Security Server Mediator for Merchant Payment Authorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current mobile communication systems lack a mechanism to verify the authority of merchants, making it possible for fraudulent merchants to access secure payment elements or perform unauthorized transactions.
Innovation Solution
A security server is introduced to establish communication between a merchant device and a customer payment application, using a security token to authenticate the merchant device and ensure only authorized devices can initiate transactions, thereby preventing unauthorized access and ensuring secure payment processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If direct communication is allowed between merchant device and customer payment application, then transaction convenience is improved, but security against unauthorized access deteriorates
Solution Approach 1:
A security server is introduced as an intermediary between the merchant device and the customer payment application. The security server verifies the merchant's authority using a security token before allowing communication, thus maintaining transaction convenience while preventing unauthorized access through the mediation of this security verification layer
2Reliability
If security verification mechanism is implemented, then security against fraudulent merchants is improved, but system complexity increases
Solution Approach 1:
The security verification function is isolated in a dedicated security server that acts as an intermediary. This separates the security mechanism from the payment transaction flow, providing robust fraud prevention while keeping the overall system architecture modular and manageable through clear separation of concerns
3Reliability
If security token verification is performed, then prevention of unauthorized transactions is improved, but communication overhead increases
Solution Approach 1:
The security token verification is performed as a preliminary action before the actual payment transaction. The security server verifies the merchant's authority in advance using the security token, ensuring unauthorized transactions are prevented while minimizing communication overhead during the actual payment process by having verification results ready beforehand
Data Source
AI summary
It is presented a security server arranged to set up communication between a merchant device and a customer payment application. The security server comprises: a receiver arranged to receive a first message comprising a customer identifier, an application identifier and a security token; a determiner arranged to determine whether the merchant device is authorized; a transmitter arranged to send a second message to the merchant device, the second message indicating that the merchant device is authorized to effect payment; and a channel establisher arranged to set up a secure channel between the merchant device and the customer payment application in a secure element being adapted to be comprised in a mobile communication terminal, wherein all communication between the merchant device and the customer payment application is controlled by the security server. Corresponding methods, merchant device, computer programs and computer program products are also presented.