Methods and systems for secure online payment

Patent metadata

Field	Value
Publication number	US-2016104152-A1
Application number	US-201514878167-A
Country	US
Kind code	A1
Filing date	Oct 8, 2015
Priority date	Oct 10, 2014
Publication date	Apr 14, 2016
Grant date	—

Abstract

A secure online payment system in which, upon initiation by a card holder of a payment operation to an online merchant, the card holder is directed to a wallet-hosting website which stores at least one digital wallet associated with the card holder. Each digital wallet is associated with at least one payment card associated with the card holder, and the website has access to database storing payment card data relating to the payment card. At the website, a card holder authentication process is performed. Upon successful authentication, payment card data is extracted from the database, and a successful authentication indicator message is generated and returned to the merchant. The successful authentication indicator message includes the payment card data, code indicating that the card holder has been successfully identified, and code indicative of the fact that the payment card is registered in the wallet.

First claim

What is claimed is:

1 . A method performed by a single web domain, for authenticating a card holder to enable a payment to an online merchant domain, the method comprising, upon the card holder initiating a payment process in relation to the online merchant domain:
receiving, at the web domain, data from the card holder; using, at the web domain, the received data to authenticate the identity of the card holder; upon the web domain successfully authenticating the identity of the card holder, extracting, from a database of the web domain, payment card data describing a payment card associated with the card holder; transmitting, using the web domain, the payment card data to the online merchant domain; and generating and transmitting to the online merchant domain, by the web domain, an authentication indicator message i) indicating that the authorization was successful and ii) containing data indicating that the payment card is registered in a digital wallet.

2 . The method of claim 1 , wherein the authentication indicator message is cryptographic data generated using confidential information known to the issuer of the payment card.

3 . The method of claim 1 , wherein the authentication indicator message includes one of an Accountholder Authorization Value (AAV) and a Cardholder Authentication Verification Value (CAVV).

4 . The method of claim 1 , wherein the web domain is a wallet-hosting domain, and wherein the database contains data which, for each of a plurality of pre-registered card holders, defines a respective one or more digital wallets, the digital wallets each being associated with one or more corresponding payment cards associated with the respective plurality of pre-registered card holders.

5 . The method of claim 4 , wherein the authentication indicator message includes data identifying a digital wallet associated with the card holder.

6 . The method of claim 4 , wherein the card holder is one of the plurality of the pre-registered card holders, and the wherein method further comprises at least one of:
receiving a selection from the card holder of one of a plurality of digital wallets associated with the card holder; and receiving a selection from the card holder of one of a plurality of payment cards associated with the digital wallet.

7 . The method of claim 1 , wherein the method is performed without the web domain redirecting a browser of the card holder to a further web domain before authenticating the identity of the card holder.

8 . A method of completing a payment transaction, the method comprising:
receiving, at an online merchant domain, a payment instruction from a computer associated with a card holder; redirecting, by the online merchant domain, the computer to a second web domain; receiving, at the second web domain, data from the card holder; using, by the second web domain, the received data to authenticate the identity of the card holder; upon the second web domain successfully authenticating the identity of the card holder, extracting, from a database of the second web domain, payment card data describing a payment card associated with the card holder; transmitting, by the second web domain, the payment card data to the online merchant domain; generating and transmitting to the online merchant domain, by the second web domain, an authentication indicator message indicating that the authorization was successful and containing data indicating that the payment card is registered in a digital wallet; and upon receiving the payment card data and the authentication indicator message, transmitting, by the online merchant domain, the payment card data and the authentication indicator message to an acquiring bank to initiate a money transfer.

9 . The method of claim 8 , wherein the authentication indicator message includes cryptographic data generated using confidential information known to the issuer of the payment card.

10 . The method of claim 8 , wherein the authentication indicator message includes one of an Accountholder Authorization Value (AAV) and a Cardholder Authentication Verification Value (CAVV).

11 . The method of claim 8 , wherein the second web domain is a wallet-hosting domain, and the database contains data which, for each of a plurality of pre-registered card holders, defines a respective one or more digital wallets, the digital wallets each being associated with one or more payment cards associated with the respective plurality of pre-registered card holders.

12 . The method of claim 11 , wherein the authentication indicator message includes data identifying a digital wallet associated with the card holder.

13 . The method of claim 11 , wherein the card holder is one of the plurality of the pre-registered card holders, and wherein the method further comprises at least one of:
receiving a selection from the card holder of one of a plurality of digital wallets associated with the card holder; and receiving a selection from the card holder of one of a plurality of payment cards associated with a digital wallet.

14 . The method of claim 8 , wherein the method is performed without the second web domain redirecting the computer of the card holder to a further web domain before authenticating the identity of the card holder.

15 . A server system supporting a single web domain, for authenticating a card holder to enable a payment to an online merchant domain, the server system comprising:
a processor; and a data storage device storing program code which, upon implementation by the processor causes the processor to:
(i) display a web interface on a screen of a computer of the card holder;
(ii) receive data from the computer of the card holder via the web interface;
(iii) use the received data to authenticate the identity of the card holder;
(iv) upon successfully authenticating the identity of the card holder, extract, from a database of the server system, payment card data describing a payment card associated with the card holder;
(v) transmit the payment card data to the online merchant domain; and
(vi) generate and transmit to the online merchant domain, an authentication indicator message indicating that the authorization was successful and containing data indicating that the payment card is registered in the wallet.

16 . The server system of claim 15 , wherein the authentication indicator message comprises cryptographic data generated using confidential information known to the issuer of the payment card.

17 . The server system of claim 15 , wherein the authentication indicator message includes one of an Accountholder Authorization Value (AAV) and a Cardholder Authentication Verification Value (CAVV).

18 . The server system of claim 15 , wherein the web domain is a wallet-hosting domain, and the database contains data which, for each of a plurality of pre-registered card holders, defines a respective one or more digital wallets, the digital wallets each being associated with one or more payment cards associated with the respective plurality of pre-registered card holders.

19 . The server system of claim 18 , wherein the authentication indicator message comprises data identifying a digital wallet associated with the card holder.

20 . The server system of claim 18 , wherein the card holder is one of the plurality of the pre-registered card holders, and the program code causes the processor to perform at least one of:
receiving a selection from the card holder of one of a plurality of digital wallets associated with

Assignees

• Mastercard Asia Pacific Pte Ltd

Inventors

• Prabhu Rajen
• Sinha Advait
• Hayes Joseph Damon

Classifications

• G06Q20/4018

  using the card verification value [CVV] associated with the card · CPC title

• G06Q20/3674

  involving authentication · CPC title

• G06Q20/363 Primary

  with the personal data of a user · CPC title

• G06Q20/409

  Device specific authentication in transaction processing · CPC title

• G06Q20/36

  using electronic wallets or electronic money safes · CPC title