AU2014100003A4 - Secure Payment System with biometric authorisation and dual path authentication - Google Patents

Abstract

Abstract A system that contains the following major components: a Customer Agent (CA) that resides in a mobile handheld device attributed to the authorised customer of the method; a Vendor Agent (VA) that resides in a Point of Sales (POS) solution that is attributed to a vendor of the method and; a Verification and Authorisation Agent (VAA) that resided in the Certification Agency domain.

Description

Title Secure Payment System with biometric authorisation and dual path authentication Introduction This application is for a secure payment business method (the method) that features biometric authorisation to activate a transaction and multi-path communication channels to authentication the payment. The functionally for the method is distributed across the three participants (a customer, a vendor, and a certification and verification agencies) in the process that contains the following major components: " the Customer Agent (CA) that resides in a mobile handheld device attributed to the authorised customer of the method, " the Vendor Agent (VA) that resides in a Point of Sales (POS) solution that is attributed to a vendor of the method and " the Verification and Authorisation Agent (VAA) that resided in the Certification Agency domain. The Business Method To successfully complete a payment between a customer and a vendor all three agents must participant in the transaction as described below. The process is started when the customer informs the vendor's POS system that they would like to use the (secure payment) method. To initiate a payment using this method an authorised customer (who has previously set-up an account and has a valid CA on their mobile handheld device) would activate the customer agent on their mobile device and use the finger print scanner to authenticate the customer' from their finger print image that has previously be recorded and stored securely. While the customer finger is touching the scanner on the mobile device the Customer Agent (CA) generates a customer message (to the vendor agent) that contains at a minimum (depending on the capability of the coding system used): e a transaction ID (must be clear text) 1 * the Digital Signature (Digital Certificate) of the customer Additional information that could also be appended to the customer message to the vendor agent are: " geographic location information " Time to Live (TTL) The CA then generates a computer readable code that contains the customer message and displayed it on the screen of the customer's mobile device. The customer then shows this code to the vendor's POS system so that the VA can 2 read the computer readable code. The VA would provide feedback to the customer when the message has been received. 1 Other forms of biometric information that could be used are voice recognition or retina scans althoughh both of these would mean that the customer's message would to be displayed on the customer's mobile device wh le the customer is potential not holding the device) Page 1 1 The communications channel between the CA and VA can be either via: " a camera or " alaserscanner Alternatively, a Near Field Communications (NFC) interface could be utilities to transfer the customer message. This type of communications channel does not require the computer readable image to be generated, but would operate is a similar manner. When the customer removes their finger from the scanner the computer readable code is removed from the display. If the customer's message has not been received by the VA then the process will be terminated by this action. At the same time that the customer message (to the vendor) is generated and displayed a customer message to the VAA is also generated. This message contains the transaction id and other additional information. This message is encrypted using the customer's public key and sent to the VAA with a time to live (TTL) tag using a secure link. The Vendor Agent (VA) after successfully scanning the computer readable image will generate a message (to the VAA) with the payment details and attached the customer's 4 message to their message to the VAA. The vendor message is then er crypts using the vendor's public key and sends the message to the VAA using a secure link. When the VAA receives the vendor message it decodes it using the vendor's private key and verifies the vendor's credentials. The VAA looks at the transaction id and tries to find the matching customer message with the same transaction id. If it finds the transaction id then it can find the customer's private key and decode the digital 5 signature to authenticate the transaction and authorise the payment. If the customer's message has not been received that is will store the vendor's message until the customer's message arrives. When the VAA receives a customer's message it will check for the corresponding vendor message and if not found will store the customer's message. If the vendor 6 message is found it will check the customer digital signature on the vendor's message to authenticate the transaction and authorise the payment. When a payment has been authorised the VAA will then generate a response to the vendor message that indicates that the customer digital signature is valid and that the transaction was successful. 7 The VAA can also send a message to the CA to inform the customer that the transaction was successful The VAA can also complete the EFT between the customer's bank del it or credit 8 account to the vendors bank account. Page | 2