Methods and apparatus for card transactions
A secure payment system comprises a merchant POS client and a remote POS server. The merchant POS client comprises a reading device for reading a customer user token and for accepting transaction details and customer verification data, and also a computing device with access to a communications network and in communication with the reading device. The merchant POS client also comprises a merchant token associated with the remote POS server. The remote POS server is in communication with the merchant POS client through the communications network, and one or more elements of the merchant POS client business logic are assured by the remote POS server and not the merchant POS client. A merchant token for use in such a merchant POS client is described, as is a suitable reader device, and a method of conducting a transaction using such a payment system.
1. A secure payment system, comprising a merchant POS client and a remote POS server,
wherein the merchant POS client comprises a reading device for reading a customer user token and for accepting transaction details and customer verification data and a computing device with access to a communications network and in communication with the reading device, and wherein the merchant POS client further comprises a merchant token associated with the remote POS server, and
wherein the remote POS server is in communication with the merchant POS client through the communications network, and wherein the remote POS server, and not the merchant POS client, receives delegation of, and assures, security of at least two merchant assets including terminal configuration data and at least one of: payment provider brand parameterization data and code of a payment application for merchant POS client.
2. The secure payment system as claimed in claim 1 , wherein the customer user token is a payment card and wherein the reading device comprises a card reader, and
wherein the card reader comprises a chip card reader adapted to read an EMV chip.
3. The secure payment system as claimed in claim 1 , wherein the remote POS server comprises payment logic for transactions received at the merchant POS client.
4. The secure payment system as claimed claim 1 , further comprising a secure channel from the merchant POS client to the remote POS server, wherein the secure channel is established via a secure channel layer between the merchant POS client and the remote POS server.
5. The secure payment system as claimed in claim 4 , wherein the merchant token associated with the remote POS server is used to establish the secure channel.
6. The secure payment system as claimed in claim 5 , wherein the merchant token comprises a tamper responsive card.
7. The secure payment system as claimed in claim 6 , wherein the merchant token is a merchant card, and the POS client further comprises a PIN encryption device.
8. The secure payment system as claimed in claim 6 , wherein the merchant token is a merchant display card comprising a secure keyboard and a display.
9. The secure payment system as claimed in claim 8 , wherein the merchant display card is adapted to receive and encrypt a PIN through the secure keyboard.
10. The secure payment system as claimed in claim 5 , wherein the reading device is adapted to retain for reading both the merchant token and a customer payment card at the same time.
11. The secure payment system as claimed in 1 , wherein the computing device is a smartphone adapted to receive contactless payments.