Method and apparatus for secure online transactions

• US 7,908,227 B2
• Filed: 01/12/2007
• Issued: 03/15/2011
• Est. Priority Date: 05/01/2002
• Status: Expired due to Term

• Current Assignee: Meta Platforms, Inc. (f/k/a Facebook, Inc.)
• Original Assignee: AOL Inc. (Apollo Global Management, Inc.)
• Inventors: Marshall, John, Rawat, Jai, Zissimopoulos, Vasileios “Bill”
• Primary Examiner(s): Worjloh; Jalatee
• Application Number:
  US11/623,033
• Publication Number:
  US 20070112688A1
• Time in Patent Office: 1,523 Days
• Field of Search: 705 64- 79, 713/150, 726/26
• US Class Current: 705/79
• CPC Class Codes: G06Q 20/027 involving a payment switch or gateway
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/0855 involving a third party
• CPC Class Codes: G06Q 20/105 involving programming of a portable memory device, e.g. IC cards, "electronic purses"
• CPC Class Codes: G06Q 20/24 Credit schemes, i.e. "pay after"
• CPC Class Codes: G06Q 20/342 Cards defining paid or billed services or quantities
• CPC Class Codes: G06Q 20/367 involving electronic purses or money safes
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: G07F 7/025 by means, e.g. cards, providing billing information at the time of purchase, e.g. identification of seller or purchaser, quantity of goods delivered or to be delivered
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: G07F 7/1025 Identification of user by a PIN code

Abstract

A method and apparatus for performing secure online transactions provides a user interface that is intuitive and easily to understand. The invention integrates an online wallet service with credit card issuers that provide online credit card authentication services. The method provides a keypad interface for PIN entry, or an interface that resembles an offline transaction receipt. The apparatus that stores personal information and credit card information uses a level-two authentication password to protect the user'"'"'s credit card information. The invention integrates with the credit card issuer when a personal identification number is required for the user to perform online transactions by the credit card issuer. The embodiments include integrations when the level-two authentication password is equivalent to the personal identification number and that when they or not equivalent.

Claims

1. A computer-implemented method for conducting an online transaction comprising the steps of:

receiving, by a server, a request from a user to checkout a selection of merchandize or services sold by a merchant;

generating, by said server, an extensible HTML page containing;

a transaction message comprising a core specification that describes online transactions and a frame specification, said frame specification embedding said core specification in a web service message, said transaction message represented in a payment markup language that describes payment transactions; and

a request for an authentication password from said user;

transmitting, by said server, said extensible HTML page to a browser;

rendering, by said browser, said extensible HTML page to a graphical interface that resembles a real-world receipt, said graphical interface displaying a sign button;

receiving said authentication password from said user;

authenticating said authentication password;

installing, on said browser and by said user, a certificate of said user by using browser methods, said certificate of said user issued by said user'"'"'s bank;

signing, by said browser, said core specification in said transaction message with said certificate of said user;

transmitting, by said browser, said signature to said server in response to said user clicking said sign button;

generating, by said server, a complete transaction message including said signature and sending it to a payment gateway; and

verifying, by said payment gateway, said transaction message along with said signature and in response to said verifying, said payment gateway honoring said transaction.

2. The method of claim 1 further comprising:

storing said signature on said server in case of future disputes.

3. The method of claim 1 further comprising:

containing said transaction message in said extensible HTML page, such that said core specification has its own namespace, and wherein said rendering step further comprises;

rendering said transaction message readily contained in said extensible HTML page and said core specification having its own namespace.

4. The method of claim 1, wherein said certificate of said user is issued by a credit card issuer of said user, said signing step further comprising signing said transaction message with said certificate issued by said credit card issuer of said user to generate a signature.

5. The method of claim 1 further comprising said transaction message containing a unique transaction ID and a date and time that said transaction takes place to provide non-repudiation.

6. A computer-implemented method for conducting an online transaction comprising the steps of:

receiving, by a server, a request from a user to checkout a selection of merchandize or services sold by a merchant;

generating, by said server, an extensible HTML page containing;

a transaction message comprising a core specification that describes online transactions and a frame specification, said frame specification embedding said core specification in a web service message, said transaction message represented in a payment markup language that describes payment transactions and said transaction message containing a unique transaction ID and a date and time that said transaction takes place to provide non-repudiation; and

a request for an authentication password from said user;

transmitting, by said server, said extensible HTML page to a browser;

rendering, by said browser, said extensible HTML page to a graphical interface that resembles a real-world receipt, said graphical interface displaying a sign button;

receiving said authentication password from said user;

authenticating said authentication password;

signing said core specification in said transaction message by a smart card that contains said certificate of said user, said signing with said certificate;

transmitting, by said browser, said signature to said server in response to said user clicking said sign button;

generating, by said server, a complete transaction message including said signature and sending it to a payment gateway;

verifying, by said payment gateway, said transaction message along with said signature and in response to said verifying, said payment gateway honoring said transaction; and

storing said signature on said server in case of future disputes,

wherein said certificate of said user is issued by a credit card issuer of said user, said signing step further comprising signing said core specification in said transaction message with said certificate issued by said credit card issuer of said user to generate a signature.

7. The method of claim 6 further comprising:

containing said transaction message in said extensible HTML page, such that said core specification has its own namespace, and wherein said rendering step further comprises;

rendering said transaction message readily contained in said extensible HTML page and said core specification having its own namespace.