[go: up one dir, main page]

WO2014174342A1 - Paiement mobile avec authentification et non-répudiation fortes - Google Patents

Paiement mobile avec authentification et non-répudiation fortes Download PDF

Info

Publication number
WO2014174342A1
WO2014174342A1 PCT/IB2013/053265 IB2013053265W WO2014174342A1 WO 2014174342 A1 WO2014174342 A1 WO 2014174342A1 IB 2013053265 W IB2013053265 W IB 2013053265W WO 2014174342 A1 WO2014174342 A1 WO 2014174342A1
Authority
WO
WIPO (PCT)
Prior art keywords
payer
payment
mobile
sell
customer
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/IB2013/053265
Other languages
English (en)
Inventor
Mohamed ELHARRAS
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Individual
Original Assignee
Individual
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Individual filed Critical Individual
Priority to PCT/IB2013/053265 priority Critical patent/WO2014174342A1/fr
Publication of WO2014174342A1 publication Critical patent/WO2014174342A1/fr
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
    • G06Q20/322—Aspects of commerce using mobile devices [M-devices]

Definitions

  • the design resolves the problem of identifying a mobile phone/computer user rather than identifying the device itself (which is the case in most current mobile authentication mechanisms), to make it clearer, a mobile phone user can make phone calls once the phone is in his possession unless the mobile phone was protected by a pin code in such case we say that the mobile device is protected by two-factors authentication : something you know (pin) and something you have (the mobile itself). The problem becomes more complicated once this mechanism is required to do payment as a third party (payment recipient) is introduced into the equation.
  • the mobile device user presents his credential (PIN code) at the payment station (authenticator) b.
  • the authenticator sends an encrypted message with the credentials it received to a verification authority (supplicant) which has access to all mobile users' credentials seeking verifications of this credential c.
  • the supplicant sends a message to the applicant's pre-registered mobile device with a one-time password token to be presented to the authenticator d. Once the token is presented manually to the authenticator, payment is considered done as the authenticator will send another message to the supplicant with payment confirmation e.
  • the authenticator sends a message to the supplicant indicating the completion of goods delivery and the supplicant might then send a message to the applicant with his/her new balance after this transaction.
  • the user registers with his payment authority (e.g. bank) and receives a PIN.
  • This pin has segments indicating the bank code and the customer code.
  • One of the registration fields is the customer's mobile phone number
  • the payment authority performs the necessary checks on the entered PIN: its correctness, its balance,..etc. and any built-in check routine (including running the necessary Fraud Management System checks at this point) before proceeding.
  • the payment authority sends a push USSD message to the sell point refusing the payment process.
  • the error message will be displayed to the customer at the sell point screen
  • the payment authority sends a SMS message to the customer mobile phone with the payment ID number.
  • This message content has a configurable life time after which it becomes invalid to use.
  • the payment authority updates customer balance and sends SMS to the customer with confirmation of transaction
  • This design is based on deploying the following security / anti-fraud techniques to produce the above process:
  • the user password might be switched to another form of passwords such as zero knowledge passwords where the user is asked for parts of a known secret (e.g. enter the first, third and last character of a known password). Switching to more complicated forms must be proportionate to the value of good/service the user asks access to.
  • Generating the one time password might take many forms. From random number to advanced random passwords could be used, again based on the value of the goods / service the user seeks access for. As such the system becomes a flexible payment tool covering payment for restaurant meals to payment for house down payments.
  • the above process is also valid when using a mobile computer (not phone) and messages can be exchanged using the Internet instead of the cellular mobile networks. The following part will introduce a real life case study: paying for fuel at petrol station.
  • the Payment Process represents the message flow diagram exchanged during payment process as per the proposed invention design (also enclosed in the file “Flow Diagram BW.PDF”
  • the user registers with the authentication authority (the government) who keeps any authentication credentials (name, mobile phone number, national ID number, car plate number ...etc).
  • the authentication authority the government
  • the customer has to enter data from both his car licenses and his national id card then a mobile phone is required.
  • the customer receives a SMS on his mobile with his 8 digits customer number
  • the reader at the petrol station is just a normal mobile phone, could be rugged device to sustain the hard operational environment 6.4
  • the reader at the fuel dispensing point opens USSD session (Unstructured Supplementary Service Data) sending this presented data plus the requested amount of fuel (e.g. 20 liters of fuel) to Tawasul platform which is a server hosting the software that does the authentication process and operates as centralized authenticator point for all mobile networks operators. Toii/osu/ then contacts the supplicant system (government, user bank ...etc) seeking verification of the presented credentials (in this case customer number)
  • the Tawasul platform Upon receiving confirmation of correctness, the Tawasul platform also receives the latest registered mobile number of this customer then Tawasul sends message through SMS to the customer phone with one time token (e.g. process ID in the form of 8-digits number).
  • the SMS content has expiration time after which it becomes invalid
  • Tawasul might send SMS to the customer with his new balance

Landscapes

  • Engineering & Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Accounting & Taxation (AREA)
  • Strategic Management (AREA)
  • Physics & Mathematics (AREA)
  • General Business, Economics & Management (AREA)
  • General Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

L'invention concerne la conception d'un processus de paiement mobile, en fonction de l'authentification du payeur par une authentification à deux facteurs, une chose que le payeur possède (son téléphone mobile) et quelque chose qu'il connaît (son code PIN). Le processus ne va pas à son terme tant qu'un numéro de confirmation représentant l'identification du paiement n'est pas reçu sur le téléphone du payeur, en provenance de l'autorité de paiement (banque du payeur, etc.). Le processus démarre par la saisie du justificatif d'identité du payeur au niveau du dispositif mobile du point de vente, à savoir : le code PIN du payeur, puis la banque du payeur envoie un SMS au numéro de mobile préenregistré du payeur avec une identification de transaction qu'il doit saisir dans le lecteur du point de vente pour obtenir les biens/le service demandés. Ainsi, on a vérifié la présence physique du payeur au point de vente, empêché le point de vente de faire de fausses opérations commerciales et surveillé/approuvé en temps réel toutes les transactions. Entre-temps, aucune donnée privée individuelle n'a été communiquée au vendeur et ni le vendeur ni le payeur ne peuvent renier leurs actions dans la transaction de vente (répudiation). Dans la mise en œuvre pragmatique, le processus repose sur le déploiement de ces messages échangés par le biais de communications mobiles en temps réel, un déploiement de USSD et SMS et une saisie de données physiques entre les trois parties : le payeur, le vendeur et l'autorité de paiement.
PCT/IB2013/053265 2013-04-25 2013-04-25 Paiement mobile avec authentification et non-répudiation fortes Ceased WO2014174342A1 (fr)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/IB2013/053265 WO2014174342A1 (fr) 2013-04-25 2013-04-25 Paiement mobile avec authentification et non-répudiation fortes

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/IB2013/053265 WO2014174342A1 (fr) 2013-04-25 2013-04-25 Paiement mobile avec authentification et non-répudiation fortes

Publications (1)

Publication Number Publication Date
WO2014174342A1 true WO2014174342A1 (fr) 2014-10-30

Family

ID=48577793

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/IB2013/053265 Ceased WO2014174342A1 (fr) 2013-04-25 2013-04-25 Paiement mobile avec authentification et non-répudiation fortes

Country Status (1)

Country Link
WO (1) WO2014174342A1 (fr)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108140182A (zh) * 2015-09-23 2018-06-08 平方股份有限公司 用于支付系统的消息分派器
US12361404B2 (en) 2016-06-29 2025-07-15 Block, Inc. Preliminary enablement of transaction processing circuitry

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO1998042173A2 (fr) * 1997-03-24 1998-10-01 Fd Finanssidata Oy Utilisation de services bancaires grace a un systeme radioelectrique numerique a cellules
WO2004049621A1 (fr) * 2002-11-28 2004-06-10 Gold Fusion International Limited Systeme d'authentification et d'identification et transactions utilisant un tel systeme d'authentification et d'identification
WO2010126509A2 (fr) * 2009-04-30 2010-11-04 Donald Michael Cardina Systèmes et procédés pour paiement mobile rendu aléatoire
WO2010140876A1 (fr) * 2009-06-01 2010-12-09 Bemobile Sdn. Bhd. Procede, systeme et serveur securise d'authentification multifactorielle de transaction
US20110231315A1 (en) * 2010-03-16 2011-09-22 Infosys Technologies Limited Method and system for making secure payments
US20120303534A1 (en) * 2011-05-27 2012-11-29 Tomaxx Gmbh System and method for a secure transaction

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO1998042173A2 (fr) * 1997-03-24 1998-10-01 Fd Finanssidata Oy Utilisation de services bancaires grace a un systeme radioelectrique numerique a cellules
WO2004049621A1 (fr) * 2002-11-28 2004-06-10 Gold Fusion International Limited Systeme d'authentification et d'identification et transactions utilisant un tel systeme d'authentification et d'identification
WO2010126509A2 (fr) * 2009-04-30 2010-11-04 Donald Michael Cardina Systèmes et procédés pour paiement mobile rendu aléatoire
WO2010140876A1 (fr) * 2009-06-01 2010-12-09 Bemobile Sdn. Bhd. Procede, systeme et serveur securise d'authentification multifactorielle de transaction
US20110231315A1 (en) * 2010-03-16 2011-09-22 Infosys Technologies Limited Method and system for making secure payments
US20120303534A1 (en) * 2011-05-27 2012-11-29 Tomaxx Gmbh System and method for a secure transaction

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108140182A (zh) * 2015-09-23 2018-06-08 平方股份有限公司 用于支付系统的消息分派器
CN108140182B (zh) * 2015-09-23 2022-06-14 布洛克公司 用于支付系统的消息分派器
US12361404B2 (en) 2016-06-29 2025-07-15 Block, Inc. Preliminary enablement of transaction processing circuitry

Similar Documents

Publication Publication Date Title
US12375269B2 (en) Systems and methods for trustworthy electronic authentication using a computing device
US11108558B2 (en) Authentication and fraud prevention architecture
US7490062B2 (en) Method of payment by means of an electronic communication device
US8407112B2 (en) Transaction authorisation system and method
EP2643787B1 (fr) Manipulation d'informations encodées
US9699183B2 (en) Mutual authentication of a user and service provider
US20110103586A1 (en) System, Method and Device To Authenticate Relationships By Electronic Means
US20060005024A1 (en) Dual-path pre-approval authentication method
AU2007281028A1 (en) Transaction authorisation system and method
WO2009087544A2 (fr) Système d'authentification et de certification à multiples facteurs pour des transactions électroniques
JP2003523569A (ja) サービスユーザのｉｄの認証を確認する方法及びこの方法を実施する装置
WO2004049621A1 (fr) Systeme d'authentification et d'identification et transactions utilisant un tel systeme d'authentification et d'identification
US20180183805A1 (en) System and method of authorization of simple, sequential and parallel requests with means of authorization through previously defined parameters
EP2533486A1 (fr) Procédé pour valider une transaction entre un utilisateur et un fournisseur de services
CN111937023B (zh) 安全认证系统和方法
US20140019366A1 (en) Method and a system for securing financial transaction
GB2519894A (en) Handling encoded information
JP2024507012A (ja) 支払いカード、認証方法、及び遠隔支払いのための使用
WO2014174342A1 (fr) Paiement mobile avec authentification et non-répudiation fortes
Kyrillidis et al. Card-present transactions on the internet using the smart card web server
RU50325U1 (ru) Система осуществления многофакторной строгой аутентификации держателя банковской карты с использованием мобильного телефона в среде мобильной связи при осуществлении межбанковских финансовых транзакций в международной платежной системе, по протоколу спецификации 3-d secure
KR102693911B1 (ko) 이미지 연상 2차 인증방법.
AU2014269180A1 (en) A system for authorizing electronic transactions and a method thereof
US20230409752A1 (en) System and method for localized permission-based sharing of personal information
Parte et al. Study and implementation of multi-criterion authentication approach to secure mobile payment system

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 13727652

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 13727652

Country of ref document: EP

Kind code of ref document: A1