Source: http://www.freepatentsonline.com/8919643.html
Timestamp: 2017-10-24 09:49:00
Document Index: 247609249

Matched Legal Cases: ['art\n20030135739', 'Application No. 10', 'Application No. 10012051', 'Application No. 200680022761', 'Application No. 06', 'Application No. 06', 'Application No. 200680022761', 'Application No. 2605596']

Method and apparatus for using at least a portion of a one-time password as a dynamic card verification value - Bank of America Corporation
United States Patent 8919643
Ashfield, James M. (Charlotte, NC, US)
13/617885
G06K5/00; G06Q20/24; G06Q20/34; G06Q20/38; G06Q20/40; G07F7/10
235/382, 235/493, 235/380
Download PDF 8919643 PDF help
20080137861 Security Code Production Method and Methods of Using the Same, and Programmable Device Thereof 2008-06-12 Lindmo et al. 380/270
20080029607 Dynamic credit card with magnetic stripe and embedded encoder and methods for using the same to provide a copy-proof credit card 2008-02-07 Mullen 235/492
20060242698 ONE-TIME PASSWORD CREDIT/DEBIT CARD 2006-10-26 Inskeep et al.
20060174113 System for secure communication 2006-08-03 Zahari
20060059346 Authentication with expiring binding digital certificates 2006-03-16 Sherman et al.
7003501 Method for preventing fraudulent use of credit cards and credit card information, and for preventing unauthorized access to restricted physical and virtual sites 2006-02-21 Ostroff
20060015358 Third party authentication of an electronic transaction 2006-01-19 Chua
20050239440 Replaceable sequenced one-time pads for detection of cloned service client 2005-10-27 Chen et al.
6957185 Method and apparatus for the secure identification of the owner of a portable device 2005-10-18 Labaton
6952781 Security server token caching 2005-10-04 Chang et al.
20050188202 Token provisioning 2005-08-25 Popp
20050182971 Multi-purpose user authentication device 2005-08-18 Ong et al.
20050182927 Multi-function solar cell in authentication token 2005-08-18 Shatford
6928558 Method and arrangement for reliably identifying a user in a computer system 2005-08-09 Allahwerdi et al.
20050067485 Apparatus and method of identifying the user thereof by means of a variable identification code 2005-03-31 Caron
20050050330 Security token 2005-03-03 Agam et al.
20050015588 Token device that generates and displays one-time passwords and that couples to a computer for inputting or receiving data for generating and outputting one-time passwords and other functions 2005-01-20 Lin et al.
20040255119 Memory device and passcode generator 2004-12-16 Ukeda et al.
20040202325 User-computer interaction method for use by a population of flexible connectable computer systems 2004-10-14 Margalit et al.
20040064706 System and method for controlling access to multiple public networks and for controlling access to multiple private networks 2004-04-01 Lin et al.
6715082 Security server token caching 2004-03-30 Chang et al.
20040059952 Authentication system 2004-03-25 Newport et al.
6704715 Method and system for ensuring the security of the remote supply of services of financial institutions 2004-03-09 Rosset et al.
20040031856 Physical presence digital authentication system 2004-02-19 Atsmon et al.
20040026506 Financial transaction card with sound recording 2004-02-12 Finkelstein
20040026495 Transaction card with annunciator 2004-02-12 Finkelstein
20030212894 Authentication token 2003-11-13 Buck et al.
20030208449 Credit card fraud prevention system and method using secure electronic credit card 2003-11-06 Diao
20030204732 System and method for storage and retrieval of a cryptographic secret from a plurality of network enabled clients 2003-10-30 Audebert et al.
20030182241 Time variable financial authentication apparatus 2003-09-25 Everhart
20030135739 System and method for authentication 2003-07-17 Talton, Sr.
20030084304 System and method for validating a network session 2003-05-01 Hon et al.
20030011731 Liquid crystal display device with retardation plates 2003-01-16 Yoshida et al.
20020198848 Transaction verification system and method 2002-12-26 Michener
20020133713 Security system for preventing a personal computer from being stolen or used by unauthorized people 2002-09-19 Fieschi et al.
6445780 Method and system for ensuring the security of telephone call management centers 2002-09-03 Rosset et al.
20020116617 System and method for authentication 2002-08-22 Talton, Sr.
20010056409 Offline one time credit card numbers for secure e-commerce 2001-12-27 Bellovin et al.
5963643 Method and system for the transfer of information between two populations of persons, one nomadic and the other sedentary 1999-10-05 Goreta et al.
5859913 Method and system for the high-speed generation and transmission of a sequence of characters by means of voice frequencies 1999-01-12 Goreta et al.
5661807 Authentication system using one-time passwords 1997-08-26 Guski et al.
5432851 Personal computer access control system 1995-07-11 Scheidt et al.
5216716 Transmitting device of signal sequences 1993-06-01 Bernard
EP1338940 2003-08-27 Universal password generator
EP1378870 2004-01-07 Encryption Communication System for Generating Passwords on the Basis of Start Information on both parties of Communication
GB2387999A 2003-10-29 Sequential authentication with infinitely variable codes
WO2000048064A1 2000-08-17 SECURITY ACCESS AND AUTHENTICATION TOKEN WITH PRIVATE KEY TRANSPORT FUNCTIONALITY
WO2001063515A1 2001-08-30 SECURITY CARD AND SYSTEM FOR USE THEREOF
WO2001067355A2 2001-09-13 SYSTEM FOR FACILITATING A TRANSACTION
Korean Office Action dated Jul. 18, 2012 for Korean Application No. 10-2007-7027029.
Molloy I. et al., “Dynamic Virtual Credit Card Numbers”, Database Inspec [Online], The Intritution of Engineering and Technology, Feb. 2007, XP002480816.
European Search Report dated May 24, 2011 for European Patent Application No. 10012051.8.
Mjolsnes et al., “On-line E-Wallet System with Decentralized Credential Keepers”, Mobile Networks and Applications 8, pp. 87-99, 2003.
De La Puente et al., “Pocket Device for Authentication and Data Integrity on Internet Banking Applications”, IEEE 0-7802/03 [online], pp. 43-50, 2003.
International Preliminary Report on Patentability dated Jul. 3, 2007 for International Application No. PCT/US2006/015218.
Second Chinese Office Action dated Jul. 12, 2010 for Chinese Patent Application No. 200680022761.0.
European Examination Report dated Mar. 4, 2008 for European Application No. 06 758 494.6.
European Examination Report dated Apr. 29, 2010 for European Application No. 06 758 494.6.
Mexican Office Action dated May 4, 2010 for Mexican Application No. MX/a/2007/013218.
First Chinese Office Action dated Nov. 6, 2009 for Chinese Patent Application No. 200680022761.0.
International Preliminary Report on Patentability and Written Search Report dated May 28, 2009 for International Application No. PCT/US2007/084529.
International Preliminary Report on Patentability dated Jun. 4, 2008 for International Application No. PCT/US2007/084529.
Written Search Report dated Jun. 4, 2008 for International Application No. PCT/US2007/084529.
International Preliminary Report on Patentability dated Aug. 22, 2006 for International Application No. PCT/US2006/015218.
Written Search Report dated Aug. 22, 2006 for International Application No. PCT/US2006/015218.
Office Action issued for Canadian Patent Application No. 2605596 dated May 29, 2013.
The present application is being filed as a divisional application of U.S. patent application Ser. No. 11/559,931 entitled “METHOD AND APPARATUS FOR USING AT LEAST A PORTION OF A ONE-TIME PASSWORD AS A DYNAMIC CARD VERIFICATION VALUE” filed on Nov. 15, 2006, and assigned to the assignee hereof and hereby expressly incorporated by reference herein.
1. A credit/debit card able to generate a dynamic card verification value (CVV), the credit/debit card comprising: a body the size and shape of a credit/debit card; a one-time password generator disposed within the body to generate the dynamic CVV; a display disposed within the body, wherein the display is configured to display a challenge to a user, wherein the challenge is generated by a challenge based algorithm that requires alpha-numeric inputs to be available; a speaker disposed within the body, wherein the speaker is configured to present, upon request, the challenge to the user and present the dynamic CVV; two or more input devices disposed within the body for alpha-numeric inputs, wherein the two or more input devices are configured to receive a challenge response in response to the challenge being displayed on the credit/debit card by the challenge based algorithm, and wherein the challenge response comprises two or more alpha-numeric inputs by the user; the display disposed within the body configured to display the dynamic CVV based at least in part on the received challenge response; a validation device to authenticate the use of the card as a credit/debit card; and an indication that the dynamic CVV is to be used as a security code.
2. The credit/debit card of claim 1 wherein the one-time password generator generates a one-time password and the dynamic CVV comprises a portion of the one-time password.
8. The credit/debit card of claim 7 wherein the validation device comprises a magnetic stripe.
9. The credit/debit card of claim 1 wherein the dynamic CVV is based at least partially on the challenge response input by the user into the credit/debit card.
10. A credit/debit card comprising: a body; a validation device, wherein the validation device is configured to authenticate the use of the card as a credit/debit card; a display disposed within the body, wherein the display is configured to display a challenge to a user, wherein the challenge is generated by a challenge based algorithm that requires alpha-numeric inputs to be available; a speaker disposed within the body, wherein the speaker is configured to present, upon request, the challenge to the user and present the dynamic CVV; an input device disposed within the body for alpha-numeric inputs, wherein the input device is configured to receive a challenge response in response to the challenge being displayed based on the challenge based algorithm, and wherein the challenge response comprises two or more alpha-numeric inputs by the user; a one-time password generator disposed within the body, wherein the one-time password generator is configured to generate a dynamic card verification value (CVV) , wherein the dynamic CVV is displayed on the display device and is based at least in part on the received challenge response.
11. The credit/debit card of claim 10 wherein the one-time password generator generates a one-time password and the dynamic CVV comprises a portion of the one-time password.
12. The credit/debit card of claim 10, further comprising an indication that the dynamic CVV is to be used as a security code.
13. The credit/debit card of claim 12, wherein the indication comprises highlighting of a portion of the one-time password.
14. The credit/debit card of claim 12, wherein the indication comprises instructions printed on the body.
15. The credit/debit card of claim 10, where the validation device comprises a magnetic stripe.
16. The credit/debit card of claim 10, wherein the input device comprises two or more inputs.
17. The credit/debit card of claim 10, wherein the dynamic CVV is based at least partially on the challenge response input by the user into the credit/debit card.
18. A credit/debit card comprising: a body; a display disposed within the body, wherein the display is configured to display a challenge to a user, wherein the challenge is generated by a challenge based algorithm that requires alpha-numeric inputs to be available; a speaker disposed within the body, wherein the speaker is configured to present, upon request, the challenge to the user and present the dynamic CVV; an input device disposed within the body for alpha-numeric inputs, wherein the input device is configured to receive a challenge response in response to the challenge being displayed based on the challenge based algorithm, and wherein the challenge response comprises two or more alpha-numeric inputs; a one-time password generator disposed within the body, wherein the one-time password generator is configured to generate a dynamic card verification value (CVV) , wherein the dynamic CVV is displayed on the display device and is based at least in part on the received challenge response.
19. The credit/debit card of claim 18, further comprising: a validation device, wherein the validation device is configured to authenticate the use of the card as a credit/debit card.
20. The credit/debit card of claim 18, wherein the dynamic CVV is based at least partially on the challenge response input into the credit/debit card.
The term “bank” and any similar terms are used herein in their broadest sense. Financial institutions that process transactions of the types discussed can include stock brokerages, credit unions, credit card processing companies, and other types of institutions which are not strictly banks in the historical sense. The use of terms such as bank, “financial institution”, “card issuer”, or the like herein is meant to encompass all such possibilities. Additionally, the terms “credit card”, “debit card”, “credit/debit card” and the like can refer to any type of financial transaction card or ATM card, in any form factor. Such terms may also refer to a so-called “smart” card. It should also be noted that reference to “one-time passwords” and the like is not necessarily limited to the classical case of passwords generated to access on-line systems. Rather, this terminology is intended to invoke any systems, methods, concepts, and apparatus connected with generating a value that changes in any automated fashion with time or use that is used to authenticate access to any resources or the use of a device or article of manufacture.
Referring to FIG. 1 an OTP credit/debit card that might be used with an embodiment of the invention comprises a plastic card 1 having the size and shape of a conventional credit card. Conventional credit/debit cards are approximately 33/8 inches× 21/8 inches×⅛ of an inch. Smaller credit cards are also known. One such card is the MINI-CARD that is approximately 21/2 inches× 11/2 inches×⅛ of an inch. The card may be provided in any conventional credit card size. The card may be provided with raised card numbers 2, card holder name 3, expiration date 4 and card holder photograph and/or hologram 5 as is known in the art. The card 1 also may include issuer information such as bank name 7 and logo 9. A display 6 is provided for visually displaying the OTP generated by card 1. Also located on card 1 is an initiation button 10 that is depressed by the user to initiate the generation of the OTP. The rightmost half of display 6 is surrounded by visual highlighting 11 in the form of a printed outline, as an indication to the consumer that the rightmost three digits of the OTP, which would normally fall inside the highlighting are to be used as a CVV in place of the three digit code that would normally be printed on the back of a typical credit card, typically referred to as a “security code” by consumers and on-line vendors. This highlighting can be accomplished in almost infinite ways, including coloring of the display window or background. The highlighting might also be absent altogether, in which case the financial institution would rely on user knowledge, either apart from the card itself, or based on printed instructions on the back of the card (see below).
In order to generate the OTP, a hashed message authentication code (HMAC) one-time password algorithm (HTOP) may be used. OTP algorithms are well known and are commercially available. A time/clock-based algorithm such as RSA Security's SecurelD algorithm could also be used. Other suitable OTP algorithms may also be used. The algorithm can be stored in memory 20 or in the OTP generator 18. OTP generator 18 generates the OTP when the system is initiated by the user by depressing button 10. Button 10 may consist of a film capacitance button. A third type of OTP algorithm is based on a challenge issued by the system. The challenge is entered into the card 1 and the OTP algorithm generates the OTP based on the challenge. A challenge based algorithm may require a complement of buttons to provide the alpha-numeric input. These buttons also may consist of film capacitance buttons.
Still referring to FIG. 5, at block 510, a determination is made as to whether the credit card data identifies a credit card or a debit card. In this example embodiment, credit card and debit cards are processed by different systems. It cannot be overemphasized that this is but an example only, and a financial institution could set up a system in which either type of card is processed in the same manner. If the card is a debit card, processing proceeds to block 512 where the CVV is separated from the debit card data. At block 514, the debit card data is validated using a “Base24” system. Base24 is a standard processing engine for debit cards that is known throughout the financial services industry. At block 516, the dynamic CVV from the card is authenticated by comparing that to a one-time password generated by the system. Once an authentication decision is reached, the dynamic CVV is merged with the credit/debit card data at block 518 in order to provide an authorization or denial as the case may be. A file communicating an authorization or denial contains all of this information so that the vendor can process such a response. The decision via this file is then returned to the vendor systems at block 520.
The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. As used herein, the singular forms “a”, “an” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms “comprises” and/or “comprising,” when used in this specification, specify the presence of stated features, steps, operations, elements, and/or components, but do not preclude the presence or addition of one or more other features, steps, operations, elements, components, and/or groups thereof
<- Previous Patent (Device for handling ...) | Next Patent (Systems and methods ...) ->