Systems, Methods and Computer Program Products for Secure Contactless Payment Transactions

Abstract

The invention provides methods, systems and computer program products for implementing an electronic payment transaction between mobile communication device and a NFC enabled merchant device, both of which are configured to implement a defined communication protocol. The invention implements the required functionality by (i) receiving a request for a trust token from a merchant device, (ii) determining whether the merchant device is trustworthy, (iii) responsive to a determination that the merchant device is trustworthy, generating and transmitting a first displayable trust token to the merchant device, (iv) receiving a second displayable token from the mobile communication device, (v) comparing the received second displayable token against the first displayable token, and generating a merchant device validation message based on the comparison, and (vi) transmitting the merchant validation decision message to the mobile communication device.

Description

Claims

1. A method for implementing an electronic payment transaction between a mobile communication device configured for implementing a defined communication protocol and a merchant device configured to implement the wireless communication protocol, comprising implementing within a processor implemented trust token server, comprising: receiving from the merchant device a request for a trust token;determining whether the merchant device is trustworthy, wherein said determination is based on merchant device data associated with the merchant device;responsive to a determination that the merchant device is trustworthy, generating a first displayable trust token and transmitting the first displayable trust token to the merchant device;receiving a second displayable token from the mobile communication device, wherein the second displayable trust token has been imaged by the mobile communication device from a display coupled with the merchant device;comparing the received second displayable token or information extracted therefrom, against the first displayable token or information extracted therefrom, and generating a merchant device validation message based on the comparison, wherein: the merchant device validation decision message comprises an indication that the merchant device has been validated as being trustworthy, in response to the comparison resulting in a match decision; andthe merchant device validation decision message comprises an indication that the merchant device has not been validated as being trustworthy, in response to the comparison resulting in a non-match decision; and transmitting the merchant validation decision message to the mobile communication device.

2. The method as claimed in claim 1 wherein the defined communication protocol is a near-field-communication (NFC) protocol.

3. The method as claimed in claim 1, wherein: responsive to the merchant device validation decision message comprising an indication that the merchant device has been validated, the mobile communication device proceeds to implement a payment transaction through contactless communication between the mobile communication device and the merchant device; and responsive to the merchant device validation decision message comprising an indication that the merchant device has not been validated, the mobile communication device terminates the contactless communication session between the mobile communication device and the merchant device prior to: implementing the payment transaction, ortransmitting payor account information to the merchant device.

4. A system for implementing an electronic payment transaction between a mobile communication device configured for implementing a defined communication protocol and a merchant device configured to implement the wireless communication protocol, the system comprising: a trust token server comprising a processor and a memory, wherein the processor is configured to: receive from the merchant device, a request for a trust token;determine whether the merchant device is trustworthy, wherein said determination is based on merchant device data associated with the merchant device;responsive to a determination that the merchant device is trustworthy, generate a first displayable trust token and transmit the first displayable trust token to the merchant device;receive a second displayable token from the mobile communication device, wherein the second displayable trust token has been imaged by the mobile communication device from a display coupled with the merchant device;compare the received second displayable token or information extracted therefrom, against the first displayable token or information extracted therefrom, and generating a merchant device validation message based on the comparison, wherein: the merchant device validation decision message comprises an indication that the merchant device has been validated as being trustworthy, in response to the comparison resulting in a match decision; andthe merchant device validation decision message comprises an indication that the merchant device has not been validated as being trustworthy, in response to the comparison resulting in a non-match decision; andtransmit the merchant validation decision message to the mobile communication device.

5. The system as claimed in claim 4 wherein the defined communication protocol is a near-field-communication (NFC) protocol.

6. The system as claimed in claim 4, wherein: responsive to the merchant device validation decision message comprising information representing the merchant device as being validated, the mobile communication device proceeds to implement a payment transaction through contactless communication between the mobile communication device and the merchant device; andresponsive to the merchant device validation decision message comprising information representing the merchant device as not being validated, the mobile communication device terminates the contactless communication session between the mobile communication device and the merchant device, prior to: implementing the payment transaction, ortransmitting payor account information to the merchant device.

7. The system as claimed in claim 4, wherein the merchant device data includes any one or more of state data, historical data, parameter data, operating system data, device data, application integrity data, and operating system reliability state data corresponding to the merchant device.

8. The system as claimed in claim 4, wherein one or both of the first displayable trust token and the second displayable token comprise any of an optically displayable token, an optically imageable token, a pictogram, icon, image, bar code, optical code, data matrix code, or a quick-response (QR) code.

9. The system as claimed in claim 4, wherein the first displayable trust token comprises a token that is encrypted using one or more encryption algorithms or encryption keys, for which the corresponding decryption algorithms and / or decryption keys are accessible to the trust token server, and are not accessible to either of the merchant device or the mobile communication device.

10. The system as claimed in claim 4, wherein the first displayable trust token is generated and encrypted to include a set of data parameters associated uniquely with the first displayable trust token.

11. The system as claimed in claim 4, wherein: the first displayable trust token is associated with a defined time-to-live duration; andgeneration of the merchant device validation message is based on determining whether the second displayable token is received from the mobile communication device within a time-to-live duration that is associated with the first displayable trust token.

12. A non-transitory computer readable medium for implementing an electronic payment transaction between a mobile communication device configured for implementing a defined communication protocol and a merchant device configured to implement the wireless communication protocol, the non-transitory computer readable medium having a computer readable program code embodied therein, the computer readable program code comprising instructions for: receiving from the merchant device a request for a trust token;determining whether the merchant device is trustworthy, wherein said determination is based on merchant device data associated with the merchant device;responsive to a determination that the merchant device is trustworthy, generating a first displayable trust token and transmitting the first displayable trust token to the merchant device;receiving a second displayable token from the mobile communication device, wherein the second displayable trust token has been imaged by the mobile communication device from a display coupled with the merchant device;comparing the received second displayable token or information extracted therefrom, against the first displayable token or information extracted therefrom, and generating a merchant device validation message based on the comparison, wherein: the merchant device validation decision message comprises an indication that the merchant device has been validated as being trustworthy, in response to the comparison resulting in a match decision; andthe merchant device validation decision message comprises an indication that the merchant device has not been validated as being trustworthy, in response to the comparison resulting in a non-match decision; andtransmitting the merchant validation decision message to the mobile communication device.

13. The non-transitory computer readable medium of claim 12, wherein the defined communication protocol is a near-field-communication (NFC) protocol.

14. The non-transitory computer readable medium of claim 12, wherein: responsive to the merchant device validation decision message comprising an indication that the merchant device has been validated, the mobile communication device proceeds to implement a payment transaction through contactless communication between the mobile communication device and the merchant device; andresponsive to the merchant device validation decision message comprising an indication that the merchant device has not been validated, the mobile communication device terminates the contactless communication session between the mobile communication device and the merchant device prior to: implementing the payment transaction, ortransmitting payor account information to the merchant device.

15. The non-transitory computer readable medium of claim 12, wherein: the first displayable trust token is associated with a defined time-to-live duration; andgeneration of the merchant device validation message is based on determining whether the second displayable token is received from the mobile communication device within a time-to-live duration that is associated with the first displayable trust token.

16. The method of claim 1, wherein the merchant device data includes any one or more of state data, historical data, parameter data, operating system data, device data, application integrity data, and operating system reliability state data corresponding to the merchant device.

17. The method of claim 1, wherein one or both of the first displayable trust token and the second displayable token comprise any of an optically displayable token, an optically imageable token, a pictogram, icon, image, bar code, optical code, data matrix code, or a quick-response (QR) code.

18. The method of claim 1, wherein the first displayable trust token comprises a token that is encrypted using one or more encryption algorithms or encryption keys, for which the corresponding decryption algorithms and / or decryption keys are accessible to the trust token server, and are not accessible to either of the merchant device or the mobile communication device.

19. The method of claim 1, wherein the first displayable trust token is generated and encrypted to include a set of data parameters associated uniquely with the first displayable trust token.

20. The method of claim 1, wherein: the first displayable trust token is associated with a defined time-to-live duration; andgeneration of the merchant device validation message is based on determining whether the second displayable token is received from the mobile communication device within a time-to-live duration that is associated with the first displayable trust token.