METHODS AND APPARATUS FOR CARD TRANSACTIONS

• US 20150287031A1
• Filed: 11/19/2013
• Published: 10/08/2015
• Est. Priority Date: 11/19/2012
• Status: Active Grant

• Current Assignee: Mastercard International Incorporated (MasterCard Incorporated)
• Original Assignee: Mastercard International Incorporated (MasterCard Incorporated)
• Inventors: Radu, Cristian, Ates, Fikret, Pochic, Sebastien, Ekselius, Erik Lukas, Lourenco, Fernando
• Granted Patent: US 10,515,362 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06K 19/07701 the record carrier comprising an interface suitable for human interaction
• CPC Class Codes: G06K 19/07703 the interface being visual
• CPC Class Codes: G06K 19/07709 the interface being a keyboard
• CPC Class Codes: G06K 7/10009 sensing by radiation using wavelengths larger than 0.1 mm, e.g. radio-waves or microwaves
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/204 comprising interface for record bearing medium or carrier for electronic funds transfer or payment credit
• CPC Class Codes: G06Q 20/3278 RFID or NFC payments by means of M-devices
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G07F 7/0846 On-card display means
• CPC Class Codes: G07F 7/0853 On-card keyboard means
• CPC Class Codes: G07F 7/088 the card reader being part of the point of sale [POS] terminal or electronic cash register [ECR] itself
• CPC Class Codes: G07F 7/0886 the card reader being portable for interacting with a POS or ECR in realizing a payment transaction

Abstract

A secure payment system comprises a merchant POS client and a remote POS server. The merchant POS client comprises a reading device for reading a customer user token and for accepting transaction details and customer verification data, and also a computing device with access to a communications network and in communication with the reading device. The merchant POS client also comprises a merchant token associated with the remote POS server. The remote POS server is in communication with the merchant POS client through the communications network, and one or more elements of the merchant POS client business logic are assured by the remote POS server and not the merchant POS client. A merchant token for use in such a merchant POS client is described, as is a suitable reader device, and a method of conducting a transaction using such a payment system.

Claims

1. A secure payment system, comprising a merchant POS client and a remote POS server,

wherein the merchant POS client comprises a reading device for reading a customer user token and for accepting transaction details and customer verification data and a computing device with access to a communications network and in communication with the reading device, and wherein the merchant POS client further comprises a merchant token associated with the remote POS server, and

wherein the remote POS server is in communication with the merchant POS client through the communications network, whereby one or more elements of the merchant POS client business logic are assured by the remote POS server and not the merchant POS client.

2. A secure payment system as claimed in claim 1, wherein the customer user token is a payment card and wherein the reading device comprises a card reader.

3. A secure payment system as claimed in claim 2, wherein the card reader comprises a chip card reader adapted to read an EMV chip.

4. A secure payment system as claimed in any preceding claim, wherein the one or more elements of the merchant POS client assured by the remote POS server comprise one or more of terminal configuration data, payment provider brand parameterization data and code of a payment application.

5. A secure payment system as claimed in claim 4, wherein the remote POS server comprises payment logic for transactions received at the merchant POS client.

6. A secure payment system as claimed in any preceding claim, further comprising a secure channel from the merchant POS client to the remote POS server.

7. A secure payment system as claimed in claim 6, wherein the merchant token associated with the remote POS server is used to establish the secure channel.

8. A secure payment system as claimed in claim 7, wherein the merchant token comprises a tamper responsive card.

9. A secure payment system as claimed in claim 8, wherein the merchant token is a merchant card, and the POS client further comprises a PIN encryption device.

10. A secure payment system as claimed in claim 8, wherein the merchant token is a merchant display card comprises a secure keyboard and a display.

11. A secure payment system as claimed in claim 10, wherein the merchant display card is adapted to receive and encrypt a PIN through the secure keyboard.

12. A secure payment system as claimed in any of claims 7 to 11, wherein the reading device is adapted to retain for reading both the merchant token and a customer payment card at the same time.

13. A secure payment system as claimed in any preceding claim, wherein the computing device is a personal computer.

14. A secure payment system as claimed in any of claims 1 to 12, wherein the computing device is a smartphone.

15. A secure payment system as claimed in claim 14, wherein the smartphone is NFC enabled and is adapted to receive contactless payments.

16. A server programmed to operate as a remote POS server in the secure payment system of any of claims 1 to 15.

17. A combination of a computing device and a reading device programmed to operate as a merchant POS client in the secure payment system of any of claims 1 to 15.

18. A merchant token comprising a display, a secure data entry means, a processor, and storage means for reading by a reading device, wherein

the processor is adapted to receive merchant data through the secure data entry means to activate the merchant token for transactions, and

the processor is adapted to receive customer data through the secure data entry means and to encrypt the received customer data for storage in the storage means for reading by the reading device.

19. A merchant token as claimed in claim 18, wherein the secure data entry means is a secure keypad, and wherein the merchant token is adapted for the received customer data to be a personal information number.

20. A merchant token as claimed in claim 19, wherein the merchant token is adapted to receive a transaction amount and to receive a customer personal information number for association with that transaction amount.

21. A merchant token as claimed in any of claims 18 to 20, wherein the merchant token is adapted to provide symmetric key encryption.

22. A merchant token as claimed in any of claims 18 to 21, wherein the merchant token is adapted to establish a secure channel to a remote server with which the merchant token is associated.

23. A merchant token as claimed in any of claims 18 to 22, wherein the merchant token is adapted to initialize a merchant POS client.

24. A merchant token as claimed in any of claims 18 to 23, wherein the merchant token is adapted to be responsive to tampering such that the appearance or the capabilities of the merchant token will be changed by tampering to prevent subversion.

25. A merchant token as claimed in any of claims 18 to 24, wherein the merchant token has a credit card form factor.

26. A combination of a merchant token as claimed in claim 25 and a credit card reader, wherein the credit card reader is adapted in use not to obscure the secure data entry means when the merchant token is inserted into a card reading slot of the credit card reader.

27. A credit card reader comprising:

a slot for reading a chip of a transaction card, and

a second slot for reading a chip of a merchant card.

28. A credit card reader as claimed in claim 27 and adapted for use with a merchant card having a secure data entry means, wherein the second slot is adapted so as not to obscure in use the secure data entry means of a merchant card when the merchant card is inserted into the second slot.

29. A method of conducting a transaction at a merchant POS with a customer having a customer token, the merchant POS comprising a reading device for reading user tokens and for accepting transaction details and customer verification data through a secure data entry means, a merchant token and a computing device with access to a communications network and in communication with the reading device, the method comprising:

entering transaction details at the merchant token through the secure data entry means;

the customer validating the transaction details at the merchant token with customer validation data through the secure data entry means;

the reading device reading the transaction details and the customer validation data from the merchant token and the merchant POS providing them to a remote POS server over a communication channel;

using the merchant POS with the user token to produce transaction payment data, the reading device forwarding the transaction payment data to the remote POS server over the communication channel for transaction authorisation to be obtained.

30. A method of conducting a transaction as claimed in claim 29 wherein the customer verification data comprises a customer personal information number.

31. A method of conducting a transaction as claimed in claim 29 or claim 30, wherein the merchant POS encrypts the customer verification data.

32. A method of conducting a transaction as claimed in any of claims 29 to 31, wherein communication over the communication channel is encrypted.