METHOD OF PERFORMING A FINANCIAL TRANSACTION VIA UNSECURED PUBLIC TELECOMMUNICATION INFRASTRUCTURE AND AN APPARATUS FOR SAME

• US 20130226815A1
• Filed: 11/10/2010
• Published: 08/29/2013
• Est. Priority Date: 11/10/2010
• Status: Abandoned Application

• Current Assignee: Einnovations Holdings Pte. Ltd. (PLDT, Inc.)
• Original Assignee: Smart Hub Pte Limited
• Inventors: Ibasco, Alex D., Posadas, Patrick B., Co, Vincent C., Yu, William Emmanuel S.
• Application Number:
  US13/884,935
• Publication Number:
  US 20130226815A1
• Time in Patent Office: Days
• US Class Current: 705/71
• CPC Class Codes: G06Q 20/305 using wired telephone networks
• CPC Class Codes: G06Q 20/38215 Use of certificates or encrypted proofs of transaction rights
• CPC Class Codes: G06Q 20/3823 combining multiple encryption tools for a transaction
• CPC Class Codes: G06Q 20/425 using two different networks, one for transaction and one for security confirmation
• CPC Class Codes: G06Q 2220/00 Business processing using cryptography postage metering system using cryptography G06Q2250/05
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/033 of the user plane, e.g. user's traffic

Abstract

A method of performing a financial transaction via unsecured public telecommunication infrastructure comprising collecting data relating to a specified financial transaction type; building a transaction token including collected data and/or data derived from the collected data; encrypting the transaction token; creating a financial transaction protocol message incorporating the encrypted transaction token as dependent on a selected transport channel through which the message is to be conveyed; and conveying the financial transaction protocol message using the selected transport channel and by way of the unsecured public telecommunication infrastructure to a destination where the financial transaction protocol message will be further processed is disclosed.

Claims

1. A method of performing a financial transaction via unsecured public telecommunication infrastructure comprising the steps of:

collecting data relating to a specified financial transaction type;

building a transaction token including collected data and/or data derived from the collected data;

encrypting the transaction token;

creating a financial transaction protocol message incorporating the encrypted transaction token as dependent on a selected transport channel through which the message is to be conveyed; and

conveying the financial transaction protocol message using the selected transport channel and by way of the unsecured public telecommunication infrastructure to a destination where the financial transaction protocol message will be further processed.

2. A method according to claim 1, where the step of collecting data relating to a specified transaction type includes the sub-step of collecting authentication data which is thereafter encrypted and the transaction token built thereafter includes the encrypted authentication data.

3. A method according to claim 2, including the step of formatting the authentication data.

4. A method according to claim 1, where the step of collecting data relating to a specified financial transaction type includes obtaining data by at least one of the following ways:

from files stored on a device used to obtain the data;

from a data reader associated with, or integrated into, the device used to obtain the data;

from a customer by way of the user interface of the device used to obtain the data.

5. A method according to claim 1, where the step of collecting data relating to a specified financial transaction type includes obtaining a set of transaction rules applicable to the financial transaction type.

6. A method according to claim 1, further including the step of padding the transaction token as required for the selected transport channel.

7. A method according to claim 1, further including the step of calculating a session key, the session key then being used to encrypt the transaction token during the step of encrypting the transaction token.

8. A method according to claim 1, where the selected transport channel is GPRS.

9. A method according to claim 8, where the step of creating a transaction token includes the sub-steps of;

appending an end token record data value to the transaction token;

and padding the transaction token with null values until the altered transaction token is a multiple of 8 bytes.

10. A method according to claim 9, where the step of encrypting the transaction token further includes the sub-steps of calculating a message authentication code session key and encrypting the altered and padded transaction token using the message authentication code session key.

11. A method according to claim 10, where the step of creating a financial transaction protocol message includes the sub-step of creating a key serial number and where the financial transaction protocol message so created comprises the key serial number the transaction token and a message authentication code session key.

12. A method according to claim 1, where the selected transport channel is SMS.

13. A method according to claim 12, where the step of building the transaction token further includes the sub-steps of determining a padding counter and a message counter and appending the padding counter and the message counter to the message.

14. A method according to claim 13, where the step of encrypting the transaction token includes the sub-step of encrypting the transaction token using a ciphering key based on 3GPP TS 03.48 specifications.

15. A method according to claim 12, where the step of creating a financial transaction protocol message includes the sub-step of prefixing the encrypted transaction token with a SMS header.

22. A method according to claim 13, where the step of creating a financial transaction protocol message includes the sub-step of prefixing the encrypted transaction token with a SMS header.

16. A communications device for facilitating the performance of a financial transaction via unsecured public telecommunication infrastructure, the communications device operable to execute software stored thereon or on removable media In data and control communication with the device to;

build a transaction token Including collected data and/or data derived from the collected data;

encrypt the transaction token;

create a financial transaction protocol message incorporating the encrypted transaction token as dependent on a selected transport channel through which the message is to be conveyed; and

convey the financial transaction protocol message using the selected transport channel and by way of the unsecured public telecommunication infrastructure to a destination where the financial transaction protocol message will be further processed.

17. A communications device according to claim 16, where collected data includes authentication data and where the transaction token includes the authentication data in an encrypted form.

18. A communications device according to claim 16, further including a reader for reading information stored on external devices.

19. A communications device according to claim 16, the communications device operable to communicate by way of one or more of the following transport channels:

GPRS;

SMS.

20. A card comprising at least one integrated circuit, the card being of similar size and shape to an ordinary SIM card where, when the card is received within a device having a SIM card interface, executable software stored on a memory means of the at least one integrated circuit and when executed, is able to communicate with software stored on the device thereby allowing the device to provide both SIM and PSAM functionality to a user of the device.

21. A card according to claim 20, where the device is only able to be operated as a SIM or PSAM at any point in time and communication between the software stored on the memory means and software stored on the device is by way of a logical communications channel.