entity computer of claim 11, wherein validating the encrypted or signed identification information is one of a plurality of validation tests that are performed by the validation entity computer before transmitting the dynamic account number or the verification value to the mobile communication device.