Secure mobile-based financial transactions

• US 8,374,916 B2
• Filed: 10/27/2009
• Issued: 02/12/2013
• Est. Priority Date: 10/27/2009
• Status: Active Grant

• Current Assignee: AT&T Mobility II LLC (AT&T, Inc.)
• Original Assignee: AT&T Mobility II LLC (AT&T, Inc.)
• Inventors: White, Spencer Neil
• Primary Examiner(s): Gart, Matthew
• Assistant Examiner(s): Goyea, Olusegun
• Application Number:
  US12/606,243
• Publication Number:
  US 20110099079A1
• Time in Patent Office: 1,204 Days
• Field of Search: 455/410, 455/41.1, 455/550.1, 455/411, 455/414.2, 705/17, 705/30, 705/41, 705/27, 705/44, 705/13, 705/75, 705/18, 705/72, 705/67, 705/16, 705/76, 705/26.1, 705/35, 713/184, 713/182
• US Class Current: 705/17
• CPC Class Codes: G06Q 20/00 Payment architectures, schemes or protocols apparatus for performing or posting payment transactions G07F7/08, G07F19/00; electronic cash registers G07G1/12
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/102 Bill distribution or payments
• CPC Class Codes: G06Q 20/105 involving programming of a portable memory device, e.g. IC cards, "electronic purses"
• CPC Class Codes: G06Q 20/18 involving self-service terminals [SST], vending machines, kiosks or multimedia terminals
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/202 Interconnection or interaction of plural electronic cash registers [ECR] or to host computer, e.g. network details, transfer of information from host to ECR or from ECR to ECR
• CPC Class Codes: G06Q 20/204 comprising interface for record bearing medium or carrier for electronic funds transfer or payment credit
• CPC Class Codes: G06Q 20/3223 Realising banking transactions through M-devices
• CPC Class Codes: G06Q 20/3227 using secure elements embedded in M-devices
• CPC Class Codes: G06Q 20/3255 using mobile network messaging services for payment, e.g. SMS
• CPC Class Codes: G06Q 20/326 Payment applications installed on the mobile devices
• CPC Class Codes: G06Q 20/327 Short range or proximity payments by means of M-devices
• CPC Class Codes: G06Q 20/3278 RFID or NFC payments by means of M-devices
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/425 using two different networks, one for transaction and one for security confirmation

Abstract

Devices, systems and methods are disclosed which relate to securing payments from a mobile communications device. In exemplary embodiments, a mobile communications device communicates with a payment server via a point-of-sale device to conduct a transaction. The mobile communications device uses a client payment logic to send payment information to the point-of-sale device. The point-of-sale device uses a vendor payment logic to forward the payment information to the payment server. The payment server verifies the payment information and sends confirmation to the point-of-sale device.

Claims

1. A system for securely processing transactions comprising:

a mobile communications device having a client payment logic, the client payment logic generating a payment number through an addition, a subtraction, a multiplication, an appending, and a mixing of a random number generated by the client logic with a one-time digital key;

a point-of-sale device in communication with the mobile communications device, the point-of-sale device having a vendor payment logic;

the vendor payment logic sending a one-time digital key to the mobile communications device via wireless communication upon determining that the mobile communications device is not connected to a payment server through a cellular network; and

said payment server in communication with the mobile communications device through the cellular network and the point-of-sale device through a second connection, the payment server having a server payment logic;

wherein the server payment logic,

sends the one-time digital key to the mobile communications device upon determination that the mobile communications device is connected to the payment server via a cellular network;

receives the payment number and an amount from the point-of-sale device, the payment number sent to the point-of-sale device from the mobile communications device;

disassembles the payment number into the one-time digital key and the random number;

verifies the one-time digital key;

generates an identical random number using an identical algorithm to an algorithm used to generate the random number by the client payment logic;

compares the disassembled random number to the generated identical random number; and

deducts the amount from an account associated with the mobile communications device based on the result of the comparison.

2. The system in claim 1, wherein the client payment logic sends the payment number and the amount to the point-of-sales device upon generating the payment number after receiving the one-time digital key.

3. The system in claim 1, wherein the mobile communications device is at least one of a cellular telephone, notebook computer, or a personal digital assistant.

4. The system in claim 1, wherein the point-of-sale device is at least one of a cash register or a kiosk.

5. The system in claim 1, wherein the server payment logic extracts the one-time digital key from the payment number.

6. The system in claim 1, wherein the client payment logic sends a payment cap to the payment server.

7. The system in claim 6, wherein the server payment logic requests verification from the mobile communications device in response to receiving an amount that exceeds the payment cap.

8. A method of securely processing a payment comprising:

sending, by a server payment logic located on a payment server, a one-time digital key to a mobile communications device, the mobile communication device in communication with the payment server over a cellular network;

sending, by a vendor payment logic located on a point-of-sale device, the one-time digital key to a mobile communications device via wireless communication upon determining that the mobile communications device is not connected to the payment server over the cellular network;

generating, by a client payment logic of the mobile communication device, a payment number through adding, subtracting, multiplying, appending and mixing of the one-time digital key and a random number generated by the mobile communication device;

receiving, at the payment server, the payment number generated by the mobile communications device, an identification number, and an amount from the point-of-sale device;

the payment number, identification number and amount sent to the point-of-sale device from the mobile communications device;

disassembling, by the payment server, the payment number into the one-time digital key and the random number; and

deducting, using the payment server, the amount from an account associated with the mobile communications device upon verifying the random number and the one-time digital key obtained from disassembling the payment number into the one-time digital key and the random number, the verifying of the random number accomplished by the payment server generating an identical random number using an identical algorithm to an algorithm used to generate the random number on the mobile communications device and comparing the random number and the identical random number.

9. The method in claim 8, further comprising sending a confirmation corresponding to the deduction to the mobile communications device.

10. The method in claim 8, further comprising sending a new one-time digital key to the mobile communications device.

11. The method in claim 8, further comprising receiving a payment cap from the mobile communications device.

12. The method in claim 11, further comprising requesting verification for an amount that exceeds the payment cap.

13. The method in claim 12, further comprising receiving verification from the mobile communications device.

14. A method of securely processing a payment comprising:

receiving a one-time digital key, at a mobile communications device, from a server payment logic located on a payment server and a vendor payment logic located on a point-of-sale device, the one-time digital key received from the vendor payment logic of the point-of-sale device upon determining that the mobile communications device is not connected to the payment server via a cellular network;

sending, by the point-of-sale device, a payment number, an identification number, and an amount to a payment server, the payment number generated using a client payment logic of the mobile communications device, the client payment logic adding, subtracting, multiplying, appending, and mixing the one-time digital key with a random number generated by the mobile communications device;

wherein the point-of-sale device receives the payment number, identification number and the amount from the mobile communications device;

wherein the payment server verifies the random number and the one-time digital key, the verifying of the random number accomplished by the payment server generating an identical random number using an identical algorithm to an algorithm used to generate the random number on the mobile communications device and comparing the random number and the identical random number, and

deducting, by the payment server, the amount from an account associated with the mobile communications device.

15. The method in claim 14, further comprising combining the one-time digital key with a random number into the payment number.

16. The method in claim 14, further comprising receiving a confirmation corresponding to the deduction from the payment server.

17. The method in claim 14, further comprising receiving a new one-time digital key from the payment server.

18. The method in claim 14, further comprising sending a payment cap to the payment server.

19. The method in claim 18, further comprising receiving a verification request for an amount that exceeds the payment cap.