The present invention provides methods for performing transactions in wireless environments and for selecting the interface and application which will be used in the transaction. More specifically, the present invention provides methods for utilizing an electronic device, such as an integrated circuit card, which is capable of communicating with a point of sale terminal across both a wireless interface and physical contacts present on the card to select the application to be used in the transaction, the interface to be used, and to inform the point of sale terminal of the appropriate data formats which will be used in the transaction.
Technological improvements have allowed businesses and individuals to engage in transactions in new and expanding environments. For example, payment of a transaction may now be made over a wireless interface such as in the case of a radio frequency or infrared enabled electronic device. For instance, radio frequency enabled credit cards, also commonly known as contactless cards, typically comprise an integrated circuit, and a coiled antenna. The integrated circuit of a contactless card comprises a processor, memory such as random access memory or electrically erasable-programmable read only memory (“EEPROM”), and a modulator/demodulator for impressing data on a radio frequency wave and decoding received data. The antenna is coiled through the interior of the contactless card and is used to communicate data with an external location. In addition, the coiled antenna inductively couples with an external electromagnetic field and serves as a power source for the contactless card. In addition, wireless transactions may be conducted by any electronic device which is enabled to communicate transaction information over any wireless interface including infrared, radio frequency, laser, or another frequency or communication means or protocol for use therewith.
Contactless cards provide increased cost savings to the issuer of such cards because they do not require contact with a physical card-reading device to receive power or exchange information. Similarly, contactless integrated circuit cards provide significant convenience to the cardholder as they allow a consumer to conduct a transaction more quickly and conveniently than in a contact-based environment. For example, using contactless technology, a consumer could present the card for payment without having to locate their card in their wallet, physically provide the card to the merchant, await the merchant to properly read the card through physical means, receive the card back from the merchant, and replace the card in their wallet. Rather, using contactless technology, the transaction could be conducted without the consumer ever removing the card from their wallet. By eliminating the physical exchanges between the consumer and the merchant, contactless technology will result in significant overall time savings to the consumer even if actual processing time for contactless transactions is longer than for contact-based transactions. In addition, a contactless card never needs to leave the actual possession of the card holder as all of the data necessary to the transaction is transferred over a wireless interface. This feature itself provides the cardholder with a increased level of security as it reduces the likelihood that the card will be passed through an unauthorized reader for purposes of skimming the data on the card and creating a counterfeit card.
Nonetheless, these benefits must be balanced against the potential for security breaches which are presented by contactless cards that are not presented in a contact-based environment. In particular, different security issues arise where information is transmitted between a card and a contactless card reader which information may be intercepted during transmission. Potential security breaches which arise by the use of contactless cards include data “hijacking”, data “pick-pocketing” and the “man in the middle” attack.
Hijacking data occurs when a party not involved in a credit card transaction taps into the exchange of data occurring as part of the transaction to extract information being transmitted between a contactless card and a contactless card reader. Not surprisingly, the ability for a fraudulent device to obtain valid data is inversely proportional to the distance between the hijacking device and the card reader and/or the contactless card. In other words, as the hijacking device is permitted to be in closer proximity to card reader and/or the contactless card, the likelihood of the hijacking device successfully obtaining valid data from the transaction is increased.
Pick-pocketing data occurs when a fraudulent device activates and reads the contactless card without the cardholder's knowledge. Data pick-pocketing may even occur when the card is not being used in a transaction as the pick-pocketing device can activate the card and initiate a data exchange. Data is obtained from the card by the fraudulent device using legitimate commands causing the card to evaluate the data exchange as legitimate. Since a contactless card transmits data as radio frequency waves propagating from a single source, a contactless card may be subject to such an attack in locations and from sources of which the cardholder is not aware. Again, the ability for a fraudulent device to obtain valid data is inversely proportional to the distance between the contactless card and the fraudulent device.
A “man in the middle” attack occurs when an exchange between a contactless card and a legitimate card reader is unknowingly intercepted by a third and unauthorized device to the transaction. The third and unauthorized device to the transaction intercepts the data transmitted by the card, copies or otherwise manipulates such data, then transmits such data to the legitimate card reader. When the card reader is returning data or instructions to the card, the third device receives such data and transmits such data to the card. The transaction continues with the third device accepting and re-transmitting all data exchanged between the card and the legitimate card reader. In this fashion, the third device has access to all of the data of the transaction, without the knowledge of either the card holder or the merchant operated card reader.
Because the security risks inherent in a contactless environment may require additional security measures to be performed to secure data during transmission, terminals interfacing with cards need to differentiate between contactless cards and cards that physically contact the terminal. Applications deployed on cards capable of contactless communication with a point of sale terminal may vary and require the use of different types of data, in different formats and with different processing requirements. For example, a single card as used in the present invention may simultaneously have deployed thereon applications which utilize magnetic stripe data and applications which utilize chip data. In this context, magnetic stripe data is that data which is commonly referred to in the industry as Track 1 and/or Track 2 data, as this data is commonly stored on those tracks of the magnetic stripe which appears on the back of non-integrated circuit enabled cards. Chip data is that data which is utilized in the so call smartcard transactions, such as for example the Visa Smart Debit/Credit (VSDC) transactions, and is stored on memory residing on the card itself.
Accordingly, utilizing an integrated circuit card to perform transactions across both a wireless interface with a point of sale terminal and across a contact interface require methods for selecting the application which will be used in the transaction, the interface which will be used in the transaction and the data format which will be used in the transaction. The present invention provides such methods and further provides for their use in the existing environment for credit and debit card transactions with minimal equipment changes to merchant and issuer or service provider equipment.
The present invention provides a method for performing a transaction between an electronic device, such as an integrated circuit card, and a point of sale terminal wherein the electronic device and the point of sale terminal can exchange data across either a contactless interface or a contact based interface.
As described in more detail herein, the present invention enables the user of such an electronic device, referred to herein as a cardholder, to present to a merchant-operated point of sale terminal information regarding a payment service utilized by the cardholder. Once the cardholder presents the device to a point of sale terminal, the payment service to be used in performing the transaction is selected, the interface by which the transaction information will be exchanged is determined, and the format for exchanging data between the device and the terminal is determined. In a preferred embodiment, the cardholder will select the payment service to be utilized in the transaction from a list of services mutually supported by the point of sale terminal on the contactless card.
Further advantages and aspects of the present invention will become apparent to those of ordinary skill in the art upon reading and understanding the following detailed description of the preferred embodiments.
The invention may take form in various components and arrangements of components, and in various steps and arrangements of steps. The drawings are only for purposes of illustrating the preferred embodiments and are not to be construed as limiting the invention.
Before the present methods are described, it is to be understood that this invention is not limited to the particular methodologies or protocols described, as these may vary. It is also to be understood that the terminology used in the description is for the purpose of describing the particular versions or embodiments only, and is not intended to limit the scope of the present invention which will be limited only by the appended claims. In particular, although the present invention is described in conjunction with a financial transaction, it will be appreciated that the present invention may find use in any electronic exchange of data.
It must also be noted that as used herein and in the appended claims, the singular forms “a”, “an”, and “the” include plural reference unless the context clearly dictates otherwise. Thus, for example, reference to a “record” is a reference to one or more records and equivalents thereof known to those skilled in the art, and so forth. Unless defined otherwise, all technical and scientific terms used herein have the same meanings as commonly understood by one of ordinary skill in the art. Although any methods similar or equivalent to those described herein can be used in the practice or testing of embodiments of the present invention, the preferred methods are now described. All publications mentioned herein are incorporated by reference. Nothing herein is to be construed as an admission that the invention is not entitled to antedate such disclosure by virtue of prior invention.
For purposes of this application, “contactless” or “wireless” shall mean any communication method or protocol, including proprietary protocols, in which data is exchanged between two devices without the need for the two devices to be physically coupled. For example, “contactless” or “wireless” shall include radio frequency, infrared, laser, any other communication means, and the use of any protocols, such as proprietary protocols, with such communication means.
For purposes of this application, “card” or “device” shall mean an integrated circuit card which has been enabled to communicate with an external device over a wireless interface, an electronic device which has been enabled to communicate with an external device over a wireless interface, or any other device which is capable of exchanging data with an external device without physically coupling with said external device. For example, and without limiting the foregoing, “card” or “device” shall include an integrated circuit or so called smartcard, a memory chip card comprising flash or other memory means, a personal digital assistant, or a cellular phone. Preferably, a “card” or “device” will also be capable of communicating with an external device through physical contacts as well.
For purposes of this application, “data exchange environment” shall mean the means by which applications are logically stored and organized on the card. For example, “data exchange environment” may include lists or root directories of one or more applications deployed on the device which may be organized according to functionality, processing requirements, the issuer or service provider which deployed the applications, or by some other criteria.
The present invention provides a method by which a card can be used to accomplish a variety of transactions over a wireless interface. It is anticipated that a card used in the present invention does not operate solely in a contactless environment. Rather, it is expected that the card of the present invention may also be utilized in a contact-based environment in which the card must be physically placed in contact with (i.e. swiped through) a card reader. However, the methods of the present invention are equally effective if the card communicates with a terminal or card reader solely by way of a wireless interface.
As shown in
The interaction between the card and the terminal is depicted in
When the card is presented to the terminal at step 200 in
The selection of the data exchange environment, as discussed above, may take any form or follow any methodology now known or hereafter developed. For example, the present invention may utilize the Payment System Environment, or PSE, currently utilized in contact-based transactions modified to operate over a wireless interface or the Proximity Payment System Environment, or PPSE, for selecting the applications over a wireless interface. In a PPSE data exchange environment, the application which is selected for a given transaction is determined by the terminal. Standard PPSE operates by the terminal requesting information on the applications supported by the card. The card responds with the AID's for the supported applications and priority indicators for each application. The priority indicators indicate the card's preferences for which application should be used in the transaction. The terminal receives this information from the card and determines which of the applications supported by the card are also supported by the terminal. The terminal then selects the mutually supported application with the highest priority indicator as the application for use in the given transaction.
In a preferred embodiment, the data exchange environment may comprise an improved PPSE. The improved PPSE of the present invention, as described below, allows the cardholder to make the selection of the application to be used in the transaction rather than allowing that selection to be performed automatically by the terminal. The improved PPSE, as shown in
Since the card can supply the terminal with either magnetic stripe data or chip data, it is necessary that both the card and the terminal agree on the format and type of data being exchanged. The card will, of course, be aware of the format and type of data as the selection of the application and the interface occurs on the card. The format and type of data (also referred to as the profile of the data) is identified and transmitted to the terminal as shown in the embodiment of
In the alternate embodiment as shown in
In an alternate embodiment, the present invention may be utilized when a plurality of cards are placed in wireless communication with the terminal. For example, a cardholder may present his or her entire wallet in proximity to the terminal thus allowing each of the cards within the wallet to be in wireless communication with the terminal. In this embodiment, a plurality of cards are discovered by the terminal. The terminal then polls each of the cards to build a list of supported applications which are deployed on the plurality of cards as follows. Utilizing anti-collision procedures, the terminal selects a first card. The applications deployed on the first selected card and supported by the terminal are then identified on a list of available applications. The card is then placed in a “half” state and the terminal determines if there are additional cards in communication with the terminal. This process is then repeated for each additional card in communication with the terminal. At the conclusion of this processing, the terminal will have compiled a list of all available applications deployed on any of the plurality of cards in wireless communication with the terminal which applications are also supported by the terminal. From this list of applications, the application to be used in processing the transaction may be selected utilizing any of the application selection processes of the present invention including use of priority indicators or displaying a list to the cardholder for selection.
A transaction in the present invention may be conducted using no security techniques or one or more security techniques. Security techniques such as data encryption, dynamic data authentication, static data authentication, and cardholder verification methods may be used as part of a transaction in the present invention. Further, in a preferred embodiment a method for conducting dynamic data authentication where the card need not remain in wireless communication with the terminal is included as part of the present invention. In the dynamic data authentication of the preferred embodiment, also referred to herein as fast dynamic data authentication, the card creates a hash of the magnetic stripe data on the card and includes that hashed data in the ICC Certificate which is utilized with standard dynamic data authentication (DDA). The terminal receives data from the card comprising the magnetic stripe data and the DDA data (including the ICC Certificate). Once this data has been received by the terminal, the terminal needs no further data from the card for authentication purposes. Accordingly, the from the cardholder's perspective the transaction is perceived to be faster as the cardholder can remove the card from communication with the terminal once said data has been transmitted. The terminal then continues processing to authenticate the data received from the card and perform the processing for approval or disapproval of the transaction. It will be apparent to one of ordinary skill in the art that such an authentication method will be particularly advantageous in an environment where quick transaction speeds (or the perception of quick transaction speeds by the cardholder) are required or beneficial.
Although the present invention has been described in conjunction with magnetic stripe data transactions or other data transactions it will be appreciated by one of ordinary skill in the art that the present invention will be effective with any type of transaction or processing which may be deployed on a card or device. For example, applications in which approval or disapproval of the transaction is determined offline (i.e., without the requirement that a third party to the transaction, such as an issuer, approve the transaction) by either the terminal, the card, or a combination of the card and the terminal are within the scope of the present invention.
The foregoing is considered as illustrative only of the principles of the invention. Further, since numerous modifications and changes will readily occur to those skilled in the art, it is not desired to limit the invention to the exact construction and operation shown and described, and accordingly, all suitable modifications and equivalents may be resorted to, falling within the scope of the invention.
This application claims priority to U.S. provisional patent application Ser. No. 60/399,274, filed Jul. 29, 2002 and entitled Contactless Credit Card Payment System and Method.
Number | Name | Date | Kind |
---|---|---|---|
5528222 | Moskowitz et al. | Jun 1996 | A |
5550358 | Tait | Aug 1996 | A |
5774877 | Patterson, Jr. | Jun 1998 | A |
5789733 | Jachimowicz | Aug 1998 | A |
5793301 | Patterson, Jr. | Aug 1998 | A |
5796832 | Kawan | Aug 1998 | A |
5797002 | Patterson, Jr. | Aug 1998 | A |
5828044 | Jun et al. | Oct 1998 | A |
5869825 | Ziarno | Feb 1999 | A |
5870722 | Albert | Feb 1999 | A |
5880769 | Nemirofsky | Mar 1999 | A |
5907832 | Pieterse et al. | May 1999 | A |
5915245 | Patterson, Jr. | Jun 1999 | A |
5943624 | Fox | Aug 1999 | A |
5991410 | Albert | Nov 1999 | A |
5991749 | Morrill, Jr. | Nov 1999 | A |
6038549 | Davis | Mar 2000 | A |
6041314 | Davis | Mar 2000 | A |
6073840 | Marion | Jun 2000 | A |
6076073 | Pieterse et al. | Jun 2000 | A |
6078806 | Heinonen | Jun 2000 | A |
6101477 | Hohle | Aug 2000 | A |
6105006 | Davis | Aug 2000 | A |
6148405 | Liao | Nov 2000 | A |
6170742 | Yacoob | Jan 2001 | B1 |
6195541 | Griffith | Feb 2001 | B1 |
6223291 | Puhl | Apr 2001 | B1 |
6305603 | Grunbok, Jr. | Oct 2001 | B1 |
6311167 | Davis | Oct 2001 | B1 |
6321980 | Yazumi | Nov 2001 | B1 |
6331972 | Harris | Dec 2001 | B1 |
6342844 | Rozin | Jan 2002 | B1 |
6356752 | Griffith | Mar 2002 | B1 |
6366893 | Hannula | Apr 2002 | B2 |
6378073 | Davis | Apr 2002 | B1 |
6394341 | Makipaa et al. | May 2002 | B1 |
6397126 | Nelson | May 2002 | B1 |
6415156 | Stadelmann | Jul 2002 | B1 |
6442532 | Kawan | Aug 2002 | B1 |
6463534 | Geiger | Oct 2002 | B1 |
6480957 | Liao | Nov 2002 | B1 |
6487180 | Borgstahl | Nov 2002 | B1 |
6487540 | Smith | Nov 2002 | B1 |
6505095 | Kolls | Jan 2003 | B1 |
6512919 | Ogawawara | Jan 2003 | B2 |
6539362 | Patterson, Jr. | Mar 2003 | B1 |
6557752 | Yacoob | May 2003 | B1 |
6577229 | Bonneau | Jun 2003 | B1 |
6577861 | Ogasawara | Jun 2003 | B2 |
6584309 | Whigham | Jun 2003 | B1 |
6585598 | Nguyen | Jul 2003 | B2 |
6587835 | Treyz | Jul 2003 | B1 |
6590588 | Lincke | Jul 2003 | B2 |
6601040 | Kolls | Jul 2003 | B1 |
6604086 | Kolls | Aug 2003 | B1 |
6604087 | Kolls | Aug 2003 | B1 |
6606602 | Kolls | Aug 2003 | B1 |
6609655 | Harrell | Aug 2003 | B1 |
6609658 | Sehr | Aug 2003 | B1 |
6609659 | Sehr | Aug 2003 | B2 |
6615186 | Kolls | Sep 2003 | B1 |
6622124 | Kolls | Sep 2003 | B1 |
6625583 | Silverman | Sep 2003 | B1 |
6626356 | Davenport | Sep 2003 | B2 |
6641050 | Kelley et al. | Nov 2003 | B2 |
6978019 | Lapstun et al. | Dec 2005 | B1 |
20010037249 | Fitzgerald | Nov 2001 | A1 |
20010037264 | Husemann | Nov 2001 | A1 |
20010051920 | Joao | Dec 2001 | A1 |
20020023215 | Wang | Feb 2002 | A1 |
20020030579 | Albert | Mar 2002 | A1 |
20020073024 | Gilchrist | Jun 2002 | A1 |
20020073027 | Hui | Jun 2002 | A1 |
20020073042 | Maritzen et al. | Jun 2002 | A1 |
20020077993 | Immonen | Jun 2002 | A1 |
20020087478 | Hudd | Jul 2002 | A1 |
20020107007 | Gerson | Aug 2002 | A1 |
20020111919 | Weller et al. | Aug 2002 | A1 |
20020116330 | Hed | Aug 2002 | A1 |
20020123359 | Wei | Sep 2002 | A1 |
20020143634 | Kumar | Oct 2002 | A1 |
20020143655 | Elston | Oct 2002 | A1 |
20020152178 | Lee | Oct 2002 | A1 |
20020174016 | Cuervo | Nov 2002 | A1 |
20020181710 | Adam | Dec 2002 | A1 |
20030001459 | Scott | Jan 2003 | A1 |
20030004891 | Van Rensburg | Jan 2003 | A1 |
20030022655 | Bogat | Jan 2003 | A1 |
20030074328 | Schiff | Apr 2003 | A1 |
20030075610 | Ong | Apr 2003 | A1 |
20030125054 | Garcia | Jul 2003 | A1 |
20030125969 | Kizer | Jul 2003 | A1 |
20030130919 | Templeton | Jul 2003 | A1 |
20030135470 | Beard | Jul 2003 | A1 |
20030149662 | Shore | Aug 2003 | A1 |
20030167207 | Berardi | Sep 2003 | A1 |
20030172028 | Abell | Sep 2003 | A1 |
20030187786 | Swift | Oct 2003 | A1 |
20030187796 | Swift | Oct 2003 | A1 |
20030195842 | Reece | Oct 2003 | A1 |
Number | Date | Country | |
---|---|---|---|
20040068472 A1 | Apr 2004 | US |
Number | Date | Country | |
---|---|---|---|
60399274 | Jul 2002 | US |