The invention relates to a data transmission and processing arrangement for customer payment of a product or service at a retailer point of sale as well as a corresponding data transmission and processing method.
The on-site “electronic” payment of goods or services; i.e. at a retailer's point of sale, using a bank or credit card has long been standard in everyday payment transactions. In recent years, there has also thereby been intensified use of retailer terminals, so-called point-of-sales (PoS) terminals, which are equipped for near-field data communication with a likewise endowed bank card.
In recent years, substantial developments have been pursued in which a bank card is implemented in virtualized form in an intelligent customer device, in particular a smartphone, so that the smartphone's owner can use his bank account solely by using the smartphone—thus without using a physical bank card—and thereby also realize payment transactions.
In addition, the method of near-field data communication according to the NFC standard has steadily become more widely available, even beyond just payment transactions of the aforementioned type alone. The smartphones of the Apple manufacturer have recently offered mobile app vendors a function via which the smartphone NFC Data Exchange Format (NDEF) can read out data from other NFC devices. Other well-known smartphone manufacturers already support this NFC data format such that it can be used to create a new payment process which covers all common smartphones.
The invention is based on the task of specifying a constructive solution for the on-site payment of goods or services at a retailer's location using a suitable customer device, said solution being simple and yet at the same time secure and can thus anticipate having high user acceptance.
With respect to the device, this task is solved by an arrangement having the features of claim 1, 2 or 3 and with respect to its method, by a method having the features of claim 10, 11 or 12. Advantageous further developments of the inventive concept constitute the subject matter of the dependent claims.
The present invention indicates a solution which enables mobile app vendors to develop mobile payment solutions for smartphones which are accepted at established point-of-sales (POS) terminals.
The proposed arrangement comprises an NFC-capable retailer device, an NFC-capable customer device and a retailer payment service provider server, wherein the NFC retailer device comprises a first data exchange software component (hereinafter also “software component 1”) which makes the payment data available for readout by the NFC customer device in passive NFC mode and in particular in the NFC Data Exchange Format (NDEF) and the NFC customer device comprises a second data exchange software component (hereinafter also “software component 2”) which imports the payment data in active mode and interprets as NDEF-formatted payment data.
The NFC customer device in particular comprises a virtualized payment card which is virtualized on the NFC customer device in the form of a Host Card Emulation (HCE) and protected by the white-box cryptography principle.
Furthermore, the retailer device comprises switching means for switching from an active NFC operating mode, in which Request-to-Answer-To-Select (RATS) commands are sent, into the passive readout mode in response to no Answer-To-Select (ATS) response from the customer device after a predefined interval of time. The payment service provider server in particular comprises transmitting means for transmitting a payment confirmation to the retailer device as well as for transmitting an additional confirmation message to the customer device over a wireless network.
Method aspects of the invention essentially correspond to the arrangement aspects and are inasmuch not reiterated here.
Reference is, however, made to one implementation in which prior to providing the payment data in the passive read-out mode, the retailer device sends out RATS commands in an active NFC operating mode and switches into the passive read-out mode upon no response after a predefined interval of time. One configuration provides for the back and forth switching from active NFC operating mode into passive read-out mode to be cyclically repeated a number of times until the retailer device identifies the NFC mode in which the customer device is to be addressed.
In a further configuration, the payment data is actively transmitted from the retailer device to the payment service provider server in response to the retailer device having exchanged the payment data with the customer device in one of the two NFC modes.
The payment data particularly comprises an identification of the retailer device, a transaction identification and a payment amount, and is in particular digitally signed by a signature component in the retailer device.
Provided to further increase the security of the data transmission is for the customer to be legitimized at the customer device via acquisition and analysis of a biometric feature or input and analysis of a PIN prior to and as a condition for the step of the customer device actively reading out the payment data. Further provided in terms of this aspect is for the payment order dataset to be digitally signed in the customer device, in particular by the virtualized bank card, before being transmitted to the payment service provider server.
In a further configuration, in addition to or in place of the customary payment service provider server linked to a POS terminal, also called network provider in Germany, another online payment service provider is integrated which communicates with a mobile online payment service provider app on the customer device. To verify the authenticity of the payment order, the bank of the customer paying at the point-of-sale terminal then does not necessarily need an aforementioned bank card signature but can execute the payment as a direct debit and leave the customer authentication to the online payment service provider which normally authenticates the customer via the online payment service provider app and a password or PIN input and/or biometric feature.
Since according to today's EMC requirement, the POS terminal may only be switched into active NFC operating mode and not passive readout mode in a traditional EMC card transaction, software component 1 must be installed on the POS terminal outside of the so-called EMC core and can be directly connected to any given payment service provider which does not necessarily have to be a network provider but rather can also be solely an online payment service provider.
If the customer device is to independently process the payment data via a payment service provider after same having been read out from the POS terminal by means of NFC pursuant to the inventive principle, the customer device needs to have an online connection. That is not always the case at point-of-sale terminals.
A further configuration addresses the payment data, after having been received from the customer device via NFC and the customer authorizing payment there, not being received via the customer device but rather via the NFC retailer device for the payment service provider. To generate or forward the payment order dataset, the NFC retailer device reads in customer data beforehand via Bluetooth or WLAN, such as an IBAN account or a card number or, respectively, the previously created payment order dataset. In the latter case, the retailer device functions as a gateway between the customer device and the payment service provider server.
Compared to just a Bluetooth connection between the two devices, the combination of an initial NFC connection with a subsequent Bluetooth connection between the POS terminal and customer device has the advantage of the customer intuitively expressing the intention to pay with an NFC connection, by the customer having to hold his customer device close to the NFC point of the POS terminal while a Bluetooth connection can be established at a distance of for example 1m without any corresponding action on the part of the customer and the customer then needs to manually select the appropriate retailer device.
The two Bluetooth/WLAN communication partners; i.e. the retailer device and the customer device, can be automatically connected, for example by the customer device also receiving from the retailer device, in addition to the payment data, the Bluetooth identification code or the EAP (Extensible Authentication Protocol) WLAN code of the retailer device respectively and then precisely establishing a Bluetooth/WLAN connection with same.
The Bluetooth/WLAN passwords to access the retailer device can be generated dynamically by same just for the respective session and communicated to the customer device via NFC. This prevents fraudulent replay attacks.
The NFC retailer device can be a stationary or mobile POS terminal. Recently, commercially available smartphones have also been able to be used as mobile POS terminals in conjunction with the applicable mobile apps.
Advantages and functionalities of the invention in other respects are yielded by the following explanation of example embodiments based on the accompanying figures, which show:
In accordance with
At the beginning of the payment procedure, the retailer device 1 displays a payment amount on a corresponding display and thereby holds a payment dataset ready internally. When the retailer device detects the approaching of the NFC customer device 2 (particularly by a change in the detected electromagnetic field strength), it sends the usual RATS command in active NFC mode to establish a connection, which is in particular defined with a passive NFC communication partner.
Additionally to the payment service provider connected to the retailer device,
Taking the place of the server 3 of the online payment service provider in the arrangement according to
According to
Furthermore, reference is made to claim 10 with regard to the method steps according to
In the arrangement and the method according to
According to
Furthermore, the invention can also be implemented in a plurality of modifications of the example depicted here and of the aspects of the invention emphasized further above.
| Number | Date | Country | Kind |
|---|---|---|---|
| 102017114275.4 | Jun 2017 | DE | national |
| 102017115074.9 | Jul 2017 | DE | national |
| 102018105757.1 | Mar 2018 | DE | national |