Method for securing transactional data processing, corresponding terminal and computer program

Patent metadata

Field	Value
Publication number	US-11625713-B2
Application number	US-201615335868-A
Country	US
Kind code	B2
Filing date	Oct 27, 2016
Priority date	Oct 27, 2015
Publication date	Apr 11, 2023
Grant date	Apr 11, 2023

Abstract

A method for securing the processing of transactional data is disclosed. The method is implemented within a communications terminal comprising a transactional data processing module. The method has: a step for the detection, by the processing module, of a display of at least one entry area relating to a piece of payment means data; a step for the activation, by the processing module, of a contactless data reading module; a step for the obtaining, by the contactless data reading module, of at least one piece of payment means data coming from a payment means; and a step for the furnishing, at said at least one entry area, of at least one piece of payment means data previously obtained.

First claim

What is claimed is:

1. A method for securing the processing of transactional data during a payment transaction, the method being implemented within a communications terminal running a processing application, wherein the method comprises:
detecting, by the processing application, a display, made by a requesting application, of a payment data entry form comprising at least one entry area relating to a piece of payment data, on a display screen of the communications terminal, the requesting application having initiated the payment transaction;
in response to the detecting, activating, by the processing application, a contactless data reading device;
in response to the detecting, taking control, by the processing application, of the display made on the display screen by interrupting the requesting application; and, when the display is under control of the processing application:
obtaining, by the contactless data reading device, at least one piece of payment data coming from a contactless payment device;
generating, by the processing application, a current authentication code having a bank card verification code format, the generating comprising:
obtaining a piece of identification data of the communications terminal;
obtaining a piece of authentication data of a user with whom the communications terminal is associated; and
generating the current authentication code using a symmetric bilinear coupling function as a function of the piece of identification data of the communications terminal and the piece of authentication data of the user, the symmetric bilinear coupling function relying on Barreto-Naehrig curves;

filling, by the processing application, the at least one entry area of the payment data entry form with at least one piece of payment data previously obtained;
filling, by the processing application, in a pre-selected entry area of the payment data entry form corresponding to an entry area for a bank card verification code, with the generated current authentication code;
returning control of the display from the processing application to the requesting application; and
upon validation of the payment data entry form, transmitting, by the requesting application, the at least one piece of payment data and the generated current authentication code to a transaction processing server, either directly or through a merchant server, for checking a validity of the generated current authentication code and validation or rejection of the payment transaction as a function of the validity of the generated current authentication code.

2. The method for securing processing according to claim 1 , further comprising obtaining a value of occurrence of implementation of the method for securing processing, and when the value indicates a first occurrence of implementation of the method, the method further comprises creating a piece of data representing a link between the communications terminal and a transaction processing server, called a piece of reference authentication data.

3. The method for securing processing according to claim 2 , wherein creating the piece of reference authentication data between the communications terminal and the transaction processing server comprises:
obtaining the piece of identification data of the communications terminal;
obtaining the piece of authentication data for the user with whom the communications terminal is associated;
encrypting the identification data of the communications terminal and the authentication data of the user, and delivering the piece of reference authentication data; and
transmitting the piece of reference authentication data to the transaction processing server.

4. The method for processing, according to claim 2 , further comprising, during the reception, by the transaction processing server, of the data coming from the at least one entry area, at least one act of comparing at least one piece of data transmitted within the entry area and the piece of reference authentication data, and delivering an assertion of validation of the transaction.

5. The method for securing processing according to claim 1 , wherein generating the current authentication code having the bank card verification code format comprises formatting the current authentication code to have a size corresponding to a size accepted by the pre-selected entry area corresponding to the entry area for the bank card verification code.

6. A communications terminal comprising:
a display screen;
a contactless data reading device; and
a processor for processing transactional data during a payment transaction and a non-transitory computer-readable medium comprising instructions stored thereon which when executed by the processor configure the communications terminal to run a processing application performing acts comprising:
detecting a display, made by a requesting application, of a payment data entry form comprising at least one entry area for a piece of payment data on the display screen of the communications terminal, the requesting application having initiated the payment transaction;
in response to the detecting, activating the contactless data reading device;
in response to the detecting, taking control of the display made on the display screen by interrupting the requesting application; and, when the display is under control of the processing application:
obtaining, by the contactless data reading device, at least one piece of payment data coming from a contactless payment device;
generating a current authentication code having a bank card verification code format, the generating comprising:
obtaining a piece of identification data of the communications terminal;
obtaining a piece of authentication data of a user with whom the communications terminal is associated; and
generating the current authentication code using a symmetric bilinear coupling function, as a function of the piece of identification data of the communications terminal and the piece of authentication data of the user, the symmetric bilinear coupling function relying on Barreto-Naehrig curves;

filling the at least one entry area of the payment data entry form with the at least one piece of payment data previously obtained;
filling a pre-selected entry area of the payment data entry form corresponding to an entry area for a bank card verification code with the generated current authentication code;

returning control of the display to the requesting application; and

further configure the communications terminal to transmit, upon validation of the payment data entry form, via the requesting application, the at least one piece of payment data and the generated current authentication code to a transaction processing server, either directly or through a merchant server, for checking a validity of the generated current authentication code and validation or rejection of the payment transaction as a function of the validity of the generated current authentication code.

7. The communications terminal according to claim 6 , wherein generating the current authentication code having the bank card verification code format comprises formatting the current authentication code to have a size corresponding to a size accepted by the pre-selected entry area corresponding to the entry area for the bank card verification code.

8. A non-transitory computer-readable medium comprising a computer program product stored thereon, which comprises program code instructions for executing a method for securing a processing of transactional data during a payment transaction when the instructions are executed by a processor of a communications terminal comprising a contactless data reading device, the instructions configuring the communications terminal to run a processing application imp

Assignees

• Banks And Acquirers Int Holding

Inventors

• Geraud Remi
• Koudoussi Hiba

Classifications

• H04L9/50

  using hash chains, e.g. blockchains or hash trees · CPC title

• G06Q2220/00

  Business processing using cryptography · CPC title

• G06F21/34

  involving the use of external additional devices, e.g. dongles or smart cards · CPC title

• G06Q20/327

  Short range or proximity payments by means of M-devices · CPC title

• G06Q20/4018

  using the card verification value [CVV] associated with the card · CPC title