SYSTEMS AND METHODS FOR AUTHENTICATION CODE ENTRY USING MOBILE ELECTRONIC DEVICES

Abstract

Systems and methods for authentication code entry using mobile electronic devices are disclosed. In one embodiment, in an information processing device comprising at least one computer processor, a display, and an input device a method for authentication code entry may include: (1) receiving, at the information processing device, a masking pattern for receiving entry of an authentication code, the masking pattern specifying an order for entering the authentication code; (2) presenting, on the display, a prompt to enter the authentication code in accordance with the masking pattern; (3) receiving, at the input device, a masked authentication code entry where the masked authentication code entry comprises the authentication code entered in accordance with the masking pattern; and (4) storing the masked authentication code entry.

Claims

1. A method for authentication code entry, comprising: in an information processing device comprising at least one computer processor, a display, and an input device: receiving, at the information processing device, a masking pattern for receiving entry of an authentication code, the masking pattern specifying an order for entering the authentication code; presenting, on the display, a prompt to enter the authentication code in accordance with the masking pattern; receiving, at the input device, a masked authentication code entry where the masked authentication code entry comprises the authentication code entered in accordance with the masking pattern; and storing the masked authentication code entry.

2. The method of claim 1, wherein the masking pattern comprises a plurality of placeholders, and the order for entering the authentication code specifies a first subset of the plurality of placeholders that receive values of the authentication code and a second subset of the plurality of placeholders that receive dummy values.

3. The method of claim 2, wherein the masked authentication entry comprises the authentication code and a plurality of dummy values.

4. The method of claim 1, further comprising: wirelessly transmitting the masked authentication code entry to a point of transaction device.

5. The method of claim 1, wherein the prompt is displayed in a manner such that it cannot be machine-read by the information processing device.

6. The method of claim 1, wherein the information processing device comprises a mobile electronic device.

7. The method of claim 6, wherein the masked authentication code is stored in secure storage of the mobile electronic device.

8. A method for authentication code entry, comprising: in an information processing device comprising at least one computer processor, a display, and an input device: receiving, over a network and from a mobile electronic device, a request to generate a masking pattern for receiving entry of an authentication code, the masking pattern specifying an order for entering the authentication code; generating the masking pattern; associating the masking pattern with a customer account; and communicating the masking pattern to the mobile electronic device.

9. The method of claim 8, wherein the masking pattern specifies the order of entering values of the authentication code and dummy values in an authentication code entry.

10. The method of claim 8, wherein the masking pattern is communicated to the mobile electronic device with a prompt for entering the authentication code in accordance with the masking, wherein the prompt is displayed in a manner such that it cannot be machine-read by the information processing device.

11. The method of claim 8, further comprising: receiving, from a point of transaction device, a customer account identifier and a masked authentication code entry received from the mobile electronic device; retrieving the masking pattern for the account associated with the customer account identifier; identifying the authentication code in the masked authentication code entry based on the masking pattern; and validating the authentication code.

12. The method of claim 11, wherein the masked authentication entry comprises the authentication code and a plurality of dummy values.

13. The method of claim 11, further comprising: communicating the validation of the authentication code to the point of transaction device.

14. A method for conducting a transaction using a stored authentication value, comprising: in a point of transaction device comprising at least one computer processor: receiving information for a financial instrument requiring validation of an authentication code to conduct a transaction; receiving, from a computer application executed by a mobile electronic device, a masked authentication code entry comprising authentication values and dummy values, wherein the authentication values are not identified as part of the authentication code; communicating, to a backend for a financial institution associated with the financial instrument, the masked authentication code entry; and receiving, from the backend, approval or denial for the transaction.

15. The method of claim 14, wherein the point of transaction device prompts the mobile electronic device for the masked authentication code entry.

16. The method of claim 14, wherein the masked authentication code entry is received wirelessly.

Description

BRIEF DESCRIPTION OF THE DRAWINGS

[0026] For a more complete understanding of the present invention, the objects and advantages thereof, reference is now made to the following descriptions taken in connection with the accompanying drawings in which:

[0027] FIG. 1 depicts a system for authentication code entry using mobile electronic devices according to one embodiment;

[0028] FIG. 2 depicts a method for authentication code entry using mobile electronic devices according to one embodiment;

[0029] FIG. 3 depicts a method for conducting a transaction with authentication code entry using mobile electronic devices according to one embodiment; and

[0030] FIG. 4 depicts a method for conducting an offline transaction with authentication code entry using mobile electronic devices according to another embodiment.

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS

[0031] Several embodiments of the present invention and their advantages may be understood by referring to FIGS. 1-4.

[0032] Embodiments are directed to systems and methods for authentication code entry using mobile electronic devices.

[0033] Referring to FIG. 1, a system for authentication code entry using mobile electronic devices is disclosed according to one embodiment. System 100 may include mobile electronic device 110, backend 120, and merchant point of transaction device 130. Mobile electronic device 110 may be any suitable electronic device, including, for example, notebook/laptop computers, tablet computers, smartphones, Internet of Things (IoT) appliances, smartwatches, etc. In one embodiment, mobile electronic device 110 may execute one or more computer programs or computer applications that may receive and/or store an authentication code, such as a PIN from user 115.

[0034] Backend 120 may include one or more servers or computing devices that may be hosted by an issuer of a financial instrument, or a third party associated with the issuer (e.g., an outsourced service), that may be used to conduct a transaction. In one embodiment, backend 120 may be hosted by a credit card issuer, a bank, etc.

[0035] Merchant point of transaction device 130 may be any suitable device that receives payment for a transaction from user 115. In one embodiment, point of transaction device 130 may be a point of sale device, an electronic device executing a payment computer application (e.g., a tablet computer, smartphone, etc.). In one embodiment, point of transaction device 130 may include a magnetic stripe reader, an EMV chip reader, an user interface, etc.

[0036] Mobile electronic device 110 and backend 120 may communicate with each other using any suitable communication channel, including the Internet. Similarly, backend 120 and point of transaction device 130 may communicate using any suitable communication channel, including the Internet, payment networks, etc.

[0037] In one embodiment, mobile electronic device 110 and point of transaction device 130 may communicate using, for example, RF communications (e.g., WiFi, near field communication, Bluetooth), optically, audibly, etc.

[0038] Referring to FIG. 2, a method for authentication code entry using mobile electronic devices is disclosed according to one embodiment.

[0039] In step 205, a user may execute an authentication code entry computer program or application using a mobile electronic device. For example, the authentication code entry application may be provided by the issuer of a financial instrument that may be used to conduct a transaction.

[0040] In one embodiment, the user may be authenticated to the application by, for example, providing a user identifier and a password, biometrics, etc.

[0041] In one embodiment, the user may request the entry and/or storage of an authentication code via the authentication code entry application, and the authentication code entry application may communicate the request to a backend. In one embodiment, the communication may include user credentials (e.g., user identifier and password, account information, etc.).

[0042] In step 210, the backend for the issuer may generate a masking pattern for receiving entry of an authentication code from the use of the mobile electronic device. The masking pattern may include a plurality of placeholders. In one embodiment, the masking pattern may specify an order of entry of the values in the authentication code. It may further specify the order of entry of dummy values. For example, if the authentication code has four values, the masking pattern may specify that the first, third, fourth, and seventh places in an eight value entry may include the values of the authentication code. The remaining places (e.g., the second, fifth, sixth, and eighth places) may contain dummy values.

[0043] The number of dummy values may vary as is necessary and/or desired, as may the placement for the authentication values and the dummy values.

[0044] In one embodiment, the masking pattern may also re-order the authentication code values. As an illustrative example, the masking pattern may specify that the first authentication code value be entered in the fourth authentication code place, the second authentication code value be entered in the third authentication code place; the third authentication code value be entered in the second authentication code place, and the fourth authentication code value be entered in the first authentication code place.

[0045] In one embodiment, the backend may store the masking pattern and may associate the masking pattern with the user. It may then communicate the masking pattern to the user.

[0046] In step 215, the user may be prompted by the authentication code entry application to enter the authentication code according to the masking pattern. For example, the user may be presented with eight entry spaces, and may be instructed to enter the authentication code values in the first, third, fourth, and seventh places, and to enter dummy values in the second, fifth, sixth, and eighth places.

[0047] In one embodiment, the prompt may be presented in a manner that cannot be read or interpreted by a machine. For example, the user may be presented with one or more images of numbers associated with the values in a manner similar to CAPTCHA prompts. The images may include numbers of different fonts, sizes, orientations, colors, darkness, hue, focus, line quality, etc. in order to prevent machine reading.

[0048] Thus, in one embodiment, the authentication code entry application does not know what places contain the authentication code values, and what spaces contain the dummy values.

[0049] In step 220, the user may enter the authentication code values and dummy values in accordance with the prompt, and, in step 225, the authentication code values and the dummy values may be communicated to the backend.

[0050] In step 230, the backend, using the stored masking pattern, may identify the authentication code values from the received authentication code values and the dummy values, and may validate the authentication code. If, in step 235, the authentication code is validated, in step 240, the backend may instruct the authentication code entry application to store the authentication code values and dummy values that were entered. In one embodiment, the authentication code values and dummy values may be stored in device memory, in a secure element, in the cloud, etc.

[0051] If the authentication code is not validated, the backend may instruct the authentication code entry application to repeat the entry.

[0052] In one embodiment, after a predetermined number of unsuccessful validations, the user may be re-authenticated, the user’s account may be locked, the backend may generate a new masking pattern, or any other suitable action may be taken.

[0053] In one embodiment, the stored authentication code values and dummy values and/or the masking pattern may expire after a predetermined event. For example, the backend may expire the masking pattern after a certain number of transactions, after a period of time, after a certain amount is spent, etc.

[0054] In one embodiment, the authentication value entry may be performed remotely from a merchant, and in advance of a transaction.

[0055] Referring to FIG. 3, a method for conducting a transaction with authentication code entry using mobile electronic devices is disclosed according to one embodiment.

[0056] In step 305, a user may approach a merchant point of transaction device with a mobile electronic device that has authentication code values and dummy values that were entered in accordance with a masking pattern stored in the memory thereof.

[0057] In step 310, the user may present a financial instrument (e.g., credit card, debit card, token, etc.) to the point of transaction device. In one embodiment, the financial instrument may be physically presented; in another embodiment, the financial instrument may be communicated by RF communication, optical communication, etc.

[0058] In one embodiment, the point of transaction device may communicate a request for authenticating information to the mobile electronic device. In one embodiment, the point of transaction device may communicate the request to a computer program or application executed by the mobile electronic device, such as an authentication code entry application.

[0059] In step 315, the computer application may retrieve the authentication code values and the dummy values from memory, and may communicate the authentication code values and dummy values to the point of transaction device.

[0060] In one embodiment, if the mobile electronic device does not have the stored authentication code values and dummy values, or if the stored authentication code values and dummy values have expired, the computer application may conduct the process of entering the authentication code values and dummy values as detailed above.

[0061] In one embodiment, if the financial instrument information was communicated as a token, the authentication code values and dummy values may be communicated therewith.

[0062] In step 320, the point of transaction device may communicate the authentication code values and dummy values to a backend for a financial institution associated with the financial instrument.

[0063] In step 325, the backend may retrieve the masking pattern associated with the financial instrument and, using the stored masking pattern, may identify the authentication code values from the received authentication code values and the dummy values, and, in step 330, may validate the authentication code. If, in step 335, the authentication code is validated, in step 340, the backend may instruct the point of transaction device that the transaction is approved.

[0064] If the authentication code is not validated, in step 345, the backend may instruct the point of transaction device that the transaction is denied.

[0065] In one embodiment, the backend may notify the user associated with the financial instrument that the authentication code was rejected, and may take any appropriate action as is necessary and/or desired (e.g., lock the account, expire the masking pattern, etc.).

[0066] In another embodiment, the backend may not be available to validate the authentication code. Referring to FIG. 4, a method for conducting an offline transaction with authentication code entry using mobile electronic devices according to another embodiment.

[0067] In step 405, a user may approach a merchant point of transaction device with a mobile electronic device that has authentication code values and dummy values that were entered in accordance with a masking pattern stored in the memory thereof.

[0068] In step 410, the user may present a financial instrument (e.g., credit card, debit card, token, etc.) to the point of transaction device. In one embodiment, the financial instrument may be physically presented; in another embodiment, the financial instrument may be communicated by RF communication, optical communication, etc.

[0069] In one embodiment, the financial instrument may be an EMV card. The EMV card may have an authentication code stored thereon. In another embodiment, the EMV card may not have the authentication code stored thereon, but may verify the authentication code using, for example, a stored hash of the authentication code.

[0070] In one embodiment, the authentication code may be cryptographically protected.

[0071] In step 415, the point of transaction device may communicate a request for authenticating information to the mobile electronic device, for example, to a computer application executed by the mobile electronic device. In one embodiment, the point of transaction device may communicate the request to a computer program or application executed by the mobile electronic device, such as an authentication code entry application.

[0072] In one embodiment, if the point of transaction device is not in communication with a backend for the financial institution associated with the financial instrument, it may further provide its public key and any other necessary information to the computer application executed by a mobile electronic device. In one embodiment, the public key may be the point of transaction’s Secure Card Reader for PIN, or SCRP, public key. Additional information, such as a serial number or identification number for the point of transaction, merchant information, etc. may be provided as is necessary and/or desired.

[0073] In step 420, the computer application may communicate the point of transaction’s public key and other information to the backend for the financial institution associated with the financial instrument.

[0074] In step 425, the backed may retrieve and encrypt the masking pattern with the point of transaction’s public key, and, in step 430, may communicate the encrypted masking pattern to the computer application.

[0075] In step 435, the computer application may communicate the authentication values and dummy values, and the encrypted masking pattern, to the point of transaction device.

[0076] In step 440, the point of transaction device may decrypt the masking pattern and use the masking pattern to extract the authentication code from the authentication values and dummy values.

[0077] In step 445, the authentication code may optionally be encrypted as is necessary and/or desired for the financial instrument (e.g., the EMV card).

[0078] In step 450, the point of transaction device may communicate the plaintext authentication code, or the encrypted authentication code, to the financial instrument. Alternatively, the financial instrument may communicate a stored authentication code, or a stored hash or other cryptographically-processed version of the authentication code, to the point of transaction device. The stored authentication code, or a stored hash or other cryptographically-processed version of the authentication code may optionally be encrypted for communication as is necessary and/or desired.

[0079] In one embodiment, the financial instrument may provide the function, or an identification of the function, that was used to generate the hash or other cryptographically-processed version of the authentication code that may be stored on the financial instrument.

[0080] In step 455, offline authentication code validation may be performed between the financial instrument (e.g., the EMV card) and the point of transaction device. In one embodiment, the authentication code may be stored on the financial instrument, and the financial instrument may verify the authentication code. In another embodiment, a hash or other cryptographically-processed version of the authentication code may be stored on the financial instrument, and the financial instrument may verify the authentication code against the stored cryptographically-processed version of the authentication code.

[0081] Alternatively, in another embodiment, the point of transaction device may then verify the authentication code against the received authentication code or the hash or other cryptographically-processed version of the authentication code. In one embodiment, the point of transaction device may generate a hash or other cryptographically-generated version of the decrypted authentication code using the function received or identified by the financial instrument.

[0082] Other ways of verifying the authentication code may be used as is necessary and/or desired.

[0083] If, the authentication code is validated, in step 460, the transaction may be approved. If the authentication code is not validated, in step 465, the transaction may be denied.

[0084] It will be appreciated by persons skilled in the art that the present invention is not limited by what has been particularly shown and described hereinabove. Rather the scope of the present invention includes both combinations and sub-combinations of features described hereinabove and variations and modifications thereof which are not in the prior art. It should further be recognized that these embodiments are not exclusive to each other.

[0085] It will be readily understood by those persons skilled in the art that the embodiments disclosed here are susceptible to broad utility and application. Many embodiments and adaptations of the present invention other than those herein described, as well as many variations, modifications and equivalent arrangements, will be apparent from or reasonably suggested by the present invention and foregoing description thereof, without departing from the substance or scope of the invention.

[0086] Accordingly, while the present invention has been described here in detail in relation to its exemplary embodiments, it is to be understood that this disclosure is only illustrative and exemplary of the present invention and is made to provide an enabling disclosure of the invention. Accordingly, the foregoing disclosure is not intended to be construed or to limit the present invention or otherwise to exclude any other such embodiments, adaptations, variations, modifications or equivalent arrangements.