Systems and methods for convenient and secure mobile transactions

Patent metadata

Field	Value
Publication number	US-9276910-B2
Application number	US-201314083948-A
Country	US
Kind code	B2
Filing date	Nov 19, 2013
Priority date	Nov 19, 2013
Publication date	Mar 1, 2016
Grant date	Mar 1, 2016

Abstract

Systems and methods for conducting convenient and secure mobile transactions between a payment terminal and a mobile device, e.g., in a fueling environment, are disclosed herein. In some embodiments, the payment terminal and the mobile device conduct a mutual authentication process that, if successful, produces a session key which can be used to encrypt sensitive data to be exchanged between the payment terminal and the mobile device. Payment and loyalty information can be securely communicated from the mobile device to the payment terminal using the session key. This can be done automatically, without waiting for the user to initiate a transaction, to shorten the overall transaction time. The transaction can also be completed without any user interaction with the mobile device, increasing the user's convenience since the mobile device can be left in the user's pocket, purse, vehicle, etc.

First claim

What is claimed is:

1. A terminal, comprising:
a wireless transceiver configured to communicate wirelessly with a mobile device;
an input device configured to receive input from a user of the terminal;
a storage device configured to store user information associated with one or more users; and
at least one processor coupled to the wireless transceiver, the input device, and the storage device, the processor being programmed to:
conduct a mutual authentication process with a mobile device to obtain a session key;
receive user information from the mobile device via the wireless transceiver, said user information being encrypted by the session key;
store the received user information in the storage device;
after the mutual authentication process is conducted and after the received user information is stored in the storage device:
receive a request to initiate a transaction from a user via the input device;
prompt the user for authorization information;
receive authorization information from the user via the input device;
encrypt the authorization information using the session key;
send the encrypted authorization information to the mobile device via the wireless transceiver;
receive a validation result from the mobile device via the wireless transceiver; and
when the validation result is positive, complete a transaction requested by the user using the stored user information.

2. The terminal of claim 1 , wherein the user information is received automatically, without any interaction between the user and the mobile device.

3. The terminal of claim 1 , wherein user interaction with the mobile device is not required before, during, or after completing the transaction.

4. The terminal of claim 1 , wherein the terminal comprises a point of sale terminal.

5. The terminal of claim 1 , wherein the processor is programmed to send an electronic receipt to the mobile device via the wireless transceiver, the electronic receipt being encrypted using the session key.

6. The terminal of claim 1 , wherein the processor is programmed to delete user information received from a mobile device if the terminal loses communication with said mobile device or if a predetermined time elapses without a user of said mobile device initiating a transaction.

7. The terminal of claim 1 , wherein the processor is programmed to receive a user identification from the user and to send the encrypted authorization information only to a mobile device associated in the storage device with said user identification.

8. The terminal of claim 1 , wherein the processor is programmed to receive at least one of a payment type indication and a loyalty type indication and to send said indication to the mobile device with the encrypted authorization information.

9. The terminal of claim 1 , wherein a cryptographic key of a Root CA with which the mobile device and the terminal have a trust relationship is stored in the storage device.

10. The terminal of claim 1 , wherein a cryptographic key of a mobile vendor with which the mobile device has a trust relationship is stored in the storage device.

11. The terminal of claim 1 , wherein the terminal comprises a fuel dispenser.

12. A mobile device, comprising:
a wireless transceiver configured to communicate wirelessly with a terminal;
a storage device configured to store user information associated with a user; and
at least one processor coupled to the wireless transceiver and the storage device, the processor being programmed to execute a transaction with a terminal by:
conducting a mutual authentication process with the terminal to obtain a session key;
encrypting the user information stored in the storage device using the session key;
sending the encrypted user information to the terminal via the wireless transceiver;
after conducting the mutual authentication process and after sending the encrypted user information to the terminal;
receiving encrypted authorization information from the terminal via the wireless transceiver;
decrypting the authorization information using the session key;
comparing the authorization information to master authorization information to generate a validation result, the validation result being positive when a match is found and being negative when a match is not found; and
sending the validation result to the terminal via the wireless transceiver to facilitate completion of the transaction by the terminal.

13. The mobile device of claim 12 , wherein the processor is programmed to send the user information to the terminal automatically, without any interaction between a user and the mobile device.

14. The mobile device of claim 12 , wherein user interaction with the mobile device is not required before, during, or after completing the transaction.

15. The mobile device of claim 12 , wherein the processor is programmed to receive at least one of a payment type indication and a loyalty type indication from the terminal via the wireless transceiver, and to select master authorization information for said comparing based on the indication.

16. The mobile device of claim 12 , wherein a cryptographic key of a Root CA with which the mobile device and the terminal have a trust relationship is stored in the storage device.

17. The mobile device of claim 12 , wherein a cryptographic key of a terminal vendor with which the terminal has a trust relationship is stored in the storage device.

18. The mobile device of claim 12 , wherein the terminal comprises a fuel dispenser.

19. A method for conducting a convenient and secure mobile transaction using a terminal and a mobile device, comprising:
automatically and without user interaction with the terminal or the mobile device,
conducting a mutual authentication process in which the terminal and the mobile device authenticate one another to each obtain a session key;
receiving user information from the mobile device via a wireless transceiver of the terminal, said user information being encrypted by the session key; and
storing the user information in a storage device of the terminal;
after conducting the mutual authentication process and after storing the user information in the storage device;
receiving a request to initiate a transaction from a user via an input device of the terminal;
prompting the user for authorization information via an electronic display of the terminal;
receiving authorization information from the user via the input device;
encrypting the authorization information using the session key;
sending the encrypted authorization information to the mobile device via the wireless transceiver;
receiving a validation result from the mobile device via the wireless transceiver; and
when the validation result is positive, completing a transaction requested by the user using the stored user information.

20. The method of claim 19 , wherein the terminal comprises a fuel dispenser.

Assignees

• Wayne Fueling Systems Llc

Inventors

• Tang Weiming
• Brewer James Matthew

Classifications

• G06Q20/3278

  RFID or NFC payments by means of M-devices · CPC title

• G06Q20/401

  Transaction verification · CPC title

• H04L63/0428 Primary

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• G06Q30/06

  Buying, selling or leasing transactions · CPC title

• G06Q2220/00

  Business processing using cryptography · CPC title