System and method of securely transferring payment for an online transaction

Patent metadata

Field	Value
Publication number	US-2016239840-A1
Application number	US-201514624081-A
Country	US
Kind code	A1
Filing date	Feb 17, 2015
Priority date	Feb 17, 2015
Publication date	Aug 18, 2016
Grant date	—

Abstract

The system and method of the present disclosure relates to securing financial data associated with an online payment made over a network at a merchant website, without sharing financial details with the merchant. Merchants register with financial institutions of their customers in order to form a trusted and secure relationship. When a customer purchases an item at the merchant website, a payment option is presented to the customer on the merchant website. The customer is then redirected to a website of the financial institution to authenticate the payment. Once the payment is authenticated, the financial institution may pay the merchant using a secure connection. The customer may also grant the merchant permission to share consumer profile information. Thus, when the consumer shops online at the merchant website, payment may be made to the online merchant directly from the financial institution of the consumer without having to share any financial details.

First claim

What is claimed is:

1 . An apparatus to secure financial data in a network, comprising:
a storage system to store financial data, credentials, access restriction data and profile information of a first client coupled to the network, the first client registered with a financial institution; and a payment server in communication with the storage system and associated with the financial institution of the first client, the payment server further comprising
a receiver to receive a payment request directly from a merchant server, the payment request comprising a request for the transfer of payment in response to an online transaction by the first client, the online transaction identifying a form of payment associated with the financial institution and restricting access of payment details to the merchant server based on rules governing the access restriction data;
an authenticator to authenticate the first client when identifying the form of payment as part of the online transaction, the first client having been redirected from a website of the merchant server directly to a website of the payment server, and the first client being authenticated when the credentials input by the first client at the website of the payment server are read from the storage system and validated by the payment server;
an authorizer to authorize
payment to the merchant server in response to the payment request when the credentials are read from the storage system and have been validated by the payment server, the authorization establishing a trusted relationship between the payment server and the merchant server using a first token to grant the merchant server secure access to the payment server and indicate a scope of the payment, and
sending the profile information of the first client to the merchant server when approved by the client, the profile information secured by a second token comprising the profile information; and

a transmitter to transmit the payment and the approved profile information by the payment server to a financial institution of the merchant server using a mutually secure connection after establishing the trusted relationship.

2 . The apparatus according to claim 1 , wherein
the receiver receives a registration request at the payment server to register the merchant server with the payment server, and the transmitter provides values to the merchant server in response to the registration.

3 . The apparatus according to claim 2 , wherein the trusted relationship comprises a network level security that is established by:
the transmitter and the receiver exchanging messages between the payment server and the merchant server using a private key; the transmitter placing tokens within a JSON web token container; and the transmitter applying mutual SSL for communications after the merchant server is registered with the payment server.

4 . The apparatus according to claim 1 , wherein the payment server denies the transfer of the payment to the merchant server by the payment server when the first client fails to authorize the payment and exits the online transaction without payment.

5 . The apparatus according to claim 1 , wherein
when the credentials are validated by the payment server, the payment server issuing a temporary code to the merchant server by the payment server; the payment server receiving the first token at the payment server in exchange for the issued temporary code from the merchant server; when the first client authorizes sending of the profile information, the payment server issuing the first token and the second token to the merchant server by the payment server, the second token comprising the profile information; and when the first client fails to authorize the sending of the profile information, the payment server issuing the first token to the merchant server, by the payment server, without providing the profile information.

6 . The apparatus according to claim 5 , wherein when the transmitter transmits the payment,
the receiver receiving a status of the payment using the first token, the status identifying whether the scope of the payment token has expired; the authorizer granting the payment to the merchant server when the scope of the first token has not expired; the receiver receiving a payment execution transaction from the merchant server when the payment has been granted, after the profile information has been verified; and the transmitter paying the merchant server the payment in the amount associated with the online transaction, and confirming payment.

7 . The apparatus according to claim 6 , wherein the scope of the payment token is defined as expiring after one execution of payment.

8 . A method of securing financial data in a network, comprising:
storing the financial data, credentials and access restriction data in a storage system of a payment server, the financial data, the credentials and the access restriction data associated with a first client having a financial relationship with the payment server; receiving a payment request by a merchant server at the payment server in response to an online transaction made at a website of the merchant server, the online transaction prompting payment by the first client; authenticating the first client in response to the payment request, after selection of a form of payment identifying the payment server and restricting access of the financial data to the merchant server based on rules governing the access restriction data, the first client having been redirected from a website of the merchant server directly to a website of the payment server, the authentication performed by validating the credentials read from the storage system of the first client accepted at a login screen of the website of the payment server; authorizing the merchant server for payment, in an amount associated with the online transaction, in response to the authentication when the credentials are read from the storage system and validated by the payment server, and obtaining details of the online transaction from the merchant client after confirming authorization, the authorization establishing a trusted relationship between the payment server and the merchant client using a first token to grant the merchant client access to the payment server and indicating a scope of the payment; and transmitting the payment by the payment server to the merchant client using a mutually secure connection after establishing the trusted relationship, and providing profile information of the first client to the merchant client with the transmitted payment using a second token when authorized by the first client.

9 . The method according to claim 8 , further comprising
receiving a registration request at the payment server to register the merchant client with the payment server; and providing values to the merchant client in response to the registration.

10 . The method according to claim 9 , the registration request comprising the merchant client name, the merchant client terms and conditions, the merchant client owner, the merchant client network address, the merchant client public key, the merchant client redirect_uri and the merchant client bank account information, and
the values of the payment server comprising the payment server name, the payment server public key, the payment server network address and the payment server APIs to exchange protocol related requests.

11 . The method according to claim 9 , the trusted relationship comprises a network level security and is established by:
exchanging messages between the payment server and the merchant client using a private key; placing tokens within a JSON web token co

Assignees

• Ca Inc

Inventors

• Preibisch Sascha

Classifications

• G06Q20/3829 Primary

  involving key management · CPC title

• G06Q20/405 Primary

  Establishing or using transaction specific rules · CPC title

• G06Q20/12

  specially adapted for electronic shopping systems · CPC title