Security aspects of a self-authenticating credit card

A self-authenticating credit card includes an input device for entering a PIN. The PIN is accepted by a micro-controller that uses the entered PIN as an encryption key for decrypting stored account information. A portion of the account information includes data, that when decrypted, contains an image that is rendered on an integral display, with account information sent to a transaction terminal. A timer is used to limit access to account data while in the unlocked state.

Not applicable.

FIELD OF THE INVENTION

The present invention relates generally to credit cards/tokens and more particularly to a means of providing additional security to credit cards and transactions without changing underlying infrastructure.

BACKGROUND OF THE INVENTION

Credit cards are ubiquitous with monetary transactions. They are used in a number of scenarios to purchase groceries, restaurant meals, retail/online products, gas, or just about anything. Most often a cash or check transaction can be replaced with a credit/debit card.

False charges create a tremendous burden on financial institutions and card holder alike. A lost or stolen card can easily be used by an unauthorized user to make purchases. Within several hours of obtaining a lost or stolen card, a thief can fraudulently charge thousands of dollars before a notification process can stop use of the card.

Some safeguard procedures have been put into place:1. Retail clerk verifies customer signature matches that on the back of card.2. Retail clerk verifies customer ID matches the name on card.3. Authorization center uses sophisticated buying profiles to identify a potentially unauthorized purchase.

These safeguard procedures are not always performed at the point of sale, for example, a gas purchase. Many retail outlets do not require a signature for authentication with purchases under $50, nor does the retail clerk check the card carrier's ID.

There is accordingly an unmet need in the art to provide additional security to the use of credit cards while using the existing underlying infrastructure without changes.

An example of a prior art device is shown in U.S. Pat. No. 6,954,133, entitled Biometric smart card, biometric smart card reader, and method use issued Oct. 11, 2005, to Travis M. McGregor et al. McGregor claims an alternate means of exchanging data between authenticating bank and card to make transactions more secure.

Another example of a prior art device is shown in U.S. Pat. No. 4,667,087, entitled Secure Credit Card, issued May 19, 1987 to Max A. Quintana. Quintana teaches a means of obscuring critical account information until a user PIN is supplied.

It is the goal of the present invention to use the policies and equipment of existing infrastructure for credit card purchases. In addition, the present invention provides a means of managing internal account data of a credit card to prevent unauthorized use.

SUMMARY OF THE INVENTION

The present invention relates generally to credit cards/tokens and more particularly to a means of providing an additional layer of security to existing credit cards.

The apparatus and system according to the present invention provides a credit card with a display and integrated input mechanism that is electrically connected to a micro-controller equipped with internal memory. A user PIN is entered via the input mechanism and used to decrypt account data stored within the micro-controller's memory. The decrypted account data is then rendered on the integral display and sent to a transaction terminal when making a purchase.

Other objects and advantages of the present invention will be more readily apparent from the following detailed description when read in conjunction with the accompanying drawings.

DETAILED DESCRIPTION OF THE INVENTION

FIG. 1schematically depicts a self-authenticating credit card100with an integrated micro-controller102, an input device101which is an integrated human interface device (“HID”), and a graphic display109which is an integrated output display. The self-authenticating credit card100includes an indicator107, and an RF transponder108.

The self-authenticating credit card100is shown schematically as being in two-way communication of account data112(in clear form) with a banking institution111, and two-way communication of account data112(in clear form) with a transaction terminal110. It will be understood that the terminal is exemplary, as is the banking institution shown, and it is contemplated that the present inventive self-authenticating credit card100would work with other types of suitable transaction terminals and with any banking institutions capable of accepting this type of credit card.

The micro-controller102includes a timer103, encrypted account/reference data104, clear reference data105, and an encryption/decryption engine106. The RF transponder108provides two-way communication of decrypted account data112.

More specifically,FIG. 1schematically depicts a self-authenticating credit card100showing the input device101as a series of alpha-numeric buttons (namely buttons 0-9 and a button with a key symbol shown thereon) connected to the micro-controller102, the connection being indicated schematically by dashed lines120,121, and122. It will be understood that the actual connection between the input device101and the micro-controller102can be of any type which would be within the ambit of skill of anyone having skill in the numeric keypad electronic interface arts.

The micro-controller102is equipped with non-volatile memory used to store the encrypted account data104. The account data104preferably includes of a number of different numeric elements describing a customer account.

For example, the encrypted account data104preferably includes the following:Name and addressAccount numberCustomer photographCustomer signatureExpiration date

The account data104is held in non-volatile memory in its encrypted form. Clear reference data105is stored in non-volatile memory, and is an arbitrary known string which is also included as account data when the encrypted account data104is created. That is, in addition to the aforementioned account data, the account data104also includes the identical arbitrary known string, all in encrypted form.

Since reference data104is present in both its cypher and clear forms, it is used to verify correct PIN entry. A PIN is entered via the input device101and received by the micro-controller102. The entered PIN is used as an encryption key to decrypt account data104with the encryption/decryption engine106, e.g. using an AES-128 (Advanced Encryption Standard). Other types of encryption can be employed as well, and all such variations are contemplated as being within the ambit of any one skilled in the electronic encryption arts.

For example, specific account data104is encrypted using PIN=1234. If the user enters the correct PIN number (here, 1234), then the decrypted reference data contained within the account data104will match the clear reference data105permanently held in clear form. If the user enters 1233 (for instance), then no match will occur, and it will be presumed that an incorrect PIN was input.

Cryptographers generally do not believe doing a direct compare of an entered PIN with a PIN stored in memory is secure, inasmuch as a compromised memory will yield a means of accessing account data. That is, a skilled person might fraudulently access the memory, and thereby gain knowledge of the data in the memory. Therefore, it is desirable to make an indirect comparison, wherein knowledge of the data in the clear memory is useless since the encrypted memory will differ unless that data in the encrypted memory is first decrypted by entry of a correct PIN. This is as described in the preceding discussion.

The RF transponder108is provided for communication with the transaction terminal110, as mentioned above. The micro-controller102will respond to requests to transmit account data112at any time. If the user has not input the correct PIN, garbled account data will be sent to the transaction terminal110resulting in a rejected purchase request. If, on the other hand, a correct PIN was entered, correct account data112will be sent to the transaction terminal110.

A timer103is provided to limit the time account data112resides in memory in clear form. The timer103starts at the time a PIN is entered. Decrypted account data112residing in memory will get erased once the timer expires. A period for expiration is selected to provide adequate time to complete a transaction and short enough to prevent unauthorized access if the card is lost or stolen. This period of time can be selected, by way of an example, to be on the order of tens of seconds or even up to several minutes. Longer time periods, while possible, are inadvisable because of the risk of loss of the card.

The graphic display109allows rendering of a customer's picture ID once a correct PIN is entered. A digitized photograph taken at one's banking institution is coupled with the aforementioned exemplary account data which is also then encrypted with a default PIN to create the account data104. Decryption of this account data104, by use of the correct PIN, will restore the correct digital representation of a customer likeness which will be rendered on the graphic display109. Furthermore, the present invention contemplates that digitized representation of the customer's signature can also be used in addition to customer photo for display by the graphic display109, and such display can be together, or sequential, or in an alternating form. Other types of information can optionally also be provided, and all such variations are within the ambit of any one having skill in the art of electronic displays.

An optional indicator107is provided to indicate correct or incorrect PIN entry. The correct PIN entry will result in the indicator lighting up and/or changing from one condition to another condition. If graphic content is rendered on graphic display109, indicator107may not be necessary since a correct PIN will yield the correct customer likeness. If an incorrect PIN is used to decrypt account data104, the image on the display109will appear as random dots (e.g. like “snow” on a TV) thereby providing visual feedback of correct or incorrect PIN entry.

When distributing the self-authenticating credit card100, the dispensing bank will need to load the account data. The procedure is preferably performed via the RF transponder108that is used as a receiver. The account data in clear form is sent from the banking institution's computer111to the self-authenticating credit card100via the RF transponder108. The account data is accompanied with a default PIN which the encryption/decryption engine106uses to encrypt received account data (that is, which is received in clear form) so as to encrypt that data so as to create account data104in a cypher form (that is, in encrypted form). Once the card100is distributed, it becomes possible for the customer to change their PIN in the manner shown and referenced inFIG. 3, discussed further hereunder.

FIG. 2represents a state diagram showing three states of the SACC (Self-Authenticating Credit Card)100as a preferred embodiment of the present invention. Deployment starts at a reset state201. Here, no account data is present and all memory is zeroized (zeroizing is the act of over-writing all critical data with zeros). An RF communication link is then established between the SACC100and the banking institution computer111in the manner discussed hereinabove. Customer data, along with a default PIN, is then written to the card100by the banking institution computer111. The known reference data105is concatenated with the received clear account data, is encrypted by the encryption/decryption engine106with the default PIN, and is stored in non-volatile memory to become the encrypted account data104. Once the account data104has been written successfully, the SACC100enters the locked state202and is ready for use.

In the locked state202, the account data104is not accessible in clear form to the outside world until the user enters a correct PIN. A request from the transaction terminal110to transmit account information will cause the SACC100to transmit account data112which is in its zeroized state, and will therefore be rejected by the credit authorization facility; the transaction terminal110will therefore indicate an error.

In order to provide legitimate account data112to the transaction terminal110, the SACC100must be unlocked by entering a correct PIN. Once the correct PIN is entered, the SACC100will transition to the unlocked state203. If entry of the correct PIN fails a predetermined number of times, the SACC100will zeroize account data104and render itself inoperable. At this point, the SACC100must be returned to the banking institution for re-creation of valid account data104.

The steps and operations discussed in the foregoing, and as further discussed below, are accomplished by programs and/or software stored in the micro-controller102, and/or as part of the operating system of the micro-controller102. These would be within the ambit of skill of any one having skill in the programming arts for micro-controllers for smart credit cards.

Entry into the unlocked state203occurs when the correct user PIN has been entered via the input device101. The PIN entry procedure and verification is shown inFIG. 3and is discussed further hereunder. Once unlocked, the encryption/decryption engine106creates account data in clear form112from the account data104(which exists in cypher form) and the user is thereby able to transmit legitimate account data (in a clear form) to the transaction terminal110.

In addition, once the unlocked state occurs, the user is able to define a new PIN. A four digit PIN has a chance of 1/10000 of being guessed and is not considered cryptographically secure. Therefore, the user is encouraged to create a custom PIN with more digits/characters. Alpha characters, as well as numeric characters, are preferably supplied on the keys of the input device101allowing creation of PINs that are easier to remember.

Upon entry into the unlocked state203, the timer103is started providing a means of limiting the time in which the SACC100remains in the unlocked state203. Once the predetermined amount of time (as measured by the timer103) expires, the account data in clear form112is zeroized and the SACC100reverts back to its locked state202.

FIG. 3diagrammatically shows the process of entry into the unlocked state203. The process starts in the locked state202whereupon the customer enters a PIN as depicted in step301. Once a PIN has been received, the micro-controller102decrypts the account data104at step302to create account data112in clear form and which also thereby creates the encrypted reference data in a clear form as well to form decrypted reference data. If the decrypted reference data matches the reference data105, then the correct PIN has been received; this test is shown in step303.

Assuming that the correct PIN is entered as determined at step303, then the SACC100is in the unlocked state203. In this unlocked state, the user can define a new PIN as shown in step304. The new PIN will be used to encrypt the account data112together with the known reference data105to create new encrypted account data104as depicted in step305.

If the decrypted reference data does not match the clear reference data105in step303, a failed-attempts counter is incremented at step306and compared with a brute force attack limit (the brute force attack limit being a predetermined number of failed attempts) in step307. If the failed attempts exceeds the brute force attack limit at step307, then all account parameters are zeroized as indicated in step308, at which point the SACC100is no longer operable and requires reconfiguration by the issuing bank.

The foregoing embodiments are described in sufficient detail to enable those skilled in the art to make and use the invention, and it is to be understood that other embodiments would be evident based on the present disclosure and that process or mechanical changes may be made without departing from the scope of the present invention.

In the foregoing description, numerous specific details are given to provide a thorough understanding of the invention. However, it will be apparent that the invention may be practiced without these specific details. In order to avoid obscuring the present invention, some well-known circuits, system configurations, and process steps are not shown in detail and would be understood by any one having skill in the relevant art.

The device100of the present invention can be powered by a self-contained battery (not shown), or can be externally powered by RF energy or microwave energy (not shown), or can draw power from a terminal which reads the device.

Likewise, the drawings showing embodiments of the apparatus/device are semi-diagrammatic and not to scale and, particularly, some of the dimensions are for clarity of presentation and may be shown greatly exaggerated in the drawings.

While the invention has been described in conjunction with a specific preferred embodiment which is considered to be the best mode, it is to be understood that many alternatives, modifications, and variations will be apparent to those skilled in the art in light of the foregoing description and accompanying drawings. Accordingly, it is intended to embrace all such alternatives, modifications, and variations that fall within the scope of the included claims. All matters hithertofore set forth herein or shown in the accompanying drawings are to be interpreted in an illustrative and non-limiting sense.