Authenticating users to ATMs and other secure machines for cardless transactions

Patent metadata

Field	Value
Publication number	US-9836741-B2
Application number	US-201414556669-A
Country	US
Kind code	B2
Filing date	Dec 1, 2014
Priority date	Nov 14, 2011
Publication date	Dec 5, 2017
Grant date	Dec 5, 2017

Abstract

Systems, apparatus, methods, and computer program products for using quick response (QR) codes for authenticating users to ATMs and other secure machines for cardless transactions are disclosed. Embodiments of the present disclosure read an image displayed on a display of an external device using a mobile device associated with a user authorized to access a secure resource, decode transaction information encoded in the image, transmit the transaction information and an identifier of the mobile device from the mobile device to an authentication system, and grant access to the secure resource if the transaction information and the identifier satisfy an authentication test performed at the authentication system.

First claim

What is claimed is:

1. An apparatus for authenticating a transaction, the apparatus comprising:
a memory configured to store two or more seed keys;
a communication interface configured to facilitate communications between the apparatus and an authentication system;
an input device configured to receive transaction information from an external device when the apparatus is in proximity of the external device, the transaction information comprising at least one of a monetary value and an identity of a merchant associated with a transaction; and a processor configured to:
require user input of additional information before recovering a first seed key from the two or more seed keys stored on the memory if at least one of:
the monetary value associated with the transaction is greater than a predetermined amount, and the identity of the merchant associated with the transaction does not correspond to a trusted merchant;
recover the first seed key from the memory when the required user input is received; and recover the an incorrect key from the memory when some other user input is received;
recover a second seed key from the two or more seed keys stored on the memory without requiring user input of additional information if at least one of:
the monetary value associated with the transaction is less than or equal to the predetermined amount, and
the identity of the merchant associated with the transaction corresponds to a trusted merchant; and
transmit authentication information generated with the recovered seed key to the authentication system via the communication interface.

2. The apparatus of claim 1 , wherein the memory is configured to store the two or more seed keys in a secure manner utilizing a key protection technique.

3. The apparatus of claim 2 , wherein:
the key protection technique comprises cryptographic camouflaging.

4. The apparatus of claim 1 , wherein the processor is configured to decode the transaction information and to generate the authentication information with the recovered seed key.

5. The apparatus of claim 1 , wherein:
the apparatus is configured to transmit the authentication information to the external device via a proximity-based wireless connection; and
the external device is configured to transmit the authentication information to the authentication system.

6. The apparatus of claim 1 , wherein the apparatus is configured to receive the transaction information from the external device via a proximity-based wireless connection.

7. A method for authenticating a transaction comprising:
receiving with a mobile device transaction information from an external device when the mobile device is in proximity of the external device, the transaction information comprising at least one of a monetary value and an identity of a merchant associated with a transaction;
requiring user input of additional information before recovering a first seed key from two or more seed keys stored on a memory of the mobile device if at least one of:
the monetary value associated with the transaction is greater than a predetermined amount, and the identity of the merchant associated with the transaction does not correspond to a trusted merchant;
recovering the first seed key from the memory of the mobile device when the required user input is received; and
recovering incorrect key from the memory of the mobile device when some other user input is received;
recovering a second seed key from the two or more seed keys stored on a memory of the mobile device without requiring user input of additional information if at least one of:
the monetary value associated with the transaction is less than or equal to the predetermined amount, and
the identity of the merchant associated with the transaction corresponds to a trusted merchant; and

transmitting authentication information generated with the recovered seed key from the mobile device to an authentication system.

8. The method of claim 7 , further comprising storing the two or more seed keys on the memory of the mobile device in a secure manner utilizing a key protection technique.

9. The method of claim 8 , wherein:
the key protection technique comprises cryptographic camouflaging.

10. The method of claim 7 , further comprising generating the authentication information at the mobile device with the recovered seed key.

11. The method of claim 7 , further comprising:
the mobile device transmitting the authentication information to the external device via a proximity-based wireless connection; and
the external device transmitting the authentication information to the authentication system.

12. The method of claim 7 , further comprising the apparatus receiving the transaction information from the external device via a proximity-based wireless connection.

13. A non-transitory computer program product comprising a computer-readable storage medium having computer-readable program code embodied therewith, the computer-readable program code being configured to be executed by an apparatus with a memory that stores two or more seed keys and comprising:
computer-readable program code configured to receive transaction information from an external device when the apparatus is in proximity of the external device, the transaction information comprising at least one of a monetary value and an identity of a merchant associated with a transaction;
computer-readable program code configured to require user input of additional information before recovering a first seed key from the two or more seed keys stored on the memory if at least one of:
the monetary value associated with the transaction is greater than a predetermined amount, and the identity of the merchant associated with the transaction does not correspond to a trusted merchant;

computer readable program code configured to recover the first seed key from the memory when the required user input is received; and
computer readable program code configured to recover an incorrect key from the memory when some other user input is received;
computer-readable program code configured to recover a second seed key from the two or more seed keys stored on the memory without requiring user input of additional information if at least one of:
the monetary value associated with the transaction is less than or equal to the predetermined amount, and
the identity of the merchant associated with the transaction corresponds to a trusted merchant; and

computer-readable program code configured to transmit authentication information generated with the recovered seed key to an authentication system via the communication interface.

14. The non-transitory computer program product of claim 13 , wherein the memory is configured to store the two or more seed keys in a secure manner utilizing a key protection technique.

15. The non-transitory computer program product of claim 14 , wherein:
the key protection technique comprises cryptographic camouflaging.

16. The non-transitory computer program product of claim 13 , further comprising computer-readable program code configured to generate the authentication information with the recovered seed key.

17. The non-transitory computer program product of claim 13 , further comprising:
computer-readable program code configured to transmit the authentication information to the external device via a proximity-based wireless connection,
wherein the external device is configured to transmit the authentication information to the authentication system.

Assignees

• Varadarajan Rammohan
• Malpani Ambarish
• Ca Inc

Inventors

• Varadarajan Rammohan
• Malpani Ambarish

Classifications

• H04W12/04

  Key management, e.g. using generic bootstrapping architecture [GBA] · CPC title

• H04L2209/56

  Financial cryptography, e.g. electronic payment or e-cash · CPC title

• G06Q20/40

  Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists · CPC title

• H04L9/3234

  involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853) · CPC title

• G07F19/20

  Automatic teller machines [ATMs] · CPC title