Dual device system for secure transactions

1. A method for operating a security device, said method comprising the steps of the security device:

receiving a request for a transaction from an application programmable device executing an application sanctioned by an application controlling institution, wherein the transaction is between the application and the application controlling institution, and has been initiated by the application programmable device;

generating a first one-time identifier, the first one-time identifier comprising a unique identification of the security device and a one-time transaction ID, wherein said one-time transaction ID is not generated randomly and is not coordinated with any device other than the security device; and

communicating to the application programmable device the first one-time identifier, in which the application verifies a validity of the security device identification and, upon verification of said validity, instructs the application programmable device to communicate the first one-time identifier and the transaction to the application controlling institution for processing, wherein the application controlling institution verifies a validity of the first one-time identifier and, upon verification of the validity, processes the transaction; wherein:

said security device, application programmable device, and application controlling institution securely process the transaction without using encryption, a PIN, or a password;

the transaction request comprises an application controlling institution identification; and

the security device stores the transaction request and the one-time transaction ID, in order to form an audit trail.

2. The method as recited in claim 1 , further comprising the steps of the security device:

verifying a validity of the transaction request; and

alerting a user of receiving a valid transaction request, wherein the user indicates an acceptance of the transaction request by signaling the security device.

3. The method as recited in claim 1 , further comprising the steps of the security device:

receiving a second one-time identifier from the application programmable device, wherein the second one-time identifier is generated by the application controlling institution in response to processing the transaction and is validated by the application;

verifying a validity of the processed transaction; and

communicating to the application programmable device verification of the validity of the processed transaction.

4. The method as recited in claim 1 , further comprising the step of the security device alerting a user of receiving an invalid transaction request containing an incorrect security device identification.

5. The method as recited in claim 1 , further comprising the step of the security device generating a new transaction ID for each subsequent transaction.

6. The method as recited in claim 5 , wherein the step of generating a new transaction ID does not entail incrementing the transaction ID by a value of 1.

7. The method as recited in claim 1 , wherein the first one-time identifier further comprises at least one of a date field, a time field, and a subject matter field.

8. The method as recited in claim 1 , wherein a user of the security device signals the security device by depressing a button on the security device or by biometrically actuating the security device.

9. The method as recited in claim 1 , wherein the security device alerts a user of the security device by illuminating an indicator on the security device for a valid transaction request, or by flashing the indicator for an invalid transaction request.

10. The method as recited in claim 1 , wherein the security device and the application programmable device communicate using a wireless connection.

11. The method as recited in claim 1 , wherein the security device and the application programmable device are located within a communications protocol required distance from each other.

12. The method as recited in claim 1 , wherein the transaction ID differentiates messages sent to and received from the application controlling institution; and enables the detection of duplicate security devices, counterfeit messages, counterfeit use of security devices, and illegal uses of lost or stolen application programmable devices.

13. The method as recited in claim 1 , further comprising the application controlling institution preparing and sending a return confirmatory message, in which the application controlling institution advances algorithmically the transaction ID.

14. The method as recited in claim 13 , wherein the algorithmic advance comprises expanding the number of digits in the transaction ID, in order to reduce the possibility of a successful attack.

15. The method as recited in claim 1 , wherein all or part of the first one-time identifier is stored in the application programmable device, in order to assist in thwarting use of a counterfeit security device.

16. A security device comprising:

a communications module for communicating with an application programmable device executing an application sanctioned by an application controlling institution; and

a processing unit configured to be operable for:

verifying a validity of a request for a transaction received from the application;

generating, upon the verification, a first one-time identifier, the first one-time identifier comprising a unique identification of the security device and a one-time transaction ID, wherein said one-time transaction ID is not generated randomly and is not coordinated with any device other than the security device; and

instructing said communications module to communicate the first one-time identifier to the application programmable device, wherein the application verifies a validity of the security device identification and, upon verification of the validity, instructs the application programmable device to communicate the first one-time identifier and a substantive transaction message to the application controlling institution for processing; wherein:

said security device, application programmable device, and application controlling institution securely process the transaction without using encryption, a PIN, or a password;

the transaction request comprises an application controlling institution identification; and

the processing unit is configured to be operable for storing the transaction request and the one-time transaction ID, in order to form an audit trail.

17. The security device as recited in claim 16 wherein said processing unit is further configured to be operable for:

issuing an alert to a user of the security device upon receiving from the application a valid transaction request; and

acknowledging the user's indication of an acceptance of the request.

18. The security device as recited in claim 16 , further comprising:

an indicator configured to be operable for receiving a command from said processing unit to alert a user of the security device; and

a sensor unit configured to be operable for receiving the user's indication of an acceptance and for transmitting the indication to said processing unit.

19. The security device as recited in claim 18 , wherein said sensor unit comprises a biometric sensor.

20. The security device as recited in claim 16 , wherein said processing unit is further configured to be operable for:

processing a second one-time identifier received from the application programmable device, wherein the second one-time identifier is generated by the application controlling institution in response to processing the transaction, and is validated by the application;

verifying a validity of the processed transaction; and

instructing said communications module to communicate to the application programmable device verification of the validity of the processed transaction.

21. The security device as recited in claim 16 , further comprising a housing and an attaching means, joined to said housing, for attaching the security device to a movable article in order to enhance mobility of the security device.

22. The security device as recited in claim 16 , wherein the transaction request further comprises at least one of a subject matter identification, a date, and a time.

23. The security device as recited in claim 16 , wherein said communications module communicates with the application programmable device using a wireless connection.

24. The security device as recited in claim 23 , wherein the wireless connection adheres to the Near Field Communications protocol.

25. The security device as recited in claim 16 , wherein the security device communicates with and is operable with a plurality of application programmable devices.

26. The security device as recited in claim 16 , wherein the security device communicates with and is operable with a plurality of application controlling institutions.

27. The security device as recited in claim 16 , wherein the application controlling institution comprises an automated teller machine (ATM), and the transaction comprises withdrawing cash from the ATM.

28. The security device as recited in claim 16 , wherein the unique security device identification is not stored in the application programmable device.

29. The security device as recited in claim 16 , wherein the first one-time identifier adheres to the ANSI x4. 16-1983 (ISO 3554) Magnetic Stripe Card, Track 2 Standard.