SECURE REMOTE AUTHENTICATION THROUGH AN UNTRUSTED NETWORK

• US 20100180327A1
• Filed: 01/16/2009
• Published: 07/15/2010
• Est. Priority Date: 01/15/2009
• Status: Active Grant

• Current Assignee: John F. Sheets, Simon Hurry
• Original Assignee: John F. Sheets, Simon Hurry
• Inventors: Sheets, John F., Hurry, Simon
• Granted Patent: US 8,516,560 B2
• Time in Patent Office: Days
• US Class Current: 726/6
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/3278 RFID or NFC payments by means of M-devices
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/3825 Use of electronic signatures
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions

Abstract

A method for securely authenticating a user of a portable consumer device at an access device comprising the following steps. First, a dynamic data element and a first set of transactional information is sent to the portable consumer device from the access device. Next, the portable consumer device creates an authentication code as a function of at least the dynamic data element, a subset of the first set of transactional information, and a password. The authentication code, along with other data, is then sent from the portable consumer device back to the access device. The access device then uses the authentication code to send an authentication request message to the service provider of the user. The service provider then attempts to authenticate the user by recreating the authentication code and comparing the recreated authentication code with the authentication code received from the access device.

Claims

1. A method for securely authenticating a user of a portable consumer device, said method comprising:

receiving from an access device a dynamic data element and a first set of transactional information;

creating an authentication code as a function of at least a password, the dynamic data element, and a subset of the first set of transactional information; and

sending the authentication code to the access device, wherein the access device uses the authentication code to authenticate the user by sending an authentication request message to a service provider, wherein the authentication request message contains at least the authentication code and additional information sufficient to allow the service provider to recreate the authentication code, and wherein the service provider responds to the authentication request message by sending an authentication response message indicating if the recreated authentication code corresponds to the authentication code sent in the authentication request message.

2. The method of claim 1 wherein the access device also responds to the authentication request message by sending a second dynamic data element to be used in the creation of a new authentication code sent to the service provider from the access device.

3. The method of claim 1 wherein the function used to create the authentication code is a hash function.

4. The method of claim 3 wherein only a portion of the output of the hash function is used to create the authentication code.

5. The method of claim 1 wherein the password is a small value password if the first set of transactional information indicates that the value of the transaction is below a threshold amount.

6. The method of claim 5 wherein the small value password is stored in the portable consumer device so that the small value password does not have to be manually entered into the portable device each time the small value password is used.

7. The method of claim 1 wherein the password is a large value password if the first set of transactional information indicates that the value of the transaction is above a threshold amount.

8. The method of claim 7 wherein the large value password is manually entered into the portable consumer device each time the large value password is used.

9. The method of claim 1 wherein the recreated authentication code is created from at least a subset of the data contained in the authentication request message and other data locally available to the service provider.

10. A computer-readable medium comprising code for performing the method of claim 1.

11. A cellular phone with a processor and the computer-readable medium of claim 10.