EA041883B1 - SYSTEM AND METHOD FOR CONDUCTING REMOTE TRANSACTIONS USING POINT OF SALE PAYMENT TERMINAL - Google Patents

Description

The field of technology to which the invention belongs

The present invention relates to a system, method and terminal point of sale (Point-of-Sale,

PoS), applicable in particular in transactions in which the buyer is removed from the seller.

State of the art

Online shops and merchants often accept credit and debit cards as a means of payment. One disadvantage of online card payments is that the user must manually enter the card information into the fields on the web site page of the online store or on the page associated with said website.

The above-described online payment using a card is a so-called cardless transaction, because at the time of the transaction, the merchant does not have the opportunity to verify the existence of a physical card. Transactions without presenting a card can be easily falsified and the risk for the merchant is high. As a consequence, the corresponding transaction fee is high.

For example, there is no guarantee that the user enters their card information, ie. card information may be stolen or otherwise obtained illegally, and its use may lead to financial losses for the seller and / or buyer. The information transmitted to said website may be misused to conduct fraudulent transactions by anyone with access to this information or a person in between who has the ability to separate this information from the data transmitted between the user and said website. This can be implemented in several ways.

Various methods have been proposed to secure cardless transactions. Often, these methods do not provide significant security enhancements or require significant modifications to existing infrastructure and websites due to incompatibility with existing systems. Generic point of sale terminals are not suitable for use by end users at home or elsewhere for cardless transactions because each point of sale terminal is customized for a particular merchant. When a customer makes a payment in a store, the point-of-sale terminal transfers the payment to a predetermined bank account. The idea that for every single online merchant, every customer should have a point-of-sale terminal that that customer could use to make a payment to that merchant's appropriate bank account is unrealistic.

The essence of the invention

In accordance with an aspect of the present invention, a remote transaction processing system is provided, comprising a first data store containing a user device profile related to the user device and containing routing data for routing communications to the user device; wherein the system is configured, upon receiving a payment request specifying a user device to perform a transaction with a merchant, obtaining a point of sale configuration profile corresponding to the merchant, and obtaining from the first data store a user device profile corresponding to said specified user device, and with the possibility of reporting the point of sale configuration of a point of sale configuration profile dependent configuration profile to a user device depending on the routing data, wherein the point of sale configuration is performed by the user device to allow the user device to be used as a point of sale terminal to perform a transaction with the merchant.

Preferably, the user device profile contains a public key from a cryptographic key pair of the user device, and the remote transaction processing system is configured to encrypt the reported point of sale configuration using the public key.

Preferably, the routing data comprises a plurality of routes for communicating with the user device, and the remote transaction processing system is configured to determine a route from among the plurality of routes for communicating with the user device.

Routes in the routing data may be assigned ranks, and the remote transaction processing system may be configured to identify a route to reach the user device depending on the specified ranks.

Preferably, the routes include routes for communicating with the user device through various channels.

The channels may be selected from a set containing SMS, instant messages, communication with a predetermined address in a data network, or a call for data transmission over a communication network.

The system may further comprise a second data store containing a point of sale configuration profile for each merchant of the plurality of merchants, and may be configured to obtain a point of sale configuration profile for the merchant from the second data store.

- 1 041883

The second data store may contain a point of sale certificate related to the respective merchant and containing the merchant's point of sale configuration profile.

The first data store may contain a user device certificate related to the corresponding user device and containing the public key of the user device.

The first and second data stores may be the same data store.

The first data store may contain a user device profile for each user device of the plurality of user devices.

The first data store may be remote from user devices.

The first data store may be local to the user device, such that the user device profile may be retrieved from said user device.

The system may include a merchant website comprising a payment user interface configured to receive from the user an identifier indicating a user device profile to be used for payment, wherein the system may be configured to obtain a user device profile depending on said identifier.

The system may include a payment processing system configured to receive payment requests for each merchant from a plurality of merchants.

The payment processing system may be configured to receive a point of sale configuration profile from a merchant upon receiving a payment request.

The system may include a user device that includes a point of sale terminal application and a payment card reader, wherein the user device may be configured to receive a point of sale configuration for a transaction with a merchant, with the ability to configure the point of sale terminal application depending on said point of sale configuration. sales and with the ability to read a payment card through a payment card reader to make a payment for this transaction through the terminal application of the point of sale.

The user device may include a secure element running a point-of-sale terminal application selected from a set containing a Subscriber Identity Module (SIM), a Universal Integrated Circuit Card (UICC) or an Embedded Secure Element (ESE), a Trusted Execution Environment (TEE) or secure environment.

The secure element may be inserted, embedded, or embedded in the user device.

In accordance with yet another aspect of the present invention, a method for processing remote transactions is provided, including receiving a payment request specifying a user device to perform a transaction with a merchant; obtaining a point of sale configuration profile corresponding to the merchant; obtaining a user device profile corresponding to said given user device and containing routing data for routing communications to the user device; and reporting the point of sale configuration depending on the point of sale configuration profile to the user device depending on the routing data, wherein the point of sale configuration is performed by the user device to enable the user device to be used as a point of sale terminal to perform a transaction with the merchant.

Said method may further include associating a cryptographic certificate containing a public key of a public/private key pair with a user device profile; encrypting at least a portion of the point of sale configuration using the public key; and decrypting the encrypted point of sale configuration in the user device using the private key.

Said method may further include storing a cryptographic certificate in a data store, and the step of obtaining a user device profile may include obtaining said certificate.

The step of receiving the payment request may include receiving information about the transaction, and the step of reporting the configuration of the point of sale may include generating a configuration of the point of sale depending on the transaction information and the configuration profile of the point of sale.

The point of sale configuration generation step may include signing the point of sale configuration using a private key from a cryptographic private/public key pair.

Said method may further include performing the following steps on the user device: performing a card payment transaction on the user device via a point-of-sale terminal; signing in the terminal of the point of sale of the payment transaction data; encryption in the terminal of the point of sale of the signed data of the payment transaction; terminal transmission

- 2 041883 points of sale of encrypted and signed payment transaction data to the payment service node; and deleting, by the point of sale terminal, said payment information from the memory of the point of sale terminal. In one or more embodiments, a method for securing all communication in both directions with a remotely configurable point of sale terminal system and a remotely configurable point of sale terminal system is provided. Said method includes using cryptographic keys of the point of sale terminal and a merchant's payment system node using the cryptographic key of the point of sale terminal to encrypt payment information based on the entered transaction data. Said method also includes signing the generated payment information with a secret key and transmitting the signed payment information. The merchant or an organization providing the merchant with a payment service configures the point of sale terminal with the merchant's own profile of the merchant's point of sale terminal based on the instructions transmitted in the payment information.

In one or more embodiments, a method for remotely configuring a point of sale terminal is provided. Said method includes receiving signed payment information at a point of sale terminal. This method also includes checking, at the point of sale terminal, that the payment information is valid using a public key certificate.

In one or more embodiments, a method for remotely configuring a point of sale terminal is provided. Said method includes receiving, at the merchant's device, the entered transaction data. Said method also includes generating payment information in the merchant device based on the entered transaction data and signing the generated payment information with a secret key. The method further includes transmitting the signed payment information and the public key certificate signed by the certification authority to the point of sale terminal. The method includes checking, at the point of sale terminal, the validity of a public key certificate using a public key certificate of a certification authority and the validity of payment information using a public key certificate signed by a certification authority. The method also includes configuring, at the point of sale terminal, a terminal profile of said point of sale terminal according to the instructions received in the payment information, if the payment information has been successfully validated at the point of sale terminal.

The payment information and the first public key certificate before transmitting the signed payment information and the first public key certificate using the second public key certificate of the point of sale terminal or acquiring bank.

Brief description of the drawings

Hereinafter, with reference to the accompanying drawings, embodiments of the present invention will be described by way of example only. In these drawings, FIG. 1 is a diagram of a remote transaction processing system according to an embodiment of the present invention;

fig. 2 is a diagram of the elements of the system shown in FIG. 1, in work;

fig. 3 is an illustration of the flow of operations in a transaction with a merchant transmitting payment information to a mobile user device running a point of sale application (and thereby becoming a point of sale terminal);

fig. 4 is a diagram illustrating the issuance of a security clearance and configuration of a point of sale terminal profile without the use of an acquiring bank;

fig. 5 - messages in a transaction with a remote customer using a separate terminal for making purchases and a mobile device for payment; and fig. 6 - messages in a transaction with a remote customer using a mobile device for both making purchases and making a payment.

Information confirming the possibility of carrying out the invention

The following is a detailed discussion of the preferred embodiments of the present invention, examples of which are presented in the accompanying drawings, where like reference signs refer to like elements throughout.

Fig. 1 is a diagram of a remote transaction processing system according to an embodiment of the present invention.

The remote transaction processing system 10 includes a first data store 20 .

The first data store 20 contains a user device profile for each user device of the plurality of user devices, and each user device profile contains routing data for routing messages to that user device.

The remote transaction processing system 10 is configured, upon receiving a payment request specifying a user device 40 as a device for conducting a transaction with a merchant, obtaining a point of sale configuration profile corresponding to the specified merchant, and obtaining a user device profile from the first data store 20 corresponding to this

- 3 041883 to this user device 40. The remote transaction processing system 10 reports the point of sale configuration corresponding to the specified point of sale configuration profile to the user device 40 via the communication network 30 in accordance with the specified routing data. Said point of sale configuration may be performed by user device 40 to enable that user device to be used as a point of sale terminal to perform said transaction with said merchant.

As one possibility, the remote transaction processing system 10 may include a second data store. This second data store contains a point of sale configuration profile for each merchant of the plurality of merchants, and the remote transaction processing system 10 accesses the second data store to obtain a particular merchant's point of sale configuration profile.

The first and second data stores may be separate or combined. Distributed and redundant data stores can also be used.

Preferably, each of the point of sale configuration profiles and user device profiles is or contains a cryptographic certificate, such as a PKI (Public Key Infrastructure) certificate. Examples of data that may be contained in these cryptographic certificates are discussed below.

Fig. 2 is a diagram of the elements of the system shown in FIG. 1, in work.

The user device 40 in this embodiment is a smartphone and includes a processor 41, a memory 42, a card reader 45, and a display 43. The user device 40 is configured to communicate with the data network 30.

The user, while interacting with the website 60, comes to the stage where it becomes necessary to make a payment in a remote transaction with a merchant associated with this website. In the present embodiment, the user is accessing the website 60 through a computing device 70 other than the user device 40, however, it should be understood that the user can also access the website 60 through the user device 40.

Website 60 in the user interface presents payment options to the user. Instead of entering credit card or debit card information as usual at this stage of the transaction, the user enters the identifier of the user device 40.

Upon receiving this identifier, the website 60 communicates it and the merchant identifier to the payment processing system 80 .

The payment processing system 80 accesses the first data store 20 to obtain the point-of-sale configuration profile corresponding to the specified merchant ID and the second data store 30 to obtain the user device profile corresponding to the specified merchant ID.

Then, the payment processing system 80, based on the received point of sale configuration profile, generates a point of sale configuration 90, which reports to the user device 40 using the routing data from the obtained user device profile.

After receiving the point of sale configuration 90, the processor 41 of the user device 40 executes the point of sale terminal application 44 in its memory 42 and applies the point of sale configuration 90, causing the user device 40 to act as a point of sale terminal for that merchant. The user is prompted to present a payment card to the card reader 45, and the data from the presented card is processed by said point of sale terminal and reported to the payment processing system 100 to complete the transaction. At this point, to the payment processing system 80, the transaction appears to be initiated from the merchant's point of sale terminal, much as if it had been completed entirely in the store using the merchant's own point of sale terminal.

The routing data preferably comprises a plurality of routes for communicating with the user device 40. The payment processing system 80 is preferably configured to select from said plurality of routes a route for communicating with the indicated user device. For example, the routes in the specified routing data may be assigned ranks (or, at the time they are needed, the routes may be parsed to assign ranks). The payment processing system 80 may be configured to determine a route to each user device according to the specified ranks.

The routes preferably include routes for communicating with the user device over different channels. For example, these channels can be selected from a set containing SMS, instant messages, transmission to a predetermined address in a data network, or a call for data transmission over a communication network.

For example, a user device profile may define a Google Messaging address as a preferred route, a Skype address as a first fallback, and a mobile SMS device number as a second fallback. If necessary, message

- 4 041883 point of sale profile, the payment processing system 80 first attempts to communicate with the user device through the Google messaging program, then tries to do so through Skype, and finally sends an SMS message. When using SMS and other communication methods with a limited amount of useful information, many messages may be sent or the message may contain a link or other parameters directing the user device to obtain a point of sale profile.

The routing data may contain MSISDN (telephone number, Mobile Subscriber Integrated Services Digital Number), alias, device identifier (e.g. IMEI, International Mobile Equipment Identity), secure element identifier (for example, IMSI, International Mobile Subscriber Identity, International Mobile Subscriber Identity), email address, internet address, digital network address, or Bluetooth address of the user device.

The point of sale configuration profile may be in the form of a certificate, or may contain a certificate, and may, for example, contain one or more of the following: a cryptographic signature authenticating the contents of the certificate; bank data and/or payment processing data for use by the point of sale terminal application when transmitting transaction information, such as payment details, to the payment processing system 80 .

The point of sale configuration may contain information to be used by the point of sale terminal application on the user device in order to determine whether a successful cardholder verification result is required to complete a transaction associated with the received payment information.

The point of sale configuration may contain information about supported cardholder verification methods.

A point of sale configuration may contain payment information containing one or more of the following: date, time, amount, currency, authorization limit, contactless payment limit, transaction limit, transaction ID, merchant name, and merchant country.

A point of sale configuration profile may contain one or more of the following elements: Payment Service Provider Identification (PSPID), Merchant Identification (MID), and/or Terminal Identification (TID).

The user device profile may be in the form of a certificate or contain a certificate and may contain one or more of the following elements: public key from the user device cryptographic key pair, user device IMSI identifier, user device MSISDN number (telephone number), identifier of the organization providing the access service to cellular network, secure element ID, mobile device ID, allowed currencies, forbidden currencies, high value purchase flag with support for cardholder verification, highest purchase value, lowest purchase value, validity period, allowed mobile device identification information, list of supported card types, point of sale application version number, financial risk management information.

Preferably, said user device is a mobile device, such as a mobile phone, smartphone, tablet, or other computing device. Said user device may be a multi-purpose device (for example, a smartphone with an appropriate application program or other hardware, software or firmware solution that makes this smartphone capable of being used as a point of sale terminal), or a specialized device for providing the user with the functions of a point of sale when performing remote transactions. Preferably, the user device comprises a card reader, such as a chip reader, a magnetic stripe reader, a PIN code reader and/or a short range radio communication (NFC, etc.) antenna, a display, a memory, a processor, a program that can be executed by the processor , power supply, RF transmitter, mobile phone antenna or other network connector, and user input such as a keyboard, touch screen, camera and/or microphone.

The user device's cryptographic key pair may be generated at the user device or may be assigned to the user device. Said cryptographic key pair may be stored in the user device during manufacture.

The user device may communicate via one or more cellular networks, Bluetooth or other short-range radio frequency communications, the Internet, a local area network, a wireless LAN, a camera built into a mobile device, a cable attached to the device, a microphone, or a memory card.

The payment processing system 80 is preferably configured to encrypt the reported point of sale configuration using a public key from a specified user profile.

- 5 041883 valetsya device.

Preferred embodiments enable the user device to function as a point of sale terminal. In preferred embodiments, it is possible to process remote transactions securely, preferably using a merchant profile assigned only temporarily and stored in the user device used as a point of sale terminal, which allows such temporary merchant profile to be used only for the duration of a particular transaction. While the merchant's temporary profile is activated and in use, the user device functions as a point of sale terminal operating as a merchant's point of sale remote terminal, with the amount paid credited to the merchant's account specified in that temporary profile. When a particular transaction is executed, this temporary profile is preferably deleted, so that the terminal cannot be used again until it has accepted the new profile and the entered transaction data.

As will be appreciated, in the preferred embodiments, the customer does not need to enter their payment card information anywhere, so the card information cannot be used for fraud.

The point of sale application 44 may be implemented in accordance with co-pending US Patent Application No. US 61726121, the contents of which are incorporated herein in their entirety. Application program 44 may be implemented in hardware, firmware, software, or some combination thereof, and may reside on a UICC/SIM card. The application 44 may conform to the payment card scheme EMV and use a Public Key Infrastructure (PKI) type security certificate solution.

Preferred embodiments enable secure electronic payments using chip cards or a mobile wallet. In preferred embodiments, a point of sale application (which may reside in the secure memory of a chip card or in a user device) is used, having a smart card reader or card reader interface based on near field communication, such as Near Field Communication (NFC), and technical possibility of communication through the network.

Preferably secure certificates based on PKI are used. The integrity of the protection key control chain makes it possible to build and maintain high levels of security in the system.

Protection system management.

There are several scenarios for managing the protection system. The first of them involves the seller, the acquiring bank, the certification center (CA, for example, the card payment system) and the buyer. The second scenario involves the seller, the CA and the buyer. The third scenario additionally involves a trusted third party that maintains a database of point of sale certificates.

The user device, as one of the possibilities, generates and/or uses a pair of cryptographic keys through the point of sale application: a secure secret key and a corresponding public key. The specified key pair may be specific to that point-of-sale application, or may be used by other applications running on the same processor and/or the same secure element.

The user device preferably stores the secret key in a tamper-resistant memory or secure element. This method ensures that the secret key is kept absolutely secret, since the secret key cannot be read or otherwise made explicit outside of the protected element.

The user device preferably generates or uses a public key certificate (user device profile certificate), publishes it, and transmits it to the external certificate database node (before the first payment transaction). In the embodiment shown in FIG. 1, such a node (or an element communicating with such a node) is the first data store, thus the certificate is obtained from the first data store. As one possibility, the certificate can be obtained directly from the user device without being stored in a database.

As discussed above, the payment processing system (eg, payment service node) is configured to obtain the user's mobile device certificate from a certificate database using an MSISDN number or similar unique device or user identifier.

The payment processing system may, as one option, validate the received user device certificate to verify that the customer's mobile device has a compatible point-of-sale application and that the application has permission to complete the transaction.

The payment processing system preferably uses the public key from the certificate to partially or fully encrypt the payment information before transmitting the information to the point of sale terminal or gateway node.

- 6 041883

The payment processing system may, as one possibility, contain return routing information, such as network IP address, server ID, domain name in the reported point of sale profile, in order to obtain transaction information information, such as an authorization request and completed transactions.

Preferably, the point of sale application on the user device is configured to verify that the merchant's point of sale configuration profile received by the application is valid and has not been modified. This verification can be done using a PKI-based security system that inherits trust from a common CA. For this purpose, the public key certificate of the certification authority is reported to the terminal of the point of sale (usually during manufacture, but this can also be done later).

In both scenarios, before the first step, the buyer has already completed the selection of purchases in the online store, so the full payment information is known, the user has selected the option to pay using a mobile device with the functionality of a secure point of sale terminal, and entered the number of his mobile device.

The merchant node provides the buyer with the means to enter a phone number or other identifier, or redirects the buyer to the payment page on the payment service node for the same purpose. The user identification code may be stored in a cookie or similar method on the customer's computer device and automatically substituted in the appropriate field on the payment page. This gives the shopper the ability to use the one-click shopping experience without entering any credit card information at all.

1. The buyer on his mobile device selects the payment method using the remote terminal of the point of sale.

2. The merchant forwards the payment information to a payment service node operated, for example, by a payment acquirer or payment service provider (PSP).

3. The customer enters their mobile device number (MSISDN) or similar unique identifier on the payment service node page.

4. The payment service node obtains the user device profile certificate from the certificate database node corresponding to the information entered by the customer.

5. If this receipt is successful, then the PSP checks the validity of the certificate and checks if the mobile device is equipped with a compatible version of the point of sale terminal.

6. PSP signs the payment information.

7. The PSP encrypts the payment information using the POS terminal's public key.

8. If the payment information is valid, then the point of sale configures its terminal profile according to the instructions received in the specified payment information for the duration of one transaction.

9. The point of sale presents the specified payment instructions to the user.

10. The user can accept the payment or reject it.

11. Payment, if consent is obtained, will be processed according to the appropriate method.

12. When payment processing is completed, the point of sale terminal automatically deletes its profile, and this terminal can no longer be used until it receives new payment information.

In FIG. 3 and 4, an embodiment of the present invention is illustrated as a flowchart and a transaction flowchart. The flowchart of the transaction in FIG. 3 illustrates the flow of operations in a transaction with a merchant transmitting payment information to a mobile user device running a point of sale application (and thereby becoming a point of sale terminal). The flowchart of the transaction in FIG. 4 is a diagram illustrating the issuance of a security clearance and configuration of a temporary point of sale terminal profile without using an acquiring bank. This system contains a merchant's device and a certification center, without an acquiring bank. In this embodiment, without an acquiring bank, the following transactions can take place.

1. The merchant signs the payment information (IP) with his secret key.

2. The seller sends the signed IP and the seller's public key certificate, signed by the CA, to the terminal of the point of sale.

3. The point of sale terminal checks the validity of the merchant's public key certificate using the CA's public key certificate.

4. If the merchant's certificate is valid, then the point of sale uses it to verify the validity of the IP.

5. If the UI is valid, then the point of sale configures its terminal profile according to the instructions accepted in the specified UI for the duration of one transaction.

6. The point of sale presents the specified payment instructions to the user.

7. The user can accept the payment or reject it.

- 7 041883

8. Payment, if consent is obtained, will be processed according to the appropriate method.

9. When payment processing is completed, the point of sale terminal automatically deletes its profile, and this terminal can no longer be used until it receives new payment information.

Other scenarios are also possible with the same level of protection provided by the continuity of the chain of security certificates.

The selection of these scenarios is invisible to the user. In other words, the main difference in processing the flow of data to mobile devices is whether merchants need the ability to control the transfer of data between their systems and various mobile devices, or this function is concentrated at acquiring banks and performed by them.

The sequence of messages in a transaction.

Fig. 5 illustrates messages in a transaction with a remote customer using a separate terminal for selecting purchases and a mobile device for payment. Fig. 6 illustrates the messages in a transaction with a remote customer using a mobile device for both selecting purchases and making a payment.

(1) A user who is ready to pay for goods or services can (2) enter their mobile device number on the remote merchant site as a payment card number. The merchant server generates the payment information with all necessary transaction information containing the profile of the merchant's point of sale terminal, such as the main account number and other information, risk management information, payment processing information, information about the type (s) of accepted cards, a list of country codes in which this the mobile point of sale terminal is allowed to transact, a list of country codes in which the mobile point of sale terminal is prohibited from transacting, the date and time of purchase, the name of the merchant and the amount, and the number of the user's mobile device, and possibly other items. The issued invoice is signed with the merchant's own private key, which is signed by a trusted third party, such as a bank, card payment system, certification authority, etc., and is sent (3) to the acquiring bank, which verifies the authenticity and integrity of this invoice. If the invoice is valid, then the CA signs it with its own private key and transmits (4) to the secure point of sale terminal application on the user's mobile device or on the UICC/SIM card in said mobile device.

The data transfer function may be performed by a trusted service manager or other trusted third party. Any available communication protocol (eg, instant messaging, SMS, USSD, TCP/IP, or CSD) supported by the network in use, the mobile device, and the UICC card that may be in the mobile device may be used for data transmission.

A trusted third party, such as a CA or a bank, may maintain a database linking the specified account number to the mobile device number.

The point of sale terminal accepts the signed invoice for payment and verifies the integrity and authenticity of this invoice using the public key of the CA, a trusted third party or a card payment system located in the secure memory of this terminal.

The point of sale terminal preferably determines its geographic location using, for example, information available on the network about which country it is located in, and compares this location information with a list of allowed and prohibited country codes. If the current geographic location of the point of sale terminal is outside the allowed locations or is a prohibited location, then the point of sale terminal cancels the transaction, which may alert the user and the bank.

If the payment information is valid, the point of sale terminal uses the information contained in this payment information to configure itself to enable said terminal to operate as if it were a point of sale terminal owned by the merchant.

The payment information contains the amount to be paid as a fixed number that cannot be entered or otherwise modified by the user.

The user may be notified of a remote transaction in progress and the user may be asked for permission to proceed with the transaction. The user can cancel or allow the transaction in the form in which it is formed, but cannot change the amount, other parameters or information related to this transaction.

The point of sale terminal displays the amount, name or other identifier of the merchant, and possibly other information related to this transaction, and asks the user to approve the transaction. If the transaction is approved by the user, then the point of sale terminal requests that the payment card be presented to the card reader. In the case of a plurality of cards or card readers, the point of sale terminal prompts the user to select a card to be used and a card reader interface.

- 8 041883

The card reader may be built into the point of sale terminal/mobile device or may be an external card reader connected to the terminal. The card reader can be contact or contactless.

When (5) communicating a payment card with a card reader built into or connected to a mobile device, in order to complete a transaction, the user may be asked to provide information known to him, for example, a secret PIN code (Personal Identification Number), or other means of authentication, e.g. signatures, images, voice samples, photographs, etc. The PIN or other authentication information may be entered using, for example, a mobile device user interface display, keyboard, camera, voice recognition, character recognition, motion recognition, or fingerprint recognition.

The transaction between the payment card and the point of sale terminal can be, for example, an EMV standard transaction, a contactless payment transaction, a smart card transaction, an embedded payment card transaction, a credit or debit card transaction, a transaction using an account, for example, with a network operator , a transaction using a prepaid or held amount, or an e-wallet transaction.

This payment card may be a physically separate payment card, or may reside on the same UICC or on the same mobile device as the point of sale terminal. The payment card can be in a mobile wallet that is in a mobile device or in a UICC/SIM card. The payment card may reside in the same integrated circuit (IC) as the point of sale terminal or in a separate IC. One or both of these ICs may be embedded in a UICC/SIM card or in a mobile device. An IC containing a payment card may be embedded in a mobile device, and an IC containing a point-of-sale terminal may be embedded in a UICC card, and vice versa.

The UICC may be a SIM card and/or a secure element.

If a mobile wallet containing more than one payment card is used, then the user can select the desired payment card.

The payment transaction is then passed back to the payment acquirer, which validates the transaction with the card issuer (7-8) and confirms the transaction status to the point of sale terminals and the remote merchant (9). The remote seller can confirm the status of the transaction to the buyer (10). If the transaction is successful, the funds are transferred to the seller's account.

If the transaction is not approved, then the user can cancel the transaction or repeat it using the same or a different payment card or the same or a different card reader.

Once the transaction is processed and completed, merchant-specific configuration and payment information is permanently deleted.

These embodiments enable secure remote purchases using an NFC-compatible mobile device and a UICC card as a point-of-sale terminal for both the merchant and the customer.

The specified point of sale terminal can be any point of sale terminal connected to the network.

Said payment service node can also be a software application or a hardware implementation in a mobile device or a SIM card. In this case, in order to carry out a secure financial transaction to be transferred from the buyer's account to the seller's account, the seller's point of sale terminal application in the mobile device or SIM card can be configured to pass the profile of its own terminal to the buyer's point of sale terminal application.

Address database.

A point of sale terminal application, a point of sale configuration database, or a point of sale terminal public key certificate may contain a database with one or more building address or other physical address. These addresses can be used, for example, as a billing address and/or a delivery address when purchasing goods remotely. This address may be combined with information passed to the acquiring bank and/or merchant. The address information may be signed by the point of sale terminal using its private key for authentication and encrypted using the public key of the merchant or acquiring bank for protection.

The address database may contain fixed addresses that the user cannot change and additional addresses that the user can change.

These addresses may be labeled as addresses for various purposes, such as shipping address, billing address, home address, work address, point of sale terminal address. If the data transmitted to the acquiring bank and/or the merchant contains an address, and this address is marked as a shipping address, then the merchant must use the specified address as the shipping address for the goods. If the address is marked as a billing address, then the seller must send the invoice related to the purchase to the specified address.

Aspects of this embodiment(s) may also be implemented as a pro-

Claims (23)

a gram configured to be used with a processor to initiate execution of operations by said processor, or may be implemented in hardware on one or more attached or unattached devices. While the preferred forms and embodiments of the present invention have been illustrated and described herein, those skilled in the art will appreciate that various variations are possible without departing from the inventive concept presented above. CLAIM 1. A remote transaction processing system, comprising a first data store containing a customer user device profile related to the customer user device configuration and containing routing data for routing communication with the customer user device; wherein the system is configured, upon receiving a payment request that specifies a customer user device to perform a transaction with a merchant, obtains a merchant payment terminal configuration profile, and retrieves from the first data store a customer user device configuration profile corresponding to the specified customer user device, and with the possibility of transmitting the merchant payment terminal configuration data used at the point of sale to a customer user device based on the routing data, wherein the customer user device is configured to use the merchant payment terminal configuration data to enable the customer user device to be used as a merchant payment terminal to perform transactions with the merchant, and the configuration data of the merchant's payment terminal includes payment processing data to set the user's to the buyer's device, a configuration that transmits data about the payment made on the buyer's user device to the seller. 2. The system according to claim 1, characterized in that the buyer's user device profile contains a public key from a cryptographic key pair of the buyer's user device, and the remote transaction processing system is configured to encrypt the transmitted configuration data of the merchant's payment terminal using the public key. 3. The system according to claim 1, characterized in that the routes in the routing data are assigned ranks, and the remote transaction processing system is configured to identify the route to reach the customer's user device depending on the specified ranks. 4. The system according to claim 1 or 3, characterized in that the routes include routes for communicating with the customer's user device through various channels. 5. The system according to claim 4, characterized in that the channels are selected from the set containing SMS, instant messages, communication with a predetermined address in a data network or a call for data transmission over a communication network. 6. The system according to any one of the preceding claims, further comprising a second data store containing a configuration profile of each merchant payment terminal from a plurality of merchant payment terminals, said system being configured to obtain a merchant payment terminal configuration profile from the second data store. 7. The system according to any one of the preceding claims, characterized in that the second data store contains a merchant payment terminal certificate relating to the respective merchant and containing the merchant payment terminal configuration profile. 8. The system according to any one of the preceding claims, wherein the first data store contains a customer user device certificate relating to the respective customer user device and containing the customer user device public key. 9. The system according to any one of the preceding claims, characterized in that the first and second data stores are the same data store. 10. The system according to any one of the preceding claims, wherein the first data store contains a customer user device profile for each customer user device of the plurality of customer user devices. 11. The system according to claim 10, characterized in that the first data store is remote with respect to the customer's user device. 12. The system according to any one of claims 1 to 9, characterized in that the first data store is local to the customer's user device. 13. The system according to any of the preceding claims, characterized in that it further comprises a merchant website containing a payment user interface implemented with an - 10 041883 by the possibility of receiving from the user an identifier indicating the profile of the customer's user device to be used for payment, while the system is configured to receive the profile of the customer's user device depending on the specified identifier. 14. The system according to any one of the preceding claims, further comprising a payment processing system configured to receive payment requests for each merchant of the plurality of merchants. 15. The system of claim 14, wherein the payment processing system is configured to receive a merchant payment terminal configuration profile from the merchant upon receipt of a payment request. 16. The system according to any of the preceding claims, further comprising a shopper user device that includes a merchant payment terminal application and a payment card reader, wherein the shopper user device is configured to receive a merchant payment terminal configuration for transacting with the merchant, with the possibility of configuring the application program of the merchant payment terminal depending on the specified configuration of the payment terminal of the merchant and with the possibility of reading the payment card by means of a payment card reader to make a payment for this transaction by means of the application of the payment terminal of the merchant. 17. The system according to claim 16, characterized in that the buyer's user device contains a secure module in which the merchant's payment terminal application program is executed, while the secure module is selected from a set including a subscriber identity module (SIM), a universal card with an integrated circuit ( UICC) or Embedded Secure Element (ESE), Trusted Execution Environment (TEE), or Secure Environment. 18. The system according to claim 17, characterized in that the secure module is inserted, mounted or embedded in the customer's user device. 19. A method for processing remote transactions implemented in the system for processing remote transactions according to independent claim 1, including the following operations: receiving a payment request by the remote transaction processing system indicating the customer's user device to complete the transaction with the merchant; receiving by the remote transaction processing system the configuration profile of the merchant's payment terminal; obtaining by the remote transaction processing system from the first data store a configuration profile of the customer user device corresponding to said customer user device, containing routing data for routing communication with the customer user device; and transmitting, by the remote transaction processing system, the configuration data of the merchant's payment terminal to the customer's user device based on the routing data; the use by the customer user device of the merchant payment terminal configuration data to enable the customer user device to be used as a merchant payment terminal to perform a transaction with the merchant, wherein the merchant payment terminal configuration data includes payment processing data to configure the customer user device to transfer data on the payment made on the buyer's user device to the seller. 20. The method of claim 19, further comprising associating a cryptographic certificate containing a public key of a public/private key pair with the customer's user device profile; encrypting at least a portion of the merchant payment terminal configuration data using the public key; and decrypting the encrypted merchant payment terminal configuration data in the customer user device using the private key. 21. The method of claim 20, further comprising storing the cryptographic certificate in the data store, wherein the step of obtaining the buyer's user device profile includes obtaining said certificate. 22. The method according to any one of claims 19 to 21, wherein the step of receiving a payment request includes receiving transaction information, and the step of transmitting merchant payment terminal configuration data includes generating merchant payment terminal configuration data based on the transaction information and the profile. Merchant's payment terminal configuration. 23. The method of claim 22, wherein the step of generating the merchant payment terminal configuration data includes the step of signing the merchant payment terminal configuration data using a private key from a cryptographic private/public key pair. -