Abstract
Theft of stored credit card information is an increasing threat to e-commerce. We propose a dynamic virtual credit card number scheme that reduces the damage caused by stolen credit card numbers. A user can use an existing credit card account to generate multiple virtual credit card numbers that are either usable for a single transaction or are tied with a particular merchant. We call the scheme dynamic because the virtual credit card numbers can be generated without online contact with the credit card issuers. These numbers can be processed without changing any of the infrastructure currently in place; the only changes will be at the end points, namely, the card users and the card issuers. We analyze the security requirements for dynamic virtual credit card numbers, discuss the design space, propose a scheme using HMAC, and prove its security under the assumption the underlying function is a PRF.
The original version of this chapter was revised: The copyright line was incorrect. This has been corrected. The Erratum to this chapter is available at DOI: 10.1007/978-3-540-77366-5_37
This is a preview of subscription content, log in via an institution to check access.
Preview
Unable to display preview. Download preview PDF.
Similar content being viewed by others
References
Hotels.com credit-card numbers stolen: CNN Money (June 2, 2006)
Anderson, R.: Why cryptosystems fail. Communications of the ACM 37(11), 32–40 (1994)
Bellare, M.: New proofs for NMAC and HMAC: Security without collision-resistance. Cryptology ePrint Archive, Report 2006/043 (2006), http://eprint.iacr.org/
Bellare, M., Canetti, R., Krawczyk, H.: Keying hash functions for message authentication. In: Koblitz, N. (ed.) CRYPTO 1996. LNCS, vol. 1109, Springer, Heidelberg (1996)
Bellare, M., Garay, J., Hauser, R., Herzberg, A., Krawczyk, H., Steiner, M., Tsudik, G., Herreweghen, E.V., Waidner, M.: Design, implementation and deployment of the ikp secure electronic payment system. IEEE Journal on Selected Areas in Communications 18, 611–627 (2000)
Bellare, M., Kilian, J., Rogaway, P.: The security of the cipher block chaining message authentication code. In: Desmedt, Y.G. (ed.) CRYPTO 1994. LNCS, vol. 839, Springer, Heidelberg (1994)
Black, J., Rogaway, P.: Ciphers with arbitrary finite domains. In: Preneel, B. (ed.) CT-RSA 2002. LNCS, vol. 2271, pp. 114–130. Springer, Heidelberg (2002)
Citigroup.: Citi identify theft solutions: Virtual account numbers, http://www.citibank.com/us/cards/cardserv/advice/van.htm
Dennis, S.: French banks hacked (March 2000), http://www.computeruser.com/newstoday/00/03/11/news4.html
Discover Bank.: Discover card: Secure online account numbers, http://www.discovercard.com/discover/data/faq/soan.shtml
Evers, J.: Amazon unit loses credit card data to hackers. InfoWorld (March 6, 2001)
Franklin, D.C., Rosen, D.: Electronic online commerce card with transactionproxy number for online transactions. Patent 5883810 (1999)
Kim, J., Biryukov, A., Preneel, B., Hong, S.: On the security of HMAC and NMAC based on HAVAL, MD4, MD5, SHA-0 and SHA-1. Cryptology ePrint Archive, Report 2006/187 (2006), http://eprint.iacr.org/
Krim, J., Barbaro, M.: 40 Million Credit Card Numbers Hacked. Washington Post, p. A01 (June 18, 2005)
MasterCard: Mastercard securecode, http://www.mastercard.com/securecode/
Preneel, B., van Oorschot, P.C.: MDx-MAC and building fast MACs from hash functions. In: Coppersmith, D. (ed.) CRYPTO 1995. LNCS, vol. 963, pp. 1–14. Springer, Heidelberg (1995)
Rubin, A.D., Wright, R.N.: Off-line generation of limited-use credit card numbers. In: Syverson, P.F. (ed.) FC 2001. LNCS, vol. 2339, pp. 196–209. Springer, Heidelberg (2002)
Secure Electronic Transaction LLC: Set secure electronic transaction specification – version 1.0 (1997)
Shamir, A.: Secureclick: A web payment system with disposable credit card numbers. In: Syverson, P.F. (ed.) FC 2001. LNCS, vol. 2339, pp. 232–242. Springer, Heidelberg (2002)
Singh, A., dos Santos, A.L.M.: Grammar based off line generation of disposable credit card numbers. In: SAC 2002, pp. 221–228. ACM Press, New York (2002)
D. Transactions. Discover redoubles its commitment to single-use card numbers, http://www.orbiscom.com/news9.php
Visa International Service Association: Visa security progam: Verified by visa, https://usa.visa.com/personal/security/vbv/index.html
Visa International Service Association: Rules for visa merchants - card acceptance and chargeback management guidelines. Technical report, Visa International Service Association (2005)
Visa International Service Association: Visanet fact sheets (2006), http://www.corporate.visa.com/md/fs/corporate/visanet.jsp
Weiss, T.: Laptop with credit card info for 80,000 DOJ workers stolen. ComputerWorld (March 31 2005), http://www.computerworld.com/governmenttopics/government/legalissues/story/0,10801,102146,00.html
Ziegler, J.: Everything you ever wanted to know about CC’s, http://euro.ecom.cmu.edu/resources/elibrary/everycc.htm
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2007 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Molloy, I., Li, J., Li, N. (2007). Dynamic Virtual Credit Card Numbers. In: Dietrich, S., Dhamija, R. (eds) Financial Cryptography and Data Security. FC 2007. Lecture Notes in Computer Science, vol 4886. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-540-77366-5_19
Download citation
DOI: https://doi.org/10.1007/978-3-540-77366-5_19
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-77365-8
Online ISBN: 978-3-540-77366-5
eBook Packages: Computer ScienceComputer Science (R0)