Patent Application
20090018964
The present invention relates to secure transactions, and, more particularly, to methods, systems, and computer program products for performing transactions using Near Field Communication (NFC) technology.
NFC is a short-range, wireless connectivity technology standard that is designed to enable simple and secure communication between electronic devices. NFC technology operates by using magnetic field induction and allows connectivity to be achieved between two devices by simply bringing the two devices within a few centimeters of one another. NFC technology may be used in a variety of applications, such as contactless transactions (e.g., payment and ticketing), calendar synchronization, electronic business cards, and/or acquiring information from the surrounding environment, e.g., reading tags from posters, billboards, packaging, and the like. For applications such as monetary transactions involving credit cards, virtual payment cards, e-money, ticketing, and/or the like, security may be a concern. For example, if a mobile terminal, such as a cellular phone, is equipped with NFC technology and includes credit card information and/or e-money thereon, then if the phone is lost or stolen, another party may be able to make purchases using the phone by merely placing the phone in proximity to an NFC-enabled point-of-sale terminal.
According to some embodiments of the present invention, an electronic device performs a transaction by providing purchaser information for communication to a certification facility, receiving identification information associated with the purchaser from the certification facility, and completing the transaction responsive to authentication of the user of the electronic device as being the purchaser based on the received identification information.
In other embodiments, the identification information includes an image.
In still other embodiments, the image contains a verification indicium.
In still other embodiments, the verification indicium is a digital watermark.
In still other embodiments, completing the transaction includes presenting the image to a seller and receiving a transaction authorization from the seller responsive to a determination by the seller that the image is associated with the user of the electronic device.
In still other embodiments, the identification information includes a challenge.
In still other embodiments, completing the transaction includes receiving a response to the challenge from the user of the electronic device and authenticating the user of the electronic device as being the purchaser when the response received is correct.
In still other embodiments, the identification information is encrypted with a key known to a seller and unknown to the user of the electronic device.
In still other embodiments, completing the transaction includes receiving the key from the seller and decrypting the identification information using the key from the seller.
In still other embodiments, the method further includes defining a personal identification code associated with the purchaser and receiving a code that is input by the user of the electronic device. Providing the purchaser information includes providing the purchaser information for transmission to the certification facility when the code that is input by the user of the electronic device matches the defined personal identification code associated with the purchaser.
In still other embodiments, the purchaser information is encrypted.
In still other embodiments, providing purchaser information for communication to a certification facility includes transmitting the purchaser information to a point-of-sale terminal for forwarding to the certification facility.
In still other embodiments, transmitting the purchaser information to the point-of-sale terminal includes transmitting the purchaser information to the point-of-sale terminal using near field communication (NFC) technology.
In still other embodiments, providing purchaser information for communication to a certification facility includes transmitting the purchaser information to the certification facility.
In still other embodiments, completing the transaction includes completing the transaction with a point-of-sale terminal using near field communication (NFC) technology.
In still other embodiments, the electronic device is a mobile terminal.
In still other embodiments, an electronic device is configured to carry out one or more of the above-described methods.
In further embodiments of the present invention, a point-of-sale terminal performs a transaction by receiving identification information associated with a purchaser from a certification facility, authenticating a customer as being the purchaser based on the received identification information, and completing the transaction responsive to authentication of the customer as being the purchaser.
In still further embodiments, the identification information includes an image.
In still further embodiments, the image contains a verification indicium.
In still further embodiments, the verification indicium is a digital watermark.
In still further embodiments, the identification information includes a challenge.
In still further embodiments, completing the transaction includes presenting the challenge to the customer and receiving a response to the challenge from the customer. Authenticating the customer includes authenticating the customer as being the purchaser when the response received is correct.
In still further embodiments, completing the transaction includes presenting the image to a seller and receiving a transaction authorization from the seller responsive to a determination by the seller that the image is associated with the customer.
In still further embodiments, the method further includes receiving purchaser information from an electronic device associated with the customer and forwarding the purchaser information to the certification facility. Receiving the identification information includes receiving the identification information associated with the purchaser from the certification facility responsive to forwarding the purchaser information to the certification facility.
In still further embodiments, receiving the purchaser information from the electronic device includes receiving the purchaser information from the electronic device using near field communication (NFC) technology.
In still further embodiments, completing the transaction includes completing the transaction with an electronic device associated with the customer using near field communication (NFC) technology.
In still further embodiments, a point-of-sale terminal is configured to carry out one or more of the above-described methods.
In other embodiments of the present invention, a certification facility facilitates a transaction by receiving purchaser information and sending identification information associated with the purchaser to an electronic device associated with a customer and/or a point-of-sale terminal associated with a seller.
In still other embodiments, the identification information includes an image.
In still other embodiments, the image contains a verification indicium.
In still other embodiments, the verification indicium is a digital watermark.
In still other embodiments, the identification information includes a challenge.
In still other embodiments, the identification information is encrypted with a key known to the seller and unknown to the customer.
In still other embodiments, the purchaser information is encrypted.
In still other embodiments, a certification facility system is configured to carry out one or more of the above-described methods.
In still other embodiments, a computer program product includes computer-readable program code embodied on a computer-readable medium, the computer readable program code being configured to carry out one or more of the above-described methods.
Other features of the present invention will be more readily understood from the following detailed description of specific embodiments thereof when read in conjunction with the accompanying drawings, in which:
While the invention is susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and will herein be described in detail. It should be understood, however, that there is no intent to limit the invention to the particular forms disclosed, but on the contrary, the invention is to cover all modifications, equivalents, and alternatives falling within the spirit and scope of the invention as defined by the claims. Like reference numbers signify like elements throughout the description of the figures.
As used herein, the singular forms “a,” “an,” and “the” are intended to include the plural forms as well, unless expressly stated otherwise. It should be further understood that the terms “comprises” and/or “comprising” when used in this specification is taken to specify the presence of stated features, integers, steps, operations, elements, and/or components, but does not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and/or groups thereof. It will be understood that when an element is referred to as being “connected” or “coupled” to another element, it can be directly connected or coupled to the other element or intervening elements may be present. Furthermore, “connected” or “coupled” as used herein may include wirelessly connected or coupled. As used herein, the term “and/or” includes any and all combinations of one or more of the associated listed items.
Unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. It will be further understood that terms, such as those defined in commonly used dictionaries, should be interpreted as having a meaning that is consistent with their meaning in the context of the relevant art and will not be interpreted in an idealized or overly formal sense unless expressly so defined herein.
As used herein, the term “mobile terminal” may include a satellite or cellular radiotelephone with or without a multi-line display; a Personal Communications System (PCS) terminal that may combine a cellular radiotelephone with data processing, facsimile and data communications capabilities; a PDA that can include a radiotelephone, pager, Internet/intranet access, Web browser, organizer, calendar and/or a global positioning system (GPS) receiver; and a conventional laptop and/or palmtop receiver or other appliance that includes a radiotelephone transceiver. Mobile terminals may also be referred to as “pervasive computing” devices.
For purposes of illustration, embodiments of the present invention are described herein in the context of a mobile terminal. It will be understood, however, that the present invention is not limited to such embodiments and may be embodied generally as an electronic device that is configured to communicate with a point-of-sale terminal to perform a transaction.
To improve security in performing financial transactions, many credit cards now include a picture of the owner the card to prevent or at least inhibit the ability of another person to use the card. Unfortunately, stolen credit cards can be cloned on to a new piece of plastic with a different picture. The use of watermarking over the picture can help, but sophisticated parties can sometimes reproduce the watermark with sufficient accuracy to fool a seller. Near Field Communication (NFC) technology can be used to facilitate financial transactions using, for example, a virtual credit card, e-money, and the like. Similar to a conventional credit card without a picture, however, if a device equipped with NFC and purchasing software were to be stolen, a party may be able to make unauthorized purchases while in possession of the device. The purchasing software may require entry of a personal identification code, such as a Personal Identification Number (PIN) before allowing a purchase to be made, but such security may be deemed insufficient.
Some embodiments of the present invention may provide enhanced security for electronic transactions between devices by communicating purchaser information to a certification facility. The certification facility responds with identification information for the purchaser, such as an image or challenge, which is communicated to a customer's device and/or a point-of-sale terminal. If the identification information is sent to the customer's device, then it may be encrypted with a key known to the seller to keep the customer from altering the identification information in some way or inserting different identification information. The customer can then be authenticated as the purchaser based on the identification information and the transaction can be completed.
Referring now to
The electronic device 105 is described as a mobile terminal for purposes of illustrating some embodiments of the present invention. It will be understood, however, that the present invention is not limited to such embodiments and that the electronic device may be embodied as any electronic device that is configured to perform a transaction with the point-of-sale terminal 110. Thus, according to various embodiments of the present invention, the electronic device 105 may be a mobile terminal, such as a wireless phone, or may be relatively stationary device.
Although
Referring now to
The foregoing components of the mobile terminal 200 may be included in many conventional mobile terminals and their functionality is generally known to those skilled in the art.
The processor 240 communicates with the memory 235 via an address/data bus. The processor 240 may be, for example, a commercially available or custom microprocessor. The memory 235 is representative of the one or more memory devices containing the software and data used to operate the mobile terminal as well as to perform a transaction in which the user of the mobile terminal is authenticated as the purchaser. The memory 235 may include, but is not limited to, the following types of devices: cache, ROM, PROM, EPROM, EEPROM, flash, SRAM, and DRAM.
As shown in
Although
As shown in
Although
As shown in
Although
Computer program code for carrying out operations of devices, terminals, and/or systems discussed above with respect to
The present invention is described hereinafter with reference to message flow, flowchart and/or block diagram illustrations of methods, devices, and/or computer program products in accordance with some embodiments of the invention. These message flow, flowchart and/or block diagrams further illustrate exemplary operations for performing a transaction in which a certification facility provides identification information to an electronic device and/or point-of-sale terminal to authenticate a customer in accordance with various embodiments of the present invention. It will be understood that each message/block of the message flow, flowchart and/or block diagram illustrations, and combinations of messages/blocks in the message flow, flowchart and/or block diagram illustrations, may be implemented by computer program instructions and/or hardware operations. These computer program instructions may be provided to a processor of a general purpose computer, a special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the message flow, flowchart and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer usable or computer-readable memory that may direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer usable or computer-readable memory produce an article of manufacture including instructions that implement the function specified in the message flow, flowchart and/or block diagram block or blocks.
The computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions that execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the message flow, flowchart and/or block diagram block or blocks.
Operations for performing a transaction in which a certification facility provides identification information to an electronic device and/or point-of-sale terminal to authenticate a customer, in accordance with some embodiments of the present invention, will now be described with reference to
In accordance with various embodiments of the present invention, the purchaser information may be communicated to the point-of-sale terminal 110 via NFC, for example, for forwarding to the certification facility system 115 or the electronic device 105 may send the purchaser information directly to the certification facility system 115 over the communication network 120. For additional security, the purchaser information may be encrypted.
The certification facility system 115 receives the purchaser information and responds to the electronic device 105 and/or the point-of-sale terminal 110 with identification information associated with the purchaser at block 510. In accordance with various embodiments of the present invention, the identification information may be an image of the purchaser with or without a verification indicium, such as a digital watermark. In other embodiments, the identification information may be a challenge. For example, the certification facility system 115 may send a challenge question to the electronic device 105 and/or to the point-of-sale system terminal 110, which the user/customer is required to answer to authenticate the user/customer as the purchaser.
In some embodiments, the certification facility system 115 may encrypt the identification information before it is sent to the electronic device 105 and/or the point-of-sale terminal 110. For example, to discourage a user/customer from substituting his/her own image for the image sent from the certification facility system 115, the identification information may be encrypted with a key that is known to a seller, but is unknown to the user/customer.
At block 515, the user/customer is authenticated as being the purchaser. Authentication of the user/customer may be performed in a variety of ways in accordance with various embodiments of the present invention. If an image is sent to the electronic device 105 and/or the point-of-sale terminal 110, then a seller may view the image to determine if it matches the user/customer. If there is a match, then the seller via the point-of-sale terminal may communicate a transaction authorization to the electronic device 105. If the identification information is encrypted, then the identification information may be decrypted first before being used to authenticate the user/customer. For example, if the identification information is encrypted with a key that is known to the seller, but unknown to the user/customer, then the seller may provide the key that is used to decrypt the identification information on the electronic device 105. If the identification information is a challenge, then the user/customer may input a response to the challenge on the electronic device 105. If the response is correct, then the transaction module 285 may authenticate the user/customer on the electronic device 105 or may communicate, via NFC, for example, the correct answer to the point-of-sale terminal 110 to authenticate the user/customer.
It will be understood that the above-described authentication scenarios are merely exemplary and that the user/customer may be authenticated on various ones of the electronic device 105, the point-of-sale terminal 110 and/or the certification facility system 115 to authorize a transaction. Moreover, the various authentication techniques, such as using an image with or without a verification indicium, using a challenge, using a personal identification code and/or using encryption may be combined in various ways depending on the level of security desired.
Returning to
The flowchart of
Many variations and modifications can be made to the embodiments without substantially departing from the principles of the present invention. All such variations and modifications are intended to be included herein within the scope of the present invention, as set forth in the following claims.
