METHOD FOR PERFORMING A PAYMENT TRANSACTION BY MEANS OF A MOBILE DEVICE AND AN EXTERNAL DEVICE AND SYSTEM

Abstract

The present invention relates to a method for carrying out a payment transaction using a mobile device (20), in particular a smartphone, and an external device (30), in particular a vehicle, wherein the method comprises the following steps: - Establishment (100) of a communication link (100b) between the mobile device (20) and the external device (30), wherein the mobile device (20) has payment authorizations; - Initiation (101) of a payment process by a user (10) on the external device (30), wherein a payment request (31) is sent from the external device (30) to the mobile device (20); - Receiving (102) a payment request response (21) from the mobile device (20) on the external device (30), wherein the payment request response (21) includes a request for user authentication (32); - Performing (103) user authentication (32) on the external device (30); - Attestation (104) of user authentication (32) from the external device (30) to the mobile device (20); - Verification (105) of user authentication (32) on the mobile device (20); - Transmission (106) of a payment signature (22) comprising the payment authorizations from the mobile device (20) to the external device (30); - Submission (107) of the payment transaction with the payment signature (22) by the external device (30) to a payment backend system (40) for processing the payment transaction. The invention further relates to a corresponding system.

Description

[0001] The present invention relates to a method for carrying out a payment transaction using a mobile device and an external device and a system.

[0002] A variety of card-shaped data carriers, such as smart cards, are known from current technology. The use of credit cards or debit cards for processing payments has become particularly established. However, a trend is emerging in which more and more users are using mobile NFC (Near Field Communication) devices, such as smartphones, or tokenized digital cards for payments. For example, a smartphone can contain hardware for storing confidential account information. To make a payment, the user can hold their smartphone near a point-of-sale terminal, an access device, or another contactless communication reader. The payment can then be processed using secure payment information stored on the smartphone.This has the advantage that the user does not have to present a physical credit card or manually enter a credit card number.

[0003] Users may need to make payments while in a vehicle, for example, to pay for fuel or tolls. This is known as in-car payment, meaning payment made within or by a vehicle. To ensure that the vehicle user is also the legitimate account holder, user authentication is required. Specifically, the user must be verified.

[0004] It may be intended that the vehicle contains the actual payment authorizations or the authentication authorizations associated with a specific payment method. For example, if the authentication authorizations are contained in the vehicle, the authentication process is typically carried out on the vehicle itself, for example, via a vehicle interface.

[0005] For use cases where the smartphone does not communicate directly with a card reader, integrating the aforementioned technologies can be relatively complex. This is especially true when, in addition to card issuers, merchants, and payment service providers, other stakeholders need to be involved, such as car manufacturers. For example, the security environment in which payment or authentication permissions must be stored may be controlled by actors outside the payment ecosystem, such as the car manufacturer.

[0006] The object of the present invention is therefore to improve the security of carrying out a payment transaction using a mobile device and an external device. Furthermore, it is an object of the present invention to provide a corresponding system.

[0007] This problem is solved by a method having the features of independent claim 1. Furthermore, the problem is solved by a system having the features of claim 11.

[0008] Embodiments and further developments of the invention are specified in the dependent claims and disclosed with reference to the description and the figures. Features and details described in connection with the method according to the invention also apply in connection with the system according to the invention, and vice versa, so that the disclosure relating to the individual aspects of the invention can always be made reciprocally. Naturally, features of the individual embodiments can be freely combined with one another, provided this is technically feasible.

[0009] According to one aspect of the invention, a method for carrying out a payment transaction using a mobile device, in particular a smartphone, and an external device, in particular a vehicle, is provided, wherein the method comprises the following steps: - Establishing a communication link between the mobile device and the external device, wherein the mobile device has payment authorizations; - Initiation of a payment process by a user on the external device, whereby a payment request is sent from the external device to the mobile device; - Receiving a payment request response from the mobile device on the external device, wherein the payment request response includes a request for user authentication; - Performing user authentication on the external device; - Attestation of user authentication from the external device to the mobile device; - Verification of user authentication on the mobile device; - Transmission of a payment signature encompassing the payment authorizations from the mobile device to the external device; - Submission of the payment process with the payment signature by the external device to a payment backend system for processing the payment process.

[0010] The application preferably specifies that the mobile device is configured as a smartphone. Furthermore, the external device is preferably configured as a vehicle. The interaction of the mobile device and the external device enables a payment process or financial transaction. For this purpose, a communication link can be established between the mobile device and the external device. In other words, the mobile device and the external device are paired, and data or information can be exchanged.

[0011] The payment process can be initiated or started by a user on the external device. For example, the external device might have a display or interface that the user can interact with to initiate the payment process. Specifically, the external device sends a payment request, which is received by the mobile device. The payment request might, for example, contain information indicating that a payment process has been initiated by the user. Subsequently, the mobile device can send a payment request response to the external device, which is received by the external device. Preferably, the payment request response includes a prompt for user authentication. In other words, the payment request response can cause the external device to perform user authentication. Specifically, user authentication thus takes place on the external device and not on the mobile device.User authentication is attested from the external device to the mobile device. In other words, the external device sends the result of the user authentication to the mobile device. The mobile device then verifies the user authentication. In other words, the mobile device checks whether the user is the legitimate user. Following the verification, and especially if the verification is successful, the mobile device can transmit a payment signature to the external device.

[0012] The payment signature preferably comprises the payment authorizations stored on the mobile device. In other words, the payment signature can preferably be generated using the payment authorizations. Optionally, the payment signature can also be generated using authentication authorizations. Generally, the payment authorizations can represent credentials, which can preferably be structured as a user-specific cryptographic key. In particular, the payment signature can contain all the necessary information relevant for processing the payment transaction.

[0013] The payment process, including the payment signature, is submitted by the external device to a payment backend system for processing. This payment backend system can support various payment methods, such as credit card or SEPA direct debit. Specifically, the payment backend system is designed to process and settle payments. In other words, it can act as a payment service provider. Consequently, the payment amount can be debited from the user's account.

[0014] The invention has the advantage that the mobile device, rather than the external device, possesses the payment authorization. This means that the mobile device can be used as a payment device. Consequently, the mobile device can be flexibly used as a payment device between different external devices. For example, the mobile device can be taken from vehicle to vehicle and used in different vehicles. This is particularly helpful in scenarios involving shared vehicles such as rental cars, car sharing, company cars, or vehicles used by multiple users within a family, or even in cases where one user drives multiple vehicles. At the same time, the invention enables a payment transaction to be initiated while driving, without the user having to interact with the mobile device, which would be prohibited while driving.

[0015] Furthermore, the invention has the advantage that the integration of payment functionality into a vehicle (or other platforms that enable / require user authentication) can be significantly simplified, as it does not require the provision of payment authorizations within the vehicle. This also eliminates the need for the vehicle manufacturer to provide a secure environment. The payment authorizations are preferably available in a "roaming" form, meaning they are tied to a mobile device that can be flexibly used in multiple vehicles.

[0016] Preferably, establishing a communication connection between the mobile device and the external device involves the implementation of a standard protocol, preferably Bluetooth, Bluetooth Low Energy, or USB. Preferably, the connection between the mobile device and the external device can be established via Bluetooth. This provides a particularly simple pairing method for the user. If the external device is, for example, a desktop computer, laptop, or other computer, a communication connection via USB is preferable. Existing device profiles, such as HID Device or Security Manager (SM), could be used, or a new payment device profile could be defined and standardized.

[0017] Preferably, establishing a communication link between the mobile device and the external device includes the provision of a key, particularly a public key, from the external device to the mobile device. Specifically, a key exchange can take place during the establishment of the communication link. The external device can provide a key to the mobile device. This has the advantage that the mobile device can use the key to verify the external device during the payment process.

[0018] Alternatively or additionally, payment authorizations can be provided in the mobile device via a Secure Element or a Host Card Emulation Wallet. This has the particular advantage that the payment authorizations are stored and accessible in a secure directory or environment within the mobile device. Various security environments can be used, such as a Secure Element, Whitebox Crypto, or a Trusted Execution Environment (TEO), which provides a secure and trustworthy runtime environment for applications. For example, a card issuer wallet can be used to provide these security environments. This provision can be implemented, for instance, through a banking application.The wallet continues to provide a defined API (application programming interface) for pairing with an external device and requesting a payment signature using payment permissions. This API could preferably also be standardized.

[0019] In a particularly preferred embodiment, the payment authorizations may include an EMV key or a single-use key. The payment authorizations may also include authentication authorizations, such as a FIDO key. In other words, the payment authorizations may include an authentication key. Generally, the payment authorizations contain all the necessary information for carrying out and processing a payment transaction.

[0020] Preferably, user authentication can include the capture of the user's biometric data. For example, the user's fingerprint, face, or voice can be captured as biometric data. This represents the simplest method for biometric user authentication within the vehicle environment. However, other optical recognition methods, such as hand geometry recognition or retinal vascular pattern recognition, can also be used. Overall, biometric verification represents a particularly secure verification method.

[0021] Alternatively or additionally, the authentication of the user from the external device to the mobile device may include the transmission of payment data and a signature. The payment data may preferably contain the amount of the pending payment, the merchant's name, and other information regarding the payment transaction. Preferably, the signature may be symmetrical or asymmetrical. For example, the signature may include a private part of the key that was exchanged when the mobile device was paired with the external device.

[0022] It is particularly desirable that the verification of user authentication on the mobile device includes a signature check. This has the advantage that the mobile device can verify the attestation of user authentication.

[0023] Advantageously, initial user authentication by an account provider on the mobile device can be implemented during the establishment of the communication connection between the mobile device and the external device. This initial user authentication ensures that only an authorized user can initiate the pairing with the external device. For example, the account provider or card issuer can perform the user authentication. This provides an additional layer of security. Preferably, the initial user authentication is performed using a 3D Secure or PushTAN procedure. However, other authentication methods offered by the account provider or card issuer are also conceivable.In particular, any authentication method offered by the issuing bank or the issuer of the payment authorizations may be provided.

[0024] Advantageously, at least one vehicle or computer can be used as an external device. A car-sharing vehicle is particularly preferred. The inventive method is therefore preferably used for in-car payment. However, a variety of external devices are generally conceivable, such as a computer, a desktop computer, or a laptop.

[0025] According to a second aspect of the invention, a system for carrying out a payment transaction with a mobile device, in particular a smartphone, and an external device, in particular a vehicle, is provided, wherein the system is configured to perform a method according to one of the preceding embodiments.

[0026] Overall, the system according to the invention thus has the same advantages as those explained with regard to the method according to the invention.

[0027] The present invention is described below by way of example embodiments with reference to the accompanying figures. Of course, individual features of the embodiments can be freely combined with one another, provided this is technically feasible, without departing from the scope of the present invention. Elements with the same function and mode of operation are designated with the same reference numerals in the figures. The figures below show schematically: Fig. 1 a schematic view of a method for carrying out a payment transaction according to an embodiment according to the invention; Fig. 2. A schematic view of a system for a procedure for carrying out a payment transaction according to Fig. 1; Fig. 3 a schematic view of part of a method for carrying out a payment transaction according to a further embodiment of the invention; and Fig. 4 A schematic view for another part of a procedure for carrying out a payment transaction according to Fig. 3.

[0028] Fig. Figure 1 shows a schematic view of a method for carrying out a payment transaction according to an embodiment of the invention. The payment transaction is carried out using a mobile device 20 and an external device 30. The mobile device 20 is exemplified as a smartphone and has payment authorizations. Preferably, the payment authorizations can be provided in the mobile device 20 in a secure element or in a host card emulation wallet. Furthermore, the payment authorizations can comprise an EMV key, a FIDO key, or a single-use key. The external device 30 is exemplified as a car-sharing vehicle.

[0029] In a first process step 100, a communication connection 100b is established between the mobile device 20 and the external device 30. In other words, the mobile device 20 and the external device 30 are paired. In a second process step 101, the payment process can be initiated by a user 10 on the external device 30. Specifically, a payment request 31 is sent from the external device 30 to the mobile device 20, which is received by the mobile device 20. The payment request 31 can, for example, contain information that a payment process has been initiated by user 10.

[0030] In a third process step 102, the mobile device 20 can send a payment request response 21 to the external device 30, which is received by the external device 30. Preferably, the payment request response 21 includes a prompt for user authentication 32. In other words, in a fourth process step 103, the payment request response 21 can cause the external device 30 to perform user authentication 32. Preferably, this involves the acquisition and verification of biometric data of the user 10. In particular, the user authentication 32 thus takes place on the external device 30. In a fifth process step 104, the user authentication 32 is attested by the external device 30 to the mobile device 20. In other words, the external device 30 sends the result of the user authentication 32 to the mobile device 20.The mobile device 20 then verifies the user authentication 32 in a sixth process step 105. In a seventh process step 106, the mobile device 20 can transmit a payment signature 22 to the external device 30. The payment signature 22 preferably includes the payment authorizations stored on the mobile device 20.

[0031] In an eighth process step 107, the payment transaction with payment signature 22 is submitted by the external device 30 to a payment backend system 40 for processing. The payment backend system 40 is configured to process and settle a payment. Consequently, the payment amount can be debited from user 10's account.

[0032] The invention has the advantage that the mobile device 20, instead of the external device 30, possesses the payment authorizations. Consequently, the mobile device 20 can be flexibly used as a payment device between different external devices.

[0033] Fig. Figure 2 shows a schematic view for a System 50 for a procedure for carrying out a payment transaction according to Fig. 1. The system 50 comprises a mobile device 20 and an external device 30, wherein the system 50 is configured to perform a method as described in Fig. 1 is described. For example, the external device 30 can be configured as a user authentication device 32. The mobile device 20 can have payment authorizations. The external device 30 can establish a communication connection to a payment backend system 40 to process a payment transaction.

[0034] Fig. Figure 3 shows a schematic view of part of a method for carrying out a payment transaction according to a further embodiment of the invention. The payment transaction is carried out using a mobile device 20 and an external device 30. The mobile device 20 is exemplary configured as a smartphone and has payment authorizations. Preferably, the payment authorizations can be provided in the mobile device 20 in a secure element or in a host card emulation wallet. Furthermore, the payment authorizations can comprise an EMV key, a FIDO key, or a single-use key. The external device 30 is exemplary configured as a car-sharing vehicle. The external device 30 is used as a vehicle by a user 10.

[0035] The chronological sequence of the process is illustrated by the dashed arrows in a vertical direction. The arrows in a horizontal direction schematically show the action processes between different components.

[0036] Fig. Figure 3 schematically shows in detail the setup 100 of a communication connection 100b between the mobile device 20 and the external device 30 as the first process step 100. For this purpose, in a first step 100a, the user 10 can initiate a communication connection 100b at the mobile device 20. This can be done, for example, via a display of the mobile device 20.

[0037] Subsequently, a communication connection 100b is established between the mobile device 20 and the external device 30. In other words, the mobile device 20 and the external device 30 are paired. The communication connection 100b can be established using a standard protocol, preferably Bluetooth.

[0038] Furthermore, it is provided that the establishment 100 of the communication link 100b between the mobile device 20 and the external device 30 includes the provision of a key 33, in particular a public key, from the external device 30 to the mobile device 20. For this purpose, the key 33 is generated by the external device 30 100c. The key 33 can preferably be configured as an attestation key. After the generation 100c of the key 33, it is transmitted to the mobile device 20 100d. In particular, a key exchange thus takes place between the external device 30 and the mobile device 20. The key 33 is stored by the mobile device 20 100e. This has the advantage that the mobile device 20 can use the key 33 to verify the external device 30 during the payment process.

[0039] For example, it is envisaged that during the establishment 100 of the communication connection 100b between the mobile device 20 and the external device 30, an initial user authentication 100f is performed by an account provider on the mobile device 20. In other words, the initial user authentication 100f is performed using the mobile device 20 and not the external device 30. The account provider can, for example, be part of a payment backend system 40. The initial user authentication 100f can be performed using a 3D Secure or a PushTAN procedure. This can be carried out by the user 10 on the mobile device 20. For example, it is envisaged that the initial user authentication 100f is performed after the pairing or communication connection 100b and before the transmission 100d of the key 33. Alternatively, the initial user authentication 100f can take place after the transmission 100d of the key 33.In particular, the establishment of the communication link 100b can be carried out when the user 10 enters the external device 30 and before the journey with the external device 30 begins.

[0040] The further procedural steps are detailed in relation to Fig. 4 described. The further procedural steps with regard to Fig. 4 can also take place during a journey with the external device 30.

[0041] Fig. Figure 4 shows a schematic view for another part of a procedure for carrying out a payment transaction according to Fig.3. In a second process step 101, the payment process can be initiated by a user 10 at the external device 30. Specifically, a payment request 31 is sent from the external device 30 to the mobile device 20, which is received by the mobile device 20. For example, the payment request 31 is sent to the mobile device 20 via Bluetooth. The payment request 31 can, for example, contain information that a payment process has been initiated by user 10.

[0042] In a third process step 102, the mobile device 20 can send a payment request response 21 to the external device 30, which is received by the external device 30. Preferably, the payment request response 21 includes a request for user authentication 32. In other words, in a fourth process step 103, the payment request response 21 can cause the external device 30 to perform user authentication 32. Preferably, this involves the acquisition and verification of biometric data of the user 10. In particular, the user authentication 32 thus takes place on the external device 30.

[0043] In a fifth process step 104, the user authentication 32 is attested by the external device 30 to the mobile device 20. In other words, the external device 30 sends the result of the user authentication 32 to the mobile device 20. Furthermore, it is provided here, by way of example, that the attestation includes the transmission of payment data and the transmission of a signature on this data.

[0044] The mobile device 20 then verifies the user authentication 32 in a sixth process step 105. It is provided that the verification of the user authentication 32 on the mobile device 20 includes a review of the transmitted attestation of the user authentication 32. This has the advantage that the mobile device 20 can verify the attestation of the user authentication 32 based on the signature.

[0045] If user authentication 32 is successfully verified, the mobile device 20 generates a payment signature 22. In a seventh process step 106, the mobile device 20 can transmit the payment signature 22 to the external device 30. The payment signature 22 preferably includes the payment authorizations stored on the mobile device 20.

[0046] In an eighth process step 107, the payment transaction with the payment signature 22 is submitted by the external device 30 to the payment backend system 40 for processing. The payment backend system 40 is preferably configured to process and settle a payment. Authorization 41 can be performed by the card issuer or a payment network. Consequently, the payment amount can be debited from the user's account 10. The result of the authorization, or information on the successfully completed payment transaction, can optionally be transmitted to the external device 30 42 and thus confirmed. The authorization result can be displayed to the user 10 on a screen of the external device 30. Reference symbol list 10 users 20 mobile devices 21 Payment request response 22 Payment signature 30 external devices 31 Payment request 32 User authentication 33 keys 40 Payment Backend System 41 Authorization 42 Transmission of authorization result 50 System 100 first procedural step 100a Initiating a communication connection 100b communication link 100c Key generation 100d Transmission of the key Hundreds of key storage 100f initial user authentication 101 second procedural step 102 third procedural step 103 fourth procedural step 104 fifth procedural step 105 sixth procedural step 106 seventh process step 107 eighth procedural step

Claims

[1] Method for carrying out a payment transaction using a mobile device (20), in particular a smartphone, and an external device (30), in particular a vehicle, wherein the method comprises the following steps: - Establishment (100) of a communication link (100b) between the mobile device (20) and the external device (30), wherein the mobile device (20) has payment authorizations; - Initiation (101) of a payment process by a user (10) on the external device (30), wherein a payment request (31) is sent from the external device (30) to the mobile device (20); - Receiving (102) a payment request response (21) from the mobile device (20) on the external device (30), wherein the payment request response (21) includes a request for user authentication (32); - Performing (103) user authentication (32) on the external device (30); - Attestation (104) of user authentication (32) from the external device (30) to the mobile device (20); - Verification (105) of user authentication (32) on the mobile device (20); - Transmission (106) of a payment signature (22) comprising the payment authorizations from the mobile device (20) to the external device (30); - Submission (107) of the payment transaction with the payment signature (22) by the external device (30) to a Payment Backend System (40) for processing the payment transaction. [2] Method according to claim 1, characterized by , that the establishment (100) of a communication link (100b) between the mobile device (20) and the external device (30) includes the implementation of a standard protocol, preferably Bluetooth or Bluetooth Low Energy or USB. [3] Method according to any one of the preceding claims, characterized by, that the establishment of a communication link (100b) between the mobile device (20) and the external device (30) includes the provision of a key (33), in particular a public key, from the external device (30) to the mobile device (20). [4] Method according to any one of the preceding claims, characterized by , that the payment authorizations in the mobile device (20) are provided in a Secure Element or in a Host Card Emulation Wallet. [5] Method according to any one of the preceding claims, characterized by that the payment authorizations include an EMV key, a single-use key, or an authentication key. [6] Method according to any one of the preceding claims, characterized by , that performing user authentication (32) involves collecting biometric data of the user (10). [7] Method according to any one of the preceding claims, characterized bythat the attestation of user authentication (32) from the external device (30) to the mobile device (20) includes a transmission of payment data and a signature. [8] Method according to any one of the preceding claims, characterized by , that during the establishment of the communication link (100b) between the mobile device (20) and the external device (30), an initial user authentication (100f) is performed by an account provider on the mobile device (20). [9] Method according to claim 8, characterized by that the initial user authentication (100f) is carried out via a 3D Secure or a PushTAN procedure. [10] Method according to any one of the preceding claims, characterized by , that at least one vehicle or computer is used as an external device (30). [11] System (50) for carrying out a payment transaction with a mobile device (20), in particular a smartphone, and an external device (30), in particular a vehicle, wherein the system (50) is configured to carry out a method according to one of the preceding claims.

Images