Secure mobile-based financial transactions

• US 9,037,492 B2
• Filed: 05/19/2014
• Issued: 05/19/2015
• Est. Priority Date: 10/27/2009
• Status: Active Grant

• Current Assignee: AT&T Mobility II LLC (AT&T, Inc.)
• Original Assignee: AT&T Mobility II LLC (AT&T, Inc.)
• Inventors: White, Spencer Neil
• Primary Examiner(s): Goyea, Olusegun
• Application Number:
  US14/281,159
• Publication Number:
  US 20140258133A1
• Time in Patent Office: 365 Days
• Field of Search: 705/13, 705/17, 705 30- 35, 705/40, 705/44, 455411-414, 235375-380, 235/492
• US Class Current: 705/17
• CPC Class Codes: G06Q 20/00 Payment architectures, schemes or protocols apparatus for performing or posting payment transactions G07F7/08, G07F19/00; electronic cash registers G07G1/12
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/102 Bill distribution or payments
• CPC Class Codes: G06Q 20/105 involving programming of a portable memory device, e.g. IC cards, "electronic purses"
• CPC Class Codes: G06Q 20/18 involving self-service terminals [SST], vending machines, kiosks or multimedia terminals
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/202 Interconnection or interaction of plural electronic cash registers [ECR] or to host computer, e.g. network details, transfer of information from host to ECR or from ECR to ECR
• CPC Class Codes: G06Q 20/204 comprising interface for record bearing medium or carrier for electronic funds transfer or payment credit
• CPC Class Codes: G06Q 20/3223 Realising banking transactions through M-devices
• CPC Class Codes: G06Q 20/3227 using secure elements embedded in M-devices
• CPC Class Codes: G06Q 20/3255 using mobile network messaging services for payment, e.g. SMS
• CPC Class Codes: G06Q 20/326 Payment applications installed on the mobile devices
• CPC Class Codes: G06Q 20/327 Short range or proximity payments by means of M-devices
• CPC Class Codes: G06Q 20/3278 RFID or NFC payments by means of M-devices
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/425 using two different networks, one for transaction and one for security confirmation

Abstract

Devices, systems and methods are disclosed which relate to securing payments from a mobile communications device. In exemplary embodiments, a mobile communications device communicates with a payment server via a point-of-sale device to conduct a transaction. The mobile communications device uses a client payment logic to send payment information to the point-of-sale device. The point-of-sale device uses a vendor payment logic to forward the payment information to the payment server. The payment server verifies the payment information and sends confirmation to the point-of-sale device.

Claims

1. A system comprising:

a mobile communications device having an associated account and comprising

a first processor, and

a first memory storing a client payment logic that, when executed by the first processor, causes the first processor to perform first operations comprising

generating a payment number by combining a one-time digital key with a random number generated by the client payment logic, wherein combining the one-time digital key with the random number generated by the client payment logic comprises mixing numbers of the one-time digital key with numbers of the random number generated by the client payment logic, and

sending the payment number to a point-of-sale device;

the point-of-sale device in communication with the mobile communications device, the point-of-sale device comprising

a second processor, and

a second memory storing a vendor payment logic that, when executed by the second processor, causes the second processor to perform second operations comprising sending the one-time digital key to the mobile communications device via a wireless communication upon determination that the mobile communications device is not connected to a payment server; and

the payment server in communication with the mobile communications device through a cellular network and in communication with the point-of-sale device through a second network, the payment server comprising

a third processor, and

a third memory storing a server payment logic that, when executed by the third processor, cause the third processor to perform third operations comprising

sending the one-time digital key to the mobile communications device upon determination that the mobile communications device is connected to the payment server via the cellular network,

receiving the payment number and an amount from the point-of-sale device,

disassembling the payment number into the one-time digital key and the random number,

verifying the one-time digital key,

generating an identical random number using an identical random number generator algorithm,

comparing the random number as disassembled with the identical random number, and

deducting the amount from the associated account when the random number as disassembled and the identical random number match.

2. The system of claim 1, wherein the first operations further comprise sending the payment number and the amount to the point-of-sale device upon generating the payment number after receiving the one-time digital key.

3. The system of claim 1, wherein the mobile communications device is one of a cellular telephone, a notebook computer, and a personal digital assistant.

4. The system of claim 1, wherein the point-of-sale device is one of a cash register and a kiosk.

5. The system of claim 1, wherein the third operations further comprise sending a confirmation to the point-of-sale device when the amount is deducted.

6. The system of claim 1, wherein the point-of-sale device communicates with the payment server to receive the one-time digital key.

7. The system of claim 1, wherein the third operations further comprise comparing the amount to a payment cap.

8. A method comprising:

sending a one-time digital key to a mobile communications device, wherein sending the one-time digital key to the mobile communications device is accomplished via a cellular network from a payment server and via a wireless communication from a point-of-sale device upon determination that a connection between the mobile communications device and the payment server is not available;

generating, on the mobile communications device by a client payment logic, a payment number by combining the one-time digital key with a random number generated by the mobile communications device, wherein combining the one-time digital key with the random number generated by the mobile communications device comprises mixing numbers of the one-time digital key with numbers of the random number generated by the mobile communications device;

receiving, at the payment server, the payment number and an amount sent to the point-of-sale device from the mobile communications device;

disassembling the payment number into the one-time digital key and the random number;

verifying the one-time digital key and the random number, wherein verifying the random number is accomplished by the payment server generating an identical random number using an identical algorithm to an algorithm used to generate the random number on the mobile communications device and comparing the random number and the identical random number; and

deducting the amount from an account associated with the mobile communications device upon verification.

9. The method of claim 8, further comprising sending a confirmation corresponding to deducting the amount from the account.

10. The method of claim 8, wherein the point-of-sale device is one of a cash register and a kiosk.

11. The method of claim 8, wherein the mobile communications device is one of a cellular telephone, a notebook computer, and a personal digital assistant.

12. The method of claim 8, further comprising sending the payment number and the amount to the point-of-sale device upon generating the payment number after receiving the one-time digital key.

13. The method of claim 8, further comprising comparing the amount to a payment cap.

14. The method of claim 13, wherein the amount must be verified by the mobile communications device.

15. A method comprising:

receiving, at a mobile communications device from a point-of-sale device upon determining that the mobile communications device is not connected to a payment server via a cellular network, a one-time digital key;

sending, from the mobile communications device, a payment number and an amount to the point-of-sale device, the payment number generated by a client payment logic of the mobile communications device by combining the one-time digital key with a random number generated by the mobile communications device, wherein combining the one-time digital key with the random number generated by the mobile communications device comprises mixing numbers of the one-time digital key with numbers of the random number generated by the mobile communications device;

sending, from the point-of-sale device to the payment server, the payment number and the amount; and

deducting the amount from an account associated with the mobile communications device, wherein the payment server verifies the random number and the one-time digital key by generating an identical random number using an identical algorithm to an algorithm used to generate the random number on the mobile communications device and comparing the identical random number and the random number.

16. The method of claim 15, further comprising receiving a confirmation corresponding to deducting the amount from the account.

17. The method of claim 15, wherein the point-of-sale device is one of a cash register and a kiosk.

18. The method of claim 15, wherein the mobile communications device is one of a cellular telephone, a notebook computer, and a personal digital assistant.

19. The method of claim 15, further comprising comparing the amount to a payment cap.

20. The method of claim 19, wherein the amount must be verified by the mobile communications device.