Multi-path communication of electronic device secure element data for online payments

• US 10,878,414 B2
• Filed: 09/23/2016
• Issued: 12/29/2020
• Est. Priority Date: 09/30/2013
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: Pillai, Manoj K. Thulaseedharan, Khan, Ahmer A., Elliott, Thomas, Hurley, Timothy S., Bailey, Jennifer J., Brudnicki, David E.
• Primary Examiner(s): Agwumezie, Chinedu C
• Application Number:
  US15/274,929
• Publication Number:
  US 20170103388A1
• Time in Patent Office: 1,558 Days
• Field of Search: 705 77, 705 79, 705 71
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06Q 20/102 Bill distribution or payments
• CPC Class Codes: G06Q 20/12 specially adapted for electronic shopping systems
• CPC Class Codes: G06Q 20/3226 Use of secure elements separate from M-devices
• CPC Class Codes: G06Q 20/3227 using secure elements embedded in M-devices
• CPC Class Codes: G06Q 20/325 using wireless networks
• CPC Class Codes: G06Q 20/3278 RFID or NFC payments by means of M-devices
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/3823 combining multiple encryption tools for a transaction
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G06Q 2220/00 Business processing using cryptography postage metering system using cryptography G06Q2250/05
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 4/02 Services making use of location information

Abstract

Systems, methods, and computer-readable media for communicating electronic device secure element data over multiple paths for online payments are provided. In one example embodiment, a method includes, inter alia, at a commercial entity subsystem, receiving, from an electronic device, device transaction data that includes credential data indicative of a payment credential on the electronic device for funding a transaction with a merchant subsystem, accessing a transaction identifier, deriving a transaction key based on transaction key data that includes the accessed transaction identifier, transmitting, to one of the merchant subsystem and the electronic device, merchant payment data that includes a first portion of the credential data and the accessed transaction identifier, and sharing, with a financial institution subsystem using the transaction key, commercial payment data that includes a second portion of the credential data that is different than the first portion of the credential data. Additional embodiments are also provided.

Claims

1. A method comprising:

receiving, by a financial institution subsystem via a first communication path and from one of a merchant subsystem or an acquiring bank subsystem, merchant payment data that comprises credential data of an electronic device and transaction key data;

deriving, by the financial institution subsystem, a transaction key using the transaction key data of the merchant payment data;

accessing, by the financial institution subsystem via a second communication path that is different than the first communication path and from a commercial entity subsystem, commercial payment data using the derived transaction key;

processing the credential data and the commercial payment data; and

validating a transaction request based on the processing.

2. The method of claim 1, wherein the first communication path is between the financial institution subsystem and the merchant subsystem.

3. The method of claim 2, wherein the second communication path is between the financial institution subsystem and the commercial entity subsystem.

4. The method of claim 1, wherein the credential data comprises at least one of:

token data of a secure element of the electronic device;

or

crypto data generated using at least a portion of the token data and a shared secret between the electronic device and the financial institution subsystem.

5. The method of claim 4, wherein:

the credential data comprises one of the token data and the crypto data; and

the commercial payment data comprises the other one of the token data and the crypto data.

6. The method of claim 1, wherein the commercial payment data comprises data for enhancing operative to be used by the financial institution subsystem to enhance a risk assessment, by the financial institution subsystem, of a transaction between the electronic device and a merchant subsystem.

7. The method of claim 6, wherein the credential data comprises at least one of:

token data of a secure element of the electronic device;

or

crypto data based on at least a portion of the token data and a shared secret between the electronic device and the financial institution subsystem.

8. The method of claim 6, wherein the data comprises data indicative of at least one of the following:

a location of the electronic device;

movement of the electronic device;

or

authentication required by the electronic device to enable the generation of at least a portion of the credential data.

9. The method of claim 6, wherein the data comprises data indicative of at least one of the following:

an e-mail address associated with the electronic device;

or

a telephone number associated with the electronic device.

10. The method of claim 1, further comprising, after validating the transaction request, at the financial institution subsystem, transmitting, via a third communication path, user data to the electronic device, wherein the user data comprises information indicative of the validated transaction request.

11. The method of claim 10, wherein:

the first communication path is between the financial institution subsystem and a merchant subsystem; and

the third communication path comprises the first communication path and a fourth communication path between the merchant subsystem and the electronic device.

12. The method of claim 10, wherein:

the second communication path is between the financial institution subsystem and a commercial entity subsystem; and

the third communication path comprises the second communication path and a fourth communication path between the commercial entity subsystem and the electronic device.

13. The method of claim 10, wherein:

the second communication path is between the financial institution subsystem and the electronic device; and

the third communication path comprises the second communication path.

14. The method of claim 13, wherein the user data comprises information indicative of a confirmation of the validated transaction request.

15. The method of claim 10, wherein the user data comprises information indicative of at least one of the following:

an installment payment plan for funding the validated transaction request;

a reward earned by the validated transaction request;

or

a purchase protection plan for the validated transaction request.

16. A system comprising:

at least one processor; and

a memory storing executable instructions that when executed by the at least one processor cause the at least one processor to perform steps comprising;

receiving, via a first communication path and from one of a merchant subsystem or an acquiring bank subsystem, merchant payment data that comprises credential data of an electronic device and transaction key data;

deriving a transaction key using the transaction key data of the merchant payment data;

accessing, via a second communication path that is different than the first communication path and from one of a commercial entity subsystem or the electronic device, commercial payment data using the derived transaction key;

processing the credential data and the commercial payment data; and

validating a transaction request based on the processing.

17. The system of claim 16, wherein the system comprises a financial institution subsystem and the first communication path is between the financial institution subsystem and the merchant subsystem.

18. The system of claim 17, wherein the second communication path is between the financial institution subsystem and the commercial entity subsystem.

19. The system of claim 17, wherein the second communication path is between the financial institution subsystem and the electronic device.

20. The system of claim 17, wherein the credential data comprises at least one of:

token data of a secure element of the electronic device;

or

crypto data based on at least a portion of the token data and a shared secret between the electronic device and the financial institution subsystem.

21. The device of claim 20, wherein:

the credential data comprises one of the token data and the crypto data;

the commercial payment data comprises the other one of the token data and the crypto data.

22. A non-transitory computer readable storage medium, storing code that when executed by one or more processors causes the one or more processors to perform steps comprising:

receiving, by a financial institution subsystem via a first communication path and from one of a merchant subsystem or an acquiring bank subsystem, merchant payment data that comprises credential data of an electronic device and transaction key data;

deriving, by the financial institution subsystem, a transaction key using the transaction key data of the merchant payment data;

accessing, by the financial institution subsystem via a second communication path that is different than the first communication path and from one of a commercial entity subsystem or the electronic device, commercial payment data using the derived transaction key;

processing the credential data and the commercial payment data; and

validating a transaction request based on the processing.