Method for carrying out a payment process by means of a mobile terminal and an external device, and system

Abstract

The present invention relates to a method for carrying out a payment process by means of a mobile terminal (20), in particular a smartphone, and an external device (30), in particular a vehicle, wherein the method has the following steps: - establishing (100) a communication link (100b) between the mobile terminal (20) and the external device (30), wherein the mobile terminal (20) has payment authorisations; - initiating (101) a payment process by a user (10) on the external device (30), wherein a payment request (31) is sent from the external device (30) to the mobile terminal (20); - receiving (102) a payment request response (21) from the mobile terminal (20) on the external device (30), wherein the payment request response (21) comprises a prompt for user authentication (32); - carrying out (103) user authentication (32) on the external device (30); - attesting (104) the user authentication (32) from the external device (30) to the mobile terminal (20); - verifying (105) the user authentication (32) on the mobile terminal (20); - transmitting (106) a payment signature (22) comprising the payment authorisations from the mobile terminal (20) to the external device (30); - submitting (107) the payment process with the payment signature (22) by the external device (30) to a payment backend system (40) for processing the payment. The invention also relates to a corresponding system.

Description

[0001] Method for carrying out a payment transaction using a mobile device and an external device and system

[0002] The present invention relates to a method for carrying out a payment transaction using a mobile device and an external device and a system.

[0003] A variety of card-shaped data carriers, such as smart cards, are known from the state of the art. The use of credit cards or debit cards for processing payments has become particularly established. However, a trend is emerging in which more and more users are using mobile NFC (Near Field Communication) devices, such as smartphones, or tokenized digital cards for payments. For example, the smartphone can contain hardware for storing confidential account information. To carry out a payment, the user can hold the smartphone near a point-of-sale terminal, an access device, or another contactless communication reader. The payment can then be processed using secure payment information stored on the smartphone.This has the advantage that the user does not have to present a physical credit card or manually enter a credit card number.

[0004] Users may need to make payments while in a vehicle, for example, to pay for fuel or tolls. This is known as in-car payment, or payment made within or by a vehicle. To ensure that the vehicle user is the legitimate account holder, user authentication is required. Specifically, the user must be verified. The vehicle may contain either the actual payment authorizations or the authentication credentials associated with a particular payment method. For example, if the authentication credentials are stored in the vehicle, the authentication process is typically performed on the vehicle itself, such as via a vehicle interface.

[0005] For use cases where the smartphone does not communicate directly with an Eese device, integrating the aforementioned technologies can be relatively complex. This is especially true when, in addition to card issuers, merchants, and payment service providers, other stakeholders need to be involved, such as car manufacturers. For example, the security environment in which payment or authentication permissions must be stored may be controlled by stakeholders outside the payment ecosystem, such as the car manufacturer.

[0006] The object of the present invention is therefore to improve the security of carrying out a payment transaction using a mobile device and an external device. Furthermore, it is an object of the present invention to provide a corresponding system.

[0007] This problem is solved by a method having the features of independent claim 1. Furthermore, the problem is solved by a system having the features of claim 11.

[0008] Embodiments and further developments of the invention are specified in the dependent claims and disclosed with reference to the description and the figures. Features and details described in connection with the method according to the invention also apply in connection with the system according to the invention, and vice versa, so that the disclosure relating to the individual aspects of the invention can always be made reciprocally. Naturally, features of the individual embodiments can be freely combined with one another, provided this is technically feasible.

[0009] According to one aspect of the invention, a method for carrying out a payment transaction using a mobile device, in particular a smartphone, and an external device, in particular a vehicle, is provided, wherein the method comprises the following steps:

[0010] - Establishing a communication link between the mobile device and the external device, wherein the mobile device has payment authorizations;

[0011] - Initiation of a payment process by a user on the external device, whereby a payment request is sent from the external device to the mobile device;

[0012] - Receiving a payment request response from the mobile device on the external device, wherein the payment request response includes a request for user authentication;

[0013] - Performing user authentication on the external device;

[0014] - Attestation of user authentication from the external device to the mobile device;

[0015] - Verification of user authentication on the mobile device;

[0016] - Transmission of a payment signature encompassing the payment authorizations from the mobile device to the external device;

[0017] - Submission of the payment process with the payment signature by the external device to a payment backend system for processing the payment. For registration purposes, it is preferred that the mobile device be configured as a smartphone. Furthermore, the external device is preferably configured as a vehicle. Through the interaction of the mobile device and the external device, a payment process or financial transaction can be carried out. For this purpose, a communication connection can be established between the mobile device and the external device. In other words, the mobile device and the external device are linked, and data or information can be exchanged.

[0018] The payment process can be initiated or started by a user on the external device. For example, the external device might have a display or interface that the user can interact with to initiate the payment process. Specifically, the external device sends a payment request, which is received by the mobile device. The payment request might, for example, contain information indicating that a payment process has been initiated by the user. Subsequently, the mobile device can send a payment request response to the external device, which is received by the external device. Preferably, the payment request response includes a prompt for user authentication. In other words, the payment request response can cause the external device to perform user authentication. Specifically, user authentication thus takes place on the external device and not on the mobile device.User authentication is attested from the external device to the mobile device. In other words, the external device sends the result of the user authentication to the mobile device. The mobile device then verifies the user authentication. In other words, the mobile device checks whether the user is the legitimate user. Following the verification, and especially if the verification is successful, the mobile device can transmit a payment signature to the external device.

[0019] The payment signature preferably comprises the payment authorizations stored on the mobile device. In other words, the payment signature can preferably be generated using the payment authorizations. Optionally, the payment signature can also be generated using authentication authorizations. Generally, the payment authorizations can represent credentials, which can preferably be structured as a user-specific cryptographic key. In particular, the payment signature can contain all the necessary information relevant to processing the payment transaction.

[0020] The payment process, including the payment signature, is submitted by the external device to a payment backend system for processing. This payment backend system can support various payment methods, such as credit card or SEPA direct debit. Specifically, the payment backend system is designed to process and complete payments. In other words, it can act as a payment service provider. Consequently, the payment amount can be debited from the user's account.

[0021] The invention has the advantage that the mobile device, rather than the external device, possesses the payment authorization. This means that the mobile device can be used as a payment device. Consequently, the mobile device can be flexibly used as a payment device between different external devices. For example, the mobile device can be taken from vehicle to vehicle and used in different vehicles. This is particularly helpful in scenarios involving shared vehicles such as rental cars, car sharing, company cars, or vehicles used by multiple users within a family, or even in cases where one user drives multiple vehicles. At the same time, the invention enables a payment transaction to be initiated while driving, without the user having to interact with the mobile device, which would be prohibited while driving.

[0022] Furthermore, the invention has the advantage that the integration of payment functionality into a vehicle (or other platforms that enable / require user authentication) can be significantly simplified, as it does not require the provision of payment authorizations within the vehicle. This also eliminates the need for the vehicle manufacturer to provide a secure environment. The payment authorizations are preferably available in a "roaming" form, meaning they are tied to a mobile device that can be flexibly used in multiple vehicles.

[0023] Preferably, establishing a communication connection between the mobile device and the external device involves the implementation of a standard protocol, preferably Bluetooth, Bluetooth Low Energy, or USB. Preferably, the connection between the mobile device and the external device can be established via Bluetooth. This provides a particularly simple connection method for the user. If the external device is, for example, a desktop computer, laptop, or other computer, a communication connection via USB is preferable. Existing device profiles, such as HID Device or Security Manager (SM), could be used, or a new payment device profile could be defined and standardized.

[0024] Preferably, establishing a communication link between the mobile device and the external device includes the provision of a key, particularly a public key, from the external device to the mobile device. Specifically, a key exchange can take place during the establishment of the communication link. The external device can provide a key to the mobile device. This has the advantage that the mobile device can use the key to verify the external device during the payment process.

[0025] Alternatively or additionally, payment authorizations can be provided in the mobile device via a Secure Element or a Host Card Emulation Wallet. This has the particular advantage that the payment authorizations are stored and accessible in a secure directory or environment within the mobile device. Various security environments can be used, such as a Secure Element, Whitebox Crypto, or a Trusted Execution Environment (TEO), which provides a secure and trustworthy runtime environment for applications. For example, a card issuer wallet can provide these security environments. This provision can be implemented, for instance, through a banking application.The wallet continues to provide a defined API (application programming interface) for pairing with an external device and requesting a payment signature using payment permissions. This API could preferably also be standardized.

[0026] In a particularly preferred embodiment, the payment authorizations may include an EMV key or a single-use key. The payment authorizations may also include authentication authorizations, such as a FIDO key. In other words, the payment authorizations may include an authentication key. Generally, the payment authorizations contain all the necessary information for carrying out and processing a payment transaction.

[0027] Preferably, user authentication can include capturing the user's biometric data. For example, the user's fingerprint, face, or voice can be captured as biometric data. This represents the simplest method for biometric user authentication within the vehicle environment. However, other optical recognition methods, such as hand geometry recognition or retinal vascular pattern recognition, can also be implemented. Overall, biometric verification represents a particularly secure verification method.

[0028] Alternatively or additionally, the authentication of the user from the external device to the mobile device may include the transmission of payment data and a signature. The payment data may preferably contain the amount of the pending payment, the merchant's name, and other information regarding the payment transaction. Preferably, the signature may be symmetrical or asymmetrical. For example, the signature may include a private part of the key that was exchanged when the mobile device was paired with the external device.

[0029] It is particularly desirable that the verification of user authentication on the mobile device includes a signature check. This has the advantage that the mobile device can verify the attestation of user authentication.

[0030] Advantageously, initial user authentication by an account provider on the mobile device can be implemented during the establishment of the communication connection between the mobile device and the external device. This initial user authentication ensures that only an authorized user can initiate the pairing with the external device. For example, the account provider or card issuer can perform the user authentication. This provides an additional layer of security. Preferably, the initial user authentication is performed using a 3D Secure or PushTAN procedure. However, other authentication methods offered by the account provider or card issuer are also conceivable.In particular, any authentication method offered by the issuing bank or the issuer of the payment authorizations may be provided.

[0031] Advantageously, at least one vehicle or computer can be used as an external device. A car-sharing vehicle is particularly preferred. The inventive method is therefore preferably used for in-car payment. However, a variety of external devices are generally conceivable, such as a computer, a desktop computer, or a laptop.

[0032] According to a second aspect of the invention, a system for carrying out a payment transaction with a mobile device, in particular a smartphone, and an external device, in particular a vehicle, is provided, wherein the system is configured to perform a method according to one of the preceding embodiments.

[0033] Overall, the system according to the invention thus has the same advantages as those explained with regard to the method according to the invention.

[0034] The present invention is described below by way of example embodiments with reference to the accompanying figures. Of course, individual features of the embodiments can be freely combined with one another, provided this is technically feasible, without departing from the scope of the present invention. Elements with the same function and mode of operation are designated with the same reference numerals in the figures. The figures below show schematically:

[0035] Figure 1 shows a schematic view of a method for carrying out a payment transaction according to an embodiment of the invention;

[0036] Figure 2 is a schematic view of a system for a method for carrying out a payment process according to Figure 1; Figure 3 is a schematic view of part of a method for carrying out a payment process according to a further embodiment of the invention; and

[0037] Figure 4 shows a schematic view of a further part of a method for carrying out a payment transaction according to Figure 3.

[0038] Figure 1 shows a schematic view of a method for carrying out a payment transaction according to an embodiment of the invention. The payment transaction is carried out using a mobile device 20 and an external device 30. The mobile device 20 is exemplary configured as a smartphone and has payment authorizations. Preferably, the payment authorizations can be provided in the mobile device 20 in a secure element or in a host card emulation wallet. Furthermore, the payment authorizations can comprise an EMV key, a FIDO key, or a single-use key. The external device 30 is exemplary configured as a car-sharing vehicle.

[0039] In a first process step 100, a communication connection 100b is established between the mobile device 20 and the external device 30. In other words, the mobile device 20 and the external device 30 are paired. In a second process step 101, the payment process can be initiated by a user 10 on the external device 30. Specifically, a payment request 31 is sent from the external device 30 to the mobile device 20, which is received by the mobile device 20. The payment request 31 can, for example, contain information that a payment process has been initiated by user 10. In a third process step 102, the mobile device 20 can send a payment request response 21 to the external device 30, which is received by the external device 30. Preferably, the payment request response 21 includes a prompt for user authentication 32.In other words, in a fourth process step 103, the payment request response 21 can cause the external device 30 to perform user authentication 32. Preferably, this involves capturing and verifying the biometric data of the user 10. Specifically, user authentication 32 thus takes place on the external device 30. In a fifth process step 104, the user authentication 32 is attested by the external device 30 to the mobile device 20. In other words, the external device 30 sends the result of the user authentication 32 to the mobile device 20. The mobile device 20 then verifies the user authentication 32 in a sixth process step 105. In a seventh process step 106, the mobile device 20 can transmit a payment signature 22 to the external device 30.The payment signature 22 preferably includes the payment authorizations which are stored on the mobile device 20.

[0040] In an eighth process step 107, the payment transaction with payment signature 22 is submitted by the external device 30 to a payment backend system 40 for processing. The payment backend system 40 is configured to process and settle a payment. Consequently, the payment amount can be debited from user 10's account.

[0041] The invention has the advantage that the mobile device 20, instead of the external device 30, possesses the payment authorizations. Consequently, the mobile device 20 can be flexibly used as a payment device between different external devices.

[0042] Figure 2 shows a schematic view of a system 50 for a method of carrying out a payment transaction according to Figure 1. The system 50 comprises a mobile device 20 and an external device 30, wherein the system 50 is configured to execute a method as described in Figure 1. For example, the external device 30 can be configured as a user authentication device 32. The mobile device 20 can have payment authorizations. The external device 30 can establish a communication connection to a payment backend system 40 to process a payment transaction.

[0043] Figure 3 shows a schematic view of part of a method for carrying out a payment transaction according to a further embodiment of the invention. The payment transaction is carried out using a mobile device 20 and an external device 30. The mobile device 20 is, for example, configured as a smartphone and has payment authorizations. Preferably, the payment authorizations can be provided in the mobile device 20 in a secure element or in a host card emulation wallet. Furthermore, the payment authorizations can comprise an EMV key, a FIDO key, or a single-use key. The external device 30 is, for example, configured as a car-sharing vehicle. The external device 30 is used as a vehicle by a user 10.

[0044] The chronological sequence of the process is illustrated by the dashed arrows in the vertical direction. The arrows in the horizontal direction schematically show the action processes between different components.

[0045] Figure 3 schematically shows in detail the setup 100 of a communication connection 100b between the mobile device 20 and the external device 30 as the first process step 100. For this purpose, in a first step 100a, the user 10 can initiate a communication connection 100b at the mobile device 20. This can be done, for example, via a display of the mobile device 20.

[0046] It is then planned that a communication link 100b will be established between the mobile device 20 and the external device 30. In other words, the mobile device 20 and the external device 30 will be paired. The communication link 100b can be established by implementing a standard protocol, preferably Bluetooth.

[0047] Furthermore, it is provided that the setup 100 of the communication link 100b between the mobile device 20 and the external device 30 includes the provision of a key 33, in particular a public key, from the external device 30 to the mobile device 20. For this purpose, the key 33 is generated by the external device 30 100c. The key 33 can preferably be configured as an attestation key. After the generation 100c of the key 33, it is transmitted to the mobile device 20 lOOd or sent. In particular, a key exchange thus takes place between the external device 30 and the mobile device 20. The key 33 is stored by the mobile device 20 lOOe. This has the advantage that the mobile device 20 can use the key 33 to verify the external device 30 during the payment process.

[0048] For example, it is envisaged that during the establishment of the communication connection 100b between the mobile device 20 and the external device 30, an initial user authentication lOOf is performed by an account provider on the mobile device 20. In other words, the initial user authentication lOOf is performed using the mobile device 20 and not the external device 30. The account provider can, for example, be part of a payment backend system 40. The initial user authentication lOOf can be performed using a 3D Secure or a PushTAN procedure. This can be carried out by the user 10 on the mobile device 20. For example, it is envisaged that the initial user authentication lOOf is performed after the pairing or the communication connection 100b and before the transmission lOOd of the key 33. Alternatively, the initial user authentication lOOf can take place after the transmission lOOd of the key 33.In particular, the establishment of the communication link 100b can be carried out when the user 10 enters the external device 30 and before the journey with the external device 30 begins.

[0049] The further process steps are described in detail with reference to Figure 4. These further process steps, as shown in Figure 4, can also take place during a journey with the external device 30.

[0050] Figure 4 shows a schematic view of a further part of a method for carrying out a payment transaction according to Figure 3. In a second method step 101, the payment transaction can be initiated by a user 10 at the external device 30. In particular, a payment request 31 is sent from the external device 30 to the mobile device 20, which is received by the mobile device 20. By way of example, it is provided that the payment request 31 is sent to the mobile device 20 via Bluetooth. The payment request 31 can, for example, contain information that a payment transaction has been started by the user 10.

[0051] In a third process step 102, the mobile device 20 can send a payment request response 21 to the external device 30, which is received by the external device 30. Preferably, the payment request response 21 includes a request for user authentication 32. In other words, in a fourth process step 103, the payment request response 21 can cause the external device 30 to perform user authentication 32. Preferably, this involves the acquisition and verification of biometric data of the user 10. In particular, the user authentication 32 thus takes place on the external device 30.

[0052] In a fifth step of the process, user authentication 32 is attested by the external device 30 to the mobile device 20. In other words, the external device 30 sends the result of the user authentication 32 to the mobile device 20. Furthermore, it is provided here, by way of example, that the attestation includes the transmission of payment data and the transmission of a signature on this data.

[0053] The mobile device 20 then verifies the user authentication 32 in a sixth process step 105.

[0054] It is provided here that the verification of user authentication 32 on the mobile device 20 includes a check of the transmitted attestation of user authentication 32. This has the advantage that the mobile device 20 can verify the attestation of user authentication 32 based on the signature.

[0055] If user authentication 32 is successfully verified, the mobile device 20 generates a payment signature 22. In a seventh step of the process, the mobile device 20 can transmit the payment signature 22 to the external device 30. The payment signature 22 preferably includes the payment authorizations stored on the mobile device 20.

[0056] In step 107 of the eighth process, the payment transaction with the payment signature 22 is submitted by the external device 30 to the payment backend system 40 for processing. The payment backend system 40 is primarily configured to process and settle payments. Authorization 41 can be performed by the card issuer or a payment network. Consequently, the payment amount can be debited from the user's account 10. The authorization result, or information confirming the successful completion of the payment transaction, can optionally be transmitted to the external device 30 42. The authorization result can be displayed to the user 10 on a screen of the external device 30.

[0057] Reference symbol list

[0058] 10 users

[0059] 20 mobile devices

[0060] 21 Payment request response 22 Payment signature

[0061] 30 external devices

[0062] 31 Payment request

[0063] 32 User authentication

[0064] 33 keys

[0065] 40 Payment Backend System

[0066] 41 Authorization

[0067] 42 Transmission of authorization result

[0068] 50 System

[0069] 100 first procedural step

[0070] 100a Initiating a communication connection

[0071] 100b communication link

[0072] 100c Key generation lOOd Key transmission lOOe Key storage lOOf Initial user authentication

[0073] 101 second procedural step

[0074] 102 third V experience step

[0075] 103 fourth procedural step

[0076] 104 fifth procedural step

[0077] 105 sixth procedural step

[0078] 106 seventh procedural step

[0079] 107 eighth procedural step

Claims

Patent claims 1. Method for carrying out a payment transaction using a mobile device (20), in particular a smartphone, and an external device (30), in particular a vehicle, wherein the method comprises the following steps: - Establishment (100) of a communication link (100b) between the mobile device (20) and the external device (30), wherein the mobile device (20) has payment authorizations; - Initiation (101) of a payment process by a user (10) on the external device (30), wherein a payment request (31) is sent from the external device (30) to the mobile device (20); - Receiving (102) a payment request response (21) from the mobile device (20) on the external device (30), wherein the payment request response (21) includes a request for user authentication (32); - Performing (103) user authentication (32) on the external device (30); - Attestation (104) of user authentication (32) from the external device (30) to the mobile device (20); - Verification (105) of user authentication (32) on the mobile device (20); - Transmission (106) of a payment signature (22) comprising the payment authorizations from the mobile device (20) to the external device (30); - Submission (107) of the payment process with the payment signature (22) by the external device (30) to a Payment Backend System (40) for processing the payment process.

2. Method according to claim 1, characterized in that the establishment (100) of a communication link (100b) between the mobile device (20) and the external device (30) comprises the implementation of a standard protocol, preferably Bluetooth or Bluetooth Low Energy or USB.

3. Method according to one of the preceding claims, characterized in that the establishment of a communication connection (100b) between the mobile device (20) and the external device (30) comprises the provision of a, in particular public, key (33) from the external device (30) to the mobile device (20).

4. Method according to one of the preceding claims, characterized in that the payment authorizations are provided in the mobile device (20) in a Secure Element or in a Host Card Emulation Wallet.

5. Method according to one of the preceding claims, characterized in that the payment authorizations comprise an EMV key, a single-use key, or an authentication key.

6. Method according to one of the preceding claims, characterized in that performing the user authentication (32) includes capturing biometric data of the user (10).

7. Method according to one of the preceding claims, characterized in that the attestation of the user authentication (32) from the external device (30) to the mobile device (20) comprises a transmission of payment data and a signature.

8. Method according to one of the preceding claims, characterized in that during the establishment of the communication connection (100b) between the mobile device (20) and the external device (30) an initial user authentication (lOOf) is performed by an account provider on the mobile device (20).

9. Method according to claim 8, characterized in that the initial user authentication (lOOf) is carried out via a 3D Secure or a PushTAN method.

10. Method according to one of the preceding claims, characterized in that at least one vehicle or computer is used as the external device (30).

11. System (50) for carrying out a payment transaction with a mobile device (20), in particular a smartphone, and an external device (30), in particular a vehicle, wherein the system (50) is configured to carry out a method according to one of the preceding claims.

Images