Remote credit card authentication system

• US 6,270,011 B1
• Filed: 05/28/1999
• Issued: 08/07/2001
• Est. Priority Date: 05/28/1998
• Status: Expired due to Fees

• Current Assignee: Benenson Tal, Mimoun Elie
• Original Assignee: Benenson Tal, Mimoun Elie
• Inventors: Gottfried, Ofer
• Primary Examiner(s): Frech, Karl D.
• Assistant Examiner(s): St. Cyr, Daniel
• Application Number:
  US09/322,012
• Time in Patent Office: 802 Days
• Field of Search: 235/379, 235/380, 235/382.5, 235/487, 380/25, 380/49, 380/54, 705/26, 705/35, 705/39
• US Class Current: 235/379
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes
• CPC Class Codes: G07C 9/257 electronically G07C9/26 takes precedence

Abstract

A method for providing secure transactions with credit cards by adding a fingerprint scanner at the point-of-sale to obtain fingerprint data, so that a credit card company database can verify the fingerprint data against stored fingerprint information and verify the transaction accordingly. The method is integrated into the existing negotiation protocol between a point-of-sale system and a credit card company database, and uses a human fingerprint and a secure algorithm. The credit card company has the customer fingerprint for comparison on its existing database, and the existing credit card operation will be usual, with the fingerprint data added to it to authenticate and secure the operation via the communication media while making a point-of-sale purchase. In the case of an Internet purchase, the inventive method incorporates an authorization adaptor connected to the user PC, and once the user has made the purchase request, an encrypted communication is then commenced in which a token is sent by the credit card company to the user PC, requesting fingerprint data. The authorization adaptor provides the fingerprint scan, and sends the data to the user PC in encrypted form, for transfer to the credit card company by a secure communication, for authorization. The fingerprint scanner is based on use of a new sensor employing a technology that maps and matches fingerprints, using coincidence of the features (minutia) on as few as twelve similar points, to determine a match.

Claims

1. A method for remote credit card authentication comprising the steps of:

initiating a purchase transaction in which a purchaser provides credit card information from a purchaser location;

transmitting said credit card information to a credit card database;

requesting provision of personal information associated with said purchaser;

obtaining said personal information, including at least one fingerprint image, from the purchaser at said purchaser location, wherein said at least one fingerprint image is not included within the credit card information contained on the credit card;

processing said at least one fingerprint image in a stand-alone device, said stand-alone device being connected as an add-on unit whereat said purchase transaction is initiated;

transmitting said obtained personal information including said processed at least one fingerprint image to said credit card database;

processing, in said credit card database, said obtained personal information to match said personal information with stored personal information including at least one fingerprint image of the owner of the credit card; and

providing a message to said purchaser location in accordance with the results of said processing step for completion of said purchase transaction.

2. The method of claim 1 wherein said initiating step is performed in a purchase transaction conducted at a point-of-sale purchaser location, arranged for conventional telephone line communication with said credit card database.

3. The method of claim 1 wherein said initiating step is performed in a purchase transaction conducted by a user on an Internet-based website from a purchaser location arranged for conventional telephone line communication with said credit card database.

4. The method of claim 1 wherein said step of requesting personal information is performed by displaying at said purchaser location, a request for purchaser fingerprint data.

5. The method of claim 1 wherein said step of obtaining said personal information comprises the step of scanning the purchaser'"'"'s fingerprint and providing an image thereof at the purchaser location.

6. The method of claim 5 wherein said processing of said personal information includes the step of comparing minutia features of said scanned fingerprint image with a set of fingerprint data of the credit card owner stored in said credit card database.

7. The method of claim 1 wherein the steps of transmitting said credit card information and transmitting said obtained personal information are performed using a conventional modem and telephone communication line.

8. The method of claim 1 wherein the steps of transmitting said credit card information and transmitting said obtained personal information are performed using an Internet-based communcation line.

9. The method of claim 1 wherein said step of requesting personal information includes transmission of an encryption token for use in encrypting said obtained personal information for transmission to said database during said transmitting step.

10. The method of claim 9 wherein said encryption token contains unique information for one-time use only, such as date, time, location and the like.

11. A remote credit card authentication system comprising:

means for initiating a purchase transaction in which a purchaser provides credit card information from a purchaser location;

means for transmitting said credit card information to a credit card database;

means for requesting provision of personal information associated with said purchaser;

means for obtaining said personal information, including at least one fingerprint image, from the purchaser at said purchaser location, wherein said at least one fingerprint image is not included within the credit card information contained on the credit card;

means provided as a stand-alone device for processing said at least one fingerprint image, said stand-alone device being connected as an add-on unit to said means for initiating said purchase transaction;

means for transmitting said obtained personal information including said processed at least one fingerprint image to said credit card database;

means for processing, in said credit card database, said obtained personal information to match said personal information with stored personal information including at least one fingerprint image of the owner of the credit card; and

means for providing a message to said purchaser location in accordance with the results of said processing step for completion of said purchase transaction.

12. The system of claim 11 wherein said means for initiating a purchase transaction comprises a standard credit card reader and said means for requesting and obtaining said personal information is a stand-alone device, adapted to operate with said standard credit card reader.

13. The system of claim 11 wherein said means for initiating a purchase transaction comprises a computer connected to an Internet-based website, and said means for requesting and obtaining said personal information is a stand-alone device, adapted to operate with said computer.

14. The system of claim 13 wherein said computer isolates said stand-alone device and does not enable said stand-alone device direct access to the Internet, thereby protecting said obtained personal information and allowing encryption of said personal information before transmission.

15. In an Internet-based purchasing environment comprising a website adapted for processing a user purchase transaction and a purchaser terminal for enabling such a purchase transaction, a method for remote credit card authentication comprising the steps of:

initiating the purchase transaction in which a purchaser provides credit card information from the purchaser terminal;

transmitting to a credit card database in a secured manner a request for a unique encryption token;

generating said encryption token;

transmitting said encryption token to the purchaser terminal while requesting provision of at least one fingerprint image of the purchaser;

obtaining said at least one fingerprint image from the purchaser at a reader device associated with the purchaser terminal, wherein said at least one fingerprint image is not included within the credit card information contained on the credit card;

encrypting said at least one fingerprint image using said encryption token in said reader device, said reader device being connected as an add-on unit to said purchaser terminal whereat said purchase transaction is initiated;

transmitting said credit card information and said obtained at least one fingerprint image in encrypted form from said reader device to the purchaser terminal;

transmitting said credit card information and said obtained at least one fingerprint image in encrypted form from the purchaser terminal to said credit card database;

decrypting from said encrypted form said credit card information and said obtained at least one fingerprint image in said credit card database;

processing said decrypted credit card information and at least one fingerprint image to be matched with stored personal information in said credit card database including at least one fingerprint of the owner of the credit card; and

providing a message to said purchaser terminal in accordance with the results of said processing step for completion of said purchase transaction.

16. The method of claim 15 wherein said encryption token contains unique information for one-time use only, such as date, time, location and the like.

17. The method of claim 15 wherein the purchaser terminal comprises a computer and said reader device is a stand-alone device, and wherein said obtaining and transmitting steps performed by said reader device are performed in isolation external to said computer and not via direct access to the Internet, thereby protecting said obtained at least one fingerprint image and allowing its encryption before transmission.