Online commercial transaction system and method of operation thereof

• US 8,417,642 B2
• Filed: 09/13/2005
• Issued: 04/09/2013
• Est. Priority Date: 09/14/2004
• Status: Active Grant

• Current Assignee: Cork Group Trading Ltd.
• Original Assignee: Cork Group Trading Ltd.
• Inventors: Oren, Yosi
• Primary Examiner(s): Hewitt, II, Calvin L
• Assistant Examiner(s): MUHAMMAD, KHALIF R
• Application Number:
  US11/662,552
• Publication Number:
  US 20080301057A1
• Time in Patent Office: 2,765 Days
• Field of Search: 705/26, 705/71, 705/72
• US Class Current: 705/64
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: G06Q 30/0601 Electronic shopping [e-shopping]
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0471 applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity

Abstract

A system (1) for conducting commercial transactions comprises an application server (2) that hosts a software application that can be accessed by users to conduct commercial transactions thereon, an application user database (7) of authorized users capable of accessing the application server (2), each authorized user in the application user database (7) being uniquely identifiable by means of corresponding login name and password, and a proxy server (10) communicable with the application server (2) and accessible by a plurality of registered users from respective mobile phones (9). The proxy server provides each one of the plurality of registered users with access to the application server (2) from that user'"'"'s respective mobile phone (9). A proxy database (11) is associated with the proxy server (10), the proxy server (10) containing details of authorized user database (7) who are also registered to access the application (2) server through the proxy server from their respective mobile phones (9).

Claims

1. A method, comprising:

a proxy server apparatus serving a mobile registration form to a browser-enabled device to register a user'"'"'s mobile device for mobile access to an application hosted on an application server apparatus, wherein the mobile registration form provides for entry of user information comprising a login name and password, a telephone number of the user'"'"'s mobile device, and a login personal identification number (PIN);

the proxy server apparatus receiving from the browser-enabled device the mobile registration form with the user information, telephone number, and login PIN entered therein;

the proxy server apparatus transferring the user information to the application server apparatus for validation;

the proxy server receiving a notification from the application server apparatus that the user information is valid and, in response, allocating a user identification code to the user, generating an encryption code, constructing a validation code from the user identification code and encryption code, and transferring the validation code to the user'"'"'s mobile device;

the proxy server apparatus receiving the validation code and user information in a resubmitted mobile registration form from the browser-enabled device;

the proxy server apparatus verifying the user based on the validation code and user information in the re-submitted mobile registration form; and

in response to verifying the user, the proxy server apparatus generating an encryption key, storing the encryption key in a proxy database indexed by the user identification code, constructing an activation code from the user identification code and encryption key, encrypting the user information using the login PIN, storing the encrypted user information in the proxy database indexed by the user identification code, and transferring to the user'"'"'s mobile device (i) a link from which a mobile client software program associated with the application can be downloaded and (ii) the activation code.

2. The method of claim 1, wherein the browser-enabled device uses a full function web browser, and wherein the mobile registration form is served by the proxy server apparatus using the Hypertext Transfer Protocol (HTTP).

3. The method of claim 1, wherein the browser-enabled device uses a reduced function web browser, and wherein the mobile registration form is served by the proxy server apparatus using the Wireless Application Protocol (WAP).

4. The method of claim 3, wherein the browser-enable device is the user'"'"'s mobile device.

5. The method of claim 1, wherein the proxy server apparatus verifying the user based on the validation code and user information in the re-submitted mobile registration form comprises:

retrieving the encrypted user information from the proxy database;

decrypting the encrypted user information; and

comparing the decrypted user information with the user information received in the resubmitted mobile registration form.

6. The method of claim 1, further comprising:

the proxy server apparatus receiving a request to download the mobile client software program; and

in response to the request, the proxy server apparatus downloading the mobile client software program for installation on the user'"'"'s mobile device.

7. The method of claim 6, further comprising:

the proxy server apparatus receiving a login request from the user'"'"'s mobile device, wherein the login request comprises (i) the login PIN, which has been encrypted using the encryption key from the activation code, and (ii) the user identification code.

8. The method of claim 7, further comprising:

the proxy server apparatus using the user identification code in the login request to retrieve the encryption key from the proxy database;

the proxy server apparatus using the retrieved encryption key to decrypt the encrypted login PIN;

the proxy server apparatus using the decrypted login PIN to decrypt the encrypted user information stored in the proxy database; and

the proxy server apparatus transmitting the decrypted user information to the application server apparatus to request a user login to the application.

9. The method of claim 8, further comprising:

in response to the user login being successful, the proxy server receiving a session identifier for a current session of the application, generating a new encryption key for a next session of the application, storing the new encryption key in the proxy database indexed by the user identification code, and transmitting the new encryption key to the user'"'"'s mobile device.

10. The method of claim 9, further comprising:

after effecting a successful user login to the application, the proxy server apparatus receiving application data from the user'"'"'s mobile device, wherein the application data has been encrypted using a current encryption key for a current session of the application;

the proxy server apparatus decrypting the encrypted application data using the current encryption key; and

the proxy server apparatus transferring the decrypted application data to the application server apparatus.

11. The method of claim 8, further comprising:

the proxy server apparatus receiving from the user'"'"'s mobile device a request to register at least one payment instrument to pay for purchases made on the application server apparatus, wherein the request comprises data relating to the at least one payment instrument, a purchase PIN, and the user information;

the proxy server apparatus transferring the payment instrument data and user information to the application server apparatus for validation; and

in response to successful validation, the proxy server apparatus encrypting the payment instrument data using the purchase PIN and storing the encrypted payment instrument data in the proxy database.

12. The method of claim 11, further comprising:

after effecting the user login to the application, the proxy server apparatus receiving an encrypted purchasing request from the user'"'"'s mobile device; and

in response to the encrypted purchasing request, the proxy server apparatus decrypting the encrypted purchasing request, retrieving the encrypted payment instrument data from the proxy database, and transferring the encrypted payment instrument data to the user'"'"'s mobile device for presentation as a menu of payment instruments that are available to the user.

13. The method of claim 12, further comprising:

the proxy server apparatus receiving an encrypted payment request from the user'"'"'s mobile device, wherein the encrypted payment request comprises a selected payment instrument from the menu, a payment amount for a purchase made on the application server apparatus, and the purchase PIN;

the proxy server apparatus decrypting the encrypted payment request;

the proxy server apparatus decrypting, using the purchase PIN, the encrypted payment instrument data in the proxy database corresponding to the selected payment instrument; and

the proxy server apparatus forwarding the decrypted payment instrument data and decrypted payment amount to the application server apparatus to pay for the purchase made on the application server apparatus.

14. A proxy server apparatus, wherein the proxy server apparatus is configured to perform functions comprising:

the proxy server apparatus serving a mobile registration form to a browser-enabled device to register a user'"'"'s mobile device for mobile access to an application hosted on an application server apparatus, wherein the mobile registration form provides for entry of user information comprising a login name and password, a telephone number of the user'"'"'s mobile device, and a login personal identification number (PIN);

the proxy server apparatus receiving from the browser-enabled device the mobile registration form with the user information, telephone number, and login PIN entered therein;

the proxy server apparatus transferring the user information to the application server apparatus for validation;

the proxy server receiving a notification from the application server apparatus that the user information is valid and, in response, allocating a user identification code to the user, generating an encryption code, constructing a validation code from the user identification code and encryption code, and transferring the validation code to the user'"'"'s mobile device;

the proxy server apparatus receiving the validation code and user information in a resubmitted mobile registration form from the browser-enabled device;

the proxy server apparatus verifying the user based on the validation code and user information in the re-submitted mobile registration form; and

in response to verifying the user, the proxy server apparatus generating an encryption key, storing the encryption key in a proxy database indexed by the user identification code,

constructing an activation code from the user identification code and encryption key, encrypting the user information using the login PIN, storing the encrypted user information in the proxy database indexed by the user identification code, and transferring to the user'"'"'s mobile device (i) a link from which a mobile client software program associated with the application can be downloaded and (ii) the activation code.

15. The proxy server apparatus of claim 14, wherein the proxy server apparatus is configured to serve the mobile registration form to the browser-enabled device using the Hypertext Transfer Protocol (HTTP).

16. The proxy server apparatus of claim 14, wherein the proxy server apparatus is configured to serve the mobile registration form to the browser-enabled device using the Wireless Application Protocol (WAP).

17. The proxy server apparatus of claim 16, wherein the browser-enabled device is the user'"'"'s mobile device.

18. The proxy server apparatus of claim 14, wherein the proxy server apparatus verifying the user based on the validation code and user information in the re-submitted mobile registration form comprises:

retrieving the encrypted user information from the proxy database;

decrypting the encrypted user information; and

comparing the decrypted user information with the user information received in the resubmitted mobile registration form.

19. The proxy server apparatus of claim 14, wherein the functions further comprise:

the proxy server apparatus receiving a request to download the mobile client software program; and

in response to the request, the proxy server apparatus downloading the mobile client software program for installation on the user'"'"'s mobile device.

20. The proxy server apparatus of claim 19, wherein the functions further comprise:

the proxy server apparatus receiving a login request from the user'"'"'s mobile device, wherein the login request comprises (i) the login PIN, which has been encrypted using the encryption key from the activation code, and (ii) the user identification code.

21. The proxy server apparatus of claim 20, wherein the functions further comprise:

the proxy server apparatus using the user identification code in the login request to retrieve the encryption key from the proxy database;

the proxy server apparatus using the retrieved encryption key to decrypt the encrypted login PIN;

the proxy server apparatus using the decrypted login PIN to decrypt the encrypted user information stored in the proxy database; and

the proxy server apparatus transmitting the decrypted user information to the application server apparatus to request a user login to the application.

22. The proxy server apparatus of claim 21, wherein the functions further comprise:

in response to the user login being successful, the proxy server receiving a session identifier for a current session of the application, generating a new encryption key for a next session of the application, storing the new encryption key in the proxy database indexed by the user identification code, and transmitting the new encryption key to the user'"'"'s mobile device.

23. The proxy server apparatus of claim 22, wherein the functions further comprise:

after effecting a successful user login to the application, the proxy server apparatus receiving application data from the user'"'"'s mobile device, wherein the application data has been encrypted using a current encryption key for a current session of the application;

the proxy server apparatus decrypting the encrypted application data using the current encryption key; and

the proxy server apparatus transferring the decrypted application data to the application server apparatus.

24. The proxy server apparatus of claim 21, wherein the functions further comprise:

the proxy server apparatus receiving from the user'"'"'s mobile device a request to register at least one payment instrument to pay for purchases made on the application server apparatus, wherein the request comprises data relating to the at least one payment instrument, a purchase PIN, and the user information;

the proxy server apparatus transferring the payment instrument data and user information to the application server apparatus for validation; and

in response to successful validation, the proxy server apparatus encrypting the payment instrument data using the purchase PIN and storing the encrypted payment instrument data in the proxy database.

25. The proxy server apparatus of claim 24, wherein the functions further comprise:

after effecting the user login to the application, the proxy server apparatus receiving an encrypted purchasing request from the user'"'"'s mobile device; and

in response to the encrypted purchasing request, the proxy server apparatus decrypting the encrypted purchasing request, retrieving the encrypted payment instrument data from the proxy database, and transferring the encrypted payment instrument data to the user'"'"'s mobile device for presentation as a menu of payment instruments that are available to the user.

26. The proxy server apparatus of claim 25, wherein the functions further comprise:

the proxy server apparatus receiving an encrypted payment request from the user'"'"'s mobile device, wherein the encrypted payment request comprises a selected payment instrument from the menu, a payment amount for a purchase made on the application server apparatus, and the purchase PIN;

the proxy server apparatus decrypting the encrypted payment request;

the proxy server apparatus decrypting, using the purchase PIN, the encrypted payment instrument data in the proxy database corresponding to the selected payment instrument; and

the proxy server apparatus forwarding the decrypted payment instrument data and decrypted payment amount to the application server apparatus to pay for the purchase made on the application server apparatus.