SK288624B6 - POS payment terminal and method of cashless payment using mobile communication devices, such as a mobile phone - Google Patents

Abstract

POS terminal (1) utilizing the mobile communication device (4), in particular the mobile telephone, consists of a temporary connection of the removable memory card merchant's Sales Device (2), the removable memory card (18) being inserted into the mobile communication device (4) of the customer. The Sales Device (2) includes a protected memory (6) with POS terminal identification data in the form of a SAM card or ICC card (9), or directly in the form of a secure element on a printed circuit board. The payment terminal (1) is created before or during the payment process by temporarily linking a Sales Device (2) to a mobile communication device (4) held by the customer and having a removable memory card which may have a separate communication element (12) NFC. The payment cryptogram has a standard form, e.g. in the EMV format, and is sent to the payment processing center (15) online or offline off-line according to the payment amount and the set risk management.

Description

Technical field

The solution relates to a POS payment terminal, which has a simplified structure, using the mobile communication device of the paying customer, in particular a mobile phone, and is intended primarily for small business operations, mobile sales stands and the like.

Prior art

Existing POS (Point of Hall) terminals are widespread in commercial operations and are characterized by a stable structure, which includes, among other things, a communication channel connected to the payment processing center, printer, encryption key, display, card reader, mostly card reader of various formats and keyboard on entering the PIN code. This technical arrangement requires some space and is relatively expensive. Known versions of POS terminals are designed especially for stable points of sale in brick-and-mortar stores, where the high costs of purchasing, installing and operating POS terminals are offset by reasonable turnover payments for purchases.

The solution according to the published patent WO2008063990 describes a system in which the POS terminal does not have a communication channel with the payment processing center and uses a mediated connection via the customer's mobile phone. This solution has lower security, as the payment-terminal application itself takes place on a remote computer and the mobile phone is only an intermediary for communication. Other published patents describe a distributed POS terminal in such a way that directly at the payment point there is only its control part, which is connected to the remaining part located at another place in the store. Known solutions and published patents do not provide a simple guide on how to create a cheap, uncomplicated and possibly also a portable POS payment terminal, which would create payment cryptograms according to existing standards, in particular EM V standards.

All previous solutions require a relatively complicated installation and include many output and input devices, which increases their cost. So far, no devices are known which are at the same time characterized by simplicity, high security and at the same time would be portable and usable even in small shops, such as newsstands or mobile counters, for example for the sale of fast food.

An important requirement is that the new solution is compatible with the structures of existing payment data at the level of the payment processor. An arrangement that would require a completely new hierarchy or possibly new verification procedures would not be possible to enforce in practice.

The essence of the invention

These shortcomings are substantially eliminated by a POS payment terminal using a mobile communication device, in particular a mobile telephone, where the POS payment terminal includes, inter alia, a unit for running a payment terminal application, a protected memory with identification data for assigning and identifying a merchant, a display, a keyboard and the interface according to this solution, the essence of which consists in that the POS payment terminal is formed by a temporary connection of the Sales Device with a removable memory card which is inserted in a slot of a mobile communication device, in particular in the form of a mobile phone belonging to a paying customer. The Sales Device may belong to the merchant or may be held by the merchant and contains a protected memory with identification data, which in particular includes the data necessary for assigning the POS payment terminal to the bank account of the respective merchant. The Sales Device basically consists of hardware that ensures the correct identity of the temporarily created POS payment terminal.

An important feature of the present solution is therefore that the POS terminal arises from a temporary connection of two parts. The connection is marked as temporary, as after the payment process is completed, the parts can be separated, the communication channel is interrupted and a new connection can be re-established between the Sales Device and another removable memory card. Naturally, reconnection of a previously cooperating removable memory card and a Sales Device is not excluded either. The temporary connection is understood as a time phase essentially limited to one payment process, and a certain connection time can also be assumed before and after the start of the payment process. The possibility to always pair a new pair of elements on the side of the merchant and the paying user represents a solution in which it is always possible to create a POS terminal in the mobile communication device of the paying user, the POS terminal having the identity of the respective merchant.

The term Sales Device is not a common term in the field of POS payment terminals, and under this phrase it is necessary to introduce any hardware element equipped with the appropriate software to perform the functions according to this description. Sales Device behaves externally as a POS payment terminal and merchants will usually call it that in practice, but in terms of structure and application flow, Sales Device is only an important, but not a sufficient part of the entire POS payment terminal. The concept of Sales Device

S K 288624 B6 must therefore be understood in a general sense as a part of the terminal which is essentially tied to the merchant or to the point of sale and ensures the correct routing of non-cash payments.

The Sales Device can have two basic functions in the entire POS payment terminal - to carry the identity of the POS terminal and to enter the payment value. In principle, an even narrower hardware version is possible, in which the value of the payment is entered via the keyboard of the mobile communication device, but such a version is inconvenient for the merchant, as he would have to control the customer's mobile communication device or have to rely on the customer to enter latob n o-terminal application the correct amount of payment. The entered value could also be displayed on the Sales Device display for control by the merchant, but it will be more convenient if the amount paid is entered via elements on the merchant's side. The version described in this paragraph with the entry of the paid value via the keyboard of the mobile communication device would not have to meet some standards (eg EMV) for the behavior and actions of the merchant in handling cashless payment, but is in principle technically feasible using the principle of the presented solution.

The Sales Device alone is not able to perform a payment-terminal application and does not need to have communication channels to establish a connection with the payment processing center (eg bank, clearing house, etc.). Only by connecting the Sales Device of the merchant to a removable memory card, which is inserted in the slot of the customer's mobile communication device, a hardware assembly capable of performing all the basic functions of a conventional POS payment terminal is created. A temporary connection can be established for essentially each individual payment, while on the part of different customers it can always be a different communication device. It is the mobile communication device that is able to establish the necessary connection with the payment center thanks to the existing GSM / GPRS (Gobal System for Mobile Communications / General Packet Radio Service) channel. However, this connection does not have to be created with every payment, as the solution in our opinion describes the ability to process both offline and online payments.

An important element of the POS payment terminal according to the present solution is a removable memory card which contains such hardware and software elements that the assembly connected from the Sales Device and the mobile communication device is able to run and execute directly on the removable memory card the payment-terminal application. cashless payment transaction. Since the Sales Device and Mobile Communication Device assembly does not need to be equipped with an external payment card reader, it will be advantageous to have protected memory with at least one payment card unit directly on the removable memory card. The removable memory card will also contain a unit for running a payment-terminal application and a communication element for connection to the Sales Device. In addition to the protected memory with the POS identification data of the payment terminal, the Sales Device may also contain a communication element for connection to a removable memory card. Thanks to these elements, the POS payment terminal is created using a conventional mobile phone with a card slot for memory expansion. Thus, the removable memory card may comprise a generic payment terminal, which becomes a specific payment terminal with a unique identity only at the moment of connection to the Sales Device. The Sales Device provides the temporarily established connection with a clear identification in favor of whom the payment needs to be made. Since it is of interest for mobile phones without NFC (Near Field Communication) communication elements to be able to fulfill this function, such an NFC communication element can be contained directly on a removable memory card. In principle, the connection between the mobile communication device and the Sales Device could also take the form of a contact interface, which would, however, require complex connector unification and compatibility issues. It will therefore be advantageous, but not the only solution, if the connection between the Sales Device and the removable memory card takes the form of an NFC communication channel that is widely standardized.

Thanks to the described arrangement, it will be possible for the merchant to purchase only a very simple Sales Device, which will carry information about the identity, the terminal number and the account number of the respective merchant can be assigned in the payment processing center. Such a Sales Device will be very small and simple. It can take the form of a small box with a display and a keyboard, with which the merchant enters the required amount of payment. The identification data can be stored directly in the respective element on the Sales Device printed circuit board or can be stored on an ICC (integrated circuit card), or on other carriers, e.g. in previously known SAM (Security Authentication Module) cards with a cryptographic key In this version, a SAM card with the size of a standard SIM card (Substriber Identity Module) can be used, accessible after removing the cover of the Sales Device. The SAM card is inserted into the Sales Device before the first start-up

The customer attaches his mobile communication device to the Sales Device. By attaching, an NFC communication channel is created and information about the identity of this temporarily created POS payment terminal is sent from the Sales Device to a removable memory card. The identification data can be encrypted using the Master Key, which is stored in the Secure Element in the Sales Device. Under the term Secure Element, it is possible to present in particular, but not exclusively, protected memory with the necessary interface, and it can take the form of a separate chip with a corresponding computing capacity. The Secure Element can be arranged in such a way that the data stored on it are not freely accessible from the outside, but this data can be used as input parameters to perform a calculation operation within the Secure Element and only the results of these calculation operations are externally, for example in the form of cryptograms. . On the removable memory card, the input data from Sales De

With K 288624 B6, after reading them, they become the basis for running a payment-terminal application. The payment-terminal application can be recorded in an indifferent form, without its own identity, on a removable memory card. Thus, after establishing a temporary connection between the Sales Device and the removable memory card, a specific POS terminal is essentially formed from the general, generic, indifferent terminal, which is already assigned to the respective merchant in the system. This stage is as if preparing for the start of a new one-time POS terminal. Subsequently, a payment-terminal application can take place during the connection, e.g. type EM V similar to before in classic POS terminals.

The encryption of the POS terminal identification data can take place using a Master Key, which in general can be, and will generally be, different from the encryption keys that are later used by the payment terminal itself and the application to create the payment cryptogram. The Master Key may come from, for example, a Sales Device hardware vendor, and the encryption keys of the payment terminal application may be issued by a bank or payment processor. The difference in encryption keys in practice will be conditioned by the different requirements of individual entities operating in the payment settlement system.

From the point of view of increasing security, the data on the amount of payment can also be encrypted during the transfer from the Sales Device to the mobile communication device. This reduces the risk that, by means of a special application in the mobile communication device, the paying user could reduce the value of the payment before starting the core of the payment-terminal application. Such a change would be reflected in the final confirmation of payment on the part of the trader in the form of a display of the amount paid, but in the event of inattention and routine approach, the trader would not have to notice the change in amount.

An arrangement is preferred in which the payment terminal terminal communicates with the unit of the selected payment card directly on the removable memory card. A removable memory card can store multiple units of separate payment cards, either on physically separate secure elements or on separate domains of one secure element. With this arrangement, the payment terminal application can run directly on the removable memory card and the customer's payment card data is not sent via external readers or to the Internet space, which has a positive effect on the security of the payment operation.

The Sales Device can take various forms, in addition to a small single-purpose box with a keyboard that directly contains a Secure Element with identification data, it can also be designed to have an external card reader, preferably the classic standard ICC (integrated circuit card) format. Sensitive data can then be recorded on the chip of such an ICC card. At the same time, the card chip also contains a certain memory capacity, which can be suitably used to record data on completed payment transactions. At the end of the day, the merchant can leave the basic part of the Sales Device in the store, for example in a magazine stand, and take only the ICC card with him. If he selects an ICC card from the Sales Device, he can send it for processing to the bank or back up the data from it via a reader at home to his computer. In the case of several mobile stands of one merchant, there may be several Sales Devices combined with one ICC card with identification data of one terminal and one bank account, and conversely one Sales Device can be used sequentially with several ICC cards of different merchants in multi-store operation.

It is advantageous, but not necessary, if the Sales Device has its own interface, such as a USB format for connecting to expansion accessories, which allows payment data to be printed directly from the Sales Device, or connected to a payment card reader via this connector. , GPRS modem and the like.

Overview of figures in the drawings

The invention is explained in more detail with the aid of FIGS. 1 to 5.

Figure 1 schematically shows an external view of a mobile communication device in the form of a conventional mobile telephone, which is attached to the Sales Device. The scale, shape or ratio of the dimensions of the mobile communication device to the Sales Device is not binding and is chosen only with regard to better display clarity. In the illustration, the mobile phone and the Sales Device do not overlap to increase the clarity of the image, but in reality, the mobile phone may be directly attached to the Sales Device desktop.

Figure 2 shows a view of the basic structure of a Sales Device, where it is also visible that the communication element on the mobile phone side is located in a removable memory card. The memory with the identification data of the POS terminal is located in the S AM card. Figure 2 also shows the NFC communication channel between the removable memory card and the Sales Device.

Figure 3 schematically shows the structure of a removable memory card with an indifferent POS payment terminal unit and with four separate payment card units from different banks. In addition to the basic functions, the removable card is also supplemented with standard flash memory.

Figure 4 is a diagram of the structure of the Sales Device in an arrangement where an ICC card of a merchant is inserted in the body of the reader.

S K 288624 B6

Figure 5 shows an arrangement with a connection to a cash register. The Sales Device includes an ICC card reader and also has a mini USB connector.

Examples of embodiments of the invention

Example 1

In this example according to Figures 1, 2 and 3, a system is described where on the merchant's side there is a Sales Device 2 in the form of a single-purpose box having a numeric keypad 13, a display 14 and its own power supply in the form of a rechargeable battery. The Sales Device 2 has an NFC communication element 11 with an antenna 21 below the surface of the upper housing, where the center of the antenna 21 is graphically indicated on the outside of the housing by a target guide symbol 19. Sales Device 2 in its hardware on SAM card 24 includes a Secure Element 6, into which the identification of the POS of the payment terminal 1 has been uploaded, as well as a Master Key for encrypting the communicated data. In another version, this data can be uploaded directly to the protected memory on the Sales Device 2 PCB.

Sales Device 2 is used by the merchant by writing on the display 14 the amount he wants for his goods or service when selling via the keyboard 13. After checking the amount on the display 14, the trader presses the confirmation button. After this operation, the POS data of the payment terminal 1 is encrypted with a Master Key and this encrypted data is sent together with the payment amount to the NFC communication element H, which sends an encrypted message via antenna 21 and waits for the mobile communication device 4 to be applied to the Sales Device 2. The merchant prompts the paying customer to pay him and thus attaches his mobile communication device 4 to the Sales Device 2. The customer activates the launch of the payment application in his mobile communication device 4, for example by means of a special hardware key or a softkey. After creating the NFC communication channel, the encrypted data from the Sales Device 2 is read and decrypted, resulting in the identification data of the POS terminal 1 and the required payment amount.

This part of the transmission can also be expressed as

3DES [Mk {Cfg}]> 3DES ^-1 [Mk {Cfg}] = Cfg, where 3 DES means encryption using the Triple Data Encryption Algorithm, where Mk is the Master Key provided by the payment processor, where Cfg means configuration data and NFC represents the transmission path between Sales Device and removable memory card.

The amount paid can be verified by the customer on the display of his mobile communication device 4. The identification data from the Sales Device 2 serve to make the indifferent POS terminal J. on the removable memory card 18 a specific POS payment terminal 1 for the benefit of the merchant.

This process can be expressed as

Cfg + Generic POS = ACg POS, where Generic POS is the designation of the indifferent, generic POS and ACg POS is the POS of the relevant merchant.

Subsequently, the secondary o-terminal application takes place in the usual way, for example according to the EMC standard. According to the selected risk management of the payment card 7 and taking into account the amount paid, a password, PIN code may be requested, which the customer enters on the keypad of his mobile communication device 4. This achieves high security, as the payment-terminal application runs directly on the removable storage card 18, where also the payment card units 7 are stored and sensitive data does not leave the hardware of the connection of the Sales Device 2 and the removable memory card 18. The result of the payment application is the creation of a payment cryptogram which is sent to the Sales Device 2 and also in the case of online payment. sends via the interface 8 to the mobile communication device 4 and subsequently via the mobile network to the payment processor. A payment cryptogram can also be created and sent according to the relationship:

3DES [Mk {Transaction}]>

or to the payment processor as

3DES [Mk {Trans action}]

In this example, the removable memory card is in the form of a microSD card.

Example 2

In this example according to Figure 4, the Sales Device 2 takes the form of a device which has a slot for inserting an ICC card 9 with a reader of the appropriate format. The merchant can buy Sales Device 2 anywhere and this Sales Device 2 does not have its own identity. The ICC will receive a card of 9 common dimensions according to ISO 7810 85.60 x 53.98 mm from the bank or from the payment processor or from the card issuer. The Master Key of the payment processor is taken over on the chip of the ICC card 9 in the Secure Element, as well as the identification data of the POS terminal for assignment to the respective merchant. By inserting the ICC card 9 into the reader, a Sales Device 2 is created as described. Sales Device 2 also includes a mini-B USB connector 17, through which a printer, computer or other output or input units can be connected in an extended configuration. Operation and operation of Sales Device 2 is similar to the first one

However, it differs from K 288624 B6 in that, after the change is completed, the merchant selects his ICC card 9 and can bring it, for example, to a bank for processing off-line payments. Processing of such an ICC card 9 directly at ATMs is also not excluded. This solution also has the advantage that the ICC card 9 is easy to handle, has practical dimensions and its removal from the Sales Device 2 reader prevents its theft in commercial operation, for example during the night and the like. At the same time, the ICC card 9 provides spacious post-processing and backup of data on a computer with a simple reader.

The advantage of the arrangement according to this example is also the possibility that one device with a reader, display 14 and keyboard 13 can be used by several merchants working for changes in one business operation, payments being settled to the respective merchant who has his ICC card 9 just inserted in readers.

Example 3

Sales Device 2 according to Figure 5 has, in addition to the elements mentioned in the previous examples, an RS232 (Recommended Standard 232) interface with which it can be connected to the cash register 10. In this example, Sales Device 2 is essentially an extension of the merchant's existing cash register 10 to a POS payment terminal. 1, however, the payment-terminal application can again take place on a removable memory card 18, which is held by the customer together with the mobile communication device 4.

The result from the cash register 10 is transferred to the Sales Device 2 via the cable connection 16, where it appears on the display 14 and the merchant confirms it with the confirmation button. The process then proceeds as if the amount paid was entered by the Sales Device 2 keypad 13. it is necessary for Sales Device 2 to include a keyboard 13 for entering the amount paid, in view of the usability of Sales Device 2 in various systems, the keyboard 13 is part of Sales Device 2 in this example as well.

Industrial applicability

Industrial applicability is obvious. According to the present invention, it is possible to industrially and repeatedly manufacture and use POS payment terminals which are created temporarily for the purpose of a particular payment by connecting a Sales Device and a mobile communication device. The necessary structures of the merchant's POS terminal are created only after connection to a removable memory card in the mobile communication device of the paying user.

S K 288624 B6

List of reference marks

- POS payment terminal

- Sales Device

- Secure Element

- Secure Element POS terminal

- Secure Element of a payment card

- mobile communication device

- unit with payment-terminal application

- memory with terminal configuration data

- payment card unit

- interface

- ICC card

- cash register

- Sales Device communication element

- communication element of the removable memory card

- keyboard

- display

- Payment processing center

- connection with the cash register

- external connector

- Removable memory card

- guidance symbol

- microcontroller

- Removable memory card antenna

- memory

- Sales Device antenna

- SAM card

- communication link

Claims (16)

PATENT CLAIMS A POS payment terminal (1) using a mobile communication device (4), in particular a mobile telephone, wherein the POS payment terminal (1) comprises a unit (5) for running a payment-terminal application, a protected memory with POS terminal identification data for assigning a merchant, a keyboard and a display, wherein a removable memory card (18) is inserted in the slot of the customer's mobile communication device (4), characterized in that the payment terminal (1) is formed by a temporary contactless connection (25) of the Merchant Sales Device (2) with a removable memory card (18), the Sales Device (2) comprises a protected memory (6) with POS terminal identification data and the Sales Device (2) comprises a communication element (11) with an antenna (23) for connection to a removable memory card (18). POS payment terminal (1) according to claim 1, characterized in that the removable memory card (18) comprises: a unit (5) for running a payment-terminal application, a protected memory (3, 32) with at least one unit (7) payment card, a communication element (12) with an antenna (21) for connection to a Sales Device (2), the protected memories (3, 31, 32) being connected to a microcontroller (20) and the microcontroller (20) being connected to an interface ( 8) for connection to the circuits of the mobile communication device (4) and wherein the Sales Device (2) comprises a protected memory (6) with the identification data of the POS terminal and an encryption key. POS payment terminal (1) according to claim 1 or 2, characterized in that the protected memory (6) with the identification data of the POS terminal is located on a SAM card (24) which is inserted in the Sales Device (2). POS payment terminal (1) according to claim 1 or 2, characterized in that the protected memory (6) with the identification data of the POS terminal is located on an ICC card (9) which is inserted in the Sales Device reader (2). POS payment terminal (1) according to any one of claims 1 to 4, characterized in that the Sales Device (2) has a keypad (13) for entering the amount paid and a display (14). POS payment terminal (1) according to any one of claims 1 to 5, characterized in that the removable memory card (18) has two secure elements (31, 32), the secure element (32) of the payment card comprising a plurality of separate domains for separate units (7) of payment cards. POS payment terminal (1) according to any one of claims 1 to 6, characterized in that the removable memory card (18) has a memory (22) for unprotected user data. POS payment terminal (1) according to any one of claims 1 to 7, characterized in that the Sales Device (2) has a connector (17) for connecting external devices. POS payment terminal (1) according to any one of claims 1 to 8, characterized in that the Sales Device (2) has a connection (16) to the cash register (10). A cashless payment method using a mobile communication device, in particular a mobile telephone, wherein the mobile communication device on the removable memory card (18) comprises a generic POS terminal, characterized in that the payment terminal (1) is established before or during the payment process. connecting the Merchant's Sales Device (2) to a removable memory card (18) held by the customer, the POS terminal identification data being read from the Removable memory card (18) from the Sales Device (2) and the generic POS terminal on the removable memory card ( 18) subsequently becomes the POS terminal of the relevant trader. Cashless payment method according to claim 10, characterized in that the identification data of the POS terminal are read into the removable memory card (18) from the Sales Device (2) by means of encrypted transmission. Cashless payment method according to claims 10 or 11, characterized in that the payment terminal application takes place on a removable memory card, where the data from the payment card unit (7) according to the customer's choice are used. Cashless payment method according to any one of claims 10 to 12, characterized in that after the payment cryptogram is created, it is sent to the Sales Device (2), where it is stored in the memory of the records of the executed payments. Cashless payment method according to any one of claims 10 to 13, characterized in that after the payment cryptogram is created, the payment cryptogram is sent to the payment processing center (15) via the interface (8) and subsequently via the mobile communication device (4). Cashless payment method according to any one of claims 10 to 14, characterized in that the record carrier is provided for processing by a bank or in a payment processing center (15) after being selected from the Sales Device (2). Cashless payment method according to any one of claims 10 to 15, characterized in that the payment value is entered into the removable memory card from the Sales Device (2) via manual input via the keyboard (13) or via a connection (16) to the registration treasury (10).