System and method for effecting secure online payment using a client payment card

• US 20030069792A1
• Filed: 07/22/2002
• Published: 04/10/2003
• Est. Priority Date: 01/24/2000
• Status: Abandoned Application

• Current Assignee: Smarttrust Systems OY
• Original Assignee: Smarttrust Systems OY
• Inventors: Blumenthal, Henrik
• Application Number:
  US10/201,182
• Publication Number:
  US 20030069792A1
• Time in Patent Office: Days
• US Class Current: 705/16
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/24 Credit schemes, i.e. "pay after"
• CPC Class Codes: G06Q 20/32 using wireless devices
• CPC Class Codes: G06Q 20/3229 Use of the SIM of a M-device as secure element

Abstract

Payment using a payment card for goods and/or services ordered online via an information network such as the Internet is implemented in a notably secure manner without the need to transmit the client'"'"'s payment card number over the data transmission network. A separate confirmation for effecting the payment for an order is requested from the client. The information to be confirmed is transmitted to the terminal device of the client, such as a mobile station, by means of which the client confirms the order by digitally signing the confirmation request. The digitally signed confirmation and the electronic identity information associated with the client are then returned to the payment service equipment, which verifies the client'"'"'s identity, checks the validity of the client'"'"'s payment card, and then transmits the necessary payment information to the payment system.

Claims

1. Payment service equipment operable for completing online payment transactions using a client payment card, comprising:

a first access interface for connection to a payment system;

a second access interface for connection to an authentication system;

a third access interface for connection to a telecommunication network;

a certificate database for storing certificates associated with clients;

a service provider database for storing information relating to registered service providers from which the clients can purchase goods and services in online transactions;

a client database for storing information relating to the clients, said information relating to the clients comprising, for each client, at least one of a client mobile number and information relating to the payment card of the each client;

a transaction database for storing information relating to the payment transactions;

a verification database for storing a listing of suspicious payment cards;

a generation block for generating billing tickets associated with the payment transactions;

a telecommunication block for sending and receiving a confirmation of order associated with a payment transaction;

an identification block for identifying a client based on an electronic identity and digital signature of the client;

an information retrieval block for determining payment card information for the clients; and

a fourth access interface for connection between the payment service equipment and the mobile communication network.

2. Payment service equipment in accordance with claim 1, wherein the payment card is a credit card.

3. Payment service equipment in accordance with claim 1, wherein the information stored in one of the client database and the service provider database is encrypted.

4. Payment service equipment in accordance with claim 1, wherein payment card information is included in the certificates stored in the certification database.

5. A method for secure online payment in a telecommunication system that includes a mobile communication network, a telecommunication network, a payment terminal device connected to the mobile communication network and that includes a smart card, a display terminal device connected to one of the mobile communication network and the telecommunication network, a trusted third party, a payment system, a service provider, and an authentication system, said method comprising the steps of:

generating and issuing, by the trusted third party, a certificate associated with a client;

selecting, and thereby ordering from the service provider by the client, one of a product and a service using the terminal display device via one of the telecommunication network and the mobile communication network;

using one of a payment card of the client and client payment card information to pay for the ordered one of a product and a service;

generating, by payment service equipment, a billing ticket associated with the ordered one of a product and a service;

sending a confirmation of order associated with the ordered one of a product and a service to the payment terminal device of the client via the mobile communication network for receipt by the client;

at least one of digitally signing and encrypting the received confirmation of order using the payment terminal device of the client;

sending the at least one of digitally signed and encrypted confirmation of order and electronic identity information associated with the client from the payment terminal device of the client to the payment service equipment via the mobile communication network;

identifying the client at the payment service equipment based on the at least one of the digital signature and the encryption of the confirmation of order sent from the payment terminal device of the client;

retrieving a number of the client payment card based on the at least one of the digital signature and the encryption of the confirmation of order sent from the payment terminal device of the client to the payment service equipment; and

verifying a right of use of the client payment card and, if the verification is successful, accepting payment for the ordered at least one of goods and services.

6. The method of claim 5, wherein the client is identified at the payment service equipment based on information contained in a certification database connected to the payment service equipment.

7. The method of claim 5, wherein the client payment card number is retrieved from a client database of the payment service equipment.

8. The method of claim 5, wherein the client payment card number is retrieved from a certification database connected to the payment service equipment.

9. The method of claim 5, further comprising the step of verifying validity of the client payment card in the authentication system.

10. The method of claim 5, further comprising the step of verifying in a verification database connected to the payment service equipment that the client payment card is not among suspicious and forbidden cards listed in the verification database.

11. The method of claim 5, further comprising the step of verifying validity of the client payment card in the authentication system, and wherein said accepting payment comprises sending to the payment system, after said verifying validity of the client payment card, a request for debiting of the payment from a payment card account of the client.

12. The method of claim 5, further comprising the step of sending, to one of the display terminal device of the client and the payment terminal device of the client, and to the service provider, a confirmation that an order has succeeded.

13. The method of claim 6, wherein the certificate database is updated by the trusted third party.

14. The method of claim 5, wherein the payment terminal device and the display terminal device comprise a mobile station.

15. The method of claim 5, wherein the payment terminal device comprises a mobile station and the display terminal device comprises a personal computer.

16. The method of claim 5, wherein the client payment card comprises one of a Visa card, a Mastercard card, a Diners Club card and a bank card.

17. The method of claim 5, wherein the smart card comprises a subscriber identity module.

18. The method of claim 5, wherein the smart card contains, stored on the smart card, the electronic identity information of the client and a private key of the client.

19. The method of claim 5, wherein the smart card contains, stored on the smart card, a public key associated with the payment service equipment.

20. The method of claim 5, wherein the mobile communication network comprises a GSM mobile communication network.

21. The method of claim 5, wherein the telecommunication network comprises a packet-switched network.

22. A method for secure online payment in a telecommunication system that includes a telecommunication network, a terminal device connected to the telecommunication network and to which is attached a card reader for receiving a smart card, a trusted third party, a payment system, a service provider, and an authentication system, said method comprising the steps of:

generating and issuing, by the trusted third party, a certificate associated with a client;

selecting, and thereby ordering from the service provider by the client, one of a product and a service using the terminal display device via the telecommunication network;

using one of a payment card of the client and client payment card information to pay for the ordered one of a product and a service;

generating, by payment service equipment, a billing ticket associated with the ordered one of a product and a service;

sending a confirmation of order associated with the ordered one of a product and service to the terminal device of the client via the telecommunication network;

at least one of signing and encrypting the received confirmation of order using the smart card in the card reader attached to the terminal device of the client;

sending the at least one of signed and encrypted confirmation of order and electronic identity information associated with the client from the terminal device to the payment service equipment via the telecommunication network;

identifying the client at the payment service equipment based on the at least one of the digital signature and the encryption of the confirmation of order sent from the terminal device of the client;

retrieving a number of the client payment card based on the at least one of the digital signature and the encryption of the confirmation of order sent from the terminal device of the client to the payment service equipment; and

verifying a right of use of the client payment card and, if the verification is successful, accepting payment for the ordered at least one of goods and services.

23. The method of claim 22, wherein the client is identified at the payment service equipment based on information contained in a certification database connected to the payment service equipment.

24. The method of claim 22, wherein the client payment card number is retrieved from a client database of the payment service equipment.

25. The method of claim 22 wherein the client payment card number is retrieved from a certification database connected to the payment service equipment.

26. The method of claim 22, further comprising the step of verifying validity of the client payment card in the authentication system.

27. The method of claim 22, further comprising the step of verifying in a verification database connected to the payment service equipment that the client payment card is not among suspicious and forbidden cards listed in the verification database.

28. The method of claim 22, further comprising the step of verifying validity of the client payment card in the authentication system, and wherein said accepting payment comprises sending to the payment system, after said verifying validity of the client payment card, a request for debiting of the payment from a payment card account of the client.

29. The method of claim 22, further comprising the step of sending, to the terminal device of the client and to the service provider, a confirmation that an order has succeeded.

30. The method of claim 23, wherein the certificate database is updated by the trusted third party.

31. The method of claim 22, wherein the terminal device comprises a personal computer.

32. The method of claim 22, wherein the client payment card comprises one of a Visa card, a Mastercard card, a Diners Club card, and a bank card.

33. The method of claim 22, wherein the smart card contains, stored on the smart card, the electronic identity of the client and a private key of the client.

34. The method of claim 22, wherein the smart card contains, stored on the smart card, a public key associated with the payment service equipment.

35. The method of claim 22, wherein the telecommunication network comprises a packet-switched network.