US20140337235A1 - Person-to-person electronic payment processing - Google Patents

Abstract

A method of person-to-person anonymous electronic payment processing may involve a payment processing server receiving from a payor payment device a payment initiation request for a payment from a payor account. The payment initiation request may identify a payment amount and excludes payee particulars and the payee account. The server may also receive from a payee payment device a payment completion request requesting completion of the payment. The payment completion request may include a payee identifier and exclude the payment amount, payor account and payor particulars. The server may confirm that the payment completion request is uniquely associated with the payee payment device and the payee identifier, and determine the payment amount and the payor account by correlating the payment completion request with the payment initiation request. In accordance with an outcome of the confirming, the payment processing server may effect a transfer in the payment amount from the payor account to the payee account.

Description

CROSS-REFERENCE TO RELATED APPLICATIONS
• This application claims the benefit of priority to U.S. Provisional Patent Application No. 61/821,228, filed May 8, 2013, the disclosure of which is incorporated herein by reference to its entirety.
BACKGROUND
• 1. Technical Field
• This patent application relates to a method and network for processing electronic payments.
• 2. Background Information
• To make a person-to-person electronic payment, a payor may initiate an e-payment transfer through the payor's financial institution server. Using a web portal or a dedicated software application, the payor provides the payor's financial institution server with the intended payment amount, the payee's e-mail address or phone number, and a security question and answer. The financial institution server may issue to the payee an e-mail or text message that includes a link to the pending transaction, and identifies the payment amount and the payor. To accept the payment, the payee may use its computing device to select the transaction link, which causes the payee to authenticate to the payee's financial institution account and to be prompted for an answer to the security question. If the security answer provided by the payee corresponds with the security answer provided by the payor, the payor's financial institution server may effect a payment transfer from the payor's financial institution account to the payee's financial institution account.
• Although e-payment transfers are convenient, to receive the payment, the payor must be provided with personal information of the payee (e.g. an e-mail address, a phone number, an answer to security question), and the payee receives personal information (e.g. a name, an e-mail address) of the payor. The payee could provide the payor with a generic e-mail account address or the phone number of a disposal mobile phone. However, the payee may wish not to provide the payor with any such personal information. Moreover, e-payment transfers may be subject to man-in-the-middle attacks that can intercept the payee's security answer, and direct the payment to an unauthorized account.
SUMMARY
• The disclosed embodiments include a person-to-person e-payment processing server and computerized systems and methods that process electronic payments without exchanging personal information between payor and payee.
• In some embodiments, a method of person-to-person electronic payment processing may involve a payment processing server receiving, from a payor payment device, a payment initiation request for a payment from a payor account. The payment initiation request may identify a payment amount of the payment and exclude particulars of the payee and particulars of a payee account.
• The payment processing server may receive, from a payee payment device, a payment completion request requesting completion of the payment. The payment completion request may include a payee identifier and exclude the payment amount, the payor account and particulars of the payor.
• The payment processing server may confirm that the payment completion request is uniquely associated with the payee payment device and the payee identifier, and may determine the payment amount, the payor account, and the payee account from the payment completion request. The payment processing server may determine the payment amount and the payor account by correlating the payment completion request with the payment initiation request. In accordance with an outcome of the confirming, the payment processing server may effect a transfer in the payment amount from the payor account to the payee account.
• In certain aspects, there is also provided a payment processing server that includes a network interface, and a computer processing system that is coupled to the network interface. The computer processing system may be configured to receive, from a payor payment device, a payment initiation request for a payment from a payor account, the payment initiation request identifying a payment amount of the payment and excluding particulars of the payee and particulars of a payee account.
• The computer processing system may be configured to receive, from a payee payment device, a payment completion request requesting completion of the payment. The payment completion request may include a payee identifier and exclude the payment amount, the payor account and particulars of the payor.
• The computer processing system may be configured to (i) confirm that the payment completion request is uniquely associated with the payee payment device and the payee identifier, (ii) determine the payee account from the payment completion request, and (iii) determine the payment amount and the payor account by correlating the payment completion request with the payment initiation request. The computer processing system may also be configured to effect a transfer in the payment amount from the payor account to the payee account in accordance with an outcome of the confirming.
• In other embodiments a method of person-to-person electronic payment processing may involve a payment processing server receiving, from a payee payment device, a payment completion request that includes a transaction pointer to transaction particulars of a financial transaction between a payor and a payee. The transaction particulars may include a payment amount and a payor account. The payment completion request may include a payee identifier and exclude the transaction particulars and particulars of the payor.
• The payment processing server may confirm that the payment completion request is uniquely associated with the payee payment device and the payee identifier, may determine a payee account by querying an accounts database with the payee identifier, and may determine the payment amount and the payor account by querying a transactions database with the transaction pointer. In accordance with an outcome of the confirming, the payment processing server may effect a transfer in the payment amount from the payor account to the payee account.
• In some aspects, a payment processing server includes a network interface, a transactions database, an accounts database, and a computer processing system that is in communication with the network interface and the databases. The computer processing system may be configured to receive, from a payee payment device via the network interface, a payment completion request that includes a transaction pointer to transaction particulars of a financial transaction between a payor and a payee. The transaction particulars may include a payment amount and a payor account. The payment completion request may include a payee identifier and may exclude the transaction particulars and particulars of the payor.
• The computer processing system may be configured to (i) confirm that the payment completion request is uniquely associated with the payee payment device and the payee identifier, (ii) determine a payee account by querying the accounts database with the payee identifier, and (iii) determine the payment amount and the payor account by querying the transactions database with the transaction pointer. The computer processing system may also be configured to effect a transfer in the payment amount from the payor account to the payee account in accordance with an outcome of the confirming.
• Since the payment processing server confirms that the payment completion request is uniquely associated with the payee payment device and the payee identifier prior to effecting the transfer, the likelihood of the payment being subject to a successful man-in-the-middle attack may be reduced.
• The disclosed embodiments include, for example, a method of person-to-person anonymous electronic payment processing. The method may include receiving, by a payment processing server, and from a payor payment device, a payment initiation request for a payment from a payor account. In some aspects, the payment initiation request identifies a payment amount of the payment and excludes particulars of the payee and particulars of a payee account. The method may also include receiving, by the payment processing server, and from a payee payment device, a payment completion request requesting completion of the payment. In some aspects, the payment completion request may include a payee identifier, and may exclude the payment amount, the payor account and information associated with the payor. The method may also include confirming, by the payment processing server, that the payment completion request is uniquely associated with the payee payment device and the payee identifier, and determining, by the payment processing server, the payment amount, the payor account and the payee account from the payment completion request. In some aspects, the payment processing server may determine the payment amount and the payor account by correlating the payment completion request with the payment initiation request. The method may further include effecting, by the payment processing server, a transfer in the payment amount from the payor account to the payee account, in accordance with the confirmation.
• The disclosed embodiments also include a payment processing server having a storage device and at least one processor coupled to the storage device. The storage device may store software instructions for controlling the at least one processor when executed by the at least one processor. In one embodiment, the at least one processor may be operative with the software instructions and may be configured to receive from a payor payment device a payment initiation request for a payment from a payor account. In some aspects, the payment initiation request may identify a payment amount of the payment, and may exclude particulars of the payee and particulars of a payee account. The at least one processor may be further configured to receive from a payee payment device a payment completion request requesting completion of the payment. In some aspects, the payment completion request may include a payee identifier, and may exclude the payment amount, the payor account and information associated with the payor. The at least one processor may be further configured to confirm that the payment completion request is uniquely associated with the payee payment device and the payee identifier, determine the payee account from the payment completion request, and determine the payment amount and the payor account by correlating the payment completion request with the payment initiation request. The at least one processor may be further configured to effect a transfer in the payment amount from the payor account to the payee account in accordance with an outcome of the confirming.
• The disclosed embodiments also include a tangible, non-transitory computer-readable medium storing instructions that, when executed by at least one processor, perform a method of person-to-person anonymous electronic payment processing. The method may include receiving from a payor payment device, a payment initiation request for a payment from a payor account. In some aspects, the payment initiation request identifies a payment amount of the payment and excludes particulars of the payee and particulars of a payee account. The method may also include receiving from a payee payment device, a payment completion request requesting completion of the payment. In some aspects, the payment completion request may include a payee identifier, and may exclude the payment amount, the payor account and information associated with the payor. The method may also include confirming that the payment completion request is uniquely associated with the payee payment device and the payee identifier, and determining, by the payment processing server, the payment amount, the payor account and the payee account from the payment completion request. In some aspects, the payment processing server may determine the payment amount and the payor account by correlating the payment completion request with the payment initiation request. The method may further include effecting a transfer in the payment amount from the payor account to the payee account, in accordance with the confirmation.
BRIEF DESCRIPTION OF THE DRAWINGS
• An exemplary e-payment processing network, payment processing server, and method of person-to-person electronic payment will now be described, with reference to the accompanying drawings, in which:
• FIG. 1 is a diagram of an exemplary e-payment processing network, consistent with disclosed embodiments;
• FIG. 2 is a diagram of an exemplary payment device, consistent with disclosed embodiments;
• FIG. 3 is a diagram of an exemplary payment processing server, consistent with disclosed embodiments; and
• FIG. 4 is a message flow diagram of an exemplary method of person-to-person electronic payment, consistent with disclosed embodiments.
DETAILED DESCRIPTION
• Reference will now be made in detail to disclosed embodiments, examples of which are illustrated in the accompanying drawings. The same reference numbers in the drawings and this disclosure are intended to refer to the same or like elements, components, and/or parts.
• In this application, the use of the singular includes the plural unless specifically stated otherwise. In this application, the use of “or” means “and/or” unless stated otherwise. Furthermore, the use of the term “including,” as well as other forms such as “includes” and “included,” is not limiting. In addition, terms such as “element” or “component” encompass both elements and components comprising one unit, and elements and components that comprise more than one subunit, unless specifically stated otherwise. Additionally, any section headings used herein are for organizational purposes only, and are not to be construed as limiting the subject matter described.
• FIG. 1 is a diagram of an exemplary e-payment processing network, denoted generally as100. As shown inFIG. 1, thee-payment processing network100 includes a firstelectronic payment device200a, a secondelectronic payment device200b(collectively, payment devices200), and apayment processing server300. Although thee-payment processing network100 may include only twopayment devices200, thee-payment processing network100 typically may include a plurality of thepayment devices200. Moreover, although thee-payment processing network100 includes only a singlepayment processing server300, in additional embodiments, thee-payment processing network100 may include a plurality ofpayment processing servers300.
• One or more of theelectronic payment devices200 may be implemented as a wireless communications device configured to operate within a wireless network. In certain aspects, thee-payment processing network100 may also include amobile communications network120. Themobile communications network120 may, for example, be configured as a WiFi network, a cellular network, or a combination thereof. As shown, themobile communications network120 includes a plurality of wirelessbase station subsystems122. Thepayment devices200 communicate with thebase station subsystems122 viawireless links124, and the base station subsystems communicate with thepayment processing server300 via a wired, wireless or optical link. In some aspects, thebase station subsystems122 act as a bridge between thewireless links124 and thee-payment processing network100. Further, one or more of theelectronic payment devices200 may be implemented as a smartcard (e.g. an EMV payment card) that is configured to communicate withother payment devices200, for example, using Bluetooth and/or Near Field Communications (NFC).
• An exemplary electronic payment device (e.g.,payment device200a), implemented as a wireless communications device is depicted inFIG. 2. As shown inFIG. 2, thepayment device200aincludes adisplay202, auser input device204, and adata processing system206. Theuser input device204 may be provided as a keyboard, biometric input device (e.g. microphone) and/or a touch-sensitive layer provided on thedisplay202. Thedata processing system206 may include amicroprocessor208, awireless communication sub-system210 and a memory212. In certain aspects, thecommunication sub-system210, allows thepayment device200 to communicate with themobile communications network120. As discussed herein, themobile communications network120 may be configured as a WiFi network, a cellular network, or a combination thereof. In some embodiments, thecommunication sub-system210 allows thepayment device200ato transmit and receive wireless communications signals over WiFi networks and/or cellular networks.
• The memory212 may include a tangible, non-transitory computer-readable medium, and may include non-transient computer processing instructions stored thereon which, when accessed from the memory212 and executed by themicroprocessor208, implement anoperating system214, apayment initiation procedure216, and apayment completion procedure218. In some aspects,microprocessor208 may be configured to implement theoperating system214 to display output on thedisplay202, to receive user input from theinput device204, and to send and receive communication signals over thewireless link124 of themobile communications network120. The operation of thepayment initiation procedure216 and thepayment completion procedure218 will be discussed in greater detail below. In certain aspects,microprocessor208 may be configured to implement thepayment initiation procedure216 to receive, from theuser input device204, particulars of a payment to be made from an account associated with a payor (e.g., a “payor account”), and to transmit the payment particulars to thepayment processing server300, via themobile communications network120. As will be discussed, the payment initiation request may identify a payment amount, and may excludes particulars of a payee and particulars of an account associated with the payee (e.g., a “payee account”).
• In some aspects,microprocessor208 may be configured to implement thepayment initiation procedure216 to receive from thepayment processing server300, via themobile communications network120, a payment token generated in response to the payment particulars. The payment token may include, for example, an encoded electronic message, and thepayment initiation procedure216 may generate a visual representation of the payment token (e.g. a two-dimensional bar code (QR code)) and display the visual representation on thedisplay202 for capture by another payment device (e.g.,payment device200b). Alternately, thepayment initiation procedure216 implemented bymicroprocessor208 may directly or indirectly wirelessly transmit the visual representation of the payment token to another payment device (e.g.,payment device200b). In other aspects, and instead of generating a visual representation of the payment token,payment device200a, through thepayment initiation procedure216, may wirelessly transmit the payment token directly or indirectly to theother payment device200b. As non-limiting examples, thepayment device200amay wirelessly transmit the payment token (or the visual representation thereof) directly to theother payment device200b(for example via Bluetooth or NFC), or indirectly to theother payment device200b(for example via WiFi or cellular communications) using a relay and proximity service, such as the relay service provided by Bump Technologies.
• In some embodiments,payment device200a, through thepayment completion procedure218 implemented bymicroprocessor208, may receive a payment token from another payment device (e.g.,payment device200b), and may generate a payment completion request from the payment token. In certain aspects, the payment completion request may include a payee identifier that is uniquely associated with the payee, and may exclude the payment amount, the payor account and particulars of the payor. The visual representation of the payment token may have been displayed on thedisplay202 of theother payment device200b, in whichcase payment device200amay receive the payment token via an image capture device incorporated into thepayment device200a. Alternately, thepayment device200amay wirelessly receive the payment token (or the visual representation thereof) from theother payment device200b. As non-limiting examples, thepayment device200amay receive the payment token directly from theother payment device200b(for example, via Bluetooth or NFC), or indirectly (for example via WiFi or cellular communications) using a relay service.
• In an embodiment, thepayment device200amay be implemented as a smartcard. Thepayment device200amay, when configured as a smartcard, have a similar configuration to that described above in reference toFIG. 2, but without thedisplay202 anduser input device204, and with thecommunication sub-system210 configured to allow thepayment device200 to communicate via Bluetooth and/or NFC. Further, in certain aspects, one or more payment tokens may be stored on thepayment device200a(configured as a smartcard) by the distributor thereof or during an e-payment registration process (described below), or dynamically generated by thepayment initiation procedure216 implemented by thepayment device200ain response to a payment request received from another payment device (e.g.,payment device200b).
• In some embodiments, thepayment processing server300 may be implemented as a computer server, and may be configured to generate one or more electronic instructions that effect a transfer from a payor account to a payee account. In some aspects, thepayment processing server300 maintains the payor account and the payee account. By way of example, thepayment processing server300 may be associated with a financial institution (e.g., a financial institution server), the payor's account and/or the payee's account may include, but is not limited to, a savings account, a chequing account, a credit account and a line of credit account, and thepayment processing server300 may be used to transfer funds from the payor's account to the payee's account. In other embodiments, however, thepayment processing server300 may be used to facilitate a transfer of units other than funds. For example, the payor's account and the payee's account may include loyalty points accounts, and thepayment processing server300 may be used to facilitate a transfer of loyalty points from the payor's account to the payee's account.
• Further, although thepayment processing server300, in this embodiment, may maintain both the payor's account and the payee's account, in additional embodiments, the payor's account and the payee's account may be maintained by respective account servers (e.g., associated with respective financial institution servers), and thepayment processing server300 may act as a trusted intermediary to the respective account servers. In certain aspects, thepayment processing server300 may effect the transfer of units (e.g. funds, points) from the payor's account to the payee's account via the payor account server and the payee account server.
• As shown inFIG. 3, thepayment processing server300 may include anetwork interface302, and acomputer processing system306 that is coupled to thenetwork interface302. In some embodiments, thenetwork interface302 may interface thepayment processing server300 with thebase station subsystems122 of themobile communications network120 and may allow thepayment processing server300 to communicate with thecommunications payment devices200. If thepayment processing server300 acts as a trusted intermediary to the payor's and the payee's respective account servers, thenetwork interface302 may also interface thepayment processing server300 with a payment network that comprises the account servers.
• Thecomputer processing system306 may also include one ormore microprocessors308 and a computer-readable medium310. The computer-readable medium310 may be provided as tangible, non-transitory computer-readable medium, such as electronic computer memory (e.g. flash memory) or optical or magnetic memory (e.g. compact disc, hard disk).
• The computer-readable medium310 may maintain anaccounts database312 and anaccount holders database314. Theaccounts database312 may include a plurality of clusters, each associated with a respective payor or payee account. Each cluster may, for example, include a plurality of database records, each identifying a credit/deposit entry to the associated account. Theaccount holders database314 may include a plurality of clusters, each associated with a respective account holder (payor or payee). In some embodiments, each cluster saves an identifier that is uniquely associated with the respective account holder, and an identifier that is uniquely associated with the payment device (e.g.,payment device200a) used by the account holder.
• The computer-readable medium310 may also maintain non-transient computer processing instructions stored thereon which, when executed by the microprocessor(s)308, define an operating system (not shown) that controls the overall operation of thepayment processing server300. The computer processing instructions may, upon implementation bymicroprocessor308, also implement apayment initiation processor316 and apayment completion processor318.
• Thepayment initiation processor316 may be configured to receive, from a payor's payment device (e.g.,payment device200a), a payment initiation request to initiate a payment from a payor's account. The payment initiation request may identify a payment amount and exclude particulars of the payee and particulars of the payee's account. The payment initiation request may also include the payor identifier that is uniquely associated with the payor. Further, in some aspects, thepayment initiation processor316 may also be configured to generate a payment token from the payment initiation request, and to transmit the payment token to the payor'spayment device200a.
• In some embodiments,microprocessor308 may be configured to implement thepayment completion processor318 to receive, from a payee's payment device (e.g.,payment device200b) a payment completion request requesting completion of the payment. The payment completion request may include the payee identifier that is uniquely associated with the payee, and may exclude the payment amount, the payor's account and particulars of the payor (e.g., information identifying the payor).
• In additional embodiments, thepayment completion processor318 may be configured bymicroprocessor308 to confirm that the payment completion request is uniquely associated with the payee'spayment device200band the payee identifier, and to determine the payment amount, the payor account and the payee account from the payment completion request. In certain aspects, thepayment completion processor318 may determine the payment amount and the payor account by correlating the payment completion request with the payment initiation request. Further, thepayment completion processor318 may also be configured to effect a transfer in the payment amount from the payor account to the payee account, in accordance with an outcome of the confirmation.
• Although thepayment initiation processor316 and thepayment completion processor318 may be implemented through an execution of computer processing instructions bymicroprocessor308, all or a portion of the functionality of thepayment initiation processor316 and/or thepayment completion processor318 may be implemented instead in electronics hardware or a special-purpose computer.
• FIG. 4 illustrates an exemplary method of person-to-person electronic payment, which may be implemented using thee-payment processing network100. By way of example, a person (e.g., a payor) may initiate an electronic payment to another person (e.g., a payee) by using the payor'spayment device200ato transmit to the payment processing server300 a payment initiation request that identifies a payment amount and excludes particulars of the payee and particulars of the payee's account. The payee may initiate receipt of the electronic payment by using the payee'spayment device200bto transmit to the payment processing server300 a payment completion request that requests completion of the payment, includes the payee's unique identifier, and excludes the payment amount, the payor account and particulars of the payor.
• In some aspects, thepayment processing server300 may confirm that the payment completion request is uniquely associated with the payee payment device and the payee's unique identifier, and may determine the payment amount, the payor account and the payee account from the payment completion request. Thepayment processing server300 may, for example, determine the payment amount and the payor account by correlating the payment completion request with the payment initiation request. Thepayment processing server300 may effect a transfer in the payment amount from the payor account to the payee account in accordance with an outcome of the confirmation.
• Referring back toFIG. 4, and at an outset of the method, the payor and the payee may each use their respective payment devices200 (e.g.,payment device200aand200b) to authenticate to thepayment processing server300. For example, thepayment device200amay communicate directly with thepayment processing server300, or indirectly via a communications appliance (for example, where thepayment device200ais implemented as a smartcard). In certain aspects, the user'spayment device200aestablishes an encrypted communications channel with thepayment processing server300, and the device user (e.g., the payee) authenticates to thepayment processing server300 by transmitting to thepayment processing server300 over the encrypted communications channel the authentication credentials (e.g. payment card number and password) that the device user normally uses to initiate electronic banking with the payment processing server300 (or with the user's financial institution server).
• After successfully authenticating to thepayment processing server300, the device user uses itspayment device200a(or alternatively, a corresponding communications appliance) to invoke an e-payment registration process implemented by thepayment processing server300. In response, thepayment processing server300 may optionally prompt the device user to provide particulars of the account that the device user would like to use in an e-payment transaction (e.g., the account into/from which the device user would like the e-payment to be deposited/withdrawn).
• Thepayment processing server300 may also generate a pseudo-random user identifier (e.g., a generic ID), and saves the user's account particulars (if provided) and the user identifier (e.g., the generic ID) in theaccount holders database314 in the database cluster associated with the device user. Thepayment processing server300 may transmit the user identifier (e.g., the generic ID) to the user'spayment device200afor storage in the memory212. The user identifier is globally unique in the sense that the user identifier (e.g., the generic ID) is assigned to only one user of thee-payment processing network100.
• In some aspects, the user identifier (e.g., the generic ID) is uniquely associated with the device user, but does not include any information that would allow a third party (other than the payment processing server300) to identify the device user. For example, the user identifier (generic ID) may comprise a string consisting of the MAC address or the serial number of the user'spayment device200 and a pseudo-random number generated by thepayment processing server300. In certain aspects, the user identifier (e.g., the generic ID) may represent an anonymous identifier that is uniquely associated with the device user.
• Where thepayment device200ais implemented as a smartcard, thepayment processing server300 may prompt the device user to enter a payment amount to be used on subsequent e-payment transactions. In some embodiments, thepayment device200a(e.g., implemented as a smartcard) may be configured to dynamically generate a payment token in response to a payment request received from another payment device200 (e.g.,payment device200b). In certain aspects, thepayment processing server300 may save in the database cluster associated with the device user the serial number of thepayment device200aand a user pseudo-random counter value. As will be discussed below, thepayment processing server300 may change the pseudo-random counter value with each e-payment request using a corresponding algorithm, and thepayment processing server300 may use the pseudo-random counter value and the smartcard serial number to validate the payment token.
• In other embodiments, thepayment processing server300 may generate one or more unique payment tokens each associated with the specified payment amount, may save the specified payment amount and the user identifier (e.g., the generic D) in the database cluster associated with the device user, and may associate each payment token with the user identifier (e.g., the generic ID) in thememory310. Thepayment processing server300 may, for example, transmit the payment token(s) to thepayment device200 for storage in the memory212.
• In additional embodiments, thepayment device200a, when implemented as a smartcard, may have been preconfigured with one or more payment tokens by the distributor of thepayment device200a. In certain aspects, thepayment processing server300 may save the specified payment amount and the user identifier (e.g., the generic ID) in the database cluster associated with the device user, and associate each preconfigured payment token with the user identifier (e.g., the generic ID) in thememory310.
• During the e-payment registration process described herein, thepayment processing server300 may also query the user'spayment device200afor an identifier (e.g., a device ID) that is associated with thepayment device200a, and save the device identifier (e.g., the device ID) in theaccount holders database314 in the database cluster associated with the device user. In some aspects, the device identifier (e.g., the device ID) may include the International Mobile Equipment Identifier (IMEI) that is assigned to the user'spayment device200a. In other aspects, thepayment processing server300 may generate a pseudo-random device identifier, save the globally unique pseudo-random device identifier (e.g., the device ID) in theaccount holders database314, and transmit the device identifier (e.g., the device ID) to the user'spayment device200afor storage in a protected memory of thepayment device200a.
• In some embodiments, the device identifier (e.g., the device ID), whether provided by the user'spayment device200aor generated by thepayment processing server300, may be globally unique in the sense that the device identifier (e.g., the device ID) is assigned to only onepayment device200 of thee-payment processing network100. As will be discussed below, thepayment completion procedure218 executed by the user'spayment device200auses the device identifier (e.g., the device ID) to cryptographically sign a payment completion request that is generated by thepayment completion procedure218. To reduce the likelihood of a successful man-in-the-middle attack on the payment completion request, the device identifier (e.g., the device ID) may not be not widely published, or at least may not be widely known to be associated with the user identifier (e.g., the generic ID).
• In some embodiments, the device identifier (e.g., the device ID) may act as a symmetric cryptographic key. In other embodiments, however, thepayment processing server300 may generate a cryptographic key from the device identifier (e.g., the device ID)), such that the device identifier (e.g., the device ID) and the generated cryptographic key act as an asymmetric cryptographic key pair. In some aspects, thepayment processing server300 may save the generated cryptographic key in theaccount holders database314 instead of the device identifier (e.g., the device ID), and allows thepayment completion procedure218 to use the device identifier (e.g., the device ID) as the associated cryptographic key.
• The registration process may, for example, terminate after thepayment processing server300 confirms to the user'spayment device200athat it has saved the user identifier (e.g., the generic ID) in theaccount holders database314. After the registration process has been completed, the device user can use thee-payment processing network100 to send/receive an e-payment.
• Referring back toFIG. 4, to initiate an e-payment, at step S400 the payor may invoke thepayment initiation procedure216 on the payor'spayment device200a, and may input the payment amount into the payor'spayment device200avia theinput device204. The payor'spayment device200amay execute thepayment initiation procedure216 to establish a secure communications channel with thepayment processing server300 via themobile communications network120, generate a payment initiation request, and transmit the payment initiation request to thepayment processing server300 via the secure channel (e.g., at step S402).
• In certain aspects, the payment initiation request identifies the payment amount, but does not include particulars of the payee (e.g., payee information) or particulars of the payee's account (e.g., payee account information). If, during the e-payment registration process, the payor did not provide thepayment processing server300 with particulars of the payor's account (or alternatively, if the payor wishes to over-ride the account particulars that the payor provided during the e-payment registration process), the payor may input the payer's account particulars into the payer'spayment device200a, in which case the payment initiation request may include (or accompany) the payor's account particulars.
• The payment initiation request may also include the payer's user identifier (e.g., a payor generic ID). In other aspects, thepayment processing server300 may query the payor'spayment device200afor the payer's user identifier (e.g., the payor generic ID) in response to a receipt of the payment initiation request by thepayment processing server300 receives the payment initiation request.
• In response to the payment initiation request, thepayment initiation processor316 of thepayment processing server300 may generate a pseudo-random payment token, and may associates the payment token with the received payment amount and the payor's user identifier (e.g., the payor generic ID) in the memory310 (e.g., at step S404). In some aspects, thepayment initiation processor316 may also generate a time stamp after it generates the payment token, and associates the time stamp with the payment token in thememory310. As will be discussed below, the time stamp allows thepayment processing server300 to assign a maximum lifetime period to the payment token, after which the payment token will be considered to have expired.
• In other aspects, the payment token may not identify the payment amount or the payor account, or include the time stamp or any identification particulars of the payor. In some embodiments, the payment token may represent an anonymous identifier that is uniquely associated with the proposed payment. The payment token may also be globally unique in the sense that, during the lifetime (if assigned) of the payment token, the payment token is only associated with this particular payment initiation request. At step S406, the payment processing server300 (e.g., by executing the payment initiation processor316) may transmit the payment token to the payor'spayment device200afor storage in the memory212.
• In certain embodiments, steps S400 to S406 may not be required, for example where thepayment device200ais implemented as a smartcard. As discussed herein, when implemented as a smartcard, thepayment device200amay be preconfigured with one or more payment tokens, each associated with the same payment amount or different payment amounts, either by the distributor of thepayment device200aor by the e-payment registration process. In other aspects, thepayment device200a(e.g., by executing payment initiation procedure216) may generate the payment token in response to a payment request received at thepayment device200afrom anotherpayment device200b. For example, the payment token may include the serial number of the payment device (smartcard)200 and a cryptogram that is generated using the payor generic ID and a pseudo-random counter value as inputs to a cryptographic algorithm.
• At step S408, the payer'spayment device200amay transmit the payment token to the payee'spayment device200b. To do so, thepayment initiation procedure216 executed by the payor'spayment device200amay generate a visual representation of the payment token (e.g. a two-dimensional bard code (QR code)) and display the visual representation on thedisplay202 of the payor'spayment device200a. Alternately, thepayment initiation procedure216 of the payor'spayment device200amay wirelessly transmit the payment token directly (for example via NFC) or indirectly (for example via WiFi or cellular communications) to the payee'spayment device200b.
• Depending upon the maximum lifetime period assigned to the payment token, the payor'spayment device200amay immediately transmit the payment token to the payee'spayment device200bto thereby initiate an immediate payment, or save the payment token for use at a later time/date. Optionally, in some aspects, the payor'spayment device200amay be configured to prompt the user of the payor'spayment device200ato confirm the payment amount prior to generating the visual representation or wirelessly transmitting the payment token. The disclosed embodiments may be configured in this manner when, for example, thepayment device200ais implemented as a smartcard that is preconfigured with multiple payment tokens, each associated with different payment amounts. In other aspects, the disclosed embodiments may be configured to ensure that the payor did not inadvertently enter the incorrect payment amount at step S402.
• As discussed herein, the payment token may represent an anonymous identifier that is uniquely associated with the proposed payment. In certain aspects, the payment token may not provide the payee with any particulars of the proposed e-payment (e.g. a payment amount, a payor account, a time stamp, and/or payor identification particulars).
• To initiate receipt of the payment token, the payee may execute thepayment completion procedure218 on the payee'spayment device200band select one of the available reception methods offered by thepayment completion procedure218. If the payor'spayment device200adisplayed a visual representation of the payment token on thedisplay202 of the payor'spayment device200a, the payee'spayment device200bmay implement thepayment completion procedure218 to receive the payment token via an image capture device of the payee'spayment device200b. If the payor'spayment device200awirelessly transmitted the payment token, the payee'spayment device200bmay implement thepayment completion procedure218 to wirelessly receive the payment token directly (for example via NFC) or indirectly (for example via WiFi or cellular communications).
• After receiving the payment token, the payee'spayment device200bmay executepayment completion procedure218 and establish a secure communications channel with thepayment processing server300 via themobile communications network120, generate a payment completion request, and transmit the payment completion request to thepayment processing server300 via the secure channel (e.g., at step S410). The payment completion request may include the payee's user identifier (e.g., the payee generic ID) and the payment token, but may not identify the payment amount or include particulars of the payor or particulars of the payor's account.
• In some embodiments, the payment completion request also fails to not include particulars of the payee's account. However, if, during the e-payment registration process, the payee, through the payee'spayment device200b, did not provide thepayment processing server300 with particulars of the payee's account (or the payee wishes to over-ride the account particulars that the payee provided during the e-payment registration process), the payee may input the payee's account particulars into the payee'spayment device200b, in which case the payment completion request may include the payee's account particulars. To reduce the likelihood of a successful man-in-the-middle attack, the payee'spayment device200bmay execute thepayment completion procedure218 to cryptographically sign the payment completion request with the device identifier (e.g., the device ID) that was assigned to the payee'spayment device200b.
• After receiving the payment completion request, at step S412. the payment processing server300 (e.g., by executing the payment completion processor318) may validate the payment completion request. To do so, thepayment processing server300 may extract the payee's user identifier (e.g., the payee generic ID) from the payment completion request, and may query theaccount holders database314 with the extracted user identifier (e.g., the payee generic ID). If thepayment completion procedure218 executed by the payee'spayment device200bused the device identifier (e.g., the device ID) as a symmetric cryptographic key, the query may return the payee's device identifier (e.g., the device ID), in which case thepayment processing server300 may use the located device identifier (e.g., the device ID) to validate the digital signature on the payment completion request. However, if the payee'spayment device200b(e.g., through payment completion procedure218) used the device identifier (e.g., the device ID) as an asymmetric cryptographic key, the query may return the cryptographic key associated with the device identifier (device ID), in which case thepayment completion processor318 uses the located cryptographic key to validate the digital signature on the payment completion request.
• As will be appreciated, regardless of the type of cryptographic key used, the payment completion processor318) may be configured bypayment processing server300 to confirm the payment completion request using the cryptographic key that is associated with the payee's user identifier (e.g., the payee generic ID). Further, when validating the digital signature, thepayment completion processor318 also indirectly confirms that the cryptographic key saved in theaccount holders database314 is uniquely associated with the payee'spayment device200band is uniquely associated with the payee's user identifier (e.g., the payee generic ID) that was included in the payment completion request. Accordingly, the payment completion processor318) may validate the payment completion request by confirming that the payment completion request is uniquely associated with the payee'spayment device200band the payee's user identifier (e.g., the payee generic ID).
• After validating the payment completion request, thepayment processing server300 may execute thepayment completion processor318 to determine the payee account, the payment amount, and the payor account from the payment completion request (e.g., at step S414). By way of example, to determine the payee account, thepayment completion processor318 may query theaccount holders database314 with the payee's user identifier (e.g., the payee generic ID) for the payee's account particulars.
• In certain aspects, thepayment completion processor318 may be configured bypayment processing server300 to determine the payment amount and the payor account by correlating the payment completion request with the payment initiation request. To do so, thepayment completion processor318 may query thememory310 with the payment token (e.g., included in the payment completion request) to locate the payment amount and the payor generic ID. Thepayment completion processor318 may query theaccount holders database314 with the payor's user identifier (e.g., payor generic ID) for the payor's account particulars.
• Where the payment token was generated by thepayment device200a, thepayment completion processor318 may validate the payment token by (i) querying theaccount holders database314 with the serial number that was included in the payment token to locate the associated payor generic ID and associated pseudo-random counter value, (ii) using the located payor generic ID and pseudo-random counter value as inputs to a cryptographic algorithm, and (iii) confirming that the output of the cryptographic algorithm matches the cryptogram that was included in the payment token. If the payment token is validated, thepayment completion processor318 may then query theaccount holders database314 with the payor generic ID to locate the payment amount. In certain aspects, the payment token may be generated from a pseudo-random counter value that changes with each e-payment transaction, the payment token cannot be used to effect multiple fraudulent transfers from the payor's account. Therefore, the likelihood of replay attacks is reduced.
• Thepayment completion processor318 may also be configured bypayment processing server300 to confirm that the payment token has not expired. To do so, thepayment completion processor318 may query thememory310 with the payment token to locate the timestamp associated with the payment initiation request. If thepayment completion processor318 successfully validated the payment completion request (and payment token), and optionally the timestamp reveals that the payment token has not expired, at step S416 thepayment completion processor318 may delete the payment token from thememory310, and effect a transfer in the payment amount from the payor account to the payee account. Thepayment processing server300 may also periodically purge expired payment tokens from thememory310, to prevent the unauthorized use of unused stale payment tokens.
• If thepayment processing server300 maintains the payor and payee accounts in theaccounts database312, thepayment processing server300 may effect the transfer by updating the credit/deposit entries in their respective accounts. However, if the payor account and the payee account are maintained by respective account servers, thepayment processing server300 effects the transfer by communicating particulars of the transfer to the payor's account server.
• Thepayment processing server300 may also be configured to process repudiation requests received from payors'payment devices200a. In certain aspects, the repudiation request may include the payor generic ID, and thepayment processing server300 may be configured to purge the corresponding payment token from thememory310 in response to the repudiation request to thereby allow the payor to abort an e-payment transfer before thepayment processing server300 effects the transfer in the payment amount from the payor account.
• Thepayment processing server300 may also be configured to process change requests received from payors'payment devices200a. In certain aspects, the variation request may include the payor generic ID and an alternate payment amount, and thepayment processing server300 may be configured to update the payment amount associated with the payment token, to thereby allow the payor to change the payment amount before thepayment processing server300 effects the transfer in the payment amount from the payor account.
• Since, prior to effecting the payment transfer, thepayment processing server300 confirms that the payment completion request is uniquely associated with the payee'spayment device200band the payee's user identifier (payee generic ID), the likelihood of the e-payment being subject to a successful man-in-the-middle attack may be reduced.
• Certain aspects of the disclosures described herein include process steps and instructions described herein in the form of an algorithm. It should be noted that the process steps and instructions of the consistent with the disclosed embodiments can be embodied in software, firmware or hardware, and when embodied in software, can be downloaded to reside on and be operated from different platforms used by real time network operating systems.
• Also described herein are exemplary apparatuses, systems, and devices for performing the operations herein. These apparatuses, systems, and devices may be specially constructed for the required purposes, or may comprise a general-purpose computer selectively activated or reconfigured by a computer program stored in the computer. Such a computer program may be stored in a tangible, non-transitory computer readable storage medium, such as, but is not limited to, any type of disk including floppy disks, optical disks, CD-ROMs, magnetic-optical disks, read-only memories (ROMs), random access memories (RAMs). EPROMs, EEPROMs, magnetic or optical cards, application specific integrated circuits (ASICs), or any type of media suitable for storing electronic instructions, and each coupled to a computer system bus. Furthermore, the computers referred to in the specification may include a single processor or may be architectures employing multiple processor designs for increased computing capability.
• The algorithms and displays presented herein are not inherently related to any particular computer or other apparatus. Various general-purpose systems may also be used with programs in accordance with the teachings herein, or it may prove convenient to construct more specialized apparatus to perform the required method steps. The required structure for a variety of these systems will appear from the description above. In addition, the embodiments described herein are not described with reference to any particular programming language. It is appreciated that a variety of programming languages may be used to implement the disclosed embodiments, and any references to specific languages are provided for disclosure of enablement and best mode.
• Various embodiments have been described herein with reference to the accompanying drawings. It will, however, be evident that various modifications and changes may be made thereto, and additional embodiments may be implemented, without departing from the broader scope of the disclosed embodiments as set forth in the claims that follow.
• Further, other embodiments will be apparent to those skilled in the art from consideration of the specification and practice of one or more embodiments of the present disclosure. It is intended, therefore, that this disclosure and the examples herein be considered as exemplary only, with a true scope and spirit of the disclosed embodiments being indicated by the following listing of exemplary claims.

Claims (10)

What is claimed is:

1. A method of person-to-person anonymous electronic payment processing, the method comprising:

receiving, by a payment processing server, and from a payor payment device, a payment initiation request for a payment from a payor account, the payment initiation request identifying a payment amount of the payment and excluding particulars of the payee and particulars of a payee account;

receiving, by the payment processing server, and from a payee payment device, a payment completion request requesting completion of the payment, the payment completion request including a payee identifier and excluding the payment amount, the payor account, and particulars of the payor;

confirming, by the payment processing server, that the payment completion request is uniquely associated with the payee payment device and the payee identifier, and determining, by the payment processing server, the payment amount, the payor account and the payee account from the payment completion request, the payment processing server determining the payment amount and the payor account by correlating the payment completion request with the payment initiation request; and

in accordance with an outcome of the confirming, effecting, by the payment processing server, a transfer in the payment amount from the payor account to the payee account.

2. The method according toclaim 1, wherein the payment completion request is cryptographically signed, and the confirming comprises validating the payment completion request using a reference cryptographic key associated with the payee identifier.

3. The method according toclaim 2, wherein the confirming further comprises confirming that the reference cryptographic key is uniquely associated with the payee payment device and the payee identifier.

4. The method according toclaim 3, wherein determining the payee account comprises querying an accounts database with the payee identifier.

5. The method according toclaim 1, further comprising aborting, by the payment processing server, the transfer upon receipt of a repudiation request received from the payor payment device prior to effecting the transfer.

6. A payment processing server comprising:

a network interface; and

a storage device; and

at least one processor coupled to the storage device and the network interface, the storage device storing software instructions for controlling the at least one processor when executed by the at least one processor, and the at least one processor is operative with the software instructions and is configured to:

(i) receive from a payor payment device a payment initiation request for a payment from a payor account, the payment initiation request identifying a payment amount of the payment and excluding particulars of the payee and particulars of a payee account;

(ii) receive from a payee payment device a payment completion request requesting completion of the payment, the payment completion request including a payee identifier and excluding the payment amount, the payor account, and particulars of the payor;

(iii) confirm that the payment completion request is uniquely associated with the payee payment device and the payee identifier, determine the payee account from the payment completion request, and determine the payment amount and the payor account by correlating the payment completion request with the payment initiation request; and

(iv) effect a transfer in the payment amount from the payor account to the payee account in accordance with an outcome of the confirming.

7. The payment processing server according toclaim 6, wherein the payment completion request is cryptographically signed, and the at least one processor is further configured to confirm the payment completion request by validating the payment completion request using a reference cryptographic key associated with the payee identifier.

8. The payment processing server according toclaim 7, wherein the at least one processor is further configured to confirm the payment completion request by confirming that the reference cryptographic key is uniquely associated with the payee payment device and the payee identifier.

9. The payment processing server according toclaim 8, wherein the at least one processor is further configured to determine the payee account by querying an accounts database with the payee identifier.

10. A tangible, non-transitory computer-readable medium storing instructions which, when executed by at least one processor, cause the at least one processor to perform a method of person-to-person anonymous electronic payment processing, the method comprising:

receiving, from a payor payment device, a payment initiation request for a payment from a payor account, the payment initiation request identifying a payment amount of the payment and excluding particulars of the payee and particulars of a payee account;

receiving, from a payee payment device, a payment completion request requesting completion of the payment, the payment completion request including a payee identifier and excluding the payment amount, the payor account, and particulars of the payor;

confirming that the payment completion request is uniquely associated with the payee payment device and the payee identifier, and determining, by the payment processing server, the payment amount, the payor account and the payee account from the payment completion request, the determining comprising determining the payment amount and the payor account by correlating the payment completion request with the payment initiation request; and

in accordance with an outcome of the confirming, effecting a transfer in the payment amount from the payor account to the payee account.

Images