Patent Application
20160247161
Systems and methods disclosed herein relate to secure data cards and other devices and authentication of secure transactions using the secure data cards and other devices.
Data cards are widely used for identification purposes in applications ranging from financial transactions to security and access control. Information stored on the data cards frequently fall victim to abusive and fraudulent activities that have caused significant financial damages to card issuers and cardholders. Over years, card issuers have implemented aggressive measures to combat fraud with limited success. Data card related fraud is still on the rise. According to a recent report, payment card fraud exceeded $11 billion worldwide and $5 Billion in the US in 2012, with certain categories of fraud increasing at a very rapid pace (The Nilson Report, August 2013). Here, payment cards include credit, debit, prepaid general purpose, and private label payment cards.
One of the key measures to combat card fraud is to improve the card authorization requirements for people who want to access the card information.
In accordance with one aspect of the subject matter disclosed herein, a method of authorizing a transaction based on a secure data card is provided. In accordance with the method, a passcode is received from a user. The passcode includes a magnitude and/or a temporal duration of pressure applied by the user to a pressure sensor or pressure sensor array disposed on the secure data card. The passcode is compared with an internal passcode associated with the secure data card. The internal passcode is not visibly shown on the secure datacard. The transaction is authorized if the passcode matches the internal passcode or denying the transaction or access if the passcode does not match the internal passcode.
In accordance with another aspect of the subject matter disclosed herein, a method of authorizing a user to access the functionality provided by an electronic device includes receiving a passcode from a user. The passcode includes a magnitude and/or a temporal duration of pressure of a single point of contact applied by the user to a pressure sensor or pressure sensor array disposed on the electronic device. The passcode is compared with an internal passcode associated with the device. The internal passcode is not visibly shown on the electronic device. The user is allowed to access the functionality provided by the electronic device if the passcode matches the internal passcode. Access to the functionality is denied if the passcode does not match the internal passcode.
Those of skill in the art will understand that the drawings, described below, are for illustrative purposes only. The drawings are not intended to limit the scope of the present teachings in any way.
The present invention relates to a data card authentication system that can be implemented with considerations of security, reliability, cost, user experience, and compatibility with current and future data card infrastructure. In one aspect, provided herein is a secure data card for facilitating secure transactions and secure authorization to access a location (e.g., restricted facilities) and/or data (e.g., medical records, websites, or any other information).
In some embodiments the passcode input unit 110 comprises a single pressure sensor or pressure sensor array. The pressure sensor or sensor array measures the pressure applied to it as a single point of contact without any spatial dimension. That is, in these embodiments the characteristics of the pressure that may be measured by the pressure sensor or sensor array includes two components: a magnitude component and a temporal component. The temporal component includes a duration over which the pressure is applied to the sensor or sensor array during a single contact event. The temporal component may also optionally include the start and stop time defining the time at which a single contact event with the sensor or sensor array begins and ends, respectively. As used herein, a “contact event” begins when continuous, uninterrupted pressure on the pressure sensor or sensor array is first applied and the contact event ends when pressure with the pressure sensor or sensor array terminates. Pressure is applied to the sensor or sensor array by making contact therewith. Contact with the sensor or sensor array may be achieved by the user's finger, a stylus or by other means.
In some embodiments only the magnitude component of the pressure is measured. In other embodiments only the temporal component of the pressure is measured. In yet other embodiments both the magnitude component and the temporal component are measured.
In some embodiments, a plurality of contact events is combined to form all or a portion of the passcode, including, for example, two or more contact events, three or more contact events, four or more contact events, five or more contact events, six or more contact events, seven or more contact events, eight or more contact events, nine or more contact events, ten or more contact events, 15 or more contact events, 30 or more contact events.
A pre-programmed passcode may be stored in the memory storage unit 150 of the data card prior to its issuance to a customer or other end user. For the user's convenience, in some implementations the pre-programmed passcode may be given to the user in symbolic form using, for example, alphanumeric or other characters. Each character may represent a magnitude component of a contact event, a temporal component of a contact event, or both a magnitude and temporal component of a contact event. The pre-programmed passcode is provided to the user along with the data card. In analogy to a PIN number associated with a debit card that is separately issued to the user, the pre-programmed passcode may be provided to the user separately (e.g., by mail or phone) from the data card.
In some embodiments, the passcode can be generated when the user uses the secure data card for the first time, for example, in a process similar to the process of setting up a passcode to a computer device such as a cellphone, a tablet, or computer: a user can be instructed to enter a passcode prior to using the secure data card for the first time. The passcode is then stored on the secure data card and used as an internal, pre-programmed passcode that must be replicated in order to authorize a transaction.
By way of illustration, the pre-programmed passcode may be represented by the alphanumeric string “abc123.” For simplicity, in this example the letters represent pressure magnitude components and the numbers represent temporal components. Turning first to the pressure magnitude component, the magnitude of the pressure applied to a sensor or sensor array may range from zero to some maximum, full scale pressure. This pressure range may be divided into a number of discrete portions, each of which is represented by a different letter. For instance, if the pressure magnitude range is divided into 3 portions, then one letter, e.g., “c,” may represent the maximum, full scale pressure magnitude, another letter, e.g., “b,” may represent ⅔rds of the maximum pressure magnitude and yet another letter, e.g., “a,” may represent ⅓rd of the maximum pressure magnitude.
Turning next to the temporal component of the passcode, if a sequence of numbers are used to represent the temporal component of a series of contact events in a passcode, each number in the sequence may represent the relative duration of a respective contact event. For example, in the passcode “abc123,” the numbers 123 may represent three contact events in which the second and third contacts events have durations that are respectively two and three times longer than the first contact event.
When the user first activates the data card, an initial calibration process may be performed during which the user enters the pre-programmed passcode with which he or she has been provided. The initial calibration process can begin, for example, by having the user press the sensor or sensor array as hard as she or she can, which, continuing with the example presented above, the processor in the data card can define as the letter “c.” The processor can then define ⅔rd of the user's maximum pressure as the letter “b” and ⅓rd of the user's maximum pressure as the letter “a.”
After entering the letters “abc” of the illustrative password “abc123,” the calibration process continues when the user enters the number “1” by initiating a contact event and mentally counting a time duration of one, which for convenience may be treated as one second, for example. At the end of the time duration of “1,” as mentally determined by the user him or herself, the user terminates the first contact event (by removing contact with the sensor or sensor array) and then begins another contact event to enter the number “2,” while mentally counting to two, at which point the second contact event terminates. Finally, the user performs a similar process to enter the number “3.”
The example presented above illustrates one advantage of the authorization technique described herein. Because each user will have his or her own technique for entering a contact event in terms of the pressure magnitude and/or time duration that is used to represent each alphanumeric or other character, two people can have the same symbolic passcode (e.g., abc123) and yet it will be treated as two different passcodes. That is, if one user has already calibrated a data card to recognize his or her passcode “abc123,” then if a second user enters the same passcode into the same data card, it is unlikely to be recognized as a valid match.
Another example will now be presented in which the passcode is a one-component passcode that has only a pressure magnitude component and not a temporal component.
Turning first to the user's attempt to enter the passcode shown in
The vertically extending double-headed arrows shown in
Turning now to the user's attempt to enter the passcode in
It should be noted that the range of pressure values that will be accepted as matching the pre-programmed contact events may be adjusted by the manufacturer or the card issuer or even in some cases by the user him or herself after first being authorized by entering a matching passcode. Of course, there will be a tradeoff between the degree of security offered by the passcode and the ease of correctly entering the passcode so that it correctly matches the pre-programmed passcode.
Turning first to the user's attempt to enter the passcode shown in
The horizontally extending double-headed arrows shown in
On the other hand,
It should be noted that the range of temporal values that will be accepted as matching the pre-programmed contact events may be adjusted by the manufacturer or the card issuer or even in some cases by the user him or herself after first being authorized by entering a matching passcode. Of course, there will be a tradeoff between the degree of security offered by the passcode and the ease of correctly entering the passcode so that it correctly matches the pre-programmed passcode.
According to an embodiment, the pressure sensor or sensor array of the passcode input unit may include one or more transistor-based or capacitor-based sensors which are able to measure and digitize the pressure of contact events. In some embodiments the pressure sensor or sensor array can measure a continuous range of pressures. In other embodiments the pressure sensor or sensor array may only measure a plurality of discrete pressure values.
The pressure sensor or sensor arrays may include any suitable elements that are responsive to pressure, such as a piezoelectric material (e.g., BaTiO3, Pb(ZrxTi1-x)O3, lead zirconate titanate (PZT), ZnO, CdS, GaN), polymers (e.g., Polyvinylidene fluoride (PVDF), nylon, and poly(γ-benzyl-1-glutamate) (PBLG)), or nanowires of these materials, piezo conductive polymer composite nano materials (carbon nanotubes, nanowires, quantum tunneling composites), piezo resistive materials (e.g., Si thin film, Si nanowire, carbon nanotube, graphene, etc.). The pressure sensors may be also capacitive sensors having a flexible dielectric layer (e.g., nano/micro pyramids and rods structures). One exemplary flexible dielectric layer is described in a publication titled “Highly sensitive flexible pressure sensors with microstructured rubber dielectric layers” by Mannsfeld, S. C. B. et al., Nature Mater. 9,859-864 (2010), which is hereby incorporated by reference in its entirety.
The pressure sensors may also be electromagnetic sensors measuring the displacement of a diaphragm by means of changes in inductance or reluctance, Hall effect, or by Eddy current effect. The pressure sensors may also be optical sensors measuring the optical change (reflection, emission, absorption, fluorescence quenching, etc.) with applied pressure, for example, using Fiber Bragg gratings quantum dots emission. The pressure sensors may also be a micro-electrical-mechanical-system (MEMS) or a nano-electrical-mechanical-system (NEMS) device.
The pressure sensors may also be active matrix thin-film transistor (TFT) pressure sensors. The TFT pressure sensors may include a semiconductor thin film (e.g., Si, Ge, SiGe, III-V semiconductors, II-VI semiconductors, metal oxides, polymers, etc.) prepared by a suitable technique (e.g., evaporation, CVD, solution deposition) or a thin film including nanostructures of semiconductors (e.g., quantumdots, nanotubes, nanowires, etc.).
According to an embodiment, the pressure sensors comprise a transparent ZnO thin film. The ZnO thin film may function as conduction channel in a transistor and a pressure responsive material. An exemplary device including a ZnO thin film is described in a publication titled “Tactile Feedback Display with Spatial and Temporal Resolutions” by Siarhei Vishniakou, et al., Scientific Reports 3, Article number 2521 (2013 ), which is hereby incorporated by reference in its entirety.
The pressure sensor may be disposed on any suitable substrate (e.g.,glass, plastic). In some embodiments the substrate is substantially transparent. A transparent conductive layer such as indium tin oxide (ITO) or a thin layer of metal such as aluminum is disposed on the substrate. An electrically insulating layer (e.g., silicon nitride) may be disposed on the substrate to electrically insulate the transparent conductive layer, and serve as the dielectric of a capacitor between the ZnO filmand the transparent conductive layer. A layer of ZnO is disposed on the electrically insulating layer and is connected to an electrode (e.g., ITO). The ZnO layer preferably is encapsulated by a protective layer (e.g., aluminum oxide).
In some embodiments, authorization to conduct a transaction using the secure data card may require further proof in addition to the use of a passcode as described above. For instance, in some embodiments a biometric indicium may be employed, in which case in addition to authorizing the user to perform a transaction, the user's identity may be authenticated. Such a biometric indicium may include, by way of example, a fingerprint, an iris scan or a biochemical specimen from the user. The biochemical specimen may include, by way of example, body odor or breath or bodyfluids such as saliva or tears. In some embodiments two or more biometric indicia may be employed.
If a biometric indicium is to be employed, the secure data card may include an input unit to collect the biometric indicium or a measurement thereof (e.g., at the time of transaction). This input unit may be incorporated with or separate from the passcode input unit. For example, if the biometric indicium is based on body odor or breath, the input unit may include an electronic nose.
In some embodiments, entry of a correctly matching passcode directly results in authorization. In other embodiments the user is prompted to enter a two-component passcode (e.g., a passcode having both a pressure magnitude and a temporal component) to retrieve a one-component passcode (e.g., a passcode having either a pressure magnitude or a temporal component). In particular, a passcode that requires both a pressure magnitude component and temporal component may be converted, before authentication, into a passcode that only requires a pressure magnitude component or a temporal component. In such embodiments, a passcode requiring two components entered at the time of transaction is compared with the internal pre-programmed passcode that has two components. If the two-component passcode entered at the time of transaction matches the stored, two-component passcode, a new one-component passcode can be generated by the internal processor and displayed on the display unit. The user may use this one-component passcode to conduct subsequent transactions. In some case the number of subsequent transactions that may be performed, or the length of time over which subsequent transactions may be performed, may limited to some specified quantity, after which the user will be required to once again enter the two-component passcode.
In some embodiments, the display unit is used as a timing device to ensure consistency and accuracy of passcode input. For example, while a user is applying pressure to the pressure sensor or sensor array, the display unit can function as a timer to help the user to apply pressure for a consistent length of time. The display may also allow the user to precisely control the time interval between consecutive contact events.
In some embodiments, when the authorization process is completed, the transaction can be either authorized or denied. Upon authorization, the secure data card allows a payment transaction or grants access to restricted information. For example, the secure data card can function as a secure FOB that displays a dynamically varied card security code through which a user can access restricted data, which may include, but is not limited to, medical records or a secure company website. In some embodiments, after the transaction is authorized, the secure data card may send a radio frequency (RF) signal to a card reader or unlock a magnetic strip to allow a user access to a restricted location.
In some embodiments, the display can be used as part of the card activation process. For example, upon authorization, the display unit may show one or more of the following data: the card holder's name or a portion of the name, the card number or portion of the card number, a CSC number and the expiration date of the secure data card.
In the embodiments described above, the pressure sensor or sensor array that receives a one or two component passcode is provided on a secure data card to authorize a transaction or the like. In other embodiments, however, the pressure sensor or sensor array and the associated techniques described above may be employed on a wide variety of devices other than a secure data card. For example, a portable electronic device (e.g., a phone, a tablet, a laptop computer, a medical device) or a non-portable device (e.g., an automatic teller machine (ATM), a security system) may include a pressure sensor or sensor array as described above. By successfully entering a passcode into the pressure sensor or sensor array of such a device, the user may be provided access to some or all of the functionality offered by the device.
One example of a device on which a pressure sensor or sensor array may be disposed is shown in
In the embodiments described above, a passcode is used to authorize a transaction, provide access to an event or location, or to make the functionalityof device available to the user. In other embodiments, however, the passcode may be used solely to authenticate the user. In yet other embodiments the passcode may be used to both authenticate and authorize the user. Such embodiments may be useful, for example, with applications that require a higher degree of security. For example, a pressure sensor or sensor array may be provided on an automobile or a firearm, in which case the user must successfully enter a passcode into the pressure sensor or sensor array in order to access the functionality of the weapon.
According to an embodiment, the processor 120 shown in
The processor 120 may also comprise one or more digital signal processors (DSPs), application specific integrated circuits (ASICs), field programmable gate arrays (FPGAs), discrete logic, or any combinations thereof. When the various features and functions described above are implemented partially in software, a device may store instructions for the software in a suitable, non-transitory computer-readable storage medium and may execute the instructions in hardware using one or more processors to perform the techniques of this disclosure.
As mentioned above, aspects of the subject matter described herein may be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, and so forth, which perform particular tasks or implement particular abstract data types. Aspects of the subject matter described herein may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media including memory storage devices.
In relation to the claims, it is intended that when words such as “a,” “an,” “at least one,” or “at least one portion” are used to preface a feature there is no intention to limit the claim to only one such feature unless specifically stated to the contrary in the claim.
The descriptions above are intended to be illustrative, not limiting. Thus, it will be apparent to one skilled in the art that modifications may be made without departing from the scope of the claims set out below.
Having described the invention in detail, it will be apparent that modifications, variations, and equivalent embodiments are possible without departing the scope of the invention defined in the appended claims. Furthermore, it should be appreciated that all examples in the present disclosure are provided as non-limiting examples.
