Securing in-app purchases

Patent metadata

Field	Value
Publication number	US-12307491-B2
Application number	US-202418418654-A
Country	US
Kind code	B2
Filing date	Jan 22, 2024
Priority date	Jul 19, 2012
Publication date	May 20, 2025
Grant date	May 20, 2025

Abstract

In one embodiment, a unique (or quasi unique) identifier can be received by an application store, or other on-line store, and the store can create a signed receipt that includes data desired from the unique identifier. This signed receipt is then transmitted to a device that is running the application obtained from the on-line store and the device can verify the receipt by deriving the unique (or quasi-unique) identifier from the signed receipt and comparing the derived identifier with the device identifier stored on the device, or the vendor identifier assigned to the application vendor.

First claim

What is claimed is:

1. A method comprising:
at an application executed by an electronic device:
using an in-app purchase application programming interface (API) to receive information about products available for purchase within the application, from a server of an on-line store;
controlling the electronic device to display, within the application, the information about the products available for purchase within the application;
in response to a request received by the application to purchase a selected product of the products available for purchase within the application, using the in-app purchase API to transmit a buy request to the server of the on-line store, wherein the buy request identifies at least a product identifier that identifies the selected product;
obtaining from the server of the on-line store, using the in-app purchase API, a signed receipt that indicates that a financial transaction for the buy request has been performed, the signed receipt including data derived from the buy request, the signed receipt being signed by an operator of the on-line store;
verifying, at the electronic device, the signed receipt; and
in response to verifying the signed receipt, unlocking content associated with the selected product that is encompassed within the application, but unavailable until purchase.

2. The method of claim 1 , wherein verifying the signed receipt comprises: verifying the signed receipt by comparing a vendor identifier obtained from the signed receipt to a vendor identifier that is stored at the device and that is associated with the selected product.

3. The method of claim 1 , wherein verifying the signed receipt comprises: verifying the signed receipt by comparing a product identifier obtained from the signed receipt to the product identifier that is included in the buy request.

4. The method of claim 1 , wherein verifying the signed receipt is conducted by a receipt verification server.

5. The method of claim 4 , wherein verifying the receipt data of the in-app purchase receipt is conducted via the verification server.

6. The method of claim 1 , further comprising verifying the signed receipt by comparing a transaction ID obtained from the signed receipt to a transaction ID from a previous transaction.

7. The method as in claim 1 , further comprising verifying the signed receipt's timestamp by checking that the signed receipt was signed contemporaneously with a transaction.

8. A non-transitory machine readable medium storing executable instructions which when executed by a data processing system cause the data processing system to perform a method comprising:
using an in-app purchase application programming interface (API) to receive information about products available for purchase within the application, from a server of an on-line store;
controlling the data processing system to display, within the application, the information about the products available for purchase within the application;
in response to a request received by the application to purchase a selected product of the products available for purchase within the application, using the in-app purchase API to transmit a buy request to the server of the on-line store, wherein the buy request identifies at least a product identifier that identifies the selected product;
obtaining from the server of the on-line store, using the in-app purchase API, a signed receipt that indicates that a financial transaction for the buy request has been performed, the signed receipt including data derived from the buy request, the signed receipt being signed by an operator of the on-line store;
verifying, at the data processing system, the signed receipt;
and in response to verifying the signed receipt, unlocking content associated with the selected product that is encompassed within the application, but unavailable until purchase.

9. The non-transitory machine-readable medium of claim 8 , wherein verifying the signed receipt comprises: verifying the signed receipt by comparing a vendor identifier obtained
from the signed receipt to a vendor identifier that is stored at the device and that is associated with the selected product.

10. The non-transitory machine-readable medium of claim 8 , wherein verifying the signed receipt comprises: verifying the signed receipt by comparing a product identifier obtained from the signed receipt to the product identifier that is included in the buy request.

11. The non-transitory machine-readable medium of claim 8 , wherein verifying the signed receipt is conducted by a receipt verification server.

12. The non-transitory machine-readable medium of claim 11 , wherein verifying the receipt data of the in-app purchase receipt is conducted via the server.

13. The non-transitory machine-readable medium of claim 8 , further comprising verifying the signed receipt by comparing a transaction ID obtained from the signed receipt to a transaction ID from a previous transaction.

14. The non-transitory machine-readable medium of claim 8 , further comprising verifying the signed receipt's timestamp by checking that the signed receipt was signed contemporaneously with a transaction.

15. An electronic device comprising:
at least one processor;
a memory coupled to the processing device though a bus; and
a process executed from the memory by the processor that causes the processing device to using an in-app purchase application programming interface (API) to receive information about products available for purchase within the application, from a server of an on-line store, control the electronic device to display, within the application, the information about the products available for purchase within the application, in response to a request received by the application to purchase a selected product of the products available for purchase within the application, use the in-app purchase API to transmit a buy request to the server of the on-line store, wherein the buy request identifies at least a product identifier that identifies the selected product, obtain from the server of the on-line store, using the in-app purchase API, a signed receipt that indicates that a financial transaction for the buy request has been performed, the signed receipt including data derived from the buy request, the signed receipt being signed by an operator of the on-line store, and verify, at the electronic device, the signed receipt, in response to verifying the signed receipt, unlock content associated with the selected product that is encompassed within the application, but unavailable until purchase.

16. The electronic device of claim 15 , wherein verifying the signed receipt comprises:
verifying the signed receipt by comparing a vendor identifier obtained from the signed receipt to a vendor identifier that is stored at the device and that is associated with the selected product.

17. The electronic device of claim 15 , wherein verifying the signed receipt comprises:
verifying the signed receipt by comparing a product identifier obtained from the signed receipt to the product identifier that is included in the buy request.

18. The electronic device of claim 15 , wherein verifying the signed receipt is conducted by a receipt verification server.

19. The electronic device of claim 18 , wherein verifying the receipt data of the in-app purchase receipt is conducted via the server.

20. The electronic device of claim 15 , further comprising verifying the signed receipt by comparing a transaction ID obtained from the signed receipt to a transaction

Assignees

• Apple Inc

Inventors

• Alsina Thomas Matthieu
• Boyd Scott T
• Chu Michael Kuohao
• Farrugia Augustin J
• Fasoli Gianpaolo
• Gautier Patrice O
• Kelly Sean B
• Mirrashidi Payam
• Pardehpoosh Pedraum
• Sauerwald Conrad
• Scott Kenneth W
• Shinh Rajit
• Thomas Braden Jacob
• Whalley Andrew R

Classifications

• G06Q20/00

  Payment architectures, schemes or protocols (apparatus for performing or posting payment transactions G07F7/08, G07F19/00; electronic cash registers G07G1/12) · CPC title

• B63H20/12

  Means enabling steering · CPC title

• B63H20/02

  Mounting of propulsion units (B63H20/08 takes precedence) · CPC title

• G06Q30/0601 Primary

  Electronic shopping [e-shopping] · CPC title

• B63H20/06

  on an intermediate support · CPC title