Method and system for authorizing a transaction using a dynamic authorization code

Patent metadata

Field	Value
Publication number	US-9911121-B2
Application number	US-67572307-A
Country	US
Kind code	B2
Filing date	Feb 16, 2007
Priority date	Aug 18, 2004
Publication date	Mar 6, 2018
Grant date	Mar 6, 2018

Abstract

A method and apparatus for conducting a secure transaction involving generation of a dynamic authentication code on a mobile device, based on secret data which does not identify an account. The authentication code and financial account identifying information are transmitted to a validating entity, which shares information about the secret data, to authorize the transaction.

First claim

I claim:

1. A method for authorizing a transaction, comprising:
associating, by at least one computer of an issuer bank, account secret data with a unique financial account identifier associated with a financial account in an authorization database;
generating, by at least one computer of said issuer bank, personalization data based at least in part on data associated with said account secret data;
transmitting, by at least one computer of said issuer bank, said personalization data to a mobile processing device associated with a holder of said financial account;
wherein said mobile processing device contains a processor configured to generate a dynamic authorization code using at least in part said personalization data and a user challenge number input into said mobile processing device by said holder, and wherein said mobile processing device further configured to store transaction information other than a financial account number associated with said financial account, a card expiry associated with said financial account, card track data, or other financial account identifier;
receiving, by at least one computer of said issuer bank, at an authorization location, an authorization request to authorize a transaction, said request including (1) said unique financial account identifier provided from said holder of said financial account not provided from said mobile processing device and (2) a dynamic authentication code generated by said mobile processing device, wherein generating said dynamic authentication code comprises generating an intermediate cryptogram and compressing said intermediate cryptogram, said cryptogram comprising an encryption based on said account secret data of at least said personalization data and said user challenge number concatenated and expressed in binary form;
determining, by at least one computer of said issuer bank, whether said dynamic authentication code was generated by a mobile processing device containing personalization data that was generated at least in part based on data associated with said account secret data associated with said unique financial account identifier in said authorization database; and
authorizing, by at least one computer of said issuer bank, said transaction in response to said determining step;
wherein the determining step further comprises generating, by at least one computer, at the authorization location, a second dynamic authentication code using at least in part said personalization data, and comparing the dynamic authentication code generated by the mobile processing device and the second dynamic authentication code.

2. The method as in claim 1 , wherein said processor of said mobile processing device is further configured to:
prompt for input of an identification PIN; and
validate said identification PIN before said dynamic authentication code is generated.

3. The method of claim 1 , wherein said account secret data is an encryption key.

4. The method of claim 3 , wherein said data associated with said account secret data is said encryption key.

5. The method of claim 3 , wherein said encryption key is a private key and wherein said data associated with said account secret data is a public key associated with said private key.

6. The method of claim 1 wherein said processor of said mobile processing device is further configured to generate said dynamic authentication code based at least in part on a transaction counter stored on said mobile processing device.

7. The method of claim 6 wherein a copy of said transaction counter is maintained in said authorization database, further comprising the step of verifying said transaction counter used to generate said dynamic authentication code matches said copy of said transaction counter.

8. The method of claim 6 wherein said transaction counter is incremented when said dynamic authentication code is generated.

9. A system for authorizing a transaction, comprising:
a storage medium of an issuer bank containing an authorization database containing at least one unique financial account identifier associated with a financial account and secret account data associated with said identifier;
a mobile processing device associated with a holder of said financial account having a memory component and a processor;
a transmitter of said issuer bank for transmitting personalization data to said mobile processing device, said personalization data based at least in part on data associated with said secret account data, but not including said financial account identifier;
wherein said processor of said mobile processing device is configured to generate a dynamic authentication code using, at least in part, said personalization data and a user challenge number input into said mobile processing device by said holder, and wherein said memory component is configured to store transaction information other than a financial account number associated with said financial account, a card expiry associated with said financial account, card track data, or other financial account identifier;
wherein said processor configured to generate said dynamic authentication code comprises generating an intermediate cryptogram and compressing said intermediate cryptogram, said cryptogram comprising an encryption based on said account secret data of at least said personalization data and said user challenge number concatenated and expressed in binary form;
a receiver of said issuer bank for receiving an authorization request to authorize a transaction, said authorization request including: (1) said unique financial account identifier provided from said holder of said financial account and not provided from said mobile processing device and (2) said dynamic authentication code provided from said mobile processing device; and
an authorization processor of said issuer bank for generating a second dynamic authentication code using at least in part said personalization data, determining whether said dynamic authentication code was generated by a mobile processing device containing personalization data that was generated at least in part based on data associated with said account secret data associated with said financial account identifier in said authorization database based at least in part on comparing the dynamic authentication code generated by the mobile processing device and the second dynamic authentication code, and for authorizing said transaction in response to said determining.

10. The system of claim 9 , wherein said account secret data is an encryption key.

11. The system of claim 10 , wherein said data associated with said account secret data is said encryption key.

12. The system of claim 10 , wherein said encryption key is a private key and wherein said data associated with said account secret data is a public key associated with said private key.

13. The system of claim 9 wherein said mobile processing device includes a transaction counter, and wherein said processor of said mobile processing device is further configured to use said transaction counter at least in part to generate said dynamic authentication code.

14. The system of claim 13 wherein said authorization database further includes a copy of said transaction counter, and wherein said authorization processor is further for verifying said transaction counter used to generate said dynamic authentication code matches said copy of said transaction counter.

15. The system of claim 13 wherein said processor is further configured to update said transaction counter when said dynamic authentication code is generated.

16. The method of claim 1 , furthe

Assignees

• Wankmueller John
• Mastercard International Inc

Inventors

• Wankmueller John

Classifications

• G06Q20/3674

  involving authentication · CPC title

• G06Q20/40

  Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists · CPC title

• G06Q20/385 Primary

  using an alias or single-use codes · CPC title

• G06Q20/32

  using wireless devices · CPC title

• G06Q20/3265

  characterised by personalisation for use · CPC title