Server-Mediated Order Validation for Payment Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current payment systems for mobile devices typically only transmit the total payment amount to the user's device, preventing users from viewing or modifying their orders before payment and risking malicious activities such as item removal or underpayment.
Innovation Solution
A system where order information is stored on a server, allowing users to review and modify their orders by sending requests to the server, which validates modifications and notifies the point of sale device of payment completion, ensuring legitimate transactions and preventing theft or underpayment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If order information is transmitted only as total payment amount to user device, then payment processing is simplified, but user cannot view or modify order details before payment
Solution Approach 1:
A server is introduced as an intermediary between the point of sale device and the user device. The server stores order information and mediates all modifications, allowing users to view and modify orders through their devices while maintaining system security and integrity. The server validates modification requests and coordinates with the point of sale device, resolving the contradiction by adding a mediating component rather than directly complicating the existing payment flow.
Solution Approach 2:
The system is segmented into distinct functional components: the point of sale device for initial order entry, the server for data storage and modification validation, and the user device for order viewing and modification. This segmentation allows each component to have a specialized role, improving ease of operation for users while distributing system complexity across multiple independent modules rather than concentrating it in one device.
2Reliability
If URL with mutable parameters is used for order display, then user can view order before payment, but malicious users can modify URL to remove items or change prices
Solution Approach 1:
The server acts as an intermediary that validates all order information before presenting it to the user device. Instead of allowing direct manipulation of URL parameters, the server receives modification requests, validates them against the original order data, and only applies approved changes. This intermediary validation layer prevents malicious modifications while still allowing legitimate order reviews and modifications.
Solution Approach 2:
The system implements feedback loops where the server continuously validates order information against the original point of sale data. When a user attempts to modify order parameters through the URL or interface, the server provides feedback by either approving the modification (if valid) or rejecting it (if malicious), ensuring order information integrity while preventing harmful alterations.
3Productivity
If payment confirmation is generated locally on user device, then payment process is faster, but malicious users can present fake payment confirmation for other orders
Solution Approach 1:
The server serves as an intermediary that generates and manages payment confirmations. Instead of allowing local generation on user devices (which enables fake confirmations), the server centrally controls confirmation generation, ensuring each confirmation is authentic and tied to the correct order. This maintains productivity by keeping the payment flow efficient while eliminating the security vulnerability of local confirmation generation.
4Reliability
If server validates all order modifications, then malicious activity is prevented, but system processing time increases
Solution Approach 1:
The server implements partial validation by focusing validation efforts on critical security aspects of order modifications rather than re-validating all parameters. For routine modifications like adding tips or applying discount codes, the server performs streamlined validation that checks only essential elements. This partial validation approach maintains strong security against malicious activity while minimizing unnecessary processing time for legitimate, low-risk modifications.
Data Source
AI summary
Payment solutions that allow a user to pay for an order in a store using a user device typically only pass the total payment amount to the user device. One way of displaying other order information on a user device involves the user device sending, to the server, a URL containing instructions for building an online page to display the order. However, this introduces the risk that a malicious user may modify the URL to remove an item from the order or change a price of an item without informing the merchant. The present application relates to systems and methods for preventing malicious activity by users when modifying order information. According to some aspects of the present disclosure, items entered into a merchant's point of sale device are sent to a server for storage in order information which can be retrieved by a user device using an identifier.