Abstract:
A card certification and authorization system and method is disclosed. When a cardholder swipes a card at any terminal device and initiates the process of authorization, the data storage management system executes instantaneous bidirectional comparisons of the encoding data. It reduces the risk produced by the unidirectional certification and authentication. When the comparisons succeed and authorization is allowed, the encoding system can instantly produces new coding data randomly to be used as stored record to illuminates the chance of the card information being stolen. When the comparisons fail and authorization is denied, the data storage management system will put the account on hold and start the notification process using the terminal device, which decreases the chance of the card being used without authorization. The comparisons of the encoding data and the process of storing data need to be converted using conversion and encryption program to ensure data safety.

Description:
BACKGROUND OF THE INVENTION  
       FIELD OF INVENTION  
         [0001]    The invention relates to the system and the method of authorization, especially applied to card authorization.  
           [0002]    Previous Technology  
           [0003]    The current card certification and authorization system is used in areas as: electronic transaction security, production control, entrance/access control, internet login identification, database login identification and personal identification. All these areas have their own unique methods for performing a certification and authorization process. After in-depth researches and comparisons, all these methods have a common problem with using a single systematic process to compare the certification codes and a unidirectional model for certifications. This system and method for certification and authorization bring a safety threat and risky for cardholders after a period of time.  
           [0004]    The financial industry is mostly affected by this problem. The most widely used plastic currency are credit cards and debit cards. These cards usually only use a single systematic encoding method for certification and authorization. Even the authorization code assigned by card issuing banks uses a single systematic certification process. It is not only easily cracked and recorded, but can also cause large damage to the card&#39;s issuing bank when cardholders&#39; personal and credit information is exposed to the public, or when they use the cards incorrectly.  
           [0005]    Even though there are new ways to prevent these card frauds by combining memory chips to the cards to store identity information, including personal biometrics such as: fingerprints, pictures, voice recognition and iris signatures, these new ways still follow the traditional certification and authorization process and the method of a single systematic certification and unidirectional authorization. Although these biometrics are much more difficult to crack and/or duplicate, it is not impossible to do so. Machines can duplicate fingerprints and scanners can also reproduce iris signatures. It is also very costly to incorporate peripherals to provide the functions of verifying biological distinctions; it is difficult to apply them widely to practical everyday uses. Faced with a variety of certified card authentication systems and methods, the related beneficiaries, such as the cardholders and the card issuers, are all hoping for an effective prevention method to protect the safety of everyone involved, and the systems.  
         SUMMARY OF THE INVENTION  
         [0006]    To solve the authentication problem, this invention provides a brand new system and method for card certification and authorization. The main difference between the invention and the current technology is that the invention uses an immediate bi-directional certification and a local random encoding method to control every step of the authentication process, from the time when the cards are swept to the time when the card authorization data are stored by the card issuers.  
           [0007]    The immediate bidirectional comparison of the encoding data decreases the risks, produced by the unidirectional and single certification and authorization process, to the cardholders and issuers. It also uses an unbiased third party encoding device to produce encoding data locally and prevents unauthorized use of the card and database information and the chances to reproduce them. When abnormality is detected and authorization is denied, the invention puts the card account on ‘hold instantly’, and sends notifications to reject illegal and unauthorized use of the card. As for the storing of the encoding data, to prevent internal security defect, the invention provides a special code conversion and encryption process to keep the data safe. Using the method above, it is possible to provide a complete certification and authorization process, and use it every day without costly peripherals.  
           [0008]    To achieve these goals, the certification and authorization system includes the following components: card, terminal device, data storage management system and encoding device.  
           [0009]    The method of the invention for card certification and authorization includes the following steps: first, use the terminal device to retrieve the certification data stored in the card, transmit the certification data to the data storage management system, and then start an identifying process of the certification data by the data storage management system the comparing and authenticating process. If the identifying processes are successful, the encoding device starts the encoding process. Using the data storage management system and the terminal device, the record storing process can be executed and then completes the authorization procedure.  
           [0010]    Further scope of applicability of the present invention will become apparent from the detailed description given hereinafter. However, it should be understood that the detailed description and specific examples, while indicating preferred embodiments of the invention, are given by way of illustration only, since various changes and modifications within the spirit and scope of the invention will become apparent to those skilled in the art from this detailed description. 
       
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
       [0011]    The present invention will become more fully understood from the detailed description given herein below illustration only, and thus are not limitative of the present invention, and wherein:  
         [0012]    [0012]FIG. 1 a  is the block diagram of the system and method for certification and authorization of the prior art;  
         [0013]    [0013]FIG. 1 b  is the schematic block diagram of the system and method for certification and authorization of the prior art showing the operation of the system;  
         [0014]    [0014]FIG. 2 a  is the block diagram of the system and method for certification and authorization of the invention;  
         [0015]    [0015]FIG. 2 b  is the schematic block diagram of the system and method for certification and authorization of the invention showing the operation of the system;  
         [0016]    [0016]FIG. 2 c  is another schematic block diagram of the system and method for certification and authorization of the invention showing the operation of the system;  
         [0017]    [0017]FIG. 2 d  is the schematic block diagram of the system and method for certification and authorization of the invention showing the operation of the system;  
         [0018]    [0018]FIG. 3 a  is the flow chart of the system and method for certification and authorization of the invention showing the operation of the system;  
         [0019]    [0019]FIG. 3 b  is the flow chart of certification identifying process of the system of the invention;  
         [0020]    [0020]FIG. 3 c  is the flow chart of encoding process of the system of the invention;  
         [0021]    [0021]FIGS. 3 d  and  3   e  is the flow chart of record storing process of the system of the invention;  
         [0022]    [0022]FIG. 4 is the schematic diagram of recovering and encrypting process of the system of the invention; and  
         [0023]    [0023]FIG. 5 is the schematic diagram of bi-direction certification identifying process of the encoding data of the system of the invention. 
     
    
     DETAILED DESCRIPTION OF THE INVENTION  
       [0024]    The invention is related to the system and method for card certification and authorization. When the cardholder  15  takes the card  10  to terminal device  20  in the card-swiping device  25  for the authorization process, through bi-directionally comparing  30  the card  10  and the stored encoding data in the database via the card issuer  35 &#39;s data storage management system, the authorization process is completed safely.  
         [0025]    The main difference between this invention and the prior art is that the systems of the prior art use a single systematic certification and a unidirectional certifying process, as shown in FIGS. 1 a  and  1   b . The cardholder  15  takes the card  10  to the card-swiping device  25  and swipes the card. The terminal device  20  retrieves the stored certification information, such as the PIN number, from the card  10  and transmits it to the card issuer  35 &#39;s data storage management system  30 . The data storage management system  30  compares the certification information with the stored data in the database. If the information is correct, it then produces a replying signal, such as the authorization number, back to the terminal device  20 . Finally, the terminal device  20  accepts the card  10 &#39;s authorization and completes the process.  
         [0026]    The following is an explanation of the invention&#39;s system and method for card certification and authorization process, referring to FIGS. 2 a  and  2   b.    
         [0027]    A major difference between the known procedure for card certification and authorization and this invention is that the invention uses an unbiased third party  45 &#39;s encoding device  40  and produces the encoding data randomly. Each time when the card  10  completes the authorization process successfully, it uses the terminal device  20  and stores the encoding data that are different from the originals in the card  10 , for later certification purposes. Therefore, the data storage management system  30 , executes a bi-directional certification process, by comparing the encoding data, stored in the card  10 , and the encoding data, stored in the database. A more detailed explanation of each building block of the system is included in the following.  
         [0028]    The card  10 , issued by the card issuer  35 , contains a memory chip, i.e. an IC chip, which allows the reading and writing of data. The certification data stored in the memory chip include at least the card encoding data, sometimes even the commonly known card information cardholder such as the PIN number, and internal coding information such as the card issuer  35 &#39;s issuing code. Normally, the card issuer  35  stores at least one card encoding figure in the card  10  when issued. This figure can also be produced by the unbiased third party  45 &#39;s encoding device  40 . The figures and content of the data are generated randomly. Therefore, every issued card  10  has different numbers with unique encoding data, and all the data are converted and encrypted before being stored in the database, and used later for certification and authorization purposes.  
         [0029]    Terminal device  20 , which is located at the card-swiping device  25 , retrieves the certification information stored in the card  10  and transmits the information to the data management storage system  30  for comparison. It also sends a waiting signal to the encoding device  40 , requesting the data storage management system  30  to anticipate the continual executing of the authorization procedures. The terminal device  20  transmits the encoding data back to the card  10  if the comparison by the data storage management system  30  is successful. If the comparison with the data storage management system  30  is unsuccessful, it uses the transmitted cancellation signal to terminate the authorization process, and executes the notification procedure, such as notifying the cardholder  15  and the connected units. The terminal device  20  includes devices such as card readers/writers, or card swiping devices. It may also consist of a clock and the capability of recording the storage time in the card  10 , or image capturing devices, such as digital camcorders, or digital cameras, to record the instant images of the cardholder  15  for the notifying procedures.  
         [0030]    A data storage management system  30 , which is usually situated at the card issuer location  35 , includes a database storing the encoding data. It also encodes, decodes and encrypts the encoding data. It uses the result of the comparisons for the encoding data stored in the card  10  to decide whether a requesting signal or a cancellation signal should be transmitted. The requesting signal is sent to the encoding device  40 , requesting the production of the encoding data, and the cancellation signal is used by the data storage management system  30  to put the account on ‘hold’.  
         [0031]    The code conversion, recovery and encryption programs are used during the retrieval and storage of the encoding data. They provide conversions for the logical and physical sequence number  650  and the encoding data&#39;s number of digits. The conversion procedure is an open and non-repeating random number generating process, done locally. Therefore, every encoding data&#39;s physical sequence number  650  same as the card  10 &#39;s encoding data sequence, the encoding data&#39;s number of digits same as card  10 &#39;s encoding data&#39;s number of digits, and the encoding data content will never be the same as the stored data&#39;s logical sequence number  610  in the database and the encoding data&#39;s number of digits. Usually the encoding data&#39;s conversion and encryption processes use data sheets or text files to record the relationship of each conversion process, such as the relationship of the logical and physical sequence numbers, the encoding data&#39;s number of digits and the encoding data&#39;s contents.  
         [0032]    A data storage management system  30  compares the card encoding data and the original encoding data one-by-one to improve the efficiency of the certification and authorization process. The comparison process starts with the last entry, i.e. the latest entry, and moves forward.  
         [0033]    Encoding device  40 , which is usually situated at the unbiased third party  45  or the card issuer  35 , needs to be independently operated from the data storage management system  30 . It receives the waiting signal from the terminal device  20  and the requesting signal from the data storage management system  30 . When the requesting signal is received, it starts producing codes random and stores them in the card  10 . It also produces the encoding data in the data storage management system  6   30 , and transmits encoding data back to the data storage management system  30 .  
         [0034]    The random encoding method includes the encoding data type such as the text and number symbols, the pictures, the images, the colors and the time, the encoding data&#39;s number of digits and the encoding data content&#39;s random selection order. It is also an open and non-repeating random number process.  
         [0035]    Each system building block of the invention is connected to a network for sending data and signal-transmission. This can be a wired or wireless network. When each system building block needs to be connected in a wireless network, wireless connecting interfaces need to be added to allow operations.  
         [0036]    [0036]FIG. 3 a  illustrates the invention&#39;s card certification and authorization flow in a diagram and explains several of the major steps in the process. First, it uses the terminal device  20  to retrieve the certification data from the card  10  (step  100 ) and then transmits the certification data to the data storage management system  30  (step  200 ). It transmits the waiting signal, containing the terminal number, to the encoding device  40 . Then the data storage management system  30  starts the certification identifying process step  300 . When successful, the encoding device  40  starts the encoding process step  400 . Last, the data storing procedure is executed through the data storage management system  30  and the terminal device  20 . (step  500 ) The certification and authorization process is now completed.  
         [0037]    [0037]FIG. 3 b  illustrates the details of the method of the invention for certification identifying process. FIG. 3 c  illustrates the details of the encoding process of the invention. FIGS. 3 d  and  3   e  illustrate the details of the storage process of the method of the invention.  
         [0038]    When the cardholder  15  takes the card  10  to the card-swiping device  25  and swipes it, the terminal device  20  of the card-swiping device  25  retrieves the encoding data from the card  10  and transmits it to the data storage management system  30  of the card issuer  35  to start the authentication process. If it is the first time the cardholder  15  uses the card, then the initial encoding data stored in the card  10  will be used for the certification and authorization process. In fact, the invention can also verify the cardholder&#39;s information and internal coding data, stored in the card  10  during the certification and authorization process. However, it is a common technique used in authentication devices and is not emphasized by the invention, and will not be mentioned again. The data storage management system  30  first receives the card encoding data (step  310 ), which includes multiple records stored from previous certification and authorization processes. The data storage management system  30  then uses the card  10 &#39;s cardholder information to retrieve the stored encoding data (step  320 ) from the database. Since the stored encoding data are converted and encrypted, a recovery process needs to be performed to retrieve the original encoding data (step  330 ). This means following the original code conversion and encrypting formula, the relationships of the physical sequence number and the encoding data&#39;s number of digits, to perform the reversing process obtaining the original data. The one-by-one comparison process with the card encoding data (the original encoding data) (step  340 ) starts at the last data entry, which are the latest data, moves forward and checks if the entries are the same (step  350 ). If any differences are discovered in the entries, a cancellation signal is produced (step  351 ) and then the flow goes to the data storing process. If the entries are the same, keep going to check other records to be compared (step  360 ). If the records are identical, then it determines if there are more records to be compared (step  370 ). If no more records need to be compared and the process is completed without finding any discrepancies, a requesting signal is transmitted to the encoding device (step  380 ). This ends the certification and authorization process.  
         [0039]    When the requesting signal is generated, it means the invention is about to enter the encoding process, please use FIG. 3 c  as reference. The encoding system  40 , which received the waiting signal from the terminal device  20  and remained in the waiting stage, now receives the requesting signal from the data storage management system  30  (step  410 ) and starts the encoding process. First, it compares the terminal numbers included in the waiting and the requesting signal (step  420 ) and determines if the terminal numbers are identical (step  430 ). If the terminal numbers are different, the encoding device  40  transmits separate warning signals for the terminal device  20  and the data storage management system  30  and requests verifications and the retransmission of the waiting and requesting signals (step  460 ). If the terminal numbers are identical, the encoding device  40  will choose a local encoding method to start encoding and produce the latest encoding data (step  440 ). The local encoding method is targeted at the encoding data type (such as text and number symbols, pictures, images, color or time), encoding data&#39;s number of digits, or the encoding data content&#39;s local selection order. The selection process is also an open and non-repetitive random number process. The generated encoding data is transmitted back to the data storage management system  30  (step  440 ). The encoding process is completed.  
         [0040]    When the encoding process is completed or if the comparison result shows discrepancies, the invention enters the record storing process. There are two major components of the record storing process: the part executed by the data storage management system  30 , shown in FIG. 3 d , and the part executed by the terminal device  20 , as shown in FIG. 3 e.    
         [0041]    First, before the data storage management system  30  starts the data storing process, it first determines if there is a cancellation signal (step  510 ). If there is a cancellation signal, it shows that there are questions regarding the legitimacy of the card  10 . It then puts the card account on ‘hold’ (step  570 ), which terminates the card  10 &#39;s usability and the right to redistribute, and records this condition. A cancellation signal is sent to the terminal device  20  (step  580 ) and the system enters step ( 590 ), which is executed by the terminal device  20  and explained later. If there is no cancellation signal, then the card does not have any legitimacy problems and receives the generated encoding data from the encoding device  40  (step  520 ). The generated encoding data are newly added and become part of the original encoding data (step  530 ), added to the end of the existing encoding data. To ensure the safety of the data in the database of the data storage management system  30 , the original encoding data set undergoes code conversion and an encryption procedure. Then it receives the finally stored encoding data (step  540 ). The code conversion and encryption procedure also use a formula for code converting, recovering and encrypting for logical and physical sequence numbers, encoding data numbers of digits, and the content of the encoding data. After the code conversion and encryption, the resulting encoding data are stored in the database (step  550 ). The encoding data generated by the encoding device  40  are transmitted to the terminal device  20  (step  560 ) and then entering step  590 . The portion executed by the terminal device  20  is explained in the following paragraph. This finishes the data storing procedure executed by the data storage management system  30 .  
         [0042]    Entering the portion executed by the terminal device  20 , it will first be determined if there is a cancellation signal from the data storage management system  30  (step  590 ). If there is a cancellation signal, the authentication process will be cancelled and the necessary notification process will be executed (step  593 ). This includes: performing the notification process of the cardholder and the connected units, such as the law enforcement authority or the card issuer using the terminal device  20 . Adding the image capturing equipments to the terminal device  20 , such as digital camcorders and digital cameras, gives the possibility to obtain the instant images during the notification process. After notification, the record storing process and authorization flow will be terminated. If there is no cancellation signal, the authorization process is successful and the generated encoding data are produced. The terminal device  20  receives the generated encoding data from the data storage management system  30  (step  591 ), and writes the data in the memory chip of the card  10  (step  592 ). The record storing time can also be recorded in the memory chip for making the certification and authorization process more complete. The data storing process and the certification and authorization process is finished at this time.  
         [0043]    The descriptions above are details of the invention of the system and method for card certification and authorization basic blocks and operation procedures. The invention can be set up using a wired or wireless network to perform the data and signal transmissions. Of course, the transmission method of the data and signals is not limited to the basic procedures mentioned above; it can be changed as long as it does not violate any basic system building block and basic operation flow, such as the encoding data produced by the encoding device  40 : they can be directly transmitted to the terminal device  20 , and do not have to go through the data storage management system  30  (shown in FIGS. 2 c  and  2   d ).  
         [0044]    Last, using an embodiment, here is the explanation for the code conversion, recovery and encryption method used in this invention. Please use FIG. 4 as reference.  
         [0045]    It was mentioned that when the encoding data are retrieved, a code recovery process is executed and when the encoding data are stored, there is an encryption process. Both of these conversion processes are open and non-repeating random number procedures, so each encoding data&#39;s physical sequence number  650  and encoding data&#39;s number of digits will always be different from the logical sequence number  610  or the encoding data&#39;s number of digits of the records in the database, as shown in FIG. 4. When the encoding data are retrieved, the stored encoding data from the database undergo a recovery process. The stored encoding data  620  numbers with logical sequence numbers  610  “785” is “96846”, is a five-digit number. It is converted back to the physical sequence number  650  “05” with the original encoding data  630  of “1646”, which is a four digit number. These data are compared with the card encoding data  640  in the sequence number “05” stored in the card  10 . When the encoding data are encrypted, the original encoding data “1646” with “05” as its physical sequence number  650 , are converted using the random number generated locally, to have another logical sequence number  610  and a stored encoding data content  620 . To increase the security of the code conversion, recovery and encryption, the open and non-repeating local random process is used to produce the final stored encoding data  620 . The stored encoding data  620 , after the code recovery and encryption process, has a different logical sequence number  610 , a different digit-number  620  and content from before. This reduces the risk of cracked and reproduced data.  
         [0046]    [0046]FIG. 5 illustrates the flow bidirectional certification and authorization process using an embodiment of the invention.  
         [0047]    The card  10  can be reproduced into card B by recording information while the cardholder  15  is producing the encoding data of the physical sequence number “05”, or reproduced into card C by stealing internal database information. When the cardholder  15  completes the next authorization process, card A, the original card, produces the encoding data with physical sequence number “06”. Using the bi-directional certification and authorization process, the legitimate card A&#39;s encoding data content  720 , the reproduced card B&#39;s encoding data content  730 , and the reproduced card C&#39;s encoding data content  740  are compared with the original encoding data content  710 . Card A&#39;s encoding data content  720  has complete original encoding data record and will be authorized. However, card B and C do not have the encoding data with physical sequence number “06” of “46204”, the card account will be put on hold and the authorization is denied. If the cardholder  15  has never used the card  10  after opening the account, the reproduced card C will also be discovered for having the converted and encrypted stored encoding data  740  of “18897” instead of the original encoding data content  710  of “1646”, so the authorization will be denied and the account put on hold. Using the terminal device  20  to record the data storage time onto the memory chip can also prevent the illegal use of the cards, to achieve the complete effect of the bi-directional certification and authorization.  
         [0048]    For easy illustration purposes, the examples used above are numbers for representation. The invention is applicable to different encoding types, such as text and number symbols, pictures, images, colors, and time, to execute random number encoding for the number of digits of the encoding data.  
         [0049]    Understanding the invention being thus described, it will be obvious that the same may be varied in many ways. Such variations are not to be regarded as a departure from the spirit and scope of the invention, and all such modifications, obvious to one skilled in the art, are intended to be included within the scope of the following claims.