Terminal for conducting electronic transactions

Patent metadata

Field	Value
Publication number	US-12548007-B2
Application number	US-202318298589-A
Country	US
Kind code	B2
Filing date	Apr 11, 2023
Priority date	Feb 3, 2017
Publication date	Feb 10, 2026
Grant date	Feb 10, 2026

Abstract

The present disclosure is drawn to, among other things, a method of providing a payment terminal application on an electronic device, the electronic device comprising a volatile storage module, a user input module and a network interface module. In some aspects the method includes receiving user credentials from the user input module, transmitting an authentication request message to a remote data center via the network interface module, the authentication request message including the user credentials, receiving an authentication response message from the remote data center, the authentication response message including an indication as to whether authentication was successful, and if the authentication was successful, receiving at least one encryption key from the remote data center; and storing the at least one encryption key in the volatile storage module.

First claim

The invention claimed is:

1 . A computer implemented method, the method comprising:
receiving, by an electronic device, an encryption key for encrypting payment instrument data received from a payment instrument via an antenna of the electronic device; storing, by the electronic device, the encryption key in a volatile storage module of the electronic device; provisioning, by the electronic device, an instance of a payment terminal application of the electronic device, the provisioned instance of the provisioned payment terminal application being configured to receive a payment from the payment instrument; receiving, by the electronic device, the payment instrument data from the payment instrument; encrypting, by the electronic device, the payment instrument data using the encryption key stored in the volatile storage module of the electronic device; transmitting, by the electronic device, a transaction authorization request message to a remote data center, the transaction authorization request message including the encrypted payment instrument data; receiving, by the electronic device, a transaction response message from the remote data center; and based on the received transaction response message, indicating, by the electronic device, either success or failure of the transaction to a cardholder.

2 . The computer implemented method of claim 1 , wherein the instance of the payment terminal application is configured to conduct electronic payments using the encryption key, the method further comprising:
performing at least one security check of the instance of the payment terminal application using a local risk engine that is stored in the volatile storage module, wherein performing the at least one security check comprises: gathering information relating to the electronic device; processing one or more local risk engine rules from a local risk engine rule set using the gathered information; and determining whether to raise one or more security events based on the processed one or more local risk engine rules.

3 . The computer implemented method of claim 2 , wherein gathering information relating to the electronic device includes one or more of:
gathering information relating to the instance of the payment terminal application; gathering information relating to one or more other applications executing on the electronic device; gathering information relating to an operating system of the electronic device; gathering information relating to one or more payment terminal application files associated with the instance of the payment terminal application, the one or more payment terminal application files stored on a non-volatile storage module of the electronic device; and gathering information relating to one or more miscellaneous files associated with applications other than the instance of the payment terminal application and/or the operating system, the miscellaneous files stored on the non-volatile storage module.

4 . The computer implemented method of claim 2 , further comprising:
raising at least one security event; and storing the at least one raised security event in a security event log.

5 . The computer implemented method of claim 4 , further comprising:
processing the security event log using the local risk engine; and degrading a functionality of the instance of the payment terminal application based on a degradation instruction received from the local risk engine.

6 . The computer implemented method of claim 4 , further comprising:
transmitting the security event log to the remote data center; receiving a response from the remote data center, the response comprising one of:
a resume instruction to resume normal operation of the instance of the payment terminal application; or
a degradation instruction to degrade a functionality of the instance of the payment terminal application; and
processing the resume instruction or the degradation instruction.

7 . The computer implemented method of claim 6 , wherein the degradation instruction comprises one or more of:
an instruction to reduce an available functionality of the instance of the payment terminal application; an instruction to log a user out of the instance of the payment terminal application; an instruction to close the instance of the payment terminal application; and an instruction to render the at least one encryption key unusable.

8 . An electronic device comprising:
a memory configured to store instructions; and a processor configured to execute the instructions to perform operations comprising: receiving an encryption key for encrypting payment instrument data received from a payment instrument via an antenna of the electronic device; storing the encryption key in a volatile storage module of the electronic device; provisioning an instance of a payment terminal application of the electronic device, the provisioned instance of the provisioned payment terminal application being configured to receive a payment from the payment instrument; receiving the payment instrument data from the payment instrument; encrypting the payment instrument data using the encryption key stored in the volatile storage module of the electronic device; transmitting a transaction authorization request message to a remote data center, the transaction authorization request message including the encrypted payment instrument data; receiving a transaction response message from the remote data center; and based on the received transaction response message, indicating either success or failure of the transaction to a cardholder.

9 . The electronic device of claim 8 , wherein the instance of the payment terminal application is configured to conduct electronic payments using the encryption key, and wherein the operations further comprise:
performing at least one security check of the instance of the payment terminal application using a local risk engine that is stored in the volatile storage module, wherein performing the at least one security check comprises: gathering information relating to the electronic device; processing one or more local risk engine rules from a local risk engine rule set using the gathered information; and determining whether to raise one or more security events based on the processed one or more local risk engine rules.

10 . The electronic device of claim 9 , wherein the operations further comprise:
gathering information relating to the instance of the payment terminal application; gathering information relating to one or more other applications executing on the electronic device; gathering information relating to an operating system of the electronic device; gathering information relating to one or more payment terminal application files associated with the instance of the payment terminal application, the one or more payment terminal application files stored on a non-volatile storage module of the electronic device; and gathering information relating to one or more miscellaneous files associated with applications other than the instance of the payment terminal application and/or the operating system, the miscellaneous files stored on the non-volatile storage module.

11 . The electronic device of claim 9 , wherein the operations further comprise:
raising at least one security event; and storing the at least one raised security event in a security event log.

12 . The electronic device of claim 11 , wherein the operations further comprise:
processing the security event log using the local risk engine; and degrading a functionality of the instance of the payment terminal application based on a degradation instruction

Assignees

• Worldpay Ltd

Inventors

• Vokes Jonathan Stewart
• Telford-Reed Nicholas

Classifications

• G06Q20/4014

  Identity check for transactions · CPC title

• G06Q20/3829

  involving key management · CPC title

• G06Q20/3278

  RFID or NFC payments by means of M-devices · CPC title

• G06Q20/102

  Bill distribution or payments · CPC title

• G06F21/577

  Assessing vulnerabilities and evaluating computer system security · CPC title