Ca, Inc.

Arcot Systems, Inc.

Computer Associates Think, Inc.

Geoffrey R Hird

Rammohan Varadarajan

Balas Natarajan Kausik

James Donald Reno

Sanguthevar Rajasekaran

Douglas Neil Hoover

Steven Lloyd Greenspan

Rajendra Arcot Gopalakrishna

Wei Jun Kong

Jiann-Shi Andy Lee

Methods and devices for pre-generating session keys for securing transactions are provided. A plurality of session cryptographic keys are generated from a master cryptographic key and a respective plurality of possible values of a transaction counter. The session cryptographic keys are encrypted to provide a plurality of encrypted session cryptographic keys, which are stored in the user terminal. The master cryptographic key is deleted from the user terminal after the session keys are generated. To secure a transaction, a cryptogram is generated based on one of the encrypted session cryptographic keys and transaction data for the transaction, and the cryptogram is transmitted to a transaction terminal. The transaction counter is updated, and the encrypted session cryptographic key is deleted from the user terminal.

Pre-generation of session keys for electronic transactions and devices that pre-generate session keys for electronic transactions

Methods for securing financial transactions using dynamic PINs without requiring updates to existing banking cards or existing infrastructure at acquiring institutions. The use of a dynamic PIN may be selectively enabled for a subset of banking cards or for a particular banking card when circumstances require use of the dynamic PIN. A dynamic PIN may be required for performing a financial transaction, such as making an online purchase, if an account associated with a banking card has a particular credit limit greater than a threshold or if a suspicious transaction history has been detected (e.g., large out-of-state purchases have recently been made). A dynamic PIN may be required based on a time of day or location associated with the financial transaction (e.g., if the financial transaction is being initiated within a particular foreign country).

Anti-skimming solution

Payment instrument data is received in connection with a transaction, the data including an alternative primary account number (PAN) and an account identifier. A permanent PAN of an account is identified that is based on the account identifier. An alternative PAN associated with the permanent PAN is derived to determine whether the received alternative PAN matches the derived alternative PAN associated with the permanent PAN.

Alternative account identifier

A method of operating an authentication node is disclosed. Transaction information for a transaction is received from a merchant node. The transaction information includes an identification for a credit/debit account, a name on the credit/debit account, and a transaction amount for the transaction. Responsive to receiving the transaction information, a complete account number for the credit/debit account is determined using the identification for the credit/debit account and the name on the credit/debit account. The identification for the credit/debit account is different than the complete account number for the credit/debit account. In addition, account information may be transmitted to an acquirer node, and the account information may include the complete account number for the credit/debit account, the name on the credit/debit account, and the transaction amount. Related methods of operating merchant nodes, related computer program products, and related computer systems are also disclosed.

Methods of processing transactions and related systems and computer program products

Operations by an electronic device include randomly selecting an initial location among ordered keys for display of a selection indicia, and displaying on a display device the ordered keys containing symbols and the selection indicia at the initial location selected among the ordered keys. The operations further include moving the selection indicia from the initial location to a next location among the ordered keys responsive to a navigation signal from a user, and identifying one of the symbols as being selected by the user based on a present location of the selection indicia relative to one of the ordered keys containing the one of the symbols when a selection signal is received from the user. The one of the symbols is provided to an application as an input from the user.

Secure user input mode for electronic devices using randomized locations of selection indicia

An electronic device generates mapping information that maps individual symbols of a defined order set of symbols to individual symbols of a random order set of symbols. Symbols of the defined order set of symbols are displayed on a display device arranged adjacent to the mapped symbols of the random order set of symbols, based on the mapping information. A user selection of a symbol of the random order set of symbols is received, and a symbol of the defined order set of symbols that maps to the symbol selected by the user is identified based on the mapping information. The symbol of the defined order set of symbols is provided to an application processed by electronic device as a selection from the user.

Secure user input mode using randomized mapping between ordered sets of symbols

A computerized method of accessing a secure resource using an application associated with a user's computing device is provided. The application is programmed, in part, to monitor user browsing activity and wherein the application has associated therewith one or more predefined Uniform Resource Locaters (URLs) to trusted sites, each having an associated trusted root certificate and security key. The method includes the application detecting a user attempt to log into a secure resource, the application scanning in-process browser processes to identify a browser process that is in a login state, the application associating the browser process in a login state with one of the trusted sites, the application initiating a new browser session with the trusted site using the associated predefined URL, the application obtaining a login password from the user, the application supplying to the trusted site the associated security key and login password, and the user's computer displaying subsequent browsing activity.

Controlled and client-side authentication module

A method performed by a processor of a computer, includes obtaining a security key associated with data, dividing the security key into key fragments, and distributing different ones of the key fragments to different proxy storage devices. Key fragments are received from the proxy storage devices, a reconstructed security key is generated based on the key fragments received from the proxy storage devices, and programmatic access to the data is controlled based on the reconstructed security key. Related computer program products and systems are disclosed.

Managing distribution and retrieval of security key fragments among proxy storage devices

A method is provided for generating a human readable passcode to an authorized user including providing a control access datum and a PIN, and generating a unique machine identifier for the user machine. The method further includes modifying the controlled access datum, encrypting the controlled access datum using the PIN and/or a unique machine identifier to camouflage the datum, and generating a passcode using the camouflaged datum and the PIN and/or the unique machine identifier. A mobile user device may be used to execute the method in one embodiment. The passcode may be used to obtain transaction authorization and/or access to a secured system or secured data. The unique machine identifier may be defined by a machine effective speed calibration derived from information collected from and unique to the user machine.

Key camouflaging using a machine identifier

This invention relates to a method and a system for generating user passcodes for each of a plurality of transaction providers from a mobile user device. A method and system for activating a plurality of passcode generators on a user device configured with a passcode application installed on the user device is provided. Each of the passcode generators may correspond to a different user account or transaction provider, such that each passcode generator provides a user passcode configured for the corresponding account or transaction provider. One or more of the passcode generators may include a passcode generating algorithm and a passcode key. Access to one or more of the passcode generators may require providing a PIN or a challenge.

Method and system for multiple passcode generation

An identification device includes a computer readable code. The computer readable code includes data relating to one or more pictures of a person and identity data for the person. The computer readable code is readable by a device reader, and the device reader is configured to interpret the computer readable code and to display the picture of the person using the computer readable code data relating to the picture of the person.

Encoded picture identification

A method of authenticating a client to a service via a network includes retrieving a client ID and a lockstep code from a token interfaced with a client device, sending the client ID and the lockstep code to an authentication server as part of a verification request, at the authentication server, comparing the lockstep code to a confirmation lockstep code relating to the client ID, based on the comparison, sending an authentication message from the authentication server, at the authentication server, generating a new confirmation lockstep code, sending the new confirmation lockstep code to the client device, and updating the lockstep code of the token to an updated lockstep code that matches the new confirmation lockstep code.

Server-token lockstep systems and methods

Methods, apparatus and systems for securing user-associated passwords used in transactions are disclosed. The methods include a user computing device receiving a user-associated password such as a PIN from a user, where the user-associated password is operable to authenticate an identity of a user. The user-associated password may be received in response to the user receiving a request for the user-associated password from a third party such as a merchant. The user computing device may generate a temporary password such as a one-time password, dynamic password, or the like, and encrypt the user-associated password using the temporary password. The encrypted user-associated password may then be communicated to the third party in lieu of the user-associated password received by the user.

Methods, apparatus and systems for securing user-associated passwords used for identity authentication

Embodiments of the invention provide systems and methods for the storage of One-Time Passwords (OTPs) on a device (principal) that needs to authenticate from time to time. It utilizes recent availability of data storage capacity not previously exploited in this arena. Also disclosed is the means to initialize and modify the system (all principals) in a secure manner, and the means to store the OTP production means on a device in a secure manner, even if the device has no built-in protected storage.

Authentication with massively pre-generated one-time passwords

A system and method is provided for generating a one-time passcode (OTP) from a user device. The method includes providing a passcode application and a cardstring defined by a provider account to the user device. The passcode application is configured to generate a passcode configured as a user OTP for the provider account, using the cardstring. The cardstring is defined by at least one key camouflaged with a personal identification number (PIN). The key may be camouflaged by modifying and encrypting the modified key under the PIN. The key may be configured as a symmetric key, a secret, a seed, and a controlled datum. The cardstring may be an EMV cardstring; and the key may be a UDKA or UDKB. The cardstring may be an OTP cardstring, and the key may be a secret configurable to generate one of a HOTP, a TOTP, and a counter-based OTP.

Growing community of inventors

Cupertino, CA, United States of America

Geoffrey R Hird