One-time credit card number generator and single round-trip authentication

• US 6,908,030 B2
• Filed: 10/31/2001
• Issued: 06/21/2005
• Est. Priority Date: 10/31/2001
• Status: Expired due to Term

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.), Orphangage Incorporated
• Original Assignee: Arcot Systems, Inc. (Broadcom, Inc.)
• Inventors: Varadarajan, Rammohan, Rajasekaran, Sanguthevar
• Primary Examiner(s): Le, Thien M.
• Assistant Examiner(s): Caputo, Lisa M.
• Application Number:
  US10/003,847
• Publication Number:
  US 20030080183A1
• Time in Patent Office: 1,329 Days
• Field of Search: 235/379, 235/380, 705/44, 705/67, 713/155, 713/168, 713/170, 709/229
• US Class Current: 235/379
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes

Abstract

An online transaction is effected between a user system, a merchant system and an issuer system. The user system generates a one-time number (OTN) to use as a card number for a transaction with the merchant. The user system generates the OTN as a function of various parameters and sends the OTN to the issuer and to the merchant. With the issuer communication, the user is first authenticated, so the issuer can associate the received OTN with the user even if the user'"'"'s identity cannot be fully discerned from the OTN alone. In authenticating the user with the issuer, and possibly other authentications, the user sends the issuer a signed challenge where the challenge is a sequential challenge or a function of a prior challenge provided by the issuer. The issuer responds with an approval/denial message and, in the latter case, includes the next challenge to be used.

Claims

1. A method of authenticating a client to a server comprising:

generating a challenge at the client;

signing the challenge to form a signed challenge;

sending at least the signed challenge to the server, where the authenticity of the server is not in question;

verifying the signature of the challenge at the server; and

if the signature is verified, sending an indication of successful authentication to the client, where the indication of successful authentication is generated employing a single round trip authentication scheme.

2. The method of claim 1, wherein generating a challenge at the client comprises generating a random number.

3. The method of claim 1, wherein generating a challenge at the client comprises generating a sequential challenge.

4. The method of claim 1, wherein generating a challenge at the client comprises generating a challenge based on data received from the server in a prior step.

5. The method of claim 4, wherein the data received from the server is a challenge returned with a server response to a prior client query.

6. A method of using a one-time use card number for an online transaction, comprising:

generating a one-time use card number at a user system using a random number generator;

authenticating the user system to an issuer system, where the authenticating employs a single round trip authentication scheme;

passing the one-time use card number from the user system to the issuer system;

passing the one-time use card number from the user system to a merchant system, wherein the merchant system is programmed to present the one-time use card number to the issuer system to effect a payment;

verifying the one-time use card number received from the merchant system with the one-time use card number received from the user system; and

if the one-time use card number is verified, approving the transaction.

7. The method of claim 6, wherein passing the one-time use card number to the issuer includes passing at least one other data element related to the online transaction.

8. The method of claim 7, wherein the at least one other data element is selected from, or a function of, a user'"'"'s account number, a user'"'"'s private key, a transaction time, a transaction amount, or a merchant ID.