Account authentication service with chip card

Patent metadata

Field	Value
Publication number	US-9864993-B2
Application number	US-41911509-A
Country	US
Kind code	B2
Filing date	Apr 6, 2009
Priority date	Apr 24, 2000
Publication date	Jan 9, 2018
Grant date	Jan 9, 2018

Abstract

A payment authentication service authenticates the identity of a payer during online transactions. The authentication service of the present invention allows a card issuer to verify a cardholder's identity using a variety of authentication methods, such as the use of passwords. Also, the only system participant requiring a certificate is the issuing financial institution. One embodiment of the invention for authenticating the identity of a cardholder during an online transaction involves querying an access control server to determine if a cardholder is enrolled in the payment authentication service, requests a password from the cardholder, verifies the password, and notifies a merchant whether the cardholder's authenticity has been verified. In another aspect of the invention, a chip card and the authentication service independently generate cryptograms that must match in order for the service to verify that the correct chip card is being used by the cardholder.

First claim

We claim:

1. A method of authenticating a cardholder during an online transaction for a requesting party, said method comprising:
receiving, at a trusted party access control server, a cardholder authentication request originating from a merchant computer said cardholder authentication request including a cardholder account identifier and being routed to the trusted party access control server from the merchant computer via the cardholder computer;
sending a chip authentication request from said trusted party access control server to said cardholder computer in response to receipt of the cardholder authentication request at the trusted party access control server;
receiving a chip authentication response from said cardholder computer at said access control server that includes a cryptogram and a cardholder authentication password, said cryptogram being generated by a chip card and application in communication with said cardholder computer;
generating a second cryptogram at said access control server and comparing said second cryptogram to said cryptogram;
determining, by said access control server, that said cardholder authentication password matches a stored password that corresponds to said cardholder account identifier based on a first comparison;
determining that said cryptograms match based on a second comparison; and
responsive to the first and second comparisons, sending, via said cardholder computer, a cardholder authentication response from said trusted party access control server to said merchant computer indicating that said chip card and said cardholder authentication password are authentic, whereby said access control server authenticates said cardholder for said requesting party during said online transaction.

2. A method as recited in claim 1 further comprising:
receiving data specific to said chip card at said access control server from said cardholder computer; and
wherein generating said second cryptogram comprises generating said second cryptogram using said data specific to said chip card.

3. A method as recited in claim 1 wherein said cardholder authentication password is not a personal identification number (PIN) for use with an ATM or POS device.

4. A method as recited in claim 1 wherein said online transaction is a payment transaction.

5. A method as recited in claim 1 further comprising:
receiving a verify enrollment request from said merchant computer at said trusted party access control server with said cardholder account identifier; and
sending a verify enrollment response from said trusted party access control server to said merchant computer indicating said cardholder account identifier is enrolled, said verify enrollment request and said verify enrollment response occurring before said step of receiving the cardholder authentication request originating from the merchant computer.

6. A method as recited in claim 1 wherein said cardholder computer is a mobile telephone.

7. A method as recited in claim 1 wherein the cardholder account identifier is a card account number registered in a payment service.

8. The method of claim 1 wherein the cardholder authentication request is routed to the trusted party access control server from the merchant computer via the cardholder computer using a URL stored in a distributed payment authentication service (PAS) module of the cardholder computer.

9. The method of claim 1 further comprising:
determining if the cardholder computer includes a chip card reader.

10. The method of claim 9 further comprising:
receiving the chip card at the chip card reader.

11. The method of claim 9 wherein the access control server is configured to end the online transaction when the cardholder computer does not include the chip card reader.

12. The method of claim 9 wherein the cardholder authentication response comprises a cardholder authentication verification value, the cardholder authentication verification value informing the merchant that the cardholder is authenticated.

13. The method of claim 12 wherein the cardholder computer comprises a display device, a PIN pad or a keyboard entry device, and a card reader.

14. An access control server comprising a processor and a non-transitory computer readable medium coupled to the processor, the computer readable medium comprising code, executable by the processor for implementing a method comprising
receiving, at the access control server, a cardholder authentication request originating from a merchant computer said cardholder authentication request including a cardholder account identifier and being routed to the access control server from the merchant computer via the cardholder computer;
sending a chip authentication request from said access control server to said cardholder computer in response to receipt of the cardholder authentication request at the access control server;
receiving a chip authentication response from said cardholder computer at said access control server that includes a cryptogram and a cardholder authentication password, said cryptogram being generated by a chip card and application in communication with said cardholder computer;
generating a second cryptogram at said access control server and comparing said second cryptogram to said cryptogram;
determining, by said access control server, that said cardholder authentication password matches a stored password that corresponds to said cardholder account identifier based on a first comparison;
determining that said cryptograms match based on a second comparison; and
responsive to the first and second comparisons, sending, via said cardholder computer, a cardholder authentication response from said access control server to said merchant computer indicating that said chip card and said cardholder authentication password are authentic, whereby said access control server authenticates said cardholder for a requesting party during an online transaction.

15. The access control server of claim 14 wherein the method further comprises:
receiving a verify enrollment request from said merchant computer at said access control server with said cardholder account identifier; and
sending a verify enrollment response from said access control server to said merchant computer indicating said cardholder account identifier is enrolled, said verify enrollment request and said verify enrollment response occurring before said step of receiving the cardholder authentication request originating from the merchant computer.

16. The access control server of claim 14 wherein the cardholder authentication response comprises a cardholder authentication verification value, the cardholder authentication verification value informing the merchant that the cardholder is authenticated.

17. A system comprising:
the access control server of claim 14 ; and
the cardholder computer in communication with the access control server.

Assignees

• Weller Kevin D
• Ryan Stephen W
• Hill Peter R
• Manessis Thomas J
• Lewis Tony D
• Dominguez Benedicto H
• Bray Peter
• Reno James Donald
• Redford Liane
• Levy Philippe
• Hill Trudy
• Visa Int Service Ass

Inventors

• Weller Kevin D
• Ryan Stephen W
• Hill Peter R
• Manessis Thomas J
• Lewis Tony D
• Dominguez Benedicto H
• Bray Peter
• Reno James Donald
• Redford Liane
• Levy Philippe
• Hill Trudy

Classifications

• G06Q20/355

  Personalisation of cards for use · CPC title

• G06Q20/0855

  involving a third party · CPC title

• G06Q20/027

  involving a payment switch or gateway · CPC title

• G07F7/1016

  Devices or methods for securing the PIN and other transaction-data, e.g. by encryption (arrangements for secret communication, see H04L9/00) · CPC title

• G06Q20/4012

  Verifying personal identification numbers [PIN] · CPC title