Patent Application
20050203856
The field of the invention is financial transactions protocols, methods and systems, more particularly, methods and systems for accelerating (and increasing security of) card-initiated financial transactions and related message transmissions.
There appears to be no directly related and analogous art. There is perhaps one patent that is interesting to note, U.S. Pat. No. 6,393,411 to Bishop. This patent discloses a secure funds device for use with a computer system. One or more electronic cash devices store electronic funds and transfer funds in response to a funds transfer request when authorized by an authorization signal. A processor is used for connecting the funds transfer request from the computer system to the electronic cash device and for transferring electronic funds from the electronic cash device to the computer system when the authorization signal is present. The device of the Bishop patent is essentially a “secure funds device” (as stated) which is actuated by a “pushbutton” actuator or other actuator. In all claims of this patent, the “secure funds device” is referred to. This Bishop invention is unlike the present invention, because it appears to be essentially a vehicle for the transmission of electronic money credits. The present invention is a cardholder and card-initiated purchase request message generator, which first challenges a terminal device. While the present invention can be used to effectuate and generate electronic commerce transactions, it is not per se dedicated to transferring funds. Also the button of the present invention (where implemented, depending on configuration details) is not directly analogous to the pushbutton of the Bishop device, despite that both inventions have actuators and despite that both inventions can generate electronic commerce transactions. Furthermore, the Bishop invention does not have a card initiated terminal challenge transaction, in the manner of the present invention.
Consumers expect and demand increasingly faster completions of transactions when making purchases. The current protocols for securely transacting credit card payments take several seconds to complete transaction dialogues and close transactions. This takes more time on the part of consumers and sales clerks, than is necessary.
The conventional, existing approach to POS terminal/cardholder authentication protocols, allows POS terminals to initially and anticipatorily challenge cardholders and cardholder apparatuses (a.k.a. cardholder apparatuses and other transactions-initiating apparatuses, e.g.,tokens, debit cards, credit cards, smartcards, and other end-user apparatuses including transceivers, etc.). With current (e.g., EMV) protocols, POS terminals can access data on the user's card without the user first authorizing the POS terminal access and without the user even being aware that such access has occurred. By contrast, in the present invention, the privacy of the user (and privacy of their card) is protected because the method of the invention does not allow POS terminal communications with the card unless and until the user and the user's card have voluntarily and explicitly initiated a financial transaction.
It appears there are few (if any) products currently on the market allowing cardholders and cardholder transactions apparatuses to initially and anticipatorily authenticate, verify, and validate the identities of “interrogating” POS terminals (and/or other transactions-authenticating terminal apparatuses) before cardholders/cardholder apparatuses authenticate the “unproven” POS terminal apparatuses and their subsequent transmissions. Accordingly, what's needed in the art, is a card-initiated authentication protocol method (unlike the current EMV protocol) that allows cardholders and card apparatuses, to initially “self-authenticate” while efficiently and effectively challenging, authenticating, and verifying their chosen destination financial transaction terminal (e.g., a POS terminal or the like).
A primary object of the invention is to increase transaction speeds so that cardholders and sales personnel can save substantial amounts of time when carrying out transactions; i.e., the invention provides a method for making a cardholder-authentication-governed transaction authentication protocol operate at speeds up to 400% faster than conventional financial transaction protocols and other protocols. For example, the so-called EMV protocol may be insufficiently fast when compared to the present invention, and thereby potentially inconvenient and/or impractical for applications where speed is critical.
It is another object of the invention to improve the privacy of the transaction and protect the user's card from unauthorized access, by requiring that the user's card initiate the transaction so that the card cannot be accessed without explicit user permission. This can be achieved by creating a cardholder/cardholder apparatus-initiated method for authenticating POS transceiver devices (and other financial and POS terminal devices). This procedure allows users to have the “first and last say” in financial protocols involving authentication sequences.
It is a related primary object, to allow POS terminals to be authenticated and verified by cardholders and cardholder apparatuses (e.g. hardware tokens—such as smartcards, debit and credit cards—and/or other cardholder financial transactions devices).
The invention allows end user cardholders—by means of their own card devices—to authenticate POS terminal devices and other financial terminal machinery, in a way substantially different from the existing EMV (Europay Mastercard Visa) protocol. The EMV protocol is often used for authenticating user transmissions to POS terminal devices. By contrast, the present invention performs authentication of the parties to a prospective transaction at the same time that it also transfers the message data necessary to carry out the transaction. If both the authentications are successful—both the card device and the financial transaction terminal device—then the exchanged authentication data and transactions data sent between devices can be used to complete the transaction (assuming the account has sufficient funds). Only three sets of messages—a Purchase Request Message; an Invoice Message; and an Acknowledgement Message, each comprising a series of data packets—need to be transmitted to effectuate a financial transaction, greatly reducing the time required to perform the transaction.
The present invention teaches that the cardholder apparatus (a card, token, etc.) initially challenges the POS terminal with a randomized challenge and a Purchase Request, comprising a Purchase Request Message. Next, in response to the challenge, the financial transaction terminal (e.g., a POS terminal) returns an authenticated reply within a responsive invoice, together comprising an Invoice Message. Next, the card apparatus (e.g., smartcard, transceiver, etc.) validates and authenticates the Invoice Message reply and sends back a card apparatus-authenticated response to the financial transaction terminal where it is yet again validated.
In summary, the present invention teaches that the card device challenges the financial transaction terminal (e.g., a POS terminal or other terminal device) with a randomized challenge. The terminal then returns an authentication reply; the cardholder apparatus then validates the terminal authentication reply (included in the Invoice Message) and sends an authenticated response to the financial transaction terminal.
Table 1A shows total bytes for Purchase Request, Invoice, and Acknowledgement Messages
Table 1B estimates propagation delays for present invention contact and contactless transactions
102 Cardholder's Card (or other cardholder apparatus, e.g., a token device)
104 Financial Transaction Terminal (e.g., POS machine)
106 Card Authority/Financial Intermediary (e.g., Bank, Card Association, etc.)
In a first preferred embodiment of the invention—referring now to
Referring now to the message shown in
Referring now to the message shown in
Looking now at the message illustrated in
Referring now to
Transaction Processing Speed Discussion/EMV Transaction Speed
Current implementations of EMV (Europay, Mastercard, Visa) protocols require up to 12 seconds from the time that a contact-type smartcard is inserted into the POS equipment, until the time that it is withdrawn from the POS equipment.
Notably, the fastest EMV transactions recorded require about 8.4 seconds, e.g., as reported and chronicled at www.trintech.com in reference to “time trials” of January 2003. For additional info, see also: http://www.trintech.com/NAE213122241451005836515NDBQ22JAN03A.html
Also notably, contactless smartcards take even longer than contact smartcards, because of power limitations on their cryptographic processing capability. Most such delays are due to the EMV requirement to perform PKI (“public key infrastructure” cryptography) using mathematical exponentiation using large numbers. The rest of the time is taken up by making many transfers using primitive smartcard commands with large amounts of data.
While the EMV protocol is expected by its' providers to be an improvement in speed to complete an electronic transaction, when compared to tendering of cash to a cashier—given the cashier's manual payment amount entry and subsequent change-making (averaging 15 to 30 seconds)—it can be observed that neither the speed of EMV protocol-based payment options, nor the speed of the cash payment options—are “fast” at all, let alone optimized for high volume, fast-moving electronic commerce transactions where speed expectations are extremely high. By like reasoning, it's easy to observe, EMV protocol-based payment options also appear comparably NOT “fast” at all, compared to cash, let alone optimized for micro-payments, typically exemplified by vending machine applications, parking meter applications, coin payphone applications, etc. (To better visualize and consider this, just look uninterruptedly at a watch for 15 seconds or more, to imagine waiting that long for a card to be processed before the vending cycle begins.).
Other ideas and variations on the present invention may become apparent to those skilled in the art after reviewing this application. Only a few versions of this present invention are described herein; not all variations and combinations possible are stated. It should also be noted that the present invention requires one or more software programs to execute on both the card of the present invention and the financial transaction terminal of the present invention.
Transaction Processing Speed Discussion/Transaction Speed of this Invention
The protocol of the method of my invention greatly reduces the transaction time by reducing the number of transaction steps and simplifying the required cryptography. The symmetrical key cryptography reduces the processing time to 17 ms per 8 byte block and the shorter packets reduce the transaction delivery time. The result is transaction completion in less than one-half second (i.e. about 475,000 microseconds) if errors or retries are not present. The complete transaction can be performed within one second even when on-token biometrics are employed.
This Application claims priority to Provisional Application 60/553,024 filed Mar. 15, 2004.
| Number | Date | Country | |
|---|---|---|---|
| 60553024 | Mar 2004 | US |
