Online Commercial Transaction System and Method of Operation Thereof

• US 20080301057A1
• Filed: 09/13/2005
• Published: 12/04/2008
• Est. Priority Date: 09/14/2004
• Status: Active Grant

• Current Assignee: Cork Group Trading Ltd.
• Original Assignee: Waterleaf Limited
• Inventors: Oren, Yosi
• Granted Patent: US 8,417,642 B2
• Time in Patent Office: Days
• US Class Current: 705/71
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: G06Q 30/0601 Electronic shopping [e-shopping]
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0471 applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity

Abstract

A system for conducting commercial transactions comprises an application server that hosts a software application that can be accessed by users to conduct commercial transactions thereon, an application user database of authorised users capable of accessing the application server, each authorised user in the application user database being uniquely identifiable by means of corresponding login name and password, and a proxy server communicable with the application server and accessible by a plurality of registered users from respective mobile phones The proxy server provides each one of the plurality of registered users with access to the application server from that user'"'"'s respective mobile phone. A proxy database is associated with the proxy server, the proxy database containing details of authorised users in the application user database who are also registered to access the application server through the proxy server from their respective mobile phones. Each registered user in the proxy database is uniquely identifiable by means of a corresponding user identification code, the proxy database also providing, for each registered user, a mapping of that user'"'"'s user identification code and the user'"'"'s corresponding user information contained in the application user database. The proxy database stores each registered user'"'"'s corresponding user information in encrypted format, and the system includes a encryption engine capable of encrypting any data passed between the proxy server and the mobile phone of each registered user. The proxy database also stores an active encryption key for each registered user, the active encryption key being used by the encryption engine to encrypt and decrypt data passed between the proxy server and the user'"'"'s mobile access terminal. The encryption engine is dynamic, using a different encryption key during each session in which the user accesses the application server from his respective mobile phone, the encryption engine generating, during each session, a further encryption key for the user and transferring the further encryption key to the user'"'"'s mobile phone for storage therein.

Claims

1. A system for conducting commercial transactions, comprising:

an application server operable to host a software application for performing commercial transactions;

an application user database of authorised users capable of accessing the application server to conduct commercial transactions thereon, each authorised user in the application user database being uniquely identifiable by means of corresponding user information;

a proxy server communicable with the application server and accessible by a plurality of registered users from respective mobile access terminals, the proxy server being operable to provide each one of the plurality of registered users with access to the application server from that user'"'"'s respective mobile access terminal; and

a proxy database of authorised users in the application user database who are also registered to access the application server through the proxy server from their respective mobile access terminals, each registered user in the proxy database being uniquely identifiable by means of a corresponding user identification code, the proxy database providing, for each registered user, a mapping of that user'"'"'s user identification code and the user'"'"'s corresponding user information contained in the application user database.

2. A system as claimed in claim 1 in which the proxy database stores each registered user'"'"'s corresponding user information in encrypted format.

3. A system as claimed in claim 2 that includes an encryption engine capable of encrypting any data passed between the proxy server and the mobile access terminal of each registered user.

4. A system as claimed in claim 3 in which the proxy database also stores an active encryption key for each registered user, the active encryption key being used by the encryption engine to encrypt and decrypt data passed between the proxy server and the user'"'"'s mobile access terminal.

5. A system as claimed in claim 4 in which the encryption engine is dynamic, using a different encryption key during each session in which the user accesses the application server from his respective mobile access terminal.

6. A system as claimed in claim 5 in which the encryption engine generates, during each session, a further encryption key for the user and transfers the further encryption key to the user'"'"'s mobile access terminal for storage therein.

7. A system as claimed claim 6 in which the encryption engine automatically causes the stored further encryption key to become the active encryption key in a next session in which the user accesses the application server from the mobile access terminal.

8. A system as claimed in claim 1 in which the mobile access terminal is a mobile telephone having a corresponding telephone number.

9. A system as claimed in claim 8 in which the user information is a login name and password.

10. A system as claimed in claim 9 in which the proxy server serves a mobile registration form accessible by the user to register for access to the application server from the user'"'"'s respective mobile telephone.

11. A system as claimed in claim 10 in which the mobile registration form is served as either one or both an HTTP page accessible by means of a full-function web browser, and a WAP page accessible by means of a reduced-function browser.

12. A system as claimed in claim 10 in which, for the mobile registration form requires the user to submit a login name and password, a telephone number of the mobile phone from which the user wishes to access the application server, and a selected login PIN.

13. A system as claimed in claim 11 in which the proxy server transfers the submitted login name and password to the application server for validation against the user'"'"'s login name and password already stored in the application user database.

14. A system as claimed in claim 13 in which the proxy server allocates a user identification code to the user and generates an encryption key when the application server has successfully validated the user'"'"'s name and password.

15. A system as claimed in claim 14 in which the proxy server combines the user identification code and the encryption key as a two-part validation code and transfers the validation code to the user'"'"'s mobile phone.

16. A system as claimed in claim 15 in which the proxy server authenticates the user as a function of re-entry of the transferred validation code by the user in the registration form.

17. A system as claimed in claim 16 in which the proxy server encrypts the user'"'"'s login name and password, following user authentication, using a function of the user'"'"'s selected login PIN code as an encryption key.

18. A system as claimed in claim 17 in which the proxy server stores the encrypted user name and password in the proxy database by user identification code.

19. A system as claimed in claim 18 in which the user initiates access to the application server by entering his login PIN on the mobile phone.

20. A system as claimed in claim 19 in which the mobile phone encrypts the login PIN using the active encryption key, prefixes the encrypted login PIN with the user identification code and transfers the prefixed, encrypted login PIN to the proxy server.

21. A system as claimed in claim 20 in which the proxy server retrieves the active encryption key from the proxy database as a function of the prefixed user identification code.

22. A system as claimed in claim 21 in which the proxy server decrypts the encrypted login PIN using the retrieved active encryption key.

23. A system as claimed in claim 22 in which the proxy server retrieves the user'"'"'s encrypted login name and password from the proxy database, decrypts the encrypted login name and password using a function of the user'"'"'s decrypted login PIN as an encryption key, and transfers the user'"'"'s decrypted login name and password to the application server to effect a login.

24. A system as claimed in claim 23 in which the mobile phone encrypts any application data with the active encryption key and prefixes the encrypted application data with the user identification code prior to transferring the encrypted application data to the proxy server.

25. A system as claimed in claim 24 in which the proxy server decrypts the encrypted application data using the active encryption key and transfers the decrypted application data to the application server for processing.

26. A system as claimed in claim 25 which enables a user to register at least one payment instrument to pay for purchases made on the application server.

27. A system as claimed in claim 26 in which the at least one payment instrument is a debit card or a credit card.

28. A system as claimed in claim 26 in which the user registers the at least one payment instrument by entering on the mobile phone data relating to the payment instrument, together with a purchase PIN and the user'"'"'s login name and password.

29. A system as claimed in claim 28 in which the proxy server transfers the entered payment instrument data to the application server.

30. A system as claimed in claim 29 in which the application server utilises the transferred payment instrument data to validate the payment instrument by means of a payment gateway.

31. A system as claimed in claim 30 in which the proxy server encrypts the validated payment instrument data using a function of the purchase PIN as an encryption key.

32. A system as claimed in claim 31 in which the proxy server stores the encrypted, validated payment instrument data in the proxy database.

33. A system as claimed in claim 32 which enables a user to utilise a previously registered payment instrument to pay for a purchase made on the application server.

34. A system as claimed in claim 33 in which the proxy server transmits to the mobile phone for display thereon encrypted data relating to all payment instruments previously registered by the user.

35. A system as claimed in claim 34 in which the mobile phone decrypts the received payment data and displays on the mobile phone the decrypted data relating to all the previously registered payment instruments as a menu.

36. A system as claimed in claim 35 in which the user selects from the menu a desired one of the previously registered payment instruments to be used for payment and enters a value of the purchase together with the user'"'"'s purchase PIN.

37. A system as claimed in claim 36 in which the mobile access terminal encrypts the entered data using the active encryption key and transfers the encrypted data to the proxy server.

38. A system as claimed in claim 37 in which the proxy server obtains the user'"'"'s active encryption key from the proxy database and decrypts the transferred data using the retrieved active encryption key.

39. A system as claimed in claim 38 in which the proxy server transfers the encrypted data to the application server to settle payment for the purchase transaction.

40. A method of operation of a system for conducting commercial transactions, comprising the steps of:

hosting, on an application server, a software application for performing commercial transactions;

compiling an application user database of authorised users capable of accessing the application server to conduct commercial transactions thereon and uniquely identifying each authorised user in the application user database by means of corresponding user information;

providing a proxy server communicable with the application server and accessible by a plurality of registered users from respective mobile access terminals, the proxy server being operable to provide each one of the plurality of registered users with access to the application server from that user'"'"'s respective mobile access terminal;

establishing a proxy database of authorised users in the application user database who are also registered to access the application server through the proxy server from their respective mobile access terminals, and uniquely identifying each registered user in the proxy database by means of a corresponding user identification code; and

determining, for each registered user in the proxy database, a mapping of that user'"'"'s user identification code and the user'"'"'s corresponding user information contained in the application user database.

41. A method as claimed in claim 40 which includes the further step of storing each registered user'"'"'s corresponding user information in the proxy database in encrypted format.

42. A method as claimed in claim 41 in which any data passed between the proxy server and the mobile access terminal of each registered user is encrypted.

43. A method as claimed in claim 42 in which an active encryption key for each registered user is also stored in the proxy database, the active encryption key being used to encrypt and decrypt data passed between the proxy server and the user'"'"'s mobile access terminal.

44. A method as claimed in claim 43 in which any data passed between the proxy server and the mobile access terminal of each registered user is dynamically encrypted by using a different encryption key during each session in which the user accesses the application server from his respective mobile access terminal.

45. A method as claimed in claim 44 that includes the step of generating, during each session, a further encryption key for the user and transferring the further encryption key to the user'"'"'s mobile access terminal for storage therein.

46. A method as claimed in claim 45 in which the stored further encryption key is automatically caused to become the active encryption key in a next session in which the user accesses the application server from the mobile access terminal.

47. A method as claimed in claim 46 that includes the step of using a mobile telephone as a mobile access terminal, the mobile telephone having a corresponding telephone number.

48. A method as claimed in claim 47 that includes the step of using a login name and password as the user information.

49. A method as claimed in claim 48 that includes the step of causing the proxy server to serve a mobile registration form accessible by the user to register for access to the application server from the user'"'"'s respective mobile telephone.

50. A method as claimed in claim 49 in which the registration form is served as either one or both an HTTP page accessible by means of a full-function web browser, and a WAP page accessible by means of a reduced-function browser.

51. A method as claimed in claim 49 in which the user is required to submit, in the mobile registration form, a login name and password, a telephone number of the mobile phone from which the user wishes to access the application server, and a selected login PIN.

52. A method as claimed in claim 51 in which the submitted login name and password are transferred from the proxy server to the application server for validation against the user'"'"'s login name and password already stored in the application user database.

53. A method as claimed in claim 52 in which a user identification code is allocated to the user and an encryption key is generated when the application server has successfully validated the user'"'"'s name and password.

54. A method as claimed in claim 53 in which the user identification code and the encryption key are combined as a two-part validation code and the validation code is transferred to the user'"'"'s mobile phone.

55. A method as claimed in claim 54 in which the user is authenticated as a function of re-entry of the transferred validation code by the user in the registration form.

56. A method as claimed in claim 55 in which the user'"'"'s login name and password are encrypted at the proxy server, following user authentication, using a function of the user'"'"'s selected login PIN code as an encryption key.

57. A method a claimed in claim 56 in which the encrypted user name and password are stored in the proxy database by user identification code.

58. A method as claimed in claim 57 that includes the step of initiating access to the application server by entering a login PIN on the mobile phone.

59. A method as claimed in claim 58 in which login PIN is encrypted on the mobile phone using the active encryption key, the encrypted login PIN is prefixed with the user identification code and the prefixed, encrypted login PIN is transferred to the proxy server.

60. A method as claimed in claim 59 in which the active encryption key is retrieved from the proxy database as a function of the prefixed user identification code.

61. A method as claimed in claim 60 in which the encrypted login PIN is decrypted at the proxy server using the retrieved active encryption key.

62. A method as claimed in claim 61 in which the user'"'"'s encrypted login name and password are retrieved from the proxy database, the encrypted login name and password are decrypted using a function of the user'"'"'s decrypted login PIN as an encryption key, and the user'"'"'s decrypted login name and password are transferred to the application server to effect a login.

63. A method as claimed in claim 62 in which any application data is encrypted at the mobile phone with the active encryption key and the encrypted application data is prefixed with the user identification code prior to transferring the encrypted application data to the proxy server.

64. A method as claimed in claim 63 in which the encrypted application data is decrypted at the proxy server using the active encryption key and the decrypted application data is transferred to the application server for processing.

65. A method as claimed in claim 64 that includes the step of enabling a user to register at least one payment instrument to pay for purchases made on the application server.

66. A method as claimed in claim 65 in which the at least one payment instrument is registered by entering on the mobile phone data relating to the payment instrument, together with a purchase PIN and the user'"'"'s login name and password.

67. A method as claimed in claim 66 in which the entered payment instrument data is transferred to the application server.

68. A method as claimed in claim 67 in which the transferred payment instrument data is utilised to validate the payment instrument by means of a payment gateway.

69. A method as claimed in claim 68 in which the validated payment instrument data I encrypted on the proxy server using a function of the purchase PIN as an encryption key.

70. A method as claimed in claim 69 in which the encrypted, validated payment instrument data is stored in the proxy database.

71. A method as claimed in claim 70 which includes the step of enabling a user to utilise a previously registered payment instrument to pay for a purchase made on the application server.

72. A method as claimed in claim 71 in which encrypted data relating to all payment instruments previously registered by the user is transferred from the proxy server to the mobile phone for display thereon.

73. A method as claimed in claim 72 in which the received payment data is decrypted at the mobile phone and the decrypted data relating to all the previously registered payment instruments is displayed thereon as a menu.

74. A method as claimed in claim 73 in which a desired one of the previously registered payment instruments to be used for payment is selected from the menu and a value of the purchase together with the user'"'"'s purchase PIN is entered.

75. A method as claimed in claim 74 in which the entered data is encrypted at the mobile access terminal using the active encryption key and the encrypted data is transferred to the proxy server.

76. A method as claimed in claim 75 in which the user'"'"'s active encryption key is obtained from the proxy database and the transferred data is decrypted using the retrieved active encryption key.

77. A method as claimed in claim 76 in which the encrypted data is transferred from the proxy server to the application server to settle payment for the purchase transaction.