Roaming for mobile e-commerce

• US 20040068446A1
• Filed: 11/20/2003
• Published: 04/08/2004
• Est. Priority Date: 02/08/2001
• Status: Active Grant

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Omurcali, Savas, Kennedy, Cathal, Do, Thanh Van
• Granted Patent: US 7,664,676 B2
• Time in Patent Office: Days
• US Class Current: 705/26
• CPC Class Codes: G06Q 20/322 Aspects of commerce using mobile devices [M-devices]
• CPC Class Codes: G06Q 20/3224 Transactions dependent on location of M-devices
• CPC Class Codes: G06Q 30/0641 Shopping interfaces
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/08 Access security

Abstract

A method is disclosed by which a user of a roaming mobile station can procure services and goods from a content provider at a visiting site. The content provider establishes contact with a mobile e-commerce server, the visited MeC server. The visited MeC server directs the request to the users home MeC server. The home MeC server performs the authentication of the user. In this way security relevant information is not revealed to the visited MeC server.

Claims

1. Method for performing e-Commerce via a mobile telephone network, enabling the user of a Mobile Station (MS) to procure services or goods from a local Content Provider (CP) at a visiting site,

characterized in

that a request from the MS to procure a service or goods is routed from the CP to a first Mobile e-Commerce (MeC) server, called the visited MeC server, handling the security and payment processes,

the visited MeC server identifies the home MeC server of the MS,

the visited MeC server directs the MS to its home MeC server,

the home MeC server security verifies the MS,

the result of the security verification and payment details are passed to the visited MeC server indicating if the transaction can continue,

the visited MeC server contacts a Financial Institution to get payment clearance,

if the result is positive the CP delivers the services/goods, and

the FI charges the user.

4. A method as claimed in claim 1 or 2,

characterized in that the security verification step includes:

to get a contract from the CP and deliver it to the home MeC server,

when the MS is directed to its home MeC server, said server responds with the contract,

the MS accepts the contract by returning the user'"'"'s PIN,

the home MeC server verifies the PIN and transmits the result of the verification to the visited MeC server.

6. A method as claimed in claim 1 or 2,

characterized in that the step of identifying the home MeC server includes that the visited MeC server consults a table of available MeC servers and subsequently issue a request (roamUserRequest) to each MeC server, which request includes the following fields:

subscriber identity request type, such as payment or other service whereupon each requested MeC server responds with a message (roamUserResponse) including the following fields;

subscriber identity

request type

accept or reject

additional information available for the

subscriber

and this procedure continues until one of the contacted MeC servers issue a positive response, or the list of available servers is exhausted.

7. A method as claimed in claim 6,

characterized in that the table of available MeC servers includes the fields:

name

access address

country, in which the server is located

country code

local prefix

and the visited MeC server performs a logical search in the table in order to narrow down the number of possible MeC servers.

8. A method as claimed in claim 6,

characterized in that the table of available MeC servers only comprises servers that have established a partnership with the visited MeC server.

9. A method as claimed in claim 6,

characterized in that said requests and responses are digitally signed by the MeC servers.

10. A method as claimed in claim 6,

characterized in that when the home MeC is identified, both servers authenticate.

11. Method as claimed in any of the preceding claims,

characterized in that client-server authentication is used in the communication between MS and home MeC server.

2. A method for performing e-Commerce via a mobile telephone network, enabling the user of a Mobile Station to obtain services from a local Content Provider at a visiting site,

characterized in

that a request from the MS to obtain a service is routed from the CP to a first Mobile e-Commerce (MeC) server, called the visited MeC server, handling the security process,

the visited MeC server identifies the home MeC server of the MS,

the visited MeC server directs the MS to its home MeC server,

the home MeC server security verifies the MS, and returns a security related product to the visited MeC server,

the home MeC server redirects the MS to the visited MeC to complete the transaction.

3. A method as claimed in claim 2,

characterized in that the security related product is an authentication result, a digital signature or a digital certificate.

5. A method as claimed in claim 2,

characterized in that the security verification step includes:

to get a contract from the CP and deliver it to the home MeC server,

when the MS is directed to its home MeC server, said server responds with the contract,

the MS accepts the contract by returning a first digital signature generated in the MS,

the home MeC server verifies the first digital signature, packages said first digital signature into a second standard digital signature, and transmits the second digital signature to the visited MeC server.

12. Roaming Capability Module for a Mobile e-Commerce Server,

characterized in that

the module is connected to a communication network on which it can contact remote MeC servers,

the module includes a table storing the identity and address of other MeC servers,

the module is adapted to, upon its parent MeC server being approached by an unknown customer, to consult the table and find the home MeC server of said customer, establish contact between the customer and his home MeC server.

13. A module as claimed in claim 12,

characterized in that the module is implemented as a plug-in to its MeC server.