WO2015080689A1

WO2015080689A1 - Secure payment system over the internet

Info

Publication number: WO2015080689A1
Application number: PCT/TR2014/000474
Authority: WO
Inventors: Erdal Yazmaci
Original assignee: Kartek Kart Ve Bi̇li̇şi̇m Teknoloji̇leri̇ Ti̇caret Anonim Şirketi
Priority date: 2013-11-28
Filing date: 2014-11-28
Publication date: 2015-06-04

Abstract

The invention especially relates to a system which provides the user to complete his/her payment by approaching the card to the computer with NFC reader without entering his/her card information in the payment page / screen after adding the products desired to be bought to the cart in the e-commerce websites, wherein it provides the personal computers with POS device function in order to allow secure money transfer.

Description

DESCRIPTION

SECURE PAYMENT SYSTEM OVER THE INTERNET TECHNICAL FIELD

The invention relates to systems which provide shopping with bank's credit card in the e- commerce websites. The invention especially relates to a system which provides the user to complete his/her payment by approaching the card to the computer with NFC reader without entering his/her card information in the payment page / screen after adding the products desired to be bought to the cart in the e-commerce websites. STATE OF THE ART

Today, in the current systems used as payment method in the e-commerce websites; the users are asked to give their card information with which they will perform the payment to complete the shopping. Said information are manually entered to the relevant payment screen by the users. Although SSL (Secure connection protocol) is used during the connection of the environment where said information is entered, card information of the customers can be seen by virtual thieves. This situation results in fraud at approximately 0.08% every year. Considering that the e-commerce volume is 36 billion TL annually in Turkey, every year 250 billion TL is acquired by means of fraud committed by the fraudulent.

The applications briefly explained below can be given as an example to other applications having the same objects in the state of the art.

The PCT application No. WO0026838 (A1), titled "HOME POINT OF SALE (POS) TERMINAL AND ELECTRONIC COMMERCE METHOD" relates to a smart-diskette providing a secure method of electronic commerce and implementing a Home POS Terminal.

The application No. WO9908237, titled "METHOD FOR THE SAFE HANDLING OF ELECTRONIC MEANS OF PAYMENT AND FOR SAFELY CARRYING OUT BUSINESS TRANSACTIONS, AND DEVICE FOR CARRYING OUT SAID METHOD" relates to a device for the safe handling of electronic means of payment and for safely carrying out business transactions, comprising a first interface for communicating with at least one chip card; a second >interface for communicating with at least one security medium; a third interface for communicating with an external device; and a computer unit for receiving, processing, encoding, storing and/or emitting data.

The application No. US2004064302, titled "EMULATION METHOD FOR MANAGING A READER FOR A CHIP CARD INCOMPATIBLE WITH AN ENVIRONMENT" relates to a personal computer emulates the functionality of a smart card reader that conforms with the PCSC standard, to enable the computer to communicate with a reader that complies with the EMV standard for financial transactions.

The application No. KR20060034228, titled "CUSTOMER AUTHENTICATION IN E- COMMERCE TRANSACTIONS" relates to a chip authentication program performing customer authentication in online payment / money transfer transactions through 3D secure protocols.

The Mexican application No. MX2013000278, titled "STAND-ALONE SECURE PIN ENTRY DEVICE FOR ENABLING EMV CARD TRANSACTIONS WITH SEPARATE CARD READER" relates to a method of conducting secure electronic payments to a payment acquirer using a credit card payment unit, comprising of a portable card reader device, a mobile phone, a stand-alone PIN entry device and a payment server. The method is based on eliminating the unsecure keyboard in a mobile phone used for entering personal identification information, and instead use a separate secure PIN entry device which fulfills the EMV Level specification.

Another PCT application No. WO2012082258, titled "SYSTEM AND METHOD FOR POINT OF SERVICE PAYMENT ACCEPTANCE VIA WIRELESS COMMUNICATION" relates to a system and method for remitting payment from a consumer's credit or stored value account. The merchant portable computing devices (MPCD) have a wireless communication feature, such as a near field communication (NFC), or a machine-readable optical code feature to receive customer information, wherein a merchant may create one or more merchant account at a point-of-sale service site or use one or more portable computing devices for these accounts. Additionally, each of the MPCDs may optionally include a POS service/ application and receive the information required for payment from the EMV card or readable optical code with the NFC feature thereof. Banks have offered some^" applications as a solution in order to eliminate the abovementioned disadvantages. However, the virtual card applications offered onjy by the banks have lessened the problem to a certain degree and could not be sufficiently successful. The most significant insufficiency of the virtual card application of the banks is that it is not practical. The users, to make a secure shopping over the internet, create a virtual card by entering the online portal of the bank prior to shopping. The users limit the virtual card that they create. They complete the shopping by entering "card information" of this virtual card that they create into the websites where they will make shopping.

As most of the customers refrain from said virtual card application and do not want to share their real card information with a third-party system, the e-commerce volume has not reached the assumed level.

However, in the state of the art; shopping can be made over the internet only with the contactless debit cards of the banks.

To conclude, due to the aforementioned drawbacks and inadequacy of the existing systems regarding the subject, it is deemed necessary to make an improvement or development in the field of secure e-commerce differently from the known methods.

OBJECTS OF THE INVENTION

The object of the invention, developed by being inspired from the current conditions, is to eliminate the aforementioned drawbacks regarding the secure payment and to improve the security provided during payment for a more secure e-commerce.

One object of the invention is to allow shopping with a contactless credit card with a chip over the internet thanks to the EMV application to be installed to the process servers. Thanks to the EMV application to be installed to the process servers, personal computer (laptop etc.) serves as a personal POS (Point of Sale).

Another object of the invention is to approach the contactless bank credit cards of the users to the relevant section of the personal computer with NFC (near field communication) and to make the payment over the e-commerce platform. Thusly, the payments are made in a very fast and secure manner in the e-commerce. One object of the invention is to provide online payment transactions to be secure as if being made by physical POS devices in the shops thanks to the cloud based EMV application. The invention is a secure payment system which provides shopping over the internet by means of at least one contactless card and at least one personal computer and acquirer bank, bank confirming the payment and clearing house; comprises virtual POS applications and e-purse service or applications. To achieve the aforementioned objects without entering the bank credit card information of the user into the payment page / screen of the website for shopping confronting the user; the invention comprises the following;

a communication means which transfers the encoded information in the contactless card to the personal computer;

- a device management application through which the personal computer is managed by the customer;

a secure channel established between a personal computer and a process center comprising a virtual POS application, secure channel application, EMV L2 Kernel, e-purse service and device management application;

- a secure channel application which provides the operation of the secure channel and secure communication between virtual POS application, EMV L2 Kernel, e-purse service and device management application;

and EMV L2 Kernel performing the EMV steps. In a preferred embodiment of the invention; said communication means is a NFC reader connected to the personal computer.

In a preferred embodiment of the invention; said management application is a cloud based application.

The invention, in a preferred embodiment thereof, comprises a secure channel established by Mastercard® specifications.

In a preferred embodiment of the invention; said EMV L2 Kernel is a cloud based application. The invention also is a secure payment method comprising the process steps of enabling the information in the contactless card to be read by the NFC reader connected to the personal computer and transferring the information in the contactless card to the personal computer by means of the NFC reader. This method comprises the steps of;

transferring the card information to the EMV L2 Kernel by means of the secure channel by being encoded with a personal computer having security software; reading the information in the contactless card according to the EMV Standards by EMV L2 Kernel;

establishing a secure channel between the process center comprising POS applications, secure channel application, EMV L2 Kernel, e-purse service and the personal computer;

and linking the personal computer with the e-purse service thanks to the device management application (Cloud based device management). In the preferred embodiment of the method, said EMV L2 Kernel can be multiplexed depending on the number of the transactions. Moreover, in the preferred embodiment of the invention; said EMV L2 Kernel runs on cloud based application.

FIGURES TO FACILITATE UNDERSTANDING OF THE INVENTION

The structural and characteristic features and all the advantages of the present invention will be more clearly understood thanks to the figures below and the detailed description written with reference to those figures, therefore; the evaluation needs to be done by taking said figures and the detailed description into consideration.

Figure 1 is the view of the elements performing the method according to the invention and relationship of these elements with each other.

DESCRIPTION OF THE PART REFERENCES

1. Contactless card

2. Personal computer (PC)

3. Website for shopping

4. NFC reader

5. Secure Channel

6. Virtual POS application

7. Secure Channel Application 8. EMV L2 Kernel (EMV Engine)

9. E-purse service

10. Device management application

11. Acquirer Bank

12. Clearing House

13. Bank confirming the payment

14. Process Center (Network)

Scaling of drawings is not absolutely required and details, which are not needed for understanding the present invention, may have been neglected. Furthermore, elements, which are at least substantially identical or have at least substantially identical functions, are indicated with the same number.

DETAILED DESCRIPTION OF THE INVENTION

In this detailed description, preferred embodiments of the secure payment system according to the invention are described only for a better understanding of the invention.

The system according to the invention which performs the method according to the invention generally comprises the following;

- a contactless card (1 ) of the user, which is used during shopping;

a personal computer (PC) (2) which encodes the information in the contactless card (1), comprises therein security software and transfers said encoded information to the process center (14);

- a website for shopping (3);

- a NFC reader (4) which transfers the encoded information in the contactless card (1) to the personal computer (2);

- a protocol secure channel (5) established between the personal computer (2) and the device management application (10) by Mastercard® specifications;

- a virtual POS application (6) which runs on the virtual POS server and transfers the information from EMV L2 Kernel (8) to the acquirer bank (1 1 );

- a secure channel application (7) which starts the operation of the secure channel (5) and provides a secure communication between virtual POS application (6), EMV L2 Kernel (8), e-purse service (9) and device management application (10);

- a cloud based EMV L2 Kernel (8) (EMV Engine) which performs the EMV steps, runs on EMV engine server; - a cloud based e-purse service (9) where the card and address information of the user is securely kept;

- A device management application (10), a cloud based application which runs on the device management server and in which the personal computer (2) is managed by the customer;

- an acquirer bank ( 1 ), the bank which evaluates the card information in the contactless card (1); .

- a clearing house (12) such as Mastercard® or VISA®, which directs the contactless card (1) to the bank confirming the payment to which the card belongs, if the contactless card (1) does not belong to the acquirer bank (1 1);

- a bank confirming the payment (13), the bank verifying and confirming the contactless card (1) information

The existing systems provides shopping only with contactless debit cards of the banks. However; with the embodiment according to the invention, thanks to the EMV L2 Kernel (EMV Engine) (8) to be established in the process center (14), shopping is provided with the contactless card (1) having a chip over the internet. Thanks to the EMV L2 Kernel (EMV Engine) (8) to be established in the process center (14), the personal computers (2) serve as personal POS.

The payment of the shopping to be made over the websites for shopping (3) with the personal computer is ensured to be made in a more fast and secure manner.

Before the user starts the payment process, a secure channel (5) is established between the EMV L2 Kernel (EMV Engine) (8) installed in the process center (14) and the personal computer (2) by the secure channel application (7). When the user reads the contactless card (1 ) to the NFC reader (4) (communication means) embedded in the personal computer; the card information is received by the personal computer (2) having security software in an encoded manner. The card information is encoded with the personal computer (2) having security software and transferred to the EMV Engine (8) by means of the secure channel (5). Here, EMV process flow is applied to the card information and card information is directed to the virtual POS application (6). The card information in the contactless card (1) is directed to the host of the acquirer bank (11) after being evaluated in the virtual POS application (6). If the bank to which the contactless card belongs (1 ) is the acquirer bank (11), here accept or refuse message is given for payment. The message with respect to the payment is delivered to the website for shopping (Merchant Platform) (3). If the bank to which the contactless card belongs (1) is not the acquirer bank (11 ), the payment information is directed to the clearing house (12). The clearing house (12) sends the card information to the bank to which the contactless card (1) belongs and sends accept or refuse response to the acquirer bank (11) and then the message is sent to the website (Merchant platform) (3) from the process center (14).

The basic feature of the embodiment according to the invention is to provide a secure communication between the contactless card (1 ) and the personal computer (2). The use thereof in different sectors (especially transportation sector) is also possible.

Istanbul Kart system can be shown as a sample scenario for the embodiment according to the invention. To load credit into the card, the use of card vending machines or POS devices of the merchants is required. Thanks to the offered solution, the users can make loading into their contactless cards (1 ) by means of the personal computer (2) from their houses.

The users complete their payments by approaching the contactless cards (1 ) to the NFC reader (4) (communication means) in the personal computer (2) over the e-commerce platform. In this manner, the payments made in the e-commerce are both very fast and secure.

Claims

1. The secure payment system which

- provides shopping over the internet by means of at least one contactless card (1 ) and at least one personal computer (2) and acquirer bank (11 ), bank confirming the payment (13) and clearing house (12);

- comprises virtual POS applications and e-purse service (9) or applications, said secure payment system characterized in comprising;

- a communication means which transfers the encoded information in the contactless card (1) to the personal computer (2);

a device management application (10) through which the personal computer (2) is managed by the customer;

- a secure channel (5) established between a personal computer (2) and a process center (14) comprising a virtual POS application (6), secure channel application (7),

EMV L2 Kernel (8), e-purse service (9) and device management application (10);

- a secure channel application (7) which provides the operation of the secure channel (5) and provides a secure communication between virtual POS application (6), EMV L2 Kernel (8), e-purse service (9) and device management application (10);

- and EMV L2 Kernel (8) performing the EMV steps

in order not to enter the bank credit card information of the user into the payment page / screen of the website for shopping (3) confronting the user.

2. The secure payment system according to Claim 1 , characterized in that said communication means is a NFC reader (4) connected to the personal computer.

3. The secure payment system according to Claim 1 , characterized in that said device management application (10) is a cloud based application.

4. The secure payment system according to Claim 1 , characterized in comprising a secure channel (5) established by Mastercard® specifications.

5. The secure payment system according to Claim 1 , characterized in that said EMV L2 Kernel (8) is a cloud based application.

The secure payment method comprising the process steps of; - enabling the information in the contactless card (1 ) to be read by the NFC reader (4) connected to the personal computer and

- transferring the information in the contactless card (1 ) to the personal computer (2) by means of the NFC reader (4),

said secure payment method characterized in further comprising the process steps of;

- encoding the card information by the personal computer (2) having security software and transferring the same to the EMV L2 Kernel (8) by means of the secure channel (5);

reading the information in the contactless card (1) according to the EMV Standards by EMV L2 Kernel (8);

- establishing a secure channel (5) between the process center (14) comprising POS applications

(6), secure channel application

(7), EMV L2 Kernel (8), e-purse service (9) and the personal computer (2); and

- linking the personal computer (2) with e-purse service (9) thanks to the cloud based device management application (10).

The secure payment method according to Claim 6, characterized in that said EMV L2 Kernel (8) can be multiplexed depending on the number of the transactions.

8. The secure payment method according to Claim 6, characterized in that said EMV L2 Kernel (8) is a cloud based application.