IP Library Granted Patent US 8,843,757
Granted Patent B2
US 8,843,757 · App. 12/943,200 · Granted Sep 23, 2014

One time PIN generation

Inventor: Rammohan Varadarajan (Cupertino, CA)
Assignee: CA, Inc.
G06Q20/32G06Q20/227G07F7/1075G06Q20/385G06Q20/18G06Q20/3552G06F21/34G07F7/122
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 8,843,757
App. No.
12/943,200
Granted
Sep 23, 2014
Kind
B2
Abstract

A method and system is provided for generating a one-time passcode (OTP) configured for use as a personal identification number (PIN) for a user account from a user device. The OTP may be generated using an OTP generator which may include an algorithm an user account-specific OTP key. The OTP key may be camouflaged by encryption, obfuscation or cryptographic camouflaging using a PIN or a unique machine identifier defined by the user device. Obtaining an OTP from the user device may require inputting a data element which may be one of a PIN, a character string, an image, a biometric parameter, a user device identifier such as an machine effective speed calibration (MESC), or other datum. The OTP may be used for any transaction requiring a user PIN input, including ATM and debit card transactions, secure access and online transactions.

Claims (52)

1. A method, comprising:

providing a one-time passcode (OTP) application to a user device;

camouflaging a key using a data element defined by a user account to provide an OTP key associated with the user account, the camouflaging the key comprising using a machine effective speed calibration (MESC) defined by the user device;

providing the OTP key to the user device; and

generating the OTP on the user device using the OTP application, the MESC and the OTP key;

wherein the OTP is configured for input as a PIN into a transaction interface.

2. The method of claim 1 , further comprising:

inputting the OTP to a provider system using the transaction interface;

determining whether the OTP is an authentic PIN for the user account; and

providing an authorization result to the transaction interface using the provider system.

3. The method of claim 2 , wherein determining whether the OTP is an authentic PIN for the user account further comprises:

providing an authenticating OTP, wherein the authenticating OTP is generated by the provider system or provided from a list of acceptable OTPs for the user account;

comparing the OTP to the authenticating OTP to determine a match between the OTP and the authenticating OTP; and

verifying the OTP as an authentic PIN for the user account when the OTP matches the authenticating OTP.

4. The method of claim 1 , further comprising:

activating a first OTP generator on the user device, wherein the first OTP generator comprises a first OTP key associated with a first user account;

activating a second OTP generator on the user device, wherein the second OTP generator comprises a second OTP key associated with a second user account;

selecting a respective one of the first and second OTP generators using the OTP application; and

generating an OTP using a respective one of the first and second OTP keys associated with the respective one of the first and second OTP generators.

5. The method of claim 4 , wherein one of the OTP application and the OTP generator comprises an OTP generating algorithm which is configured as one of a HMAC-Based One-Time Password (HOTP) and an Europay, MasterCard and Visa Chip Authentication Program (EMV/CAP) algorithm.

6. The method of claim 2 , wherein the OTP is configured for input as a PIN into a transaction interface as an electronic signal transmittable from the user device or an electronic signal generated by the user device; and

wherein inputting the OTP into the transaction interface comprises inputting the OTP through use of RFID, contactless, Bluetooth, WiFi, proximity card or near field communication technologies.

7. The method of claim 1 , wherein camouflaging the key comprises:

camouflaging the key using cryptographic camouflage to provide the OTP key.

8. The method of claim 1 , wherein the key is a symmetric key, a DES key, an AES key, a non-symmetric key, a secret, a secret byte array, a UDKA, a UDKB , a seed or an indexed key list.

9. A system, comprising:

a provider system that provides a one-time passcode (OTP) application to a user device, the provider system camouflages a key using a machine effective speed calibration (MESC) defined by the user device to generate an OTP key associated with a user account, the provider system provides the OTP key to the user device; and

wherein the OTP application is configured to generate an OTP on the user device using the OTP key and the MESC;

wherein the OTP is configured for input as a PIN into a transaction interface.

10. The system of claim 9 , further comprising:

a transaction interface that receives a PIN;

wherein:

the provider system is in communication with the transaction interface and evaluates a PIN input to the transaction interface to determine whether the PIN input is an authentic PIN for the user account;

the provider system provides an authenticating OTP for the user account; and

the provider system compares the PIN input into the transaction interface to the authenticating OTP to determine whether the OTP is an authentic PIN for the user account.

11. The system of claim 9 , wherein:

the transaction interface is one of an automatic teller machine (ATM) terminal and a point of sale (POS) terminal; and

the user account is one of an ATM account and a debit account.

12. The system of claim 9 , wherein:

the provider system provides an OTP generator comprising an OTP algorithm;

the user device receives the OTP generator comprising the OTP algorithm;

the OTP algorithm is an HMAC-Based One-Time Password (HOTP) or an Europay, MasterCard and Visa Chip Authentication Program (EMV/CAP) algorithm; and

the OTP application is configured to generate an OTP using the OTP generator and the OTP key.

13. The system of claim 9 , wherein the OTP is configured as an electronic signal transmitted from the user device.

14. A system, comprising:

a processor that provides a one-time passcode (OTP) application comprising an OTP generator to a user device, the processor receives a machine effective speed calibration (MESC) from the user device, the processor camouflages a key using the MESC to generate an OTP key associated with a user account, the processor provides the OTP key to the user device, the OTP application is configured to generate an OTP on the user device using the OTP generator, the MESC and the OTP key, the OTP is configured for input as a PIN into a transaction interface.

15. The system of claim 14 , wherein:

the transaction interface is configured to receive the PIN;

the transaction interface is one of an automatic teller machine (ATM) terminal and a point of sale (POS) terminal;

the user account is one of an ATM account and a debit account;

the system is in communication with the transaction interface and evaluates the OTP to determine whether the OTP is an authentic PIN for the user account; and

the processor provides an authorization result to the transaction interface.

Assignments (3)
MERGER Recorded Sep 10, 2013
From: COMPUTER ASSOCIATES THINK, INC.
To: CA, INC.
Reel/Frame 031170/0821 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Jun 23, 2011
From: ARCOT SYSTEMS, INC.
To: COMPUTER ASSOCIATES THINK, INC.
Reel/Frame 026488/0240 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Nov 17, 2010
From: VARADARAJAN, RAMMOHAN
To: ARCOT SYSTEMS, INC.
Reel/Frame 025386/0895 →
Continuity (2)
Provisional Application 61260635 · Nov 12, 2009
Related Publication 20110113245A1 · May 12, 2011