Systems and methods for identity verification for secure transactions

• US 20020029342A1
• Filed: 07/27/2001
• Published: 03/07/2002
• Est. Priority Date: 09/07/2000
• Status: Active Grant

• Current Assignee: swivel secure Ltd. (Marr Group Holdings Ltd.)
• Original Assignee: swivel secure Ltd. (Marr Group Holdings Ltd.)
• Inventors: Keech, Winston Donald
• Granted Patent: US 7,392,388 B2
• Time in Patent Office: Days
• US Class Current: 713/184
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/10 specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
• CPC Class Codes: G06Q 20/12 specially adapted for electronic shopping systems
• CPC Class Codes: G06Q 20/32 using wireless devices
• CPC Class Codes: G06Q 20/322 Aspects of commerce using mobile devices [M-devices]
• CPC Class Codes: G06Q 20/347 Passive cards
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/388 using mutual authentication without cards, e.g. challenge-response
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G06Q 20/425 using two different networks, one for transaction and one for security confirmation
• CPC Class Codes: G07F 7/10 together with a coded signal , e.g. in the form of personal identification information, like personal identification number [PIN] or biometric data
• CPC Class Codes: G07F 7/1075 PIN is checked remotely

Abstract

A method and system for secure identification of a person in an electronic communications environment, wherein a host computer is adapted to be able to communicate with a plurality of electronic devices operated by the user. The user is issued with a user code, known only to the user and stored in the host computer. When the user is required to identify themselves to the host computer, the host computer generates a pseudo-random security string and applies the user code to the pseudo-random security string to generate a transaction code. The host computer also transmits the pseudo-random security string to one of the electronic devices which is displayed by the electronic device to the user. The user applies their known user code to the displayed pseudo-random security string and determines the transaction code. The user enters the transaction code into an electronic device and the entered transaction code is then transmitted back to the host computer. Positive identification is achieved when the host computer determined transaction code matches the transaction code entered by the user. In addition, the system could employ a secure user code entry interface which would allow secure input of the user code.

Claims

1. An identity verification secure transaction system comprising:

a host computer for storing a user code associated with a user, for supplying a pseudo-random security string for a transaction, wherein said host computer determines a one time transaction code by applying said user code to said pseudo-random security string; and

at least one electronic device in electronic communication with said host computer for administering said transaction by receiving and displaying said pseudo-random security string and for receiving a user transaction input code, wherein said user transaction input code is determined by applying said user code to said pseudo-random security string displayed on said at least one electronic device and said user transaction input code is sent to said host computer;

wherein said host computer verifies that said user input code matches said one time transaction code.

2. The system of claim 1, wherein said at least one electronic device is an Electronic Funds Transfer Point of Sale (EFT/POS) device.

3. The system of claim 1, wherein said at least one electronic device is comprised of an electronic Funds Transfer Point of Sale (EFT/POS) device for administering said transaction and receiving said user transaction input code and a wireless device associated with said user for receiving and displaying said pseudo-random security string.

4. The system of claim 3, where said one time transaction code is received and displayed by said wireless device instead of said pseudo-random security string.

5. The system of claim 1, wherein said at least one electronic device is a wireless device associated with said user.

6. The system of claim 5, wherein said one time transaction code is sent to said wireless device instead of said pseudo-random security string.

7. The system of claim 1, wherein said at least one electronic device is comprised of:

a user computer, in electronic communication with said host computer, for receiving and displaying said pseudo-random security string and receiving said user transaction input code; and

a merchant computer, in electronic communication with said user computer and said host computer, for administering said transaction, wherein one of said at least one electronic device relays said user transaction input code to said host computer for user identity verification.

8. The system of claim 7, wherein said user computer and said merchant computer communicate via the Internet.

9. The system of claim 7, wherein said one time transaction code is received and displayed by said user computer instead of said pseudo-random security string.

10. The system of claim 1, wherein said at least one electronic device is comprised of:

a wireless device associated with said user for receiving and displaying said pseudo-random security string,

a user computer, in electronic communication with said host computer, for receiving said user transaction input code; and

a merchant computer, in electronic communication with said user computer and said host computer, for administering said transaction, wherein one of said at least one electronic device relays said user transaction input code to said host computer for user identity verification.

11. The system of claim 10, wherein said one time transaction code is received and displayed by said wireless device instead of said pseudo-random security string.

12. The system of claim 1, wherein said host computer upon verification allows completion of said transaction.

13. The system of claim 1, wherein said host computer upon verification allows access to a database.

14. The system of claim 1, wherein said host computer upon verification allows access to account information.

16. The method of claim 15, further including the step of completing a transaction when said transaction code and said user transaction input code match.

17. The method of claim 16, further including the step of providing access to a database when said transaction code and said user transaction input code match.

18. The method of claim 16, further including the step of providing access to account information when said transaction code and said user transaction input code match.

19. The method of claim 15, further including the step of transmitting and displaying said pseudo-random security string on an Electronic Funds Transfer Point of Sale (EFT/POS) device.

20. The method of claim 15, further including the step of transmitting and displaying said pseudo-random security string on a wireless device associated with said user.

21. The method of claim 15, further including the step of transmitting and displaying said pseudo-random security string on a user computer wherein said user computer is in electronic communication with said host computer.

22. The method of claim 21, further including the step of communicating between the said host computer and said user computer via the Internet.

23. The method of claim 15, further including the step of transmitting and display said transaction code to said at least one electronic device.

25. The secure user code entry interface system of claim 24, wherein said response is entered by keying any one of a plurality of keys of a keyboard.

26. The secure user code entry interface system of claim 24, wherein said response is entered by keying any one of a plurality of keys of a mouse.

27. The secure user code entry interface system of claim 24, wherein said response is entered through any area of a touch sensitive display.

28. The secure user code entry interface system of claim 24, wherein said secure user code entry interface program contains a plurality of cycles of said at least one active displays for entry of each digit of said user code.

29. The secure user code entry interface system of claim 24, wherein said random run on time is less than three (3) seconds.

15. A method of verifying an identity for conducting secure transactions comprising the steps of:

storing information about a user pin associated with a host computer;

generating a pseudo-random security string by said host computer;

determining a transaction code by applying said user pin to said pseudo-random security string;

transmitting said pseudo-random security string to at least one electronic device,

displaying said pseudo-random security string on said at least one electronic device for use by said user to determine a user transaction input code by applying said user code to said pseudo-random security string;

inputting said user transaction input code on said at least one electronic device;

transmitting said user transaction input code from said at least one electronic device to said host computer; and

determining, by said host computer, whether said transaction code and said user transaction input code match.

24. A secure user code entry interface system comprising:

a secure user code entry interface for entry of a user code on an electronic device wherein said electronic device has a display;

wherein said secure user code entry interface contains at least one active display for entry of at least one digit of said user code by a user;

wherein said active display illuminates at least one display digit within said active display and said user enters said at least one digit of said user code by a response through an input device at a response time when said at least one display digit which corresponds with said at least one digit of said user code is illuminated in said active display; and

a random run on time is added to said response time to extend said at least one active display.

30. An identity verification secure transaction system comprising:

a host computer for storing a user code associated with a user;

an electronic device in electronic communication with said host computer, wherein said electronic device has a display and a user input device; and

a secure user code entry interface viewable on said display of said at least one electronic device for entry of said user code, wherein said secure user code entry interface contains at least one cycle with an active display for entry of said user code;

wherein said user enters at least one user code digit of said user code by a response through said user input device at a response time when a display digit which corresponds with said at least one user code digit of said user code is illuminated in said active display, and

wherein said each digit of said at least one user code digit if entered in each cycle of said at least one cycle and a random run on time is added to said response time to extend each cycle of said at least one cycle; and

wherein the entered said user code is transmitted to said host computer for verification with the stored said user code.

31. The identity verification secure transaction system of claim 30, wherein said response is entered by keying any one of a plurality of keys of a keyboard.

32. The identity verification secure transaction system of claim 30, wherein said response is entered through any area of a touch sensitive display.