SECURE ONLINE TRANSACTION PROCESSING

• US 20120197807A1
• Filed: 01/28/2011
• Published: 08/02/2012
• Est. Priority Date: 01/28/2011
• Status: Active Grant

• Current Assignee: The Active Network Incorporated (Cvent Incorporated)
• Original Assignee: The Active Network Incorporated (Cvent Incorporated)
• Inventors: Schlesser, Joshua, Johnson, Douglas
• Granted Patent: US 8,725,644 B2
• Time in Patent Office: Days
• US Class Current: 705/71
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

Various methods for securely processing an online transaction between a customer and a merchant are disclosed. In one method, an authentication credentials request that includes a transaction identifier is received from a merchant system. In response, an encryption key is transmitted to the merchant system. From a customer system, the personal account data associated with the customer is received, which is encrypted with the encryption key. A transaction processing request from the merchant system prompts the generating of a transaction processing response based upon its execution.

Claims

1. A method for securely processing an online transaction between a customer and a merchant, the method comprising:

receiving from a merchant system an authentication request including a transaction identifier associated with the online transaction;

transmitting an encryption key to the merchant system in response to the received authentication request, the encryption key corresponding to the transaction identifier;

receiving from a customer system the personal account data associated with the customer, the personal account data being encrypted with the encryption key;

receiving from the merchant system a transaction processing request including the transaction identifier; and

generating a transaction processing response to the merchant system based upon an execution of the transaction processing request.

2. The method of claim 1, further comprising:

storing a private version of the encryption key transmitted to the merchant system;

decrypting, in response to receiving the transaction processing request, the personal account data with the private version of the encryption key corresponding to the transaction identifier.

3. The method of claim 2, wherein the transaction processing request includes a transaction sum, a debit in an amount thereof being requested from a financial account identified by the personal account data.

4. The method of claim 2, wherein the transaction processing request includes a transaction authorization confirmation for a financial account identified by the personal account data.

5. The method of claim 2, wherein the transaction processing request includes a transaction abandonment indicator.

6. The method of claim 1, further comprising:

transmitting an identification token corresponding to the transaction identifier with the transmission of the encryption key to the merchant system; and

receiving the identification token from the customer system together with the received personal account data.

7. The method of claim 1, further comprising:

establishing a first secure data transfer link with the merchant system;

wherein the encryption key and the transaction processing response transmitted to the merchant system and the authentication request and the transaction processing request received from the merchant system are transferred over the first secure data transfer link.

8. The method of claim 1, further comprising:

initiating a session timer upon receiving the identification token and the personal account data from the customer system;

wherein a transaction processing response representative of a time-out being generated upon expiration of the session timer without receiving the transaction processing request.

9. The method of claim 1, wherein the encryption key is single use.

10. A method for securely processing an online transaction between a customer and a merchant, the method comprising:

receiving from a customer system a transaction submission request for the online transaction including at least one purchase item identifier with a purchase price associated therewith;

transmitting an authentication request to a payment processing system in response to the receipt of the transaction submission request, the authentication request including a transaction identifier associated with the specific received transaction submission request;

receiving an encryption key from the payment processing system;

transmitting a payment information form with the transaction identifier and the encryption key to the customer system;

receiving transaction data entered into the payment information form, the transaction data corresponding to the transaction identifier;

transmitting to the payment processing system a transaction processing request including the transaction identifier; and

generating a transaction processing response to the customer system based upon results for the transaction processing request to the payment processing system.

11. The method of claim 10, wherein the payment information form includes a script with executable instructions for initiating encryption of personal account data entered into the payment information page with the received encryption key.

12. The method of claim 10, wherein the transaction processing response is a success message, the results for the transaction processing request from the payment processing system indicating a success.

13. The method of claim 10, further comprising:

updating the merchant system upon a successful completion of the online transaction.

14. The method of claim 10, wherein the transaction processing response is a failure message, the results for the transaction processing request from the payment processing system indicating a failure.

15. A method for securely processing an online transaction between a customer and a merchant, the method comprising:

transmitting to a merchant system a transaction submission request for the online transaction including at least one purchase item identifier with a purchase price associated therewith;

receiving a payment information form including an encryption key corresponding to a transaction identifier for the online transaction;

receiving personal account data and transaction data entered into the payment information form;

encrypting the personal account data with the received encryption key;

transmitting the encrypted personal account data to a payment processing system;

transmitting the transaction data to the merchant system.

16. The method of claim 15, wherein the payment information form includes a script with executable instructions for encrypting the personal account data entered into the payment information form with the received encryption key.

17. The method of claim 15, wherein the encryption key is single use.

18. The method of claim 15, further comprising:

receiving an identification token corresponding to the transaction identifier with along with the receiving of the encryption key from the merchant system; and

transmitting the identification token from the customer system together with the transmitting of the personal account data.

19. An article of manufacture comprising a program storage medium readable by a data processing apparatus, the medium tangibly embodying one or more programs of instructions executable by the data processing apparatus to perform a method for securely processing an online financial transaction between a customer and a merchant, the method comprising:

receiving from a customer system a transaction submission request for the online transaction including at least one purchase item identifier with a purchase price associated therewith;

transmitting an authentication request to a payment processing system in response to the receipt of the transaction submission request, the authentication request including a transaction identifier associated with the specific received transaction submission request;

receiving an encryption key from the payment processing system;

transmitting a payment information form with the transaction identifier and the encryption key to the customer system;

receiving transaction data entered into the payment information form, the transaction data corresponding to the transaction identifier;

transmitting to the payment processing system a transaction processing request including the transaction identifier; and

generating a transaction processing response to the customer system based upon results for the transaction processing request to the payment processing system.

20. The article of manufacture of claim 19, wherein the payment information form includes a script with executable instructions for encrypting personal account data entered into the payment information form with the received encryption key.