Method and system for conducting secure payments over a computer network

Abstract

A method is provided for conducting a financial transaction by a purchaser with a merchant having an acquirer bank, over a communications network. The method includes the steps of sending a first authorization request using a pseudo account number associated with a real account number to a service provider which forwards a second authorization request to the issuer using the real account number and preferably a pseudo acquirer code associated with the service provider such that the response to the second request is based on the real account number and sent back to the service provider who preferably forwards a response to the first request preferably to the “real” acquirer. A message authentication code is further provided which includes transaction data, and where the authorization request is formatted as a standard payment card track having one or more fields including a discretionary field in which the message authentication code is placed.

1 . A method of conducting a transaction involving a merchant over an electronic payment network, the method comprising: 
 receiving data related to the transaction from the merchant;    computing a message authentication code based on the data related to the transaction;    placing the message authentication code in a portion of the discretionary data field of a standard payment card magnetic stripe track format to form a track image; and    transmitting the track image including the message authentication code, over the payment network, before or without first storing the message authentication code on a magnetic stripe of a payment card.    
     
     
         2 . The method of  claim 1 , wherein computing a message authentication code results in binary data, further comprising truncating and converting the message authentication code to decimal digits.  
     
     
         3 . The method of  claim 1 , wherein computing a message authentication code is further based on a transaction sequence number.  
     
     
         4 . The method of  claim 3 , further comprising inserting at least a portion of the transaction sequence number in a portion of the discretionary data field of the track image, and wherein transmitting the track image further includes transmitting at least the portion of the transaction sequence number over the payment network.  
     
     
         5 . The method of  claim 4 , further comprising inserting a payment account number in a payment account number field of the standard payment card magnetic stripe track format image, wherein transmitting the track image further includes transmitting the payment account number over the payment network.  
     
     
         6 . The method of  claim 5 , further comprising providing a card-unique secret key calculated using at least a derivation key and the payment account number, wherein computing the message authentication code comprises applying the card-unique secret key to the transaction sequence number and the data related to the transaction to compute the message authentication code.  
     
     
         7 . An apparatus for conducting a transaction involving a cardholder and merchant having a merchant device over an electronic payment network, the apparatus comprising: 
 a cardholder memory device containing at least a card-unique secret key;    a receiver module capable of receiving data from the merchant device related to the transaction;    a message authentication code calculator coupled to the receiver module and the cardholder memory device for calculating a message authentication code using at least the data related to the transaction received from the merchant device and the secret key;    a track image data formatter coupled to the message authentication code calculator for placing at least a portion of the message authentication code in a portion of the discretionary data field of a track image data formatted as a standard payment card magnetic stripe data track;    a transmitter coupled to the track image data formatter for transmitting the track image data formatted as a standard payment card magnetic stripe data track to the merchant device for subsequent transmission over the payment network before or without first storing the message authentication code on a magnetic stripe of a payment card.    
     
     
         8 . The apparatus of  claim 7 , wherein the message authentication code calculator further includes a decimalization module for truncating and converting the message authentication code to a shortened decimal digit representation.  
     
     
         9 . The apparatus of  claim 7 , wherein the cardholder memory device additionally has a transaction sequence number, and wherein the message authentication code calculator is further configured to compute the message authentication code based on the transaction sequence number.  
     
     
         10 . The apparatus of  claim 9 , wherein the track image data formatter is further configured to insert at least a portion of the transaction sequence number in a portion of the discretionary data field of the track image data formatted as a standard payment card magnetic stripe data track.  
     
     
         11 . The apparatus of  claim 10 , wherein the cardholder memory device additionally stores a payment account number, and wherein the track image data formatter is further configured to insert the payment account number in a payment account number field of the track image data formatted as a standard payment card magnetic stripe data track.  
     
     
         12 . The apparatus of  claim 10 , wherein the message authentication code calculator is configured to compute a message authentication code by applying the card-unique secret key to the transaction sequence number and the data related to the transaction.  
     
     
         13 . The apparatus of  claim 7 , further comprising a processor, wherein the message authentication code calculator and the track image data formatter are implemented within the processor.