US 7,024,395 B1 · Method and system for secure credit card transactions

Abstract

A customer making a credit card transaction inserts their smart card into a card reader attached to the merchant's system. The card reader activates the customer's card and passes certain merchant information. The merchant's system then requests a “billing digest” from the customer's card. The billing digest is returned to the merchant's card reader that forwards it (and the transaction information which includes customer information and merchant information) to the corresponding credit card issuer, which maintains the customer's credit card account. In one embodiment, the customer information and the merchant information are encrypted. Upon receiving the billing digest, transaction information is decrypted if necessary and the credit card issuer looks up the customer's master key using the customer's account number. The credit card issuer then uses the transaction information to re-compute the billing digest (an authentication billing digest) and compares this new value with the billing digest submitted by the merchant. If authentic, the billing digest and authentication billing digest values are equivalent, then funds are transferred and an acceptance notification is returned to the merchant. If not authentic, a denial notification is returned to the merchant. Security is further enhanced by utilizing a unique reference for each transaction in the unique customer information used for creating the billing digest.

Claims27

Dependent claims

A method for securing a transaction in order to prevent fraudulent transactions, said method comprising:

receiving prior to the transaction a secret master key from a third party, wherein the master key remains unchanged and is kept secret, and is not altered after the transaction, the third party storing a copy of the master key;
receiving a request for a digest from a requestor;
retrieving the master key;
retrieving unique client information;
the client information being associated with the master key;
creating the digest by hashing the unique client information and the master key;
returning the digest and the unique client information to the requester, wherein the digest and the unique client information will be used for transacting with the third party;
wherein the request further comprises unique requester information and creating the digest further comprises hashing the unique requester information;
and
wherein the transaction is a credit card transaction, the third party is a credit card issuer and the requestor is a merchant, further wherein the unique requester information includes information describing a merchant identifier which is specific to the credit card issuer, a transaction identifier which is specific to the credit card issuer and purchase information which is specific to a purchase initiated by the client.

7 more elements

A method for securing a transaction in order to prevent fraudulent transactions, said method comprising:

receiving, prior to the transaction, a secret master key from a third party, wherein the master key remains unchanged, and is not altered after the transaction, the third party storing a copy of the master key within the third party, the master key being kept secret;
receiving, by the third party, a transaction request from a requestor, wherein the transaction request includes a digest and unique client information, the unique client information being associated with the master key;
accessing the copy of the master key based on the unique client information;
creating an authorization digest by hashing the unique client information and the copy of the master key;
comparing, by the third party, the authorization digest with the digest from the requestor;
returning a response to the requester from the third party, the content of the response being based on an outcome of the comparison of the authorization digest with the digest from the requestor;
wherein the request includes unique requestor information and creating the authorization digest further comprises hashing the unique requestor information;
and
wherein the third party is a credit card issuer, the transaction is a credit card transaction and the requester is a merchant, further wherein the requestor information includes information describing a merchant identifier which is specific to the credit card issuer, a transaction identifier which is specific to the credit card issuer and purchase information which is specific to a purchase initiated by the client.

6 more elements

A system for securing a transaction in order to prevent fraudulent transactions comprising:

providing means for providing from a third party a secret master key to a client, the master key remaining unchanged after the transaction;
receiving means for receiving a transaction request from a requestor, wherein the transaction request includes a digest and unique client information, the digest being created utilizing the master key provided to the client and the unique client information, the unique client information being associated with the master key;
accessing means for accessing, by the third party, a master key stored within the third party based on the unique client information;
creating means for creating an authorization digest by hashing the unique client information and the master key;
comparing means for comparing the authorization digest with the digest from the requester;
returning means for returning a response to the requester, the content of the response being based on the outcome of the comparison of the authorization digest with the digest from the requestor;
wherein the request includes unique requester information and creating the authorization digest further comprises hashing the unique requester information;
and
wherein the transaction is a credit card transaction, the third party is a credit card issuer and the requester is a merchant, further wherein the requester information includes information describing a merchant identifier which is specific to the credit card issuer, a transaction identifier which is specific to the credit card issuer and transaction data which is specific to a transaction initiated by the client.

6 more elements

Dependencies are inferred from the claim text.

Method and system for secure credit card transactions

Life of this patent

Method and system for secure credit card transactions

Life of this patent

Abstract

Claims27