Method and apparatus for billing for transactions conducted over the internet

• US 6,047,268 A
• Filed: 11/04/1997
• Issued: 04/04/2000
• Est. Priority Date: 11/04/1997
• Status: Expired due to Term

• Current Assignee: Hanger Solutions, LLC (IP Investments Group LLC)
• Original Assignee: AT&T Corporation (AT&T, Inc.)
• Inventors: Griesmer, Stephen J., Tessier, Jean, Lidor, Gideon, Bartoli, Paul D., Ronen, Yzhak
• Primary Examiner(s): Teska, Kevin J.
• Assistant Examiner(s): SMITH-STEWART, DEMETRA R
• Application Number:
  US08/964,274
• Time in Patent Office: 882 Days
• Field of Search: 705/35, 705/39, 705/40, 705/42, 705/44, 380/24, 235/379, 235/380
• US Class Current: 705/35
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/102 Bill distribution or payments
• CPC Class Codes: G06Q 20/12 specially adapted for electronic shopping systems
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 30/04 Billing or invoicing
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes

Abstract

A method and apparatus for authenticating transactions accomplished over a data network utilizes a "cookie" containing both static information (user-identifying information) and dynamic information (transaction-based information). The transaction-oriented dynamic information portion comprises a random number and a sequence number, the latter tracking the number of billing transactions conducted by the user associated with the account number. The cookie, sent to the user'"'"'s cookie file upon a previous transaction, is valid for only a single new transaction. A billing server, upon receiving the cookie containing the static and dynamic information portions, identifies the user from the account number in the static portion and accesses from an associated database the expected random number and sequence number that the billing server last sent to that user in the transaction-oriented dynamic portion. If the expected dynamic portion matches the received dynamic portion, the user is authenticated to proceed with the current transaction.

Claims

1. A method of authenticating a user for a transaction on a data network comprising:

sending to a user'"'"'s client terminal data containing a static information portion and a transaction-oriented dynamic portion, the static information portion identifying an account associated with the user and the transaction-oriented dynamic information portion containing information generated for that user that is valid for a single subsequent transaction;

storing the transaction-oriented dynamic information portion in association with the static information portion;

receiving, from the user'"'"'s client terminal, the data containing the static information portion and the transaction-oriented dynamic information portion in association with information relating to the single subsequent transaction;

identifying the user'"'"'s account from the received static information portion;

comparing the transaction-oriented dynamic information portion received from the user'"'"'s client terminal with the transaction-oriented dynamic information portion stored in association with the static information portion; and

authenticating the user for the single subsequent transaction if the received transaction-oriented dynamic information portion matches the stored transaction-oriented dynamic information for the account associated with the user.

2. The method of claim 1 further comprising:

creating a new transaction-oriented dynamic information portion;

sending to the user'"'"'s client terminal new data to replaced the previously sent data, the new data containing the same static information portion in the previously sent data and the new transaction-oriented dynamic information portion, the new transaction-oriented dynamic information portion being different than the transaction-oriented dynamic information portion in the previously sent data, the new data being valid for authenticating the user for a next single transaction; and

storing the new transaction-oriented dynamic information portion in association with the same static information portion.

3. The method of claim 2 wherein the transaction-oriented dynamic portion of the data previously sent to the user'"'"'s client terminal and the new transaction-oriented dynamic information portion each comprise a random number and a sequence number.

4. The method of claim 3 wherein the new transaction-oriented dynamic portion comprises a random number different than the random number in the data previously sent to the user'"'"'s client terminal and a sequence number that is equal to the sequence number in the data previously sent to the user'"'"'s client terminal plus a predetermined increment.

5. The method of claim 1 wherein the data network is the Internet.

6. The method of claim 5 wherein the data is contained within a cookie.

7. The method of claim 1 wherein the static information portion and the transaction-oriented dynamic information portion of the data are encrypted.

8. A method for authenticating a user for a transaction on the Internet comprising:

sending to a user'"'"'s client terminal a cookie containing a static information portion and a transaction-oriented dynamic portion, the static information portion identifying an account number associated with the user and the transaction-oriented dynamic information portion containing information generated for that user that is valid for a single subsequent transaction;

storing the transaction-oriented dynamic information portion in association with the user'"'"'s account number identified by the static information portion;

receiving from the user'"'"'s client terminal the cookie containing the static information portion and the transaction-oriented dynamic information portion in association with information relating to the single subsequent transaction;

identifying the user'"'"'s account number from the static information portion in the received cookie; and

comparing the transaction-oriented dynamic information portion in the received cookie with the stored transaction-oriented dynamic information portion associated with the identified user'"'"'s account number.

9. The method of claim 8 further comprising authenticating the user for the transaction if the transaction-oriented dynamic information portion in the received cookie matches the stored transaction-oriented dynamic information portion.

10. The method of claim 8 further comprising:

if the transaction-oriented dynamic information portion in the received cookie does not match the stored transaction-oriented dynamic information portion, requesting an account number and a password from the user

receiving the account number and password from the user in response to the request; and

if the received password matches a stored password associated with the user'"'"'s account number, authenticating the user for the transaction.

11. The method of claim 9 further comprising:

creating a new cookie with a new transaction-oriented dynamic information portion and the same static information portion in the cookie previously sent to the user;

sending the new cookie to the user'"'"'s client terminal to replace the previously sent cookie; and

storing the new transaction-oriented dynamic information portion in association with the user'"'"'s account number.

12. The method of claim 8 wherein the transaction-oriented dynamic information portion of the cookie comprises a random number and a sequence number.

13. The method of claim 12 wherein the sequence number in the transaction-oriented dynamic information portion of the new cookie is equal to the sequence number in the cookie previously sent to the user'"'"'s client terminal plus a predetermined increment.

14. The method of claim 8 wherein the transaction-oriented dynamic information portion and the static information portion of the cookie are encrypted.

15. The method of claim 10 further comprising:

if the received password does not match a stored password associated with the user'"'"'s account number, denying the transaction.

16. The method of claim 8 further comprising:

if the transaction-oriented dynamic information portion in the transition-oriented received cookie does not match the stored transaction-oriented dynamic information portion, denying the transaction.

17. The method of claim 13 further comprising:

if the transaction-oriented dynamic information portion in the received cookie does not match the stored transaction-oriented dynamic information portion, determining whether any fraudulent transactions were made on the user'"'"'s account.

18. The method of claim 17 wherein the step of determining whether any fraudulent transaction were made comprises:

comparing the sequence number in the cookie received from the user'"'"'s client terminal with the sequence number in the stored cookie; and

identifying fraudulent transactions from the difference between the sequence number in the cookie received from the user'"'"'s client terminal and the sequence number in the stored cookie.

19. A system for authenticating a user for a transaction on the Internet comprising:

means for sending to a user'"'"'s client terminal a cookie containing a static information portion and a transaction-oriented dynamic information portion, the static information portion identifying an account number associated with the user and the transaction-oriented dynamic information portion containing information generated for that user that is valid for a single subsequent transaction;

means for storing the transaction-oriented dynamic information portion in association with the user'"'"'s account number identified by the static information portion;

means for receiving from the user'"'"'s client terminal the cookie containing the static information portion and the transaction-oriented dynamic information portion in association with information relating to the single subsequent transaction;

means for identifying the user'"'"'s account number from the static information portion in the received cookie; and

means for comparing the transaction-oriented dynamic information portion in the received cookie with the stored transaction-oriented dynamic information portion associated with the identified user'"'"'s account number.

20. The system of claim 19 wherein the user is authenticated for the transaction if the transaction-oriented dynamic information portion in the received cookie matches the stored transaction-oriented dynamic information portion.

21. The system of claim 20 wherein the transaction-oriented dynamic information portion of the cookie comprises a random number and a sequence number.

22. The system of claim 21 wherein the sequence number in the transaction-oriented dynamic information portion of the new cookie is equal to the sequence number in the cookie previously sent to the user'"'"'s client terminal plus a predetermined increment.

23. The system of claim 21 wherein the transaction-oriented dynamic information portion and the static information portion of the cookie are encrypted.

24. The system of claim 19 wherein the transaction is denied if the transaction-oriented dynamic information portion in the received cookie does not match the stored transaction-oriented dynamic information portion.