Managing recurring payments from mobile terminals

• US 9,501,775 B2
• Filed: 04/29/2014
• Issued: 11/22/2016
• Est. Priority Date: 03/10/2009
• Status: Active Grant

• Current Assignee: Smartcom Labs OY
• Original Assignee: Bookit Oy Ajanvarauspalvelu
• Inventors: Salonen, Jukka
• Primary Examiner(s): Gelin, Jean
• Application Number:
  US14/264,100
• Publication Number:
  US 20140236830A1
• Time in Patent Office: 938 Days
• Field of Search: 455/405, 455/406, 455/407, 455/408, 455/410, 455/411, 455/414.1, 455/558, 705/34, 705/39, 705/40, 705/44, 705/65, 705/64
• US Class Current: 1/1
• CPC Class Codes: G06Q 20/405 Establishing or using transaction specific rules
• CPC Class Codes: G06Q 20/42 Confirmation, e.g. check or permission by the legal debtor of payment
• CPC Class Codes: H04W 4/02 Services making use of location information
• CPC Class Codes: H04W 4/24 Accounting or billing

Abstract

Equipments and methods are disclosed for facilitating service provisioning in a system that comprises a payment processor, a number of service providers and a mediator that mediates information exchange between the payment processor and service providers, and a mobile terminal operated by payment card holder. In some implementations, service provisioning can be facilitated in cases wherein the payment processor must reside in a strictly regulated Payment Card Industry (PCI) compliant environment and the service providers operate servers that are not PCI-compliant.

Claims

1. A method comprising performing following acts at a payment processor computer configured to manage transactions related to one or more services provided by one or more service providers and payable by one or more payment cards:

receiving a first request to authorize recurring payments payable by a specific one of the one or more payment cards, the first request globally identifying the specific payment card;

creating a token that identifies a specific one of the one or more service providers, wherein the token fails to globally identify the specific payment card but identifies the specific payment card within payment cards issued to a holder of the specific payment card;

sending the created token to a first mediator server;

receiving from a second mediator server an authorization notification indicating that the holder of the specific payment card has used a mobile terminal via a mobile network to authorize recurring payments from the specific service provider, wherein the first mediator server and the second mediator server are the same mediator server or different mediator servers.

2. The method according to claim 1, wherein the payment processor computer causes the first or second mediator server to use the token to query if the holder of the specific payment wishes to authorize recurring payments from the specific service provider.

3. The method according to claim 1, wherein the payment processor computer verifies integrity of the first and/or second mediator server by using one or more cryptographic techniques.

4. The method according to claim 3, wherein the one or more cryptographic techniques include challenge-and-response authentication.

5. The method according to claim 3, wherein the one or more cryptographic techniques include verification of one or more certificates stored by the first and/or second mediator server.

6. The method according to claim 1, wherein the payment processor computer in less than all cases verifies the authorization notification by bypassing the first and/or second mediator computer and by consulting the holder of the specific payment card has via the mobile terminal.

7. The method according to claim 6, wherein the payment processor computer uses some or all of the following parameters in determining the cases in which the authorization notification is verified by bypassing the first and/or second mediator computer:

a random selection from all transactions;

all transactions whose value exceed a given threshold;

a random selection from transactions over a given threshold value;

a number of first transactions for the mediator, user and/or service provider;

a number of first transactions for a combination of user and service provider.

8. The method according to claim 6, wherein the payment processor computer performs some or all of the following acts to determine the cases in which the authorization notification is verified by bypassing the first and/or second mediator computer:

assigning a first initial trust value to a plurality of holders of payment cards;

assigning a second initial trust value to a plurality of service providers;

assigning a third initial trust value to the first and/or second mediator computer;

updating some or all of the initial trust values to current trust values in response to receiving notification of successfully completed transactions involving a respective one of the holders of payment cards, service providers and/or mediator servers.

9. The method according to claim 1, further comprising associating and enforcing at least one restriction with the token, wherein the at least one restriction restricts at least one of lifetime of the token and financial value of transactions made by using the token.

10. The method according to claim 1, wherein the payment processor computer and the first mediator server and second mediator server comply with specifications issued by Payment Card Industry Security Standards Council.

11. The method according to claim 1, wherein the payment processor computer and the first mediator server or the second mediator server comply with specifications issued by Payment Card Industry Security Standards Council, while the second mediator server or the first mediator server, respectively, operates outside said specifications.

12. The method according to claim 1, wherein the first request is received from a first terminal and indicates a second terminal, wherein the first terminal and second terminal use different authentication information regardless of whether the first terminal and second terminal reside in separate physical devices or share a common physical device.

13. The method according to claim 1, wherein the one or more service providers comprise a first service provider and a second service provider, the method further comprising following acts at the payment processor computer:

receiving a second request to authorize second recurring payments from the second service provider, the second recurring payments payable by a second payment card of the one or more payment cards, wherein an association exists between services of the first service provider and services of the second service provider, and wherein the first and second payment cards are the same payment card or separate payment cards;

in response to the second request, using the first mediator server or the second mediator server to obtain confirmation from the holder of the payment cards that the second service provider is allowed to propose services to the holder of the payment cards;

creating a token that identifies the second service provider, wherein the token fails to globally identify the second payment card but identifies the second payment card within payment cards issued to a holder of the payment cards;

sending the created token to the first mediator server or the second mediator server;

receiving from the first mediator server or the second mediator server an authorization notification indicating that the holder of the specific payment card has used a mobile terminal via a mobile network to authorize the second recurring payments from the second service provider.

14. A method comprising performing following acts at a mediator server configured to manage transactions, which relate to one or more services provided by one or more service providers and are payable by one or more payment cards:

receiving, from a payment processor computer, a token that identifies a specific one of the one or more service providers, wherein the token fails to globally identify the specific payment card but identifies the specific payment card within payment cards issued to a holder of the specific payment card;

receiving, from the specific service provider, a proposal for a service that incurs recurring payments payable by one or more payment cards;

sending a notification to a mobile terminal operated by the holder of the specific payment card, wherein the notification identifies the proposal for the service that incurs recurring payments, wherein the notification further identifies the specific payment card within payment cards issued to the holder of the specific payment card;

receiving, from the mobile terminal operated by the holder of the specific payment card, an authorization notification indicating that the holder of the specific payment card has used the mobile terminal via a mobile network to authorize recurring payments from the specific service provider;

notifying the service provider and the payment processor computer of the authorization notification.

15. The method according to claim 14, wherein the one or more service providers comprise a first service provider and a second service provider, the method further comprising following acts at the mediator server:

sending a request to the mobile terminal operated by the holder of the specific payment card, the request requesting permission to authorize second recurring payments from the second service provider, the second recurring payments payable by a second payment card of the one or more payment cards, wherein an association exists between services of the first service provider and services of the second service provider, and wherein the first and second payment cards are the same payment card or separate payment cards;

receiving confirmation from the mobile terminal operated by the holder of the payment cards that the second service provider is allowed to propose services to the holder of the payment cards;

relaying said confirmation to a payment processor computer;

receiving from the payment processor computer a second token and storing the second token, wherein the second token identifies the second service provider, wherein the second token fails to globally identify the second payment card but identifies the second payment card within payment cards issued to a holder of the payment cards.

16. The method according to claim 14, wherein the mediator server authenticates the mobile terminal operated by the holder of the specific payment card by using a non-predictable reply address for sending the notification.

17. The method according to claim 14, wherein the mediator server uses a multi-dimensional data structure to manage service offerings from multiple service providers to each of one or more mobile terminals, and wherein the mediator server identifies the service offerings from multiple service providers by varying a reply address for sending the notification.

18. The method according to claim 14, wherein the mediator server uses a multi-dimensional data structure to manage multiple phases of at least one service offering from at least one service providers to at least one mobile terminals, and wherein the mediator server identifies the multiple phases by varying a reply address for sending the notification.

19. A payment processor computer configured to manage transactions related to one or more services provided by one or more service providers and payable by one or more payment cards, the payment processor computer comprising:

means for receiving a first request to authorize recurring payments payable by a specific one of the one or more payment cards, the first request globally identifying the specific payment card;

means for creating a token that identifies a specific one of the one or more service providers, wherein the token fails to globally identify the specific payment card but identifies the specific payment card within payment cards issued to a holder of the specific payment card;

means for sending the created token to a first mediator server;

means for receiving from a second mediator server an authorization notification indicating that the holder of the specific payment card has used a mobile terminal via a mobile network to authorize recurring payments from the specific service provider, wherein the first mediator server and the second mediator server are the same mediator server or different mediator servers.

20. The payment processor computer according to claim 19, wherein the payment processor computer is configured to cause the first or second mediator server to use the token to query if the holder of the specific payment wishes to authorize recurring payments from the specific service provider.

21. The payment processor computer according to claim 19, wherein the payment processor computer complies with specifications issued by Payment Card Industry Security Standards Council, while the mediator server operates outside said specifications.

22. A mediator server configured to manage transactions, which relate to one or more services provided by one or more service providers and are payable by one or more payment cards, the mediator server comprising:

means for receiving, from a payment processor computer, a token that identifies a specific one of the one or more service providers, wherein the token fails to globally identify the specific payment card but identifies the specific payment card within payment cards issued to a holder of the specific payment card;

means for receiving, from the specific service provider, a proposal for a service that incurs recurring payments payable by one or more payment cards;

means for sending a notification to a mobile terminal operated by the holder of the specific payment card, wherein the notification identifies the proposal for the service that incurs recurring payments, wherein the notification further identifies the specific payment card within payment cards issued to the holder of the specific payment card;

means for receiving, from the mobile terminal operated by the holder of the specific payment card, an authorization notification indicating that the holder of the specific payment card has used the mobile terminal via a mobile network to authorize recurring payments from the specific service provider;

means for notifying the service provider and the payment processor computer of the authorization notification.

23. The mediator server according to claim 22, wherein the mediator server is configured to authenticate the mobile terminal operated by the holder of the specific payment card by using a non-predictable reply address for sending the notification.

24. The mediator server according to claim 22, wherein the mediator server is configured to use a multi-dimensional data structure to manage service offerings from multiple service providers to each of one or more mobile terminals, and wherein the mediator server identifies the service offerings from multiple service providers by varying a reply address for sending the notification.

25. The mediator server according to claim 22, wherein the mediator server is configured to use a multi-dimensional data structure to manage multiple phases of at least one service offering from at least one service providers to at least one mobile terminal, and wherein the mediator server identifies the multiple phases by varying a reply address for sending the notification.

26. A non-transitory tangible software carrier embodying a set of computer program instructions executable in a mediator server configured to manage transactions related to one or more services provided by service providers that comprise a first service provider and a second service provider, the transactions being payable by one or more payment cards;

wherein execution of the computer program instructions causes the following acts in the mediator server;

receiving, from a payment processor computer, a token that identifies a specific one of the one or more service providers, wherein the token fails to globally identify the specific payment card but identifies the specific payment card within payment cards issued to a holder of the specific payment card;

receiving, from the specific service provider, a proposal for a service that incurs recurring payments payable by one or more payment cards;

sending a notification to a mobile terminal operated by the holder of the specific payment card, wherein the notification identifies the proposal for the service that incurs recurring payments, wherein the notification further identifies the specific payment card within payment cards issued to the holder of the specific payment card;

receiving, from the mobile terminal operated by the holder of the specific payment card, an authorization notification indicating that the holder of the specific payment card has used the mobile terminal via a mobile network to authorize recurring payments from the specific service provider;

notifying the service provider and the payment processor computer of the authorization notification.

27. A method comprising performing following acts at a payment processor computer configured to manage transactions related to one or more services provided by one or more service providers and payable by one or more payment cards:

receiving from a first mediator server a first request to authorize recurring payments payable by a specific one of the one or more payment cards, the request globally identifying the specific payment card;

receiving from a second mediator server an authorization notification indicating that a holder of the specific payment card has used a mobile terminal via a mobile network to authorize recurring payments from a specific one of the one or more service providers, wherein the first mediator server and the second mediator server are the same mediator server or different mediator servers;

creating a token that identifies the specific service provider, wherein the token fails to globally identify the specific payment card but identifies the specific payment card within payment cards issued to the holder of the specific payment card.

28. The method according to claim 27, wherein the payment processor computer causes the first or second mediator server to use the token to query if the holder of the specific payment wishes to authorize recurring payments from the specific service provider.

29. The method according to claim 27, wherein the payment processor computer verifies integrity of the first and/or second mediator server by using one or more cryptographic techniques.

30. The method according to claim 29, wherein the one or more cryptographic techniques include challenge-and-response authentication.

31. The method according to claim 29, wherein the one or more cryptographic techniques include verification of one or more certificates stored by the first and/or second mediator server.

32. The method according to claim 27, wherein the payment processor computer in less than all cases verifies the authorization notification by bypassing the first and/or second mediator computer and by consulting the holder of the specific payment card has via the mobile terminal.

33. The method according to claim 32, wherein the payment processor computer uses some or all of the following parameters in determining the cases in which the authorization notification is verified by bypassing the first and/or second mediator computer:

a random selection from all transactions;

all transactions whose value exceed a given threshold;

a random selection from transactions over a given threshold value;

a number of first transactions for the mediator, user and/or service provider;

a number of first transactions for a combination of user and service provider.

34. The method according to claim 32, wherein the payment processor computer performs some or all of the following acts to determine the cases in which the authorization notification is verified by bypassing the first and/or second mediator computer:

assigning a first initial trust value to a plurality of holders of payment cards;

assigning a second initial trust value to a plurality of service providers;

assigning a third initial trust value to the first and/or second mediator computer;

updating some or all of the initial trust values to current trust values in response to receiving notification of successfully completed transactions involving a respective one of the holders of payment cards, service providers and/or mediator servers.

35. The method according to claim 27, further comprising associating and enforcing at least one restriction with the token, wherein the at least one restriction restricts at least one of lifetime of the token and financial value of transactions made by using the token.

36. The method according to claim 27, wherein the payment processor computer and the first mediator server and second mediator server comply with specifications issued by Payment Card Industry Security Standards Council.

37. The method according to claim 27, wherein the payment processor computer and the first mediator server or the second mediator server comply with specifications issued by Payment Card Industry Security Standards Council, while the second mediator server or the first mediator server, respectively, operates outside said specifications.

38. The method according to claim 27, wherein the first request is received from a first terminal and indicates a second terminal, wherein the first terminal and second terminal use different authentication information regardless of whether the first terminal and second terminal reside in separate physical devices or share a common physical device.

39. The method according to claim 27, wherein the one or more service providers comprise a first service provider and a second service provider, the method further comprising following acts at the payment processor computer:

receiving a second request to authorize second recurring payments from the second service provider, the second recurring payments payable by a second payment card of the one or more payment cards, wherein an association exists between services of the first service provider and services of the second service provider, and wherein the first and second payment cards are the same payment card or separate payment cards;

in response to the second request, using the first mediator server or the second mediator server to obtain confirmation from the holder of the payment cards that the second service provider is allowed to propose services to the holder of the payment cards;

creating a token that identifies the second service provider, wherein the token fails to globally identify the second payment card but identifies the second payment card within payment cards issued to a holder of the payment cards;

sending the created token to the first mediator server or the second mediator server;

receiving from the first mediator server or the second mediator server an authorization notification indicating that the holder of the specific payment card has used a mobile terminal via a mobile network to authorize the second recurring payments from the second service provider.

40. A payment processor computer configured to manage transactions related to one or more services provided by one or more service providers and payable by one or more payment cards, the payment processor computer comprising:

means for receiving from a first mediator server a first request to authorize recurring payments payable by a specific one of the one or more payment cards, the first request globally identifying the specific payment card;

means for receiving from a second mediator server an authorization notification indicating that a holder of the specific payment card has used a mobile terminal via a mobile network to authorize recurring payments from a specific one of the one or more service providers, wherein the first mediator server and the second mediator server are the same mediator server or different mediator servers;

means for creating a token that identifies the specific service provider, wherein the token fails to globally identify the specific payment card but identifies the specific payment card within payment cards issued to the holder of the specific payment card.

41. The payment processor computer according to claim 40, wherein the payment processor computer is configured to cause the first or second mediator server to use the token to query if the holder of the specific payment wishes to authorize recurring payments from the specific service provider.

42. The payment processor computer according to claim 40, wherein the payment processor computer complies with specifications issued by Payment Card Industry Security Standards Council, while the mediator server operates outside said specifications.