Transaction signature for offline payment processing system

• US 8,959,034 B2
• Filed: 02/29/2012
• Issued: 02/17/2015
• Est. Priority Date: 02/29/2012
• Status: Expired due to Fees

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google Inc. (Alphabet Inc.)
• Inventors: Jiang, Fan, Springer, Michael William, Lisowiec, Malgorzata Monika, Bakir, Gkhan Hasan, Leung, Patrick Pui Wah, Okonkwo, Aneto Pablo
• Primary Examiner(s): Hewitt, II, Calvin L
• Assistant Examiner(s): Iluonakhamhe, Isidora
• Application Number:
  US13/408,813
• Publication Number:
  US 20130226797A1
• Time in Patent Office: 1,084 Days
• Field of Search: 705/51, 705/52, 705/64, 705/65, 705/71, 705/72, 705/75, 235/380
• US Class Current: 705/65
• CPC Class Codes: G06Q 20/0655 e-cash managed centrally
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/343 Cards including a counter
• CPC Class Codes: G06Q 20/3433 the counter having monetary units
• CPC Class Codes: G06Q 20/349 Rechargeable cards
• CPC Class Codes: G06Q 20/352 Contactless payments by cards
• CPC Class Codes: G06Q 20/354 Card activation or deactivation
• CPC Class Codes: G06Q 20/3552 Downloading or loading of personalisation data
• CPC Class Codes: G06Q 20/3672 initialising or reloading thereof
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/3676 Balancing accounts
• CPC Class Codes: G06Q 20/38215 Use of certificates or encrypted proofs of transaction rights
• CPC Class Codes: G06Q 20/3825 Use of electronic signatures
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G06Q 20/407 Cancellation of a transaction
• CPC Class Codes: G06Q 20/40975 using encryption therefor
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system

Abstract

Preventing fraud during an offline transaction by encoding a randomly-generated card verification code onto a smart card. The verification code is transmitted to a contactless device during each transaction, wherein it is cross-referenced with the account number to ensure presence of the card. Also, every transaction record is signed by an access key resident on the contactless device and certified by a signing key resident on a remote system. Funds may be deposited onto the card when the contactless device creates a deposit request, signs the request using an access key and transmits it to the remote system, which in turn processes the request and certifies it with a signing key. Funds may be withdrawn when the contactless device creates a withdrawal record and signs it using an access key. The remote system verifies the signatures and certifies the records using a signing key when the records are later transmitted.

Claims

1. A computer-implemented method for processing a withdrawals of funds during offline payment processing of purchases, comprising:

starting a payment session by a mobile communication device;

establishing, by the mobile communication device, a network connection with a computer managing smart card device accounts;

receiving, by the mobile communication device, a session access key from, the computer managing the smart card device accounts;

establishing, by the mobile communication device, a communication channel with a smart card device while the mobile communication device is without a network connection to the computer managing the smart card device accounts;

receiving, by the mobile communication device and from the smart card device, a smart card device transaction history comprising a listing of previous deposit transactions and a listing of previous withdrawal transactions;

calculating, by the mobile communication device, an amount of previous withdrawals using the listing of previous withdrawal transactions and an amount of previous deposits using the listing of previous deposit transactions;

authorizing, by the mobile communication device and without a network connection to the computer managing the smart card device accounts, an offline debit transaction by determining that a current transaction amount is less than or equal to a difference between the amount of previous deposits and the amount of the previous withdrawals;

creating, by the mobile communication device, an offline withdrawal transaction record subtracting the current transaction amount from a smart card device account balance;

signing, by the mobile communication device, the withdrawal transaction record using the session access key; and

writing, by the mobile communication device, the signed withdrawal transaction record to the smart card device transaction history, the signed withdrawal transaction record indicating the current transaction amount debited from the smart card device account balance and the session access key signature.

2. The computer-implemented method of claim 1, further comprising:

establishing, by the mobile communication device, a second network connection with the computer managing the smart card device accounts after completing the offline debit transaction with the smart card device, without the network connection to the computer, and

transmitting, by the mobile communication device, the smart card device transaction history and the signed withdrawal transaction record to the computer managing the smart card device accounts after establishing the network connection.

3. The computer-implemented method of claim 1, wherein the session access key comprises a teller access key allowing the mobile communication device to perform debit transactions with smart card devices that have smart card device accounts managed by the computer without a network connection to the computer.

4. The computer-implemented method of claim 1, wherein the session access key has a maximum quota of allowed debit transactions, wherein the maximum quota allowed comprises one of a maximum number of transactions allowed per session, a maximum time period for the session, a maximum amount of money per transaction, and a maximum amount of money per session.

5. The computer-implemented method of claim 1, where a new session access key is required for each new payment session started by the mobile communication device.

6. The computer-implemented method of claim 1, wherein calculating the amount of previous deposits comprises:

sorting deposit transactions in order of deposit from a previous deposit D(n−

1) to a latest deposit D(n); and

reviewing the latest deposit transaction to identify the amount of previous deposits.

7. The computer-implemented method of claim 1, wherein calculating the amount of previous withdrawals comprises:

sorting withdrawal transactions in order of withdrawal from a previous withdrawal W(n−

1) to a latest withdrawal W(n); and

reviewing the latest withdrawal transaction to identify the amount of previous withdrawals.

8. The computer-implemented method of claim 2, further comprising:

receiving, by the computer managing the smart card device accounts and from the mobile communication device, the smart card device transaction history and the withdrawal transaction record;

processing, by the computer managing smart card device accounts, the withdrawal transaction record by verifying an identity of the smart card device, verifying the session access key signature, and calculating a new sum of withdrawals for the smart card device, the new sum of withdrawals equaling a previous sum of withdrawals plus the debited amount;

certifying, by the computer managing smart card device accounts, the withdrawal transaction record with a signing key; and

updating, by the computer smart card device accounts, an account associated with the smart card device with the certified withdrawal transaction record and new listing of withdrawal transactions.

9. The computer-implemented method of claim 8, further comprising transmitting, by the computer managing smart card device accounts, the certified withdrawal transaction record to a second mobile communication device for transmission to the smart card device during a second transaction.

10. The computer-implemented method of claim 1, further comprising storing, by the mobile communication device, the smart card device transaction history and the withdrawal transaction record until the mobile communication device has a second network connection with the computer managing smart card device accounts.

11. The computer-implemented method of claim 1, wherein the smart card device transaction history further comprises a smart card account number and a verification number.

12. A mobile communication device comprising:

a non-transitory computer-readable medium having computer-readable program instructions embodied therein that when executed by a computer cause the computer to perform the steps of;

receiving a session access key via a network connection from a computer managing smart card device accounts;

establishing, by a mobile communication device, a communication channel with a smart card device while the mobile communication device is without a network connection to the computer managing the smart card device accounts;

receiving, from the smart card device, a smart card device transaction history comprising a listing of previous deposit transactions and a listing of previous withdrawal transactions;

calculating an amount of previous withdrawals using the listing of previous withdrawal transactions and an amount of previous deposits using the listing of previous deposit transactions;

authorizing, without a network connection to the computer managing the smart card device accounts, an offline debit transaction by determining that a current transaction amount is less than or equal to a smart card device account balance calculated using an amount of previous deposit transactions and an amount of the previous withdrawal transactions received in the transaction history;

creating an offline withdrawal transaction record subtracting the current transaction amount from a smart card device account balance;

signing the withdrawal transaction record using the session access key; and

writing the signed withdrawal transaction record to the smart card device transaction history, the signed withdrawal transaction record indicating the current transaction amount debited from the smart card device account balance and the session access key signature.

13. The mobile communication device of claim 12, further comprising the steps of:

establishing a second network connection with the computer managing the smart card

device accounts after completing the offline debit transaction with the smart card device without the network connection to the computer, and

transmitting the smart card device transaction history and the signed withdrawal transaction record to the computer managing the smart card device accounts after establishing the network connection.

14. The mobile communication device of claim 12, wherein the session access

key comprises a key allowing the mobile communication device to process withdrawals of funds during offline payment processing of purchases with smart card devices that have smart card device accounts managed by the computer without a network connection to the computer.

15. The mobile communication device of claim 12, wherein the session access key has a maximum quota of allowed debit transactions, wherein the maximum quota allowed comprises one of a maximum number of transactions allowed per session, a maximum time period for the session, a maximum amount of money per transaction, and a maximum amount of money per session.

16. The mobile communication device of claim 12, further comprising the step of storing the smart card device transaction history and the withdrawal transaction record until the mobile communication device has a second network connection with the computer managing smart card device accounts.

18. The system of claim 16, wherein the processor is further configured to execute instructions stored in the storage device to cause the processor to execute the steps of:

establishing a second network connection with the computer managing the smart card device accounts after completing the offline debit transaction with the smart card device without the network connection to the computer, and

transmitting the smart card device transaction history and the signed withdrawal transaction record to the computer managing the smart card device accounts after establishing the network connection.

19. The system of claim 16, wherein the session access key comprises a key allowing the mobile communication device to process withdrawals of funds during offline payment processing of purchases with smart card devices that have smart card device accounts managed by the computer without a network connection to the computer.

20. The system of claim 16, wherein the session access key has a maximum quota of allowed debit transactions, wherein the maximum quota allowed comprises one of a maximum number of transactions allowed per session, a maximum time period for the session, a maximum amount of money per transaction, and a maximum amount of money per session.

17. A system for processing withdrawals of funds during offline payment processing of purchases, comprising:

a mobile communication device processor; and

a storage device comprising hardware storing executable instructions that when executed by the processor cause the processor to execute the steps of;

establishing, by a mobile communication device, a communication channel with a smart card device while a mobile communication device is without a network connection to a computer managing smart card device accounts;

receiving, from the smart card device, a smart card device transaction history comprising a listing of previous deposit transactions and a listing of previous withdrawal transactions;

calculating an amount of previous withdrawals using the listing of previous withdrawal transactions and an amount of previous deposits using the listing of previous deposit transactions;

authorizing, without a network connection to the computer managing the smart card device accounts, an offline debit transaction by determining that a current transaction amount is less than or equal to a smart card device account balance calculated using an amount of previous deposit transactions and an amount of the previous withdrawal transactions received in the transaction history;

creating an offline withdrawal transaction record subtracting the current transaction amount from a smart card device account balance;

signing the withdrawal transaction record using a session access key; and

writing the signed withdrawal transaction record to the smart card device transaction history, the signed withdrawal transaction record indicating the current transaction amount debited from the smart card device account balance and the session access key signature.