Secure method and device of financial transaction

• US 20100174653A1
• Filed: 01/07/2009
• Published: 07/08/2010
• Est. Priority Date: 01/07/2009
• Status: Abandoned Application

• Current Assignee: Onbest Technology Holding Limited
• Original Assignee: Onbest Technology Holding Limited
• Inventors: Dong, Yi, Tian, WeiCheng
• Application Number:
  US12/319,551
• Publication Number:
  US 20100174653A1
• Time in Patent Office: Days
• US Class Current: 705/71
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/3823 combining multiple encryption tools for a transaction
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: G07F 7/1016 Devices or methods for securing the PIN and other transaction-data, e.g. by encryption arrangements for secret communication, see H04L9/00
• CPC Class Codes: G07F 7/1091 Use of an encrypted form of the PIN

Abstract

A secure method and device thereof is provided for financial transaction without being access of any personal and confidential transaction information by any unwanted party, which includes the following steps. Receive transaction information and personal information of a user in a secure financial transaction device. Encrypt the transaction information, the personal information and a secure PIN of the user in the device and transfer the encrypted transaction information, personal information and the secure PIN to a designate financial entity through the Internet. Verify a payment amount to a designated financial account with the financial entity. Receive a confirmation in the device for the transaction of the payment amount to the designated financial account, after the payment amount is transferred to the designated financial account from the financial entity, by the financial entity through the Internet.

Claims

1. A secure method of financial transaction, comprising the steps of:

(a) receiving transaction information and personal information of a user in a secure financial transaction device;

(b) encrypting the transaction information, the personal information and a PIN of the user in the device and transferring the encrypted transaction information, personal information and PIN to a designate financial entity through the Internet;

(c) verifying a payment amount to a designated financial account with the financial entity; and

(d) receiving a confirmation in the device for the transaction of the payment amount to the designated financial account, after the payment amount is transferred to the designated financial account from the financial entity, by the financial entity through the Internet.

2. The method, as recited in claim 1, further comprising a step of securely operating sensitive information including the transaction information, the personal information and the PIN.

3. The method, as recited in claim 2, wherein the securely operating step further comprises the steps of:

(i) storing secrete data in a secure memory wherein application program has not access, wherein the secrete data is always encrypted before being outputted.

(ii) providing a supervisor mode wherein a firmware is processed, wherein all system resources are accessible;

(iii) providing a user mode wherein user'"'"'s application program is processed, wherein the application program has no access to system resources; and

(iv) providing a unified interface for application program development.

4. The method, as recited in claim 1, further comprising a key encryption method for completing a confirmation process.

5. The method, as recited in claim 4, wherein the key encryption method comprises the steps of:

partitioning a private key into a plurality of key components;

converting the key components;

after the key components are converted, exporting the key components into a plurality of key holders respectively for enhancing a security level of the private key; and

synthesizing back the private key by uniting the key components in the key holders in order for completing the confirmation process so as to ensure the confirmation process being verified by all of the key holders.

6. The method, as recited in claim 1, further comprising a security step of generating a PIN keypad randomly for generating PIN.

7. The method, as recited in claim 6, wherein the security step further comprises the steps of:

initially displaying a plurality of input characters at a plurality of touch-sensitive keys at the key input area of a touch screen panel respectively, wherein when one of the touch-sensitive keys is contacted, a control module identifies the corresponding input character being selected as an input data;

periodically and randomly re-arranging the input characters at different touch-sensitive keys respectively through a security key inputting system which is operatively linked to the control module; and

re-locating the input characters at different touch-sensitive keys respectively, wherein the input characters are alternately displayed at the touch-sensitive keys for preventing the input characters from being read by memorization of fixed location.

8. The method, as recited in claim 1, further comprising a step of blocking data information saved in the device from being tamper.

9. The method, as recited in claim 8, wherein the blocking step further comprises the steps of:

enclosing a core circuit module of the electronic device within a protection element to form a protection circuit surrounding the core circuit module;

operatively linking a detective circuit between the protection element and the core circuit module; and

activating the detective circuit in case of a hack of the electronic device, such that when the electronic device is broken to access the core circuit module through the protection element to physically interfere with the protection circuit, the detective circuit is activated to block data information saved in the core circuit module from being access.