Mobile Payment Security via One-Time Key and Intermediary POS
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Mobile devices, increasingly used for financial transactions, pose a security risk due to the potential for hacking, leading to unauthorized purchases and merchant reluctance to accept transactions.
Innovation Solution
A system using a mobile communications device that communicates with a payment server via a point-of-sale device, employing a one-time digital key and number generator algorithm to secure transactions, with features like transaction capping and near-field communication capabilities for secure payment processing, even outside network coverage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If mobile devices store financial information for transactions, then transaction convenience is improved, but security risk increases due to potential hacking
Solution Approach 1:
The financial transaction system is segmented into multiple components: mobile device, point-of-sale device, and payment server. Each component handles specific functions - the mobile device stores financial information securely, the point-of-sale device processes transactions, and the payment server validates and authorizes payments. This segmentation distributes security responsibilities and reduces the risk concentration in a single device.
Solution Approach 2:
The point-of-sale device serves as an intermediary between the mobile device and the payment server. It receives payment requests from the mobile device, forwards them to the payment server for validation, and relays authorization responses back. This intermediary layer adds a security buffer, preventing direct access between the mobile device and the payment processing system.
2Speed
If contactless NFC transactions are used, then transaction speed is improved, but vulnerability to unauthorized transactions increases
Solution Approach 1:
The system performs preliminary actions before completing a transaction: the payment server validates the payment request, checks account balance, verifies authorization credentials, and generates an authorization code before the transaction is finalized. This preliminary validation ensures that even if a transaction is initiated quickly via NFC, unauthorized transactions cannot be completed without proper verification.
Solution Approach 2:
The system implements feedback mechanisms where the payment server sends authorization codes and confirmation responses back to the point-of-sale device and mobile device. This feedback loop ensures that each transaction is properly authorized and recorded, providing a trail for verification and reducing the risk of unauthorized transactions going undetected.
3Adaptability or versatility
If full financial capabilities are enabled on mobile devices, then functionality is improved, but risk of financial information loss increases
Solution Approach 1:
The system extracts sensitive financial information processing from the mobile device and places it on the payment server. The mobile device stores financial information securely but does not process transactions independently. Instead, it communicates payment requests to the point-of-sale device and payment server, which handle the actual transaction processing and validation. This extraction reduces the attack surface on the mobile device while maintaining full functionality.
Data Source
AI summary
Devices, systems and methods are disclosed which relate to securing payments from a mobile communications device. In exemplary embodiments, a mobile communications device communicates with a payment server via a point-of-sale device to conduct a transaction. The mobile communications device uses a client payment logic to send payment information to the point-of-sale device. The point-of-sale device uses a vendor payment logic to forward the payment information to the payment server. The payment server verifies the payment information and sends confirmation to the point-of-sale device.