RF TRANSACTION AUTHENTICATION USING A RANDOM NUMBER

• US 20090044012A1
• Filed: 10/22/2008
• Published: 02/12/2009
• Est. Priority Date: 07/10/2001
• Status: Active Grant

• Current Assignee: Liberty Peak Ventures, LLC (Dominion Harbor Enterprises, LLC)
• Original Assignee: American Express Travel Related Services Company, Inc. (American Express Company), Xatra Fund MX LLC (Intellectual Ventures LLC)
• Inventors: Bishop, Fred, Saunders, Peter D.
• Granted Patent: US 8,066,181 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: G06Q 20/00 Payment architectures, schemes or protocols apparatus for performing or posting payment transactions G07F7/08, G07F19/00; electronic cash registers G07G1/12
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/10 specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
• CPC Class Codes: G06Q 20/14 specially adapted for billing systems
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/327 Short range or proximity payments by means of M-devices
• CPC Class Codes: G06Q 20/3278 RFID or NFC payments by means of M-devices
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/352 Contactless payments by cards
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G07C 9/28 the pass enabling tracking or indicating presence
• CPC Class Codes: G07C 9/29 the pass containing active electronic elements, e.g. smartcards
• CPC Class Codes: G07F 7/1083 Counting of PIN attempts
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083

Abstract

A system and method for securing Radio Frequency Identification (RFID) transactions is provided. An exemplary method includes using a random number in an authentication tag and authorizing an RF transaction in response to verifying the authentication tag. The method may also involve variously validating an RFID device authentication tag and an RFID reader authentication tag. Additionally, a system and method is disclosed for verifying an RFID transaction device and RFID reader operable with an RF transaction system. The method involves presenting an RFID device to an RFID reader, receiving a random number, creating an RFID transaction device authentication tag using the random number and a counter value, providing the RFID transaction device authentication tag to an RFID reader, creating an RFID reader authentication tag using the counter, random number, and RFID authentication tag, and providing the RFID reader authentication tag and RFID transaction device authentication tag for authentication.

Claims

1. A method comprising:

generating, in a radio frequency identification (RFID) transaction device, an RFID transaction device authentication tag using a random number, a transaction device identifier, and a counter value, wherein the random number is received from an RFID reader;

transmitting the RFID transaction device authentication tag to the RFID reader; and

incrementing the counter value;

wherein an RFID transaction is authorized in response to verification of the RFID transaction device authentication tag.

2. The method of claim 1, further comprising transmitting unencrypted data, the counter value, and the random number to the RFID reader.

3. The method of claim 1, further comprising encrypting the RFID transaction device authentication tag using an RFID transaction device encryption key.

4. The method of claim 1, wherein the counter value is incremented a predetermined amount.

5. The method of claim 1, further comprising:

encrypting, with a transaction device authentication key, a transaction device authentication signal received from the RFID reader to create an encrypted transaction device authentication signal;

transmitting the encrypted transaction device authentication signal to the RFID reader for authentication of the RFID transaction device by the RFID reader;

decrypting, with a reader authentication key, an encrypted reader authentication signal received from the RFID reader to create a decrypted reader authentication signal; and

authenticating the RFID reader in response to the decrypted reader authentication signal matching a reader authentication signal transmitted from the RFID transaction device to the RFID reader.

6. A method comprising:

generating a random number at a radio frequency identification (RFID) reader;

transmitting the random number to an RFID transaction device; and

receiving, from the RFID transaction device, an RFID transaction device authentication tag, wherein the RFID transaction device authentication tag was generated using a transaction device identifier, a counter value, and the random number;

wherein an RFID transaction is authorized in response to verification of the RFID transaction device authentication tag.

7. The method of claim 6, further comprising receiving unencrypted data, the random number, and the counter value from the RFID transaction device.

8. The method of claim 7, further comprising converting the unencrypted data, the random number, and the counter value into a point of sale (POS) readable format.

9. The method of claim 6, further comprising:

generating, in the RFID reader, an RFID reader authentication tag; and

transmitting the RFID reader authentication tag, the RFID transaction device authentication tag, the counter value, and the transaction device identifier in POS format to a transaction processing entity;

wherein an RFID transaction is authorized in response to verification of the RFID reader authentication tag, the RFID transaction device authentication tag, and the counter value.

10. The method of claim 9, wherein the transaction processing entity decrypts the RFID reader authentication tag and the RFID transaction device authentication tag and verifies the random number.

11. The method of claim 6, further comprising creating an RFID reader authentication key using an RFID reader encryption key.

12. The method of claim 6, further comprising:

generating a transaction request using the RFID transaction device authentication tag;

encrypting the transaction request to create an encrypted transaction request; and

transmitting the encrypted transaction request to a transaction processing entity for approval.

13. The method of claim 6, wherein the transaction is authorized in response to successfully decrypting the encrypted transaction request and validating the counter value.

14. The method of claim 13, wherein the counter value is validated in response to the counter value matching an expected counter value.

15. The method of claim 13, wherein the counter value is validated in response to the counter value being used in an algorithm and the result of the algorithm matching an expected value.

16. The method of claim 6, further comprising:

encrypting, with an RFID reader authentication key, an RFID reader authentication signal received from the RFID transaction device to create an encrypted RFID reader authentication signal;

transmitting the encrypted RFID reader authentication signal to the RFID transaction device for authentication of the RFID reader by the RFID transaction device;

decrypting, with a transaction device authentication key, an encrypted transaction device authentication signal received from the RFID transaction device to create a decrypted transaction device authentication signal; and

authenticating the RFID transaction device in response to the decrypted transaction device authentication signal matching a transaction device authentication signal transmitted from the RFID reader to the RFID transaction device.

17. A radio frequency identification (RFID) transaction device comprising:

means for generating an RFID transaction device authentication tag using a random number, a transaction device identifier, and a counter value, wherein the random number is received from an RFID reader;

means for transmitting the RFID transaction device authentication tag to the RFID reader; and

means for incrementing the counter value;

wherein an RFID transaction is authorized in response to verification of the RFID transaction device authentication tag.

18. A radio frequency identification (RFID) reader comprising:

means for generating a random number;

means for transmitting the random number to an RFID transaction device; and

means for receiving, from the RFID transaction device, an RFID transaction device authentication tag comprising a transaction device identifier, a counter value, and the random number;

wherein an RFID transaction is authorized in response to verification of the RFID transaction device authentication tag.