Methods and apparatus for securely conducting and authenticating transactions over unsecured communication channels

Abstract

A transaction processing system employs an authentication device which receives identifying and authentication information from a token such as a credit or debit card. The authentication device forms an information block comprising the identifying and authentication information and encrypts the information block using a preprogrammed key. The information block is transferred to a transaction terminal such as a merchant terminal or customer computer and subsequently transferred to an authorizing server. The authorizing server transfers the information block to an authenticating server, which decrypts the information block, extracts the identifying and authentication information and compares the identifying and authentication information against similar information accessible to the authenticating server. The authenticating server instructs the authorizing server to accept or reject the transaction based on the result of the comparison. Alternatively, a self-authenticating token may be employed in which authentication information characteristic of the token is converted to a numerical format, encrypted and stored on the token. The authentication device decrypts the numerical representation of the authentication information and compares it against the actual authentication information. The authentication device accepts or rejects the transaction based on the result of the comparison.