WO2001084452A2

WO2001084452A2 - System and method for enabling universal log-in

Info

Publication number: WO2001084452A2
Application number: PCT/US2001/014485
Authority: WO
Inventors: John Wankmueller; Michael D. Harris
Original assignee: Mastercard International Incorporated
Priority date: 2000-05-04
Filing date: 2001-05-04
Publication date: 2001-11-08
Also published as: EP1281149A2; AU5949401A; WO2001084452A3; ZA200208825B; JP2003532236A; AU2001259494B2; CA2408014A1; HK1052776A1

Abstract

A method is provided for enabling universal remote access by a user of a chip payment application on a chip card to a remote non-payment application over a communications network. Authentication software is provided at the remote location and it drives the authentication process over the network as if it were a payment transaction. The chip payment application supports a payment dynamic data authentication function to provide a payment response to the authentication software which verifies, through public key infrastructure, that the card is authentic based on the response. Access to the non-payment application is allowed based on the verification.

Description

SYSTEM AND METHOD FOR ENABLING UNIVERSAL LOG-IN

SPECIFICATION PRIORITY APPLICATION This application claims priority to United States provisional application serial number 60/201 ,790, filed on May 4, 2000, and entitled "SYSTEM AND METHOD FOR ENABLING UNIVERSAL LOG-IN," which is hereby incorporated by reference.

BACKGROUND OF THE INVENTION The present invention relates to digital identification products and more specifically to a system and method for providing a umversal log-in to software programs and web sites. Presently, there are numerous digital ID products on the market but none take advantage of payment card specifications to provide for universal log-in capability.

SUMMARY OF THE INVENTION It is therefore an obj ect of the present invention to use the functionality defined in a particular set of payment card specifications, namely those issued by Europay International S.A., MasterCard International Incorporated and Visa International Service Association ("the EMV specifications") in a different way to achieve a different end result, namely, identification of a cardholder to a piece of software or web site, thereby providing a universal log-in capability.

In accordance with a preferred embodiment of the invention, a method is provided for enabling universal remote access by a user of a chip payment application on a chip card to a remote non-payment application over a communications network through the use of a local chip card reader at the user location. The method preferably includes the following steps: providing the chip payment application with a payment security technique having at least one application that supports a payment dynamic data authentication function; providing at the remote host site instead of at the user location a public key infrastructure and payment chip terminal authentication software; reading by the local chip card reader the chip card; communicating by the payment chip terminal authentication software from the remote host site over the communications network and through the chip card reader with the chip payment application on the chip card; utilizing by the chip card the payment dynamic data authentication function to provide a payment response to the communication; verifying by the remote payment chip terminal authentication software, based on the payment response and through the public key infrastructure, that the chip card is authentic; allowing access to the non-payment application based on the verification.

Preferably, the method further includes: prompting the user for a personal identification number; locally verifying by the chip card the personal identification number; and verifying, based on the local verification step, that the user is authentic.

Preferably, the communication step further includes forwarding by the remote host site over the communications network authentication commands to the chip payment application; and the chip card contains a unique identifier utilized in the payment response. BRIEF DESCRIPTION OF THE DRAWINGS

Exemplary embodiments of the present invention will now be described in detail with reference to the accompanying drawings in which:

Fig. 1 is a block diagram illustrating the different components preferably utilized in the remote access method of the present invention; and Fig. 2 is a flow chart of a method for logging into a software program or web site according to an exemplary embodiment of the present invention.

While the subject invention will now be described in detail with reference to the figure, it is done so in connection with a preferred embodiment. It is intended that changes and modifications can be made to the described embodiment without departing from the true scope and spirit of the subject invention as defined by the appended claims. DETAILED DESCRIPTION

The EMV Specifications describe a set of functions which, taken together, perform a debit or credit payment function in a secure manner. One of the functions described is dynamic data authentication. Dynamic data authentication (DO A) is the process through which authenticating software, located generally at the point of sale terminal or local card reader device, can send specific commands and data to an EMV-compliant chip card application (on a chip card capable of performing public key cryptography signing functions) and receive data from the card application in response that allows the authenticating software to cryptographically verify that the chip card performed the digital signature. The following EMN specifications are hereby incorporated by reference and familiarity with the specifications is assumed:

EMV '96 Integrated Circuit Card, Terminal and Application Specifications June 30, 1998, Version 3.0

EMV '96 Integrated Circuit Card Specification for Payment Systems, Version 3.1.1, May 31, 1998 (available at http://www.emvco.com/specifications.cfrn).

EMV '96 Integrated Circuit Card Terminal Specifications for Payment Systems, Version 3.1.1, May 31, 1998 (available at http://www.emvco. com/ specifications, cfin).

EMV '96 Integrated Circuit Card Application Specification for Payment Systems, Version 3.1.1, May 31, 1998 (available at http://www.emvco.com/specifications. cfin).

EMN '96 Chip Electronic Commerce Specification, Version 1.0, December 1999 (available at http://www.emvco.com/specifications.cfm).

These publications are collectively referred to herein as the EMV

Specifications.

The present invention uses the DDA functionality specified in the EMV Specifications as the basis of a secure universal log-in function to identify an authorized user to a piece of software or a web site by virtue of the user's authorized possession of a DDA-capable chip application and a valid account number or other valid identifier (such as a primary account number for sign-on use only). The present invention preferably utilizes the existing MasterCard International public key infrastructure, which has been built to support EMV applications. This public key infrastructure is described in the following documents, also incorporated herein by reference (familiarity with which is also presumed):

1. Recommended Specifications for Debit and Credit, Version 2.1 (describes the recommended card requirements for the MasterCard chip card application to support MasterCard debit and credit programs);

2. Minimum Card Requirements for Debit and Credit, Version 2.1 (contains the minimum card requirements when implementing a MasterCard debit or credit program on a chip card);

3. Terminal Requirements for Debit and Credit, Version 2.1 (contains MasterCard's requirements for terminals that accept MasterCard branded debit and credit chip card programs);

4. Personalization Data Specifications for Debit and Credit on Chip, Version 2.1 (specifies the data elements that are needed to create an Application Load File (ALF) which is used in the first stage of the chip personalization process). These documents, collectively referred to as the MasterCard Specs, are available at http://www.mastercard.eom/emv/emvspecs02.html#emvl.

The present invention may also utilize PIN or password verification by the chip card application at the instigation of the authenticating software. Alternatively, other methods of cardholder verification such as biometric verification methods may be used. Successful completion of such a PIN verification by the card could be communicated to the authenticating software in the data elements defined by the EMV Specifications for this purpose with the integrity of that data element being confirmed by the DDA.

In accordance with a preferred embodiment of the invention, a method is provided for enabling universal remote access by a user of a chip payment application on a chip card to a remote non-payment application over a communications network. Previously, all chip payment applications residing on a chip card communicated directly at the user site with a card reader or point-of-sale device which itself, based on authenticating software stored locally at the user site, verified, for payment purposes, the authenticity of the card and the user, the latter depending on whether a personal identification number was provided. In contrast, the present invention contemplates using payment applications and payment security techniques in a different manner and in a different context — not for purposes of authorizing payment transactions but instead for allowing access to non-payment applications and websites over a communications network. To accomplish this, payment chip terminal authentication software is placed not at the point of sale or at the user site but is instead placed at a remote host site location to allow for access to a non-payment application, such as a website, located remotely from the user location. The remote host site, stored with the authenticating software, drives the authentication process with the local chip card in accordance with a payment public key infrastructure, over a communications network, for purposes of allowing access to non-payment applications.

In accordance with the preferred embodiment of the invention, the process starts with the consumer/client at a computer moving his or her browser to a website having an access controlled area on the Internet. The provider of this restricted service operates a digital identification processing component (e.g., the authentication software) at the remote host server site that will inquire regarding the capability of the client computer to perform an authentication transaction. If the client computer signals the availability of such a service, then the client side component will be activated by the server. Performing what it considers to be a payment procedure, it sends an authentication request to the service provider.

Figure 1 illustrates the structural or processing components involved in the preferred method of the present invention. As shown, a chip card 10 issued by an issuer contains a chip payment application 12 with a payment security technique having at least one application that preferably supports a payment dynamic data authentication function 14. Preferably, the chip card contains a unique identifier for the purpose of identifying the card and the issuer, and it also contains a secret key for use with the payment security technique.

A card reader 16 is provided at the user location (preferably attached to the user's computer) for reading (or electromechanical connection to) the card 10. The electrical interface and transmission protocols should comply with the requirements in the EMV Specs. The reader should also be available with RS232 or USB connection, or it can be built into the user/client computer 18, which will now be described.

The user/client computer 18 will provide the interface between the card reader and the merchant/service provider component. The user/client software will preferably be downloaded from the web, if not already installed on the computer. It will preferably handle the following local functions: accepting the request from the remote site; prompting the cardholder to insert the card into the reader; optionally prompting the cardholder to enter his or her PIN; verifying the PIN with the application on the card; and performing the local processing in accordance with the EMV Specs.

At the remote host site, there is provided a payment public key infrastructure (PKI) 20, for instance in accordance with the MasterCard Specs, and payment chip terminal authentication software 22. The authenticating software 22 drives the communication with the card in accordance with the flow chart depicted in Figure 2.

Fig. 2 is a flow chart of a method for logging into an authenticating software (e.g., a software program or web site) according to an exemplary embodiment of the present invention. The term "per EMV" in Fig. 2 indicates that an operation is performed according to the EMV Specifications. With reference to Fig. 2, in step 100, a card application on an integrated circuit ("IC") card is initiated by the authenticating software at the remote host site location. In step 102, it is preferably determined if PIN verification is required for the card application. If PIN verification is required, a PIN is obtained from a user in step 104. In step 106, a "VERIFY PIN" command is sent to the card application. In step 108, the card application performs PIN verification using a stored PIN in the IC card. This is done in accordance with the EMV Specs. In step 110, the result of the PIN verification is stored in the IC card, and in step 112, the PIN verification result is returned to the authenticating software per the EMV Specs.

In step 114, it is determined whether the PIN was correctly entered. If the PIN was not correctly entered, the authenticating program aborts. Alternatively, the user may be given another chance to enter the correct PIN. If the PIN was correctly entered or a PIN was not required, in step 116, a communication, including DDA command data, is prepared in accordance with the EMV Specs, and in step 118, the DDA command (with DDA command data) is sent to the card application.

In step 120, the card, via the EMV Spec payment security technique having the application which supports the payment dynamic data authentication function, processes the DDA command and data, preferably using the stored PIN result and user identifier information. The user identifier information may include a payment account number. In step 122, the card application returns the DDA data to the authenticating software. In step 124, the authenticating software authenticates the returned

DDA data using the payment public key cryptography, as specified in the EMV Specifications. The present invention preferably utilizes the existing MasterCard International payment public key infrastructure 20, as described in the MasterCard Specs, which has been built to support EMV Specifications. In step 126, it is determined whether the returned DDA data is authentic. If the data is not authentic, the authenticating program aborts. If the returned DDA data is authentic, then log-in to the non-payment application is permitted in step 128.

The foregoing merely illustrates the principles of the invention. It will thus be appreciated that those skilled in the art will be able to devise numerous systems and methods which, although not explicitly shown or described herein, embody the principles of the invention and thus within the spirit and scope of the invention.

Claims

1. A method for enabling universal remote access by a user of a chip payment application on a chip card to a remote non-payment application over a communications network through the use of a local chip card reader at the user location, comprising the following steps: providing said chip payment application with a payment security technique having at least one application that supports a payment data authentication function; providing at said remote host site a public key infrastructure and payment chip terminal authentication software; reading by said local chip card reader said chip card; communicating by said payment chip terminal authentication software from said remote host site over said communications network and through said chip card reader with said chip payment application on said chip card; utilizing by said chip card said payment data authentication function to provide a payment response to said communication; verifying by said remote payment chip terminal authentication software, based on said payment response and through said public key infrastructure, that said chip card is authentic; allowing access to said non-payment application based on said verification.

2. The method of claim 1, wherein said payment data authentication function is a payment dynamic data authentication function.

3. The method of claim 2, further comprising the steps of: prompting said user for a personal identification number; locally verifying by said chip card said personal identification number; and wherein said verification step further includes, based on the local verification step, verifying that said user is authentic.

4. The method of claim 3, wherein said communication step further includes forwarding by said remote host site authentication commands to said chip payment application; and wherein said payment response responds to said commands.

5. The method of claim 4 wherein said chip card contains a unique identifier and wherein said payment response utilizes said unique identifier.