Systems and methods for performing secure financial transactions

• US 9,104,926 B2
• Filed: 05/23/2014
• Issued: 08/11/2015
• Est. Priority Date: 03/21/2006
• Status: Active Grant

• Current Assignee: Knapp Investment Company Limited
• Original Assignee: Radiofy, LLC
• Inventors: Soltan, Maryam, Shoarinejad, Kambiz
• Primary Examiner(s): PHAM, TOAN NGOC
• Application Number:
  US14/286,868
• Publication Number:
  US 20150001298A1
• Time in Patent Office: 445 Days
• Field of Search: 340/10.1, 340/10.2, 340/10.4, 340/572.1, 340/572.4, 340/5.8, 340/5.82, 235/375
• US Class Current: 1/1
• CPC Class Codes: G06K 7/00 Methods or arrangements for sensing record carriers, e.g. for reading patterns methods or arrangements for marking the record carrier in digital fashion G06K1/00; pattern recognition G06F18/00; arrangements for image or video recognition or understanding G06V10/00; character recognition, recognising digital ink or document-oriented image-based pattern recognition G06V30/00
• CPC Class Codes: G06K 7/10257 arrangements for protecting the interrogation against piracy attacks computer security in general G06F21/00; jamming of communication, countermeasures H04K3/00; secret communication H04K1/00
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/3278 RFID or NFC payments by means of M-devices
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: G06Q 20/409 Device specific authentication in transaction processing
• CPC Class Codes: G07F 7/10 together with a coded signal , e.g. in the form of personal identification information, like personal identification number [PIN] or biometric data
• CPC Class Codes: G07F 7/12 Card verification
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 9/12 Transmitting and receiving encryption devices synchronised or initially set up in a particular manner
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861

Abstract

An RFID system includes an RFID tag, an RFID reader, and a server. The RFID tag communicates to the server via encrypted information. The information may be encrypted with synchronized encryption keys. In this manner, the reader need not decrypt the information from the RFID tag. The effectiveness of malicious readers is thereby reduced, resulting in improved RFID tag security.

Claims

1. A method for use by a server to perform a point of sale transaction with a mobile device of a user, the mobile device storing an identification information, said method comprising:

transmitting, by the server, an encryption information comprising a pointer to one of a plurality of encryption keys for use by the mobile device to encrypt the identification information in accordance with the encryption information;

receiving, by said server, the identification information in an encrypted form and a transaction information for a purchase; and

decrypting, by said server, said encrypted identification information;

associating, by the server after the decrypting, the identification information with an account number of the user; and

transmitting, in response to the associating the identification information with the account number, an authorization from the server for authorizing the purchase.

2. The method of claim 1, wherein the decrypting by the server uses the encryption information to decrypt the encrypted identification information of the mobile device to obtain the identification information.

3. The method of claim 1, wherein the server and the mobile device are in communication with a point of sale device, and wherein the point of sale device is unable to utilize the encryption information to decrypt the identification information of the mobile device in the encrypted form to obtain the identification information.

4. The method of claim 1, wherein the server and the mobile device are in communication with a point of sale device, the method further comprising receiving a password from the point of sale device prior to the transmitting of the authorization, wherein the password is obtained by the point of sale device from the user of the mobile device, wherein the transmitting of the authorization is further in response to verifying the password by the server.

5. A method for use by a point of sale device to perform a point of sale transaction using a mobile device of a user and a server, the method comprising:

receiving, by the point of sale device from the server, an encryption information;

transmitting the encryption information, by the point of sale device to the mobile device, for use by the mobile device to encrypt an identification information in accordance with the encryption information, wherein the encryption information includes a pointer to one of a plurality of encryption keys;

obtaining, by the point of sale device from the mobile device, the identification information in an encrypted form;

transmitting, by the point of sale device to the server, the identification information of the mobile device in the encrypted form and a transaction information for a purchase, wherein the point of sale device does not decrypt the identification information of the mobile device in the encrypted form to obtain the identification information; and

receiving, by the point of sale device from the server, in response to the transmitting, an authorization from the server authorizing the purchase.

6. The method of claim 5, wherein the obtaining of the identification information of the mobile device in the encrypted form from the mobile device is in response to the transmitting of the encryption information.

7. The method of claim 5, wherein the server uses the encryption information to decrypt the identification information of the mobile device in the encrypted form to obtain the identification information.

8. The method of claim 5 further comprising:

receiving a password from the user of the mobile device prior to the receiving of the authorization; and

transmitting the password to the server;

wherein the receiving of the authorization is further in response to verifying the password by the server.

9. A method for use by a mobile device of a user to perform a point of sale transaction with a server, the method comprising:

receiving, by the mobile device, an encryption information provided by the server, the encryption information comprising a pointer to one of a plurality of encryption keys;

encrypting, by the mobile device, an identification information in accordance with the encryption information to generate the identification information in an encrypted form; and

providing, by the mobile device, the identification information of the mobile device in the encrypted form for transmission to the server to decrypt the identification information of the mobile device in the encrypted form to obtain the identification information.

10. The method of claim 9, wherein the server and the mobile device are in communication with a point of sale device, wherein the point of sale device is unable to utilize the encryption information to decrypt the identification information of the mobile device in the encrypted form to obtain the identification information.

11. A server for performing a point of sale transaction with a mobile device of a user, the mobile device storing an identification information to be obtained by the server in an encrypted form from the mobile device, the server comprising:

one or more circuits configured to;

transmit an encryption information for use by the mobile device to encrypt the identification information in accordance with the encryption information, the encryption information comprising a pointer to one of a plurality of encryption keys;

receive the identification information of the mobile device in the encrypted form and a transaction information for a purchase;

decrypt the identification information of the mobile device in the encrypted form;

associate, after decrypting, the identification information with an account number of the user; and

transmit, in response to associating, an authorization from the server to for authorizing the purchase.

12. The server of claim 11, wherein said decrypting uses the encryption information to decrypt the identification information of the mobile device in the encrypted form to obtain the identification information.

13. The server of claim 11, wherein the server and the mobile device are in communication with a point of sale device, and wherein the point of sale device is unable to utilize the encryption information to decrypt the identification information of the mobile device in the encrypted form to obtain the identification information.

14. The server of claim 11, wherein the one or more circuits is further configured to receive a password prior to transmitting the authorization, wherein the password is obtained from the user of the mobile device, wherein transmitting the authorization is further in response to verifying the password by the server.