602 Messaging Server v3.32c serial key or number

IMPORTANT! READ BEFORE UPGRADE or INSTALL

If you are on Windows 7, please make sure the following updates are NOT installed. If they are installed, please uninstall them first or you may experience issues with upgrade!:

- KB

- KB

- KB

* Detail information and uninstall instruction can be viewed from following Technical Bulletin: Windows OS Updates Preventing DW Spectrum Upgrade

If the OS is Ubuntu or lower version, OS must be upgraded to or higher prior to upgrade or install DW Spectrum Refer to the Reference section of the for the related Knowledgebase article.

DW Spectrum Release Note for

CRITICAL COMPATIBILITY NOTICE:

All users must update to the v or higher Mobile release in order to be able to connect to a v System via the Mobile Client. Mobile Clients v or earlier will not be able to access Systems running v or later.

BREAKING CHANGES

Mac OS X , , support is dropped: Desktop Client will not work on these OS versions.

NEW FEATURES:

o    Push Notifications (requires Mobile Client v or later):

§  Rules can be created in DW Spectrum to send Push Notifications to mobile devices.

§  Users can receive push notifications from multiple systems and turn on/off notifications for specific systems.

§  In order to receive Push Notifications, users must be logged into the Cloud in Mobile Client.

§  Users can create custom text for notifications in the Rules Engine via Desktop Client.

o    Health Monitoring - Available in the Server Web Admin interface and Cloud Portal, Health Monitoring provides administrators detailed information about a System’s health, including, but not limited to:

§  Alerts - automatically detected / identified problems with a System

§  System Info (# of servers, channels, storage located, users, and version)

§  Servers (storage detailed state, CPU usage, NICs state, hardware spec, etc.)

§  Cameras (online/offline state, resolution, fps, quality, firmware version, etc.)

§  Storage Locations (path, server, type, status, read/write rate, size, usage %)

§  Network Interfaces (name, server, state, IP address, I/O rates)

§  Desktop Clients connected to Servers.

o    New Embedded Browser - Desktop Client now uses a full-featured embedded Chromium browser (v) to display web pages on layouts:

§  Download Files on Web-Page - the embedded browser in Desktop Client now supports downloading and saving files.

§  Cameras Web Page in Camera Settings Dialog - camera web pages can now be opened up in the Camera Settings dialog allowing users to configure/access camera web pages inside Desktop Client even when on a different Subnet (i.e., remote connections / outside the LAN / WAN). Server acts like an HTTP(s) proxy from cameras to Desktop Clients.

o    Video Wall Failover - If a Server with Video Wall licenses fails, the video wall continues working for 7 days. After that, it will be blocked with the error message "Not enough licenses".

IMPROVEMENTS

o    Best Server Selection (while connecting to a Cloud-connected Multi-Server System):

§  In prior releases, Desktop Client would connect to a random available server via Cloud. Now Cloud connections are routed through the Server with the best uplink.

§  Added the ability for users to specify the preferred Server for connections. The configured Desktop Client will attempt to connect to the preferred Server first, and if it is not reachable, it will detect and connect via the Server with the best uplink.

o    2-way Audio API - Allows third-party web clients to send audio (from client microphone) to and get audio from cameras.

o    Added Time Zone option for Virtual Cameras - Time Zone can now be specified for virtual cameras. If "Time Zone" is set to "Auto", then the time zone is defined by metadata or UTC if there's no time zone specified in the file. If set to "Client", the Time Zone is defined by the desktop client.

o    Server Side Motion Detection improved - False positives detection introduced to increase accuracy of detected motion events (e.g., turning on/off lights or switching camera day/night mode are now likely to be ignored)

o    Additional action parameter placeholders for the "Do HTTP request" action - Placeholders can be added to the HTTP POST request body to be automatically replaced by the corresponding values from Analytics Event parameters. This feature is only applicable to Analytics and Generic Events. Placeholders syntax:

§  {cromwellpsi.comId} – replaced by the camera ID (e.g., {{{ad1d1b6cfd4-ffe}}})

§  {cromwellpsi.comName} – replaced by the camera name (e.g., DWC-MB45WiAT)

§  {cromwellpsi.comype} – replaced by the event type (e.g., cromwellpsi.comInTheArea or cromwellpsi.comossing)

§  {cromwellpsi.comame} – replaced by the event name (e.g., Object in the area or Line crossing)

§  {cromwellpsi.comn} – replaced by the caption (e.g., “Line crossing - impulse event (caption)”)

§  {cromwellpsi.comption} – replaced by the description (e.g., "Line crossing - impulse event (description)").

o    Improved MacOS performance and introduced an experimental setting to limit frame rate and reduce CPU load (see Local Settings -> Advanced).

o    Improved cloud connectivity on certain network environments.

o    Added the ability to pin the Timeline in fullscreen mode:

§  When the Timeline is pinned it will remain fixed on the screen.

§  If the Timeline is pinned in fullscreen mode and the user leaves fullscreen it will be pinned for all cameras on the layout when the user returns to fullscreen mode.

o    Database backups are now categorized into the following types:

§  Created after system merge

§  Created after updates

§  Initiated via API

§  Scheduled.

o    "Camera selection" dialog was optimized for a large systems.

o    Added text search in the "Event log" dialog.

o    "Global Notification Settings" button was removed from the "Show Notification" action.

o    Added .mpegts files to the list of supported files in Desktop Client.

o    It is now possible to disable port 80 on firewalls completely and use port for HTTPS connection.

o    Added the ability to search by object types in the Notification Panel. <param>: <value> returns object where <param> has <value>. For instance, if there are analytic plugins that recognize t-shirt color, gender, and glasses, it is possible to search for analytic events by “T-Shirt: White”, “Gender: Male”, “Glasses: True”.

o    The default playback state of a camera opened from the Notification Panel has changed. Now a camera remains on Pause once opened.

o    Users are now imported from LDAP with their Email addresses.

o    It is now possible to open multiple instances of the Desktop Client by double clicking on the desktop shortcut.

o    Added information about remaining license deactivations on "License details" and "Confirmation" dialog.

NEW DEVICE SUPPORT

o    New Devices Supported with Analog Encoder License:

§  Digital Watchdog DW-EN4K16

o    New PTZ camera support

§  DWC-MPTZXW, DWC-MPTZXW

RECOMMENDED UPGRADE PATH

• From 3.x: Upgrade directly to DW Spectrum
• From or Upgrade to then upgrade to

* Always backup the database and license key information before upgrading to newer build or version

** Re-index the storage after upgrading to 

IN_CLIENT UPGRADE INFORMATION

• Build Number:
• Password:1uis6p

INSTALLATION FILE DOWNLOAD

cromwellpsi.com

OS SUPPORTED – MEDIASERVER

• Windows 7, 8, , 10 Pro/Enterprise
• Windows Server R2, , R2, v and later,
• Ubuntu LTS: , ,

• OPERATING SYSTEM NO LONGER SUPPORTED

• 32 Bit operating system (both Windows and Ubuntu Linux)
• Ubuntu is no longer supported.(refer to the reference for upgrade
• Windows Server no longer supported (Only R2 is supported)

OS SUPPORTED – CLIENT

• Windows: 7 Home, 7 Standard, 7 Pro, 7 Ultimate, 8/ Standard, 8/ Pro, Enterprise, 10 Home/Pro/Enterprise¹
• Windows Server R2, , R2, v
• Ubuntu LTS: , ,
• MAC OS X “Mojave”, “Catalina”.

¹ For Windows 10, recommend i5/i7 processors with 16GB RAM and video card with 4GB or higher RAM

• OPERATING SYSTEM NO LONGER SUPPORTED

• 32 Bit operating system (both Windows and Ubuntu Linux)
• Ubuntu is no longer supported.(refer to the reference for upgrade instruction)
• Windows Server no longer supported (Only R2 is supported)
• MAC OSX , , support is dropped. Desktop client will not work on these OS versions.

MOBILE APP

• DW Mobile Plus
• DW Spectrum™ App x.x
• DW Site Viewer™ App for Apple TV

SUPPORTED BLACKJACK AND CAAS MODELS

This application claims priority to and is a non-provisional of U.S. provisional patent application No. 61/,, filed on Nov. 13, , which is herein incorporated by reference in its entirety for all purposes.

There are a number of ways to authenticate individuals. One method normally used for identifying a user is based on a secret identification code, also referred to as a PIN (Personal Identification Number). In a typical transaction involving a payment card, a user enters his PIN into a transaction terminal, which then communicates with a back end server computer. The back end server computer thereafter verifies that the PIN code is accurate. Although PINs are useful, there are some disadvantages. For example, the owner of the card must memorize the PIN and another person can commit fraud by stealing the PIN.

Another way to authenticate individuals is to use biometrics such as fingerprint readers. Although biometrics can be useful, there are disadvantages. For example, biometric devices are expensive to implement. Further, biometric data can be stolen. For example, fingerprints of individuals can be left on glasses and other objects. Such fingerprints could be replicated by others by creating fake fingerprint impressions. Like a PIN, once biometric data is stolen, it is possible for an unauthorized person to use this data to impersonate a real user.

Static signatures may also be used to authenticate a person. However, a static signature can be forged or electronically intercepted by unauthorized persons.

Embodiments of the invention address these and other problems, individually and collectively.

Systems and methods for improved methods and devices are disclosed.

One embodiment of the invention is directed to a device comprising a processor, a display coupled to the processor, and a computer readable medium coupled to the processor. The computer readable medium comprises (i) code for displaying a first authentication image comprising a plurality of image elements comprising a set of image elements, where the image elements in the set of image elements are located at a first set of positions on a display screen, (ii) code for receiving a first glyph having a first configuration corresponding to the set of image elements from a user while the first authentication image is displayed, (iii) code for displaying a second authentication image comprising the plurality of image elements comprising the set of image elements, where the image elements in the set of image elements are located at a second set of positions on the display screen, where the second set of positions is different than the first set of positions, and (iv) code for receiving a second glyph having a second configuration corresponding to the set of image elements from a user while the second authentication image is displayed.

Another embodiment of the invention is directed to a method comprising displaying a first authentication image comprising a plurality of image elements comprising a set of image elements. The image elements in the set of image elements are located at a first set of positions on a display screen. The method also includes receiving a first glyph having a first configuration corresponding to the set of image elements from a user while the first authentication image is displayed, and displaying a second authentication image comprising the plurality of image elements comprising the set of image elements. The image elements in the set of image elements are located at a second set of positions on the display screen. The second set of positions is different than the first set of positions. The method further includes receiving a second glyph having a second configuration corresponding to the set of image elements from a user while the second authentication image is displayed.

Another embodiment of the invention is directed to a method comprising displaying a first image element and receiving a glyph. The glyph is created by moving the first image element from a first position relative to a second image element to a second position relative to the second image element. The method also includes sending an authentication message comprising data representing the glyph to a service provider.

Another embodiment of the invention is directed to a device comprising a processor, a display coupled to the processor, and a computer readable medium coupled to the processor. The computer readable medium comprises code for displaying a first image element, receiving a glyph, where the glyph is created by moving the first image element from a first position relative to a second image element to a second position relative to the second image element, and code for sending an authentication message comprising data representing the glyph to a service provider.

Further details regarding embodiments of the invention are provided below in the Detailed Description with reference to the Figures.

One embodiment of the invention is directed to a method for authenticating a user (e.g., a consumer) in a transaction such as a payment transaction. Although payment transactions are discussed in detail, it is understood that embodiments of the invention can be used in other transactions such as money transfer transactions or access transactions (e.g., obtaining access to a particular location or venue).

The method comprises, in a first transaction, displaying a first authentication image comprising a plurality of image elements comprising a set of image elements on a display screen on a device such as a personal computer, a mobile phone, or an access device. The display screen can comprise a touch screen. A touch screen can allow a user to input data into the device by contacting the screen with a finger or a stylus. The image elements in the set of image elements are located at a first set of positions on the display screen.

Any suitable type or number of image element can be displayed on the display screen. Suitable image elements may comprise images of two or three dimensional objects, or parts thereof. Examples of two dimensional objects might be simple shapes such as squares or circles, or streets or landmarks on a two-dimensional map. Examples of three-dimensional objects may include pictures of buildings, mountains, rocks, etc.

After the first authentication image is displayed, a first glyph having a first configuration corresponding to the set of image elements is received by the device while the first authentication image is displayed on the display screen. A user may use his finger or a stylus to create a glyph that corresponds to the set of image elements.

As used herein, a “glyph” can be a figure that can be drawn on the display screen using a finger, stylus, cursor, or the like. A mouse or other input device can be used to create a glyph. The glyph and/or the stroke(s) used to form the glyph may be continuous or discontinuous in nature, and they can be simple or complex. An example of a continuous figure can be in the shape of a letter such as the letter “Z,” “C,” “S,” or some other complex or simple shape. An example of discontinuous strokes used in a glyph can be a glyph in the form of the letter “X”.

Illustratively, a) shows a phone comprising a display screen coupled to a housing . The display screen shows a first authentication image comprising first plurality of image elements in the form of an array of differently patterned or colored dots (a)-(i). The user may enter a first glyph into the phone using his finger to sequentially connect dots (a), (d), (g), and (h) to form the first glyph . The dots (a), (d), (g), and (h) can form a set of image elements. The first glyph may or may not be displayed on the display screen . If it is not displayed on the display screen , then the first glyph would still be received by the phone .

After the first glyph is received by the device, the device can have an authentication module (e.g., authentication software) which authenticates the user by comparing the first glyph to a previously registered glyph. In other embodiments, the device may send data representing the entered glyph to a remote server computer. The remote server may have an authentication module (e.g., authentication software) which authenticates the user by comparing the first glyph to a previously registered glyph. In either case, if the first glyph matches a previously registered glyph (which may be stored in a database accessible to the remoter server or which may be stored in the device itself), then the user is authenticated and the user may then be allowed to proceed with the transaction. Conversely, if the first glyph does not match the previously registered glyph, then the user is not authenticated and the user may not be allowed to proceed with the transaction. Alternatively, additional authentication steps may be required before the user can proceed with the transaction. For example, a service provider may request that the user call the service provider and provide additional information (e.g., the user's mother's maiden name) before the transaction can proceed.

At some point in time, the user may then subsequently conduct a second transaction using the device (or a different device). The user may initiate a second transaction. The same or different device that was used to conduct the first transaction may then display a second authentication image. The second authentication image may comprise the plurality of image elements comprising the set of image elements.

In the second authentication image, however, the image elements in the set of image elements are located at a second set of positions on the display screen. The second set of positions is different than the first set of positions.

A second glyph having a second configuration corresponding to the set of image elements is received from a user while the second authentication image is displayed. Because the positions of the image elements that are displayed during the second transaction are different than the positions of the image elements that are displayed during the first transaction, and because the second glyph will correspond to the same set of image elements, the first and second glyphs will have different configurations.

Referring to b), for example, during the second transaction, the display may display a second authentication image with the same set of dots (a)-(i) as in the first authentication image shown in a). However, in the second authentication image shown in a), the dots (a), (d), (g), and (h) are at different positions than the positions shown in the first authentication image in a). The user may enter a second glyph into the phone to connect the dots (a), (d), (g), and (h). Because the dots (a), (d), (g), and (h) in the second authentication image are at different positions than in the first authentication image, the second glyph has a different configuration than the first glyph .

Similar to the authentication of the first glyph, the second glyph is verified for accuracy.

Although first and second glyphs and first and second transactions are discussed herein in the context of two consecutive transactions, it is understood that many more glyphs and transactions can be used in other embodiments of the invention.

The authentication images in a) and 4(b) comprise arrays of two dimensional objects such as dots. Other two-dimensional image elements include streets or landmarks in maps, walls of mazes, etc. When successive authentication images are presented to the user in successive transactions, the image elements in those authentication images change positions or change in some other way. For example, different authentication images may be rotated with respect to each other, may have different sizes with respect to each other, may be shifted relative to each other, etc.

Maps can be particularly useful as authentication images. For example, an authentication image may include a map that the user is intimately familiar with. For example, the map may include the user's home location and the user's work location. The user may know his preferred route from home to work, and back to home. This path could form the user's authentication glyph. The orientation of the map (e.g., right-side up, and then up-side down) could change with each transaction, so that the configuration of the entered glyph changes for each transaction. Another example of a useful map may be a map of a recreational site (e.g., an amusement park) that the user frequents. For example, the map may be a map of Disneyland. The user's authentication glyph may be the preferred ride sequence that the user takes through Disneyland.

Embodiments of the invention have a number of advantages. First, because the image elements in the authentication images that are used to authenticate a user during a transaction change, the glyphs that are entered into devices used by a user are constantly changing. Unlike an ordinary signature, this makes it much more difficult for an unauthorized person to replicate, and therefore use in an unauthorized manner. For example, even if an unauthorized person intercepts an electronic signature from a user's phone or computer, the data representing the signature would be of little value. Unlike a static signature, it could not be used again in a subsequent transaction, since the actual glyphs received by the device have different configurations for different authentication images. Second, if a remote server computer changes the authentication images in a predetermined or random way, the unauthorized person would not be able to reproduce the correct glyph, even if the consumer's portable consumer device is stolen. Third, embodiments of the invention have advantages over biometric authentication mechanisms. For example, complex electronics are not required in embodiments of the invention, but are required in biometric authentication mechanisms. Further, with biometrics, once biometric data are stolen, the biometric data can be reused. In contrast, in embodiments of the invention, if a person steals a glyph during a transaction (e.g., by looking at the user while the user creates the glyph), the glyph will not be used to authenticate the user during the next transaction so the stolen glyph is useless.

Specific embodiments of the invention further details regarding embodiments of the invention are provided below. shows a system which can be used in embodiments of the invention. Note that embodiments of the invention may use all or only some of the components shown in .

Additional embodiments of the invention are discussed in detail below.

I. Systems

shows a system 20 that can be used in an embodiment of the invention.

The system 20 includes a first merchant (“A”) 22 and an acquirer 24 associated with the first merchant 22. The first merchant 22 may be a traditional merchant that the consumer 30 can physically go to conduct a transaction. The first merchant 22 may operate an access device 34, which may be in communication with a payment processing network 26. The payment processing network 26 may be in communication with an issuer 28. The issuer 28 can either issue the portable consumer device 32 or an electronic token (such as an electronic payment card) that is stored in the portable consumer device 32 to the consumer 30.

The system 20 can also include a second merchant (“B”) 44, which may communicate with the consumer 30 via the Internet 38. Second merchant B 44 may have a server computer 44(a), which may operate a host site 44(a)-1. The consumer 30 can use a consumer device 40 to conduct transactions with the second merchant 44 by contacting the host site 44(a)-1 via the Internet 38. The consumer device 40 may comprise an authentication module 40′.

Each of the components in is described in further detail below.

The consumer 30 may be an individual, or an organization such as a business that is capable of purchasing goods or services.

The portable consumer device 32 may be in any suitable form. For example, suitable portable consumer devices can be hand-held and compact so that they can fit into a consumer's wallet and/or pocket (e.g., pocket-sized). Examples of portable consumer devices include cellular phones, personal digital assistants (PDAs), pagers, etc. The portable consumer devices can also be debit, credit, or stored-value devices.

The portable consumer device 32 may comprise an authentication module 32′. It may comprise hardware and/or software for facilitating the authentication process. For example, it may comprise code for storing previously registered authentication glyphs, code for sending a received authentication glyph to a remote server computer, etc.

The consumer device 40 may be a portable consumer device 32. Alternatively, the consumer device 40 can be non-portable in nature. For example, the consumer device 40 could be a kiosk or stand alone computer terminal that is not ordinarily moved. It may also comprise an authentication module 40′, which may have similar functions and/or characteristics as the authentication module 30′.

The consumer device 40 or the portable consumer device 32 may comprise a computer readable medium and a display coupled to a processor. The computer readable medium may comprise (i) code for displaying a first authentication image comprising a plurality of image elements comprising a set of image elements, wherein the image elements in the set of image elements are located at a first set of positions on a display screen, (ii) code for receiving a first glyph having a first configuration corresponding to the set of image elements from a user while the first authentication image is displayed, (iii) code for displaying a second authentication image comprising the plurality of image elements comprising the set of image elements, wherein the image elements in the set of image elements are located at a second set of positions on the display screen, wherein the second set of positions is different than the first set of positions, and (iv) code for receiving a second glyph having a second configuration corresponding to the set of image elements from a user while the second authentication image is displayed. It may also have code for providing a first indication that the first glyph is or is not considered authentic, and code for providing a second indication that the second glyph is or is not considered authentic.

In other embodiments of the invention, the consumer device 40 or the portable consumer device 32 may comprise a computer readable medium and a display coupled to a processor. The computer readable medium may comprise code for displaying a first image element, receiving a glyph, wherein the glyph is created by moving the first image element from a first position relative to a second image element to a second position relative to the second image element, and code for sending an authentication message comprising data representing the glyph to a service provider.

The payment processing system 26 may include data processing subsystems, networks, and operations used to support and deliver authorization services, exception file services, and clearing and settlement services. An exemplary payment processing system may include VisaNet™. Payment processing systems such as VisaNet™ are able to process credit card transactions, debit card transactions, and other types of commercial transactions. VisaNet™, in particular, includes a VIP system (Visa Integrated Payments system) which processes authorization requests and a Base II system which performs clearing and settlement services.

The payment processing system 26 may include a server computer 26(a) operatively coupled to a database 26(b). A server computer is typically a powerful computer or cluster of computers. For example, the server computer can be a large mainframe, a minicomputer cluster, or a group of servers functioning as a unit. In one example, the server computer may be a database server coupled to a Web server. The payment processing network 26 may use any suitable wired or wireless network, including the Internet.

The server computer 26 may operate a host site 26(a)-1. The host site 26(a)-1 may allow the consumer 30 to select or upload authentication images, and may allow the consumer 30 to manage an account.

The server computer 26(a) may also comprise an authentication module like the authentication module 32′ in the portable consumer device 32.

As noted above, the first merchant 22 may also have, or may receive communications from, an access device 34 that can interact with the portable consumer device 32. The access devices according to embodiments of the invention can be in any suitable form. Examples of access devices include point of sale (POS) devices, cellular phones, PDAs, personal computers (PCs), tablet PCs, handheld specialized readers, set-top boxes, electronic cash registers (ECRs), automated teller machines (ATMs), virtual cash registers (VCRs), kiosks, security systems, access systems, and the like.

If the access device 34 is a point of sale terminal, any suitable point of sale terminal may be used including readers such as portable consumer device readers. The card readers may include any suitable contact or contactless mode of operation. For example, exemplary card readers can include RF (radio frequency) antennas, magnetic stripe readers, etc. to interact with the portable consumer devices 32.

In a typical purchase transaction in a portable consumer device-present type of transaction, the consumer 30 purchases a good or service at merchant A 22 using the wireless portable consumer device 32 such as a mobile phone. The consumer's wireless portable consumer device 32 can interact with an access device 34 such as a POS (point of sale) terminal at merchant A 22. For example, the consumer 30 may take a wireless phone and may pass it near a contactless reader in a POS terminal.

An authorization request message is then forwarded to the acquirer 24. After receiving the authorization request message, the authorization request message is then sent to the payment processing system 26. The payment processing system 26 then forwards the authorization request message to the issuer 28 of the portable consumer device 32.

After the issuer 28 receives the authorization request message, the issuer 28 sends an authorization response message back to the payment processing system 26 to indicate whether or not the current transaction is authorized (or not authorized). The transaction processing system 26 then forwards the authorization response message back to the acquirer 24. The acquirer 24 then sends the response message back to merchant A 22.

After the merchant 22 receives the authorization response message, the access device 34 at the merchant 22 may then provide the authorization response message for the consumer 30. The response message may be displayed by the POS terminal, or may be printed out on a receipt.

In an Internet-based type of transaction, the consumer 30 may log onto the merchant's host site 44(a)-1, and may purchase items using the consumer device 44(a), which may be a personal computer with a standard Internet browser and operating system such as a Windows™ based operated system. The server computer 44(a) operated by the merchant 44 may send the authorization request message to the issuer 28 via the payment processing network 26. As in the portable consumer device-present type of transaction, the issuer 28 approves or declines the transaction, and an authorization response message can be sent to the merchant 44, and eventually to the consumer 30 via the consumer device 40.

The authentication processes described herein can be used in both portable consumer device-present types of transactions, as well as Internet based purchasing methods. Glyph authentication processes can be performed using a portable consumer device, consumer device, and access device.

At the end of the day, in both the portable consumer device-present and Internet type of transactions, a normal clearing and settlement process can be conducted by the payment processing system 26. A clearing process is a process of exchanging financial details between an acquirer and an issuer to facilitate posting to a consumer's account and reconciliation of the consumer's settlement position. Clearing and settlement can occur simultaneously.

II. Registration Methods

In some embodiments of the invention, a consumer 30 may register an authentication glyph with a service provider such as an organization that runs a payment processing network 26 or an issuer 28. For example, the consumer 30 may first use the consumer device 40 to contact the host site 26(a)-1 on the server computer 26(a) in the payment processing network 26 (step ). In other embodiments, the consumer 30 can use the portable consumer device 32 to contact the payment processing network directly (e.g., via communication channel 58).

After contacting the host site 26(a)-1, the consumer 30 can select one or more authentication images. There are a number of ways to select authentication images. For example, when the consumer 30 is logged onto the host site 26(a)-1, the consumer 30 can select an authentication image from a library of authentication images on the host site 26(a)-1. Alternatively, the consumer 30 can upload his own private collection of images to the host site 26(a)-1. For example, the consumer 30 may have a picture, pictures, or video of his favorite mountain at his favorite ski resort and this can be uploaded to the host site 26(a)-1 and may be used as the consumer's authentication image. Such authentication images may be stored in the database 26(b).

If the authentication image is to have a three-dimensional object such as a mountain in it, then the consumer 30 may upload at least two images of the object from different perspectives to the host site 26(a)-1. The at least two images may include first and second authentication images. Alternatively, commercially available digital image rendering software can be used to render any missing parts of a three dimensional object using pictures of various objects taken from different perspectives.

The server computer 26(a) may then send a request message to the user's consumer device 40. The request message may ask that the user draw a glyph corresponding to the selected authentication image. Once the user draws the glyph on the consumer device 40, the glyph may be stored in the database 26(b) by the server computer 26(a). The glyph configuration may have a shape corresponding to the set of image elements in the plurality of image elements. This way, the payment processing network 26 can use the stored authentication image and the corresponding glyph to verify that any future data representing the glyph that is received at the server computer 26(b) are authentic. At this point, the glyph is registered (step ) and this may be characterized as an “authentication glyph.” Each time the set of images objects is presented to the user in a different authentication image, then can be rearranged and the server computer 26(a) can verify the authenticity of a received glyph if it corresponds to the particular set of image elements. The glyph and the authentication image may alternatively or additionally stored in an authentication module 32′ in the portable consumer device 32 or in an authentication module 40′ in the consumer device 40. If the authentication glyph is stored locally in the portable consumer device 32 or the consumer device 40, the portable consumer device 32 or the consumer device 40 can verify that the received glyphs correspond to the authentication glyph.

III. Authentication Methods

Authentication methods can be described with reference to , 3, and 5(a) and 5(b).

Referring to , a consumer 30 may first initiate a transaction using the portable consumer device 32 (at step ). The consumer 30 may be shopping for goods at the merchant A 22 and may place the portable consumer device 32 close to or in contact with the access device 34 during the transaction.

Before or after the portable consumer device 32 is placed close to or in contact with the access device 34, the display screen on the consumer's portable consumer device 32 may display a first authentication image (step ).

The consumer 30 may then enter a first glyph into the portable consumer device 32 and the portable consumer device 32 may then receive the first glyph (step ). The consumer 30 may use a stylus or a finger to draw the first glyph on the display screen of the portable consumer device 32.

After receiving the first glyph, the portable consumer device 32 may then send an authentication request message including data representing the glyph to the server computer 26(a). This can be done by communicating directly with the payment processing network 26 (as shown by line 58) using a mobile telephone carrier network or the like. Alternatively, this can be done by sending the authentication request message to the access device 34, which then passes it to the payment processing network 26 via the acquirer 28.

The server computer 26(a) then determines if the received data representing the glyph is authentic by comparing the data to data representing the authentic glyph that is stored in the database 26(b). If the glyphs match or otherwise correspond to each other, then the server computer 26(a) sends an authentication response message back to the portable consumer device 32. This can be done directly through a direct communication channel 58 between the portable consumer device and the payment processing network 26, or through the acquirer 24, merchant 22, and access device 34. If the glyph is determined to be authentic, then the authentication request message may be indicate this and the consumer 30 may proceed with the purchase transaction as described above. If it is not authentic, then the organization that operates the payment processing network 26 can send another authentication request to the consumer 30, or may not allow the consumer 30 to proceed with the transaction.

In other embodiments, an authentication module 32′ in the portable consumer device may perform the authentication functions described above.

At some point in time, the consumer 30 could then initiate a second transaction in the same manner with the portable consumer device 32 (step ). In yet other embodiments, the issuer 28 can perform the functions that the payment processing network 26 are performing.

Before the consumer is allowed to perform the transaction, the portable consumer device 32 may display the second authentication image (step ). The second authentication image may differ from the first authentication image in any suitable way. For example, the image elements in the first and second authentication images can be rearranged, rotated, etc.

After the second authentication image is displayed, the portable consumer device 32 then receives the second authentication glyph from the consumer 30 (step ). As noted above, the consumer 30 may use a stylus or a finger to draw the second glyph on the display screen.

The portable consumer device 32 then sends the second authentication glyph to the server computer 26(a) (step ).

The server computer 26(a) then determines if the received data representing the second glyph is authentic. If it is, then the server computer 26(a) then sends an authentication request message back to the portable consumer device 32, and the portable consumer device 32 receives this message (step ). If the glyph is determined to be authentic, then the authentication request message may be indicate this and the consumer 30 may proceed with the purchase transaction as described above. If it is not authentic, then the organization that operates the payment processing network 26 can send another authentication request to the consumer 30, or may not allow the consumer 30 to proceed with the transaction.

In some embodiments, a separate authentication request message and authentication response message may not be respectively sent and received. In some embodiments, an authentication request and response may be respectively included in a traditional authorization request message and a traditional authentication response message.

The first and second authentication images in a) and 4(b) include images of two-dimensional objects. In other embodiments, the authentication images can include images of three-dimensional objects. This is illustrated in a) and 5(b). Compared to glyphs drawn relative to two-dimensional image elements, glyphs drawn on three-dimensional image elements are much harder for an unauthorized person to break, since an additional layer of complexity is provide by the three-dimensional nature of the object depicted.

The first authentication image in a) shows a ski resort. This authentication image may be displayed on the display screen of the user's portable consumer device when the user conducts a first transaction. The ski resort includes a number of towers , , , , , . Ski lift cables , , , and are strung between pairs of adjacent towers , , , , , . Other objects including rocks , , and ski lodges , are also shown. A number of ski paths , , , , are also shown in a). The various objects (e.g., the slope of the mountain, the rocks, etc.) in a) can be three-dimensional image elements.

When conducting a first transaction, a user may draw a first glyph relative to the objects in the authentication image shown in a). The first glyph may represent a preferred ski path typically taken by the user when the user visits the ski resort. For example, the user may typically take the ski lift from tower , to tower , to tower , and then down path to ski lodge . The image elements , ,