Patent Application
20080185429
This disclosure relates in general to secure Internet transactions using an open loop debit card network and, but not by way of limitation, to enrollment and authentication of Automatic Teller Machine (ATM) cardholders or debit card cardholders for Internet transactions without requiring Personal Identification Numbers (PINs) amongst other things. In this context, debit card networks refer to financial networks that primarily process ATM and point-of-sale transactions that require PIN entry for authentication, as opposed to networks that primarily require signatures for cardholder authentication. Debit networks are additionally known for their single message, guaranteed-funds transaction processing architecture.
The development of the Internet and Internet shopping in particular has led to increased developments in Internet security and secure transactions in eCommerce. Most Internet transactions are completed using credit cards, signature debit cards or other payment schemes such as PayPal or Google Checkout. Due to the high cost of introducing PIN-protecting hardware or software, ATM/Debit card payments that require PIN entry have been limited on the Internet. Security experts have advised against allowing PIN entry on PCs due to the risk of fraudsters capturing this information, and then using the transaction card and PIN information to create fraudulent plastic cards to obtain cash at an ATM, thus draining the victims' checking or savings accounts. Debit card networks do allow ATM/Debit cardholders to make card payments—without entering the associated PIN—to companies that cardholders already have relationships with—such as utilities, which mitigates the risk of fraud. Debit card network transactions are typically authenticated, often using a PIN, and authorized at a financial institution.
Due to the heightened risk related to ATM/Debit cards requiring PIN entry along with the spread of eCommerce and the desire to incorporate more security and transaction efficiencies, there is a general need for a technical solution to handle ATM/Debit card transactions over a debit network that do not require entry of a PIN.
One embodiment of the present invention includes a system for enrolling a cardholder for PIN-less transaction card transactions. The system may include a storage location and a financial network host computer system. The financial network host computer system includes a network adapter and a processor. The processor may include instructions to enroll a transaction card for PIN-less Internet transactions. The system, in response to a request from a cardholder to enroll themselves for use of a transaction card for PIN-less Internet transactions, may retrieve past transaction card transactions associated with the transaction card from a transaction card transaction storage module. The system may then provide to a cardholder a listing of transaction card transactions. This listing may include at least one true transaction card transaction selected randomly from past transaction card transactions within a predetermined time period and at least one fictitious transaction card transaction. The cardholder may be queried over the Internet to select at least one true transaction card transaction from the listing of at least one true transaction card transaction and at least one fictitious transaction card transaction. The cardholder's selection is received by the system and verifies the selected transaction corresponds to at least one of the true transaction card transactions. If the cardholder was successful, the system receives a physical identification sample from the cardholder that is then hashed and stored.
Another embodiment of the invention includes a system for authenticating a cardholder using a transaction card in an Internet transaction between the cardholder and a merchant through a financial network. The system may include a storage location and a financial network host computer system. The financial network host computer system includes a network adapter coupled with the financial network and a processor. The processor may include instructions to enroll and authenticate a cardholder for use of a transaction cards for PIN-less Internet transactions. The system may receive a transaction request from a merchant for an Internet transaction between the merchant and a cardholder using a transaction card. The system may then confirm that the transaction card is enrolled for use in PIN-less Internet transactions and has at least one stored physical identification hash associated with the transaction card stored in electronic storage. A physical identification sample may then be received from the cardholder and then hashed. At least one stored physical identification hash associated with the transaction card may then be received from electronic storage and compared with the hash of the received physical identification sample. If the two hashes match, then the system may send authorization for the PIN-less transaction card transaction to the merchant if the physical identification sample matches the stored physical identification sample.
Another embodiment may include a system for authenticating a cardholder for use of a transaction card without a PIN in an Internet transaction between the cardholder and a merchant through a financial network. The system may include electronic storage and a financial network host computer system. The financial network host computer system includes a network adapter coupled with the financial network and a processor. The system may receive a transaction card number for authentication of a transaction between a cardholder and a merchant using a transaction card. The system may then determine whether an issuing institution associated with the transaction card accepts Internet cardholder authorization of PIN-less transaction card transactions. Whereupon a URL may be sent to the cardholder directing a web browser to a webpage maintained by the issuing institution for authorization of a cardholder for transaction card Internet transaction. If the issuing institution authenticates the transaction, the system may receive authorization from the issuing institution for use of the transaction card for Internet transaction. The authorization may be routed to the system from the merchant or may be sent to the system and then sent to the merchant.
A further understanding of the nature and advantages of the present invention may be realized by reference to the figures which are described in remaining portions of the specification. In the figures, like reference numerals are used throughout several figures to refer to similar components.
This description provides exemplary embodiments only, and is not intended to limit the scope, applicability or configuration of the invention. Rather, the ensuing description of the embodiments will provide those skilled in the art with an enabling description for implementing embodiments of the invention. Various changes may be made in the function and arrangement of elements without departing from the spirit and scope of the invention as set forth in the appended claims.
Thus, various embodiments may omit, substitute, or add various procedures or components as appropriate. For instance, it should be appreciated that in alternative embodiments, the methods may be performed in an order different than that described, and that various steps may be added, omitted or combined. Also, features described with respect to certain embodiments may be combined in various other embodiments. Different aspects and elements of the embodiments may be combined in a similar manner.
It should also be appreciated that the following systems, methods, and software may be a component of a larger system, wherein other procedures may take precedence over or otherwise modify their application. Also, a number of steps may be required before, after, or concurrently with the following systems, methods, or software.
Systems, methods, and software are described for enrolling and authenticating a cardholder for use of a transaction card without entry of a PIN. Embodiments of the invention rely on and trust enrollment and authentication schemes established, maintained and performed at the financial. In general, embodiments of the invention provide for systems and methods for authenticating a PIN enabled account through a system other than a financial network host computer system, while authorizing payment through the financial network host computer system.
A PIN can be a number, a series of numbers, letters, characters, or any combination thereof used as a security instrument to authenticate a cardholder. According to certain embodiments of the invention, a financial network host computer system receives requests for enrolling cardholders for use of a transaction card without a PIN, for example, in Internet transactions. In response to the request the financial network host computer system, may retrieve past transaction card transactions and query the cardholder to select an actual transaction card transaction from a list including at least one bogus transaction card transaction as well as an actual transaction card transaction. If the cardholder is successful, a digital copy of a physical identifier, such as a fingerprint, voiceprint, or PC signature may be sent to the financial network host computer system. Additionally, the cardholder may be asked to create one or more identifiers that can be used during authentication to validate the cardholder. The financial network host computer system may then hash and store the physical identifier.
Other embodiments of the invention relate to authenticating a cardholder for PIN-less Internet transactions with a transaction card. In one such embodiment, the cardholder agrees to a PIN-less transaction with a merchant. The merchant, accordingly, may request authentication for the transaction by forwarding details to the financial network host computer system. The financial network host computer system may retrieve any hashed physical identifiers associated with the transaction card. If physical identifiers have been enrolled, the system may then request identification of the cardholder. The financial network host computer system receives a digital physical identifier, hashes the physical identifier and compares this hashed physical identifier with the stored hashed physical identifier. If they match, the financial network host computer system may authenticate the transaction card for PIN-less transactions and the system may proceed with the transaction; if they don't match then authentication fails. Authorization or approval of a cardholder for a PIN-less transaction may include a series of procedures and/or protocols. In some embodiments a transaction may not be complete upon approval or authorization. Authorization and/or verification of funds and/or identity may still be required, as well as other steps.
In another embodiment the cardholder agrees to a PIN-less transaction with a merchant. The merchant, accordingly, requests authentication for the transaction by forwarding details to a financial network host computer system. In such embodiments, the system determines whether the transaction card's issuing institution participates in authenticating PIN-less transaction card transactions. If so, the financial network host computer system sends to the cardholder an Internet link to the issuing institutions webpage for authentication. The issuing institution then authenticates the cardholder for Internet PIN-less transactions, and the transaction may proceed.
2. Financial Network
The financial network 115 in its simplest form provides communication with a financial network host computer system 110, merchants 120, financial institutions 140, ATMs 155, etc. Devices on the financial network 105 may communicate with other devices through the network, through a modem, a network interface card, or other wireless card connecting the ATM 155 to a phone line, a four-wire dedicated phone line, a dedicated data line, a wireless network, an optical network, or other communication medium known in the art. A financial institution 140 may also communicate with the financial network host computer system 110. The financial institution 140 may include, for example, one or more server computers, workstations, web servers, or other suitable computing devices. The financial institution 140 may be fully located within a single facility or distributed geographically, in which case a financial network 115, the Internet 125, or other network 150, as described above, may be used to integrate different components. The financial institution 140 may, for example, communicate transaction information, account numbers, authentication, and PINs through the financial network 115, the Internet 125, or other networks to the financial network host computer system 110. The financial institution 140 may also communicate with a merchant 120 and/or the cardholder 135 through the financial network 115, the Internet 125, or other networks to the financial network host computer system 110.
By way of example, the financial network 125 may comprise a network such as the NYCE® network, the Pulse® network, the STAR® network, and the like. The financial network 105, in some embodiments, may also be coupled with a merchant 120. A variety of other combinations is possible and will be apparent to those skilled in the art.
The cardholder 135 may access the financial network through any Internet accessible hardware. For example, the cardholder may access the network using a PC, a mobile computer, a telephone, a smart phone, mobile phone or any other network accessible device.
3. Financial Network Host Computer System and Database
The financial network host computer system 110 and database 112 may be directly connected or coupled through a network 150. The financial network host computer system 110 may include, for example, one or more server computers, workstations, web servers, or other suitable computing devices. The financial network host computer system 110 may be fully located within a single facility or distributed geographically, in which case a financial network 115, the Internet 125, or other Network 150, as described above, may be used to integrate different components. A financial network host computer system 110 may comprise any computing device configured to process, manage, complete, analyze, or otherwise address a request to authenticate a cardholder, a request to authorize a PIN-less transaction card transaction, a request to notify financial institutions of compromised accounts, request authentication for a cardholder using a transaction card from a financial institution, receive physical identifiers from the cardholder, retrieve and compare physical identifiers though a network or directly, as well as other similar tasks.
Application software running on the financial network host computer system 110 may receive a request to enroll a cardholder 135 for PIN-less transaction card transactions, query the database 112 to identify whether a cardholder is enrolled for PIN-less transaction card Internet transactions. The system may also receive authentication requests from merchants 120, send URLs to the cardholder 135, receive authentication from financial institutions 140, and transmit authentications results to the merchant 120 and/or the cardholder 135. Such software may also include the functionality to receive a request to authorize a transaction, and may authorize the transaction as appropriate. The software may also include functionality to create a cryptographic hash of physical identifiers and compare a stored hash with a new hash. The software may also include functionality to create bogus transaction card transaction records and list such bogus records with authentic records for presentation to the cardholder.
The financial network host computer system 110 may receive communications through the internet 125 from the cardholder 135 for enrollment for with a transaction card for PIN-less transactions. The request may also include a digital physical identifier. The request may also contain the transaction card number, and the Internet IP address of the cardholder, as well as other transaction related data. The physical identifier may comprise any biometric identifiers such as, for example, fingerprints, retinal scans, DNA prints, and voiceprints as well as computer fingerprints and/or scans. Other physical identifiers may include id cards.
The financial network host computer system 110 is coupled with a database 112. The database 112 may be coupled to the financial network host computer system 110 either through a network 150 or directly. The database 112 may maintain past transaction card transaction records, hashes of physical identifiers and information regarding whether financial institutions issuing transaction cards participate in online Internet authentication of PIN-less transaction card transactions. The database 112 may comprise one or more different databases, which may be located within a single facility or distributed geographically, in which case a Network 150, as described above, may be used to integrate different components. According to different embodiments of the invention, the database 112 may include any number of tables and sets of tables. One or more of the databases may be a relational database. The database 112 may be incorporated within the financial network host computer system 110 (e.g., within its storage media), or may be a part of a separate system. The financial network host computer system 110 may, therefore, comprise the database 112. The database 112 may be organized in any manner different than described above to provide the functionality called for by the various embodiments, as known by those skilled in the art.
The financial network host computer system 110 may also be connected with a merchant 120. While a merchant 120 is shown in the figures and used throughout the specification to describe embodiments of the invention, the invention is not limited to transactions solely with merchants. Embodiments of the invention may extend to payments to companies, such as, for example, payments to utility companies, credit card companies, mortgage companies, loans servicing companies, landlords, auto brokers, etc as well as transactions with individuals. Furthermore, embodiments of the invention are described in regard to transactions, however, the invention is not limited thereby and extends to all money transfers, micro transactions, tap and go transactions, all payment schemes, all purchases, etc. For example, parents may use embodiments of the invention to transfer money from a personal account to a child's account using embodiments of the invention. As another example a cardholder may make lease payments to an auto broker using embodiments of the invention. As another example a small business may make rent payments to a landlord using embodiments of the invention. As another example a business may make pay for services by transferring money from the business account to the service provider account using embodiments of the invention. As another example a person may also transfer money from a bank account to a credit card account.
The merchant may include a computer system comprising servers, web servers, personal computers, or the like. The connection may occur over the financial network 115, the Internet 125 or another network 150. The merchant server 120 may request authentication for PIN-less transaction card transaction from the financial network host computer system 110. The request may include, for example, transaction information such as, merchant code, merchant address, price of transaction, authentication amount, cardholder information including name, address, and/or transaction card number. The merchant server 120 may also receive a physical identifier from the cardholder 135 and pass it along to the financial network host computer system 110. The cardholder may also request a transaction using other accounts such as a credit card, a checking account, a savings account, other bank account, or a stored-value account. The merchant server 120 may also be in communication with the financial institution 140 server in some embodiments of the invention.
The financial network host computer system 110 may also be connected to a financial institution 140. The financial institution may comprise a bank, credit union, credit card company, gift card issuer, stored value account manager, etc. Moreover, the financial institution 140 may include one or more server computers, workstations, web servers, or other suitable computing devices. The financial institution 140 may be fully located within a single facility or distributed geographically, in which case a financial network 115, the Internet 125, or other network 150, as described above, may be used to integrate different components. The financial network host computer system 110 may communicate with the financial institution 140 for authentication of a transaction card for Internet transactions. The financial network host computer system 110 may also send a link to the cardholder 135 directing the cardholder to the financial institution 140 for authentication through the internet 125. The financial institution 140 may send an authentication for a transaction directly to the financial network host computer system 110, or the financial institution 140 may send authentication directly to the merchant 120. The authentication may include digitally signing an authentication request.
The financial institution 140 may also include a database 142. Furthermore, the financial institution 140 may have software that facilitates the authentication of cardholders for transaction card transactions when the cardholder logs onto the financial institution webpage hosted by the financial institution 140. The authentication process may require a cardholder to present known information, for example, a PIN, a password, a userID, etc. Moreover, authentication may require the cardholder to properly respond to knowledge-based questions, such as, for example, questions like: “what is your pet's name?” “what is your mother's maiden name?” or “what city were you born in?”
The embodiments represented in the flow charts shown in
For example, one cardholder may use a fingerprint as a security identifier for PIN-less transaction card transactions. Another cardholder may use a PC signature. Another cardholder may use keystroke dynamics as a security identifier that uniquely ties the cardholder to the transaction card for PIN-less ATM transactions over the Internet. Any security identifier may be used without deviating from the spirit and scope of the invention.
The flowchart 900 shown in
If the cardholder is unsuccessful in selecting a transaction at block 965, enrollment of the cardholder fails 990. If the cardholder is successful at block 965, a PC signature of the cardholder's computer is received 970, either directly or indirectly from the cardholder's computer. A hash of the PC signature is made 975 and stored in association with the transaction card number 980 without requiring further authentication. Once enrollment is complete, the cardholder is returned to block 810 for authentication of the transaction. Other embodiments may authenticate the transaction after successful enrollment at block 980. Other embodiments may require the system to return to block 805 for authentication.
Another embodiment of the present invention is the authorization of PIN-less transaction card transactions through an issuing institution 140, such as a bank or other financial institution, as depicted in the flow chart 1000 in
Another embodiment of the present invention is shown in the flowchart 1100 depicted in
Returning to block 1215, if the bank does not participate, the system requests and receives a security identifier from the cardholder at block 1220. The system then determines if the security identifier matches stored identifiers associated with the transaction card at block 1225. If there is no match, the authentication is rejected at 1235 and the transaction is rejected at 1240. If the security identifier matches at block 1225, authentication is confirmed 1230 and the transaction may be completed 1245.
If the cardholder is authorized by the bank and has passed the requirements imposed by the bank, the bank signs and sends the authorization request to the merchant at block 1323 signifying approval of the PIN-less transaction card transaction. Thereafter, at block 1325, the merchant requests financial authorization and verification at block 1325. If the transaction is not financially authorized 1329, the transaction is rejected 1240. A transaction is financially authorized if there are sufficient funds in the account associated with the transaction card. This authorization may occur at the financial network host computer system 110 or the bank system 140. If the transaction is not financially authorized, then the transaction is rejected 1240. The financial network host computer system 110 will then verify the digital signature supplied by the bank at block 1327. If the digital signature cannot be verified, the transaction is rejected 1240, otherwise authorization is successful and the transaction may be completed 1246.
Returning to block 1215, if the cardholder's bank does not participate, the system moves to block 1312 and determines whether the cardholder has previously enrolled with a physical security identifier. If the cardholder is not enrolled, enrollment begins at block 1330. If the cardholder is enrolled, the system receives a security identifier, in this case a PC signature, at block 1360. The PC signature may be sent by the cardholder following a request from the system or it may be remotely received by the system. The system creates a hash of the PC signature at 1362, retrieves stored hashes 1365 and compares the two at 1370. If the two match, authentication is confirmed at block 1230 and the transaction is verified 1245. In other embodiments, prior to completing the transaction at block 1245, further authorization and verification may be performed, such as at block 1329.
If the stored hash and the recently received hash do not match at block 1370, the system may query the cardholder at block 1375 to determine if they are using a new computer. If not, the transaction is rejected. If they are using a new computer the cardholder may be allowed to enroll the new computer at block 415. Steps 415, 421, 422, 425 and 430 are similar to those shown in
In some embodiments of the invention described above, the system creates a hash of a physical identifier as shown in block 1362. Hashing refers to a computationally efficient function mapping binary strings of arbitrary length to binary strings of some fixed length, often called “hash values.” It thus permits a data string of arbitrary length to be mapped to a smaller string in a fashion that makes recovery of the original string difficult. The use of such cryptographic hashing may be desirable to ensure that a physical identifier such as a biometric sample a PC signature or the like is secure. There are numerous hashing functions that are known to those of skill in the art and that may be used, including, for example Snefru, N-Hash, MD4, MD5, MD2, PANAMA, any of the Secure Hash Algorithms (“SHA”), RIPE-MD, Tiger, VEST, Whirlpool, and HAVAL. Many of these cryptographic hashing techniques and others are described in further detail in Bruce Schneier, Applied Cryptoraphy (John Wiley & Sons 1996), 2d ed., Chap. 18 (“Schneier II”), the entire disclosure of which is herein incorporated by reference in its entirety for all purposes.
The embodiments of the present invention may be initiated in any number of ways. For example, the cardholder may visit the merchant's web page where the cardholder selects an item to purchase. During the check-out process, the merchant may present the cardholder with a variety of payment schemes that are acceptable to the merchant. One payment scheme may include using a transaction card. If the cardholder selects the transaction card scheme, the proceeds according to the embodiments of the present invention and sends an authorization request to the financial network host computer system 110. In an enrollment embodiment, the cardholder may simply direct a web browser to the appropriate financial network web page where enrollment embodiments may begin. The cardholder may be directed to the financial network from the cardholder's bank, financial institution or the like.
As used throughout this application, a cardholder may be a user, consumer or customer as well as any person using a transaction card or the like in a transaction. The cardholder may use the cardholder's computer as shown in the figures. Embodiments of the invention, while described in relation to Internet transactions are not limited thereby. Other types of PIN-less transaction card transactions may be included. The term “system” used throughout the specification may refer to a debit card network host, a debit card server, a debit card computer system, a credit card network host computer, an ATM network computer system, a financial network host computer system, or the like and may describe processes or methods operating thereon. Moreover, the terms issuing institution, bank, and financial institution each refer to an entity that issues ATM like cards with access secured by a PIN. These entities also have access to and participate across a financial network or networks. The description and claims are not meant to be limited by use of the above terms. Rather, these terms are used in an exemplary manner in order to fully enable and describe the embodiments of the invention. Those skilled in the art will recognize various cardholders, transactions, transaction cards, accounts, systems, and/or issuing institutions that may be implemented without deviating from the spirit and scope of the claimed invention.
Furthermore, the term merchant has been used in to describe a third party payment recipient. The embodiments of the invention are not limited to transactions between a cardholder and a merchant, but extend to any transaction between a cardholder and a third party. Merchant may also refer to a third party that manages accounts for the cardholder and a transaction may be between two cardholder accounts.
Furthermore the term transaction card as used throughout the may include but is not limited to ATM cards, credit cards, charge cards, stored value accounts, stored value cards, gift cards, checking accounts, savings accounts, bank accounts, or the like whether or not the transaction card or account is PIN secured or not.
