Method and system for controlling certificate based open payment transactions
Methods and systems for controlling certificate-based open payment transactions involving a merchant and a customer utilizing various types of networks and terminals. Prior to accessing a merchant POS terminal or, for example, a merchant website, a customer obtains a certificate from a service provider (SP), such as a bank, certifying his identification (ID) and his relevant financial information, in a form that is understandable by the SP. The SP is capable of performing multiple functions. For example, the SP is capable of acting as a certificate authority when it issues the customer's certificates, an authenticator when it receives private-key encrypted certificates from the customers to be decrypted using the corresponding public-key, and an authorizing authority when it checks the value available in a customer' chosen payment account against the requested purchase or transfer amount.
1. A method comprising:
presenting, by a computer, an amount due in response to a user's product selection;
accessing, by the computer, a programmable memory device associated with the user, wherein the programmable memory device comprising an identifying certificate for identifying the user;
retrieving, by the computer, the identifying certificate from the programmable memory device;
generating, by the computer, a graphical user interface including one or more accounts to be debited;
receiving, by the computer, a selected account for payment of the amount due;
attaching, by the computer, transaction information including a deposit account to the identifying certificate and the selected account;
signing, by the computer, the identifying certificate, the selected account, and the transaction information with a digital signature;
transmitting, by the computer, the identifying certificate, the selected account, the transaction information, and the digital signature to a server; and
receiving, by the computer from the server, an authorization message for payment authorization, wherein the server authorizes the payment by decrypting and authenticating the digital signature, authorizing the identifying certificate, and determining the selected account has sufficient funds to pay the amount due.
2. The method of claim 1 , further comprising:
requesting, by the computer, biometric identifying information including fingerprint from the user when the amount due satisfies a threshold.
3. The method of claim 1 , further comprising:
receiving, by the computer, personal identification number (PIN) associated with the programmable memory device.
4. The method of claim 1 , wherein the identifying certificate is issued by the server and includes the server's digital signature by encryption via public key cryptography.
5. The method of claim 1 , wherein the one or more accounts are account identifiers only readable by the user.
6. The method of claim 1 , wherein the computer is a point of sale terminal operated by a merchant.
7. The method of claim 1 , wherein the programmable memory device is a smart card.
8. The method of claim 1 , wherein the authorization message includes a digital signature signed by the server.
9. The method of claim 1 , wherein the server deposits the amount due into the depositing account of a merchant and posts debit to the selected account of the user.
10. The method of claim 1 , wherein the server authorizes the payment by interacting with a third party financial institution that maintains the user's selected account.
11. A system comprises:
a programmable memory device associated with a user comprising an identifying certificate for identifying the user;
a server;
a computer connected to the server via a network, and comprising a processor configured to:
present an amount due in response to a user's product selection;
access a programmable memory device associated with the user, wherein the programmable memory device comprising an identifying certificate for identifying the user;
retrieve the identifying certificate from the programmable memory device;
generate a graphical user interface including one or more accounts to be debited;
receive a selected account for payment of the amount due;
attach transaction information including a deposit account to the identifying certificate and the selected account;
sign the identifying certificate, the selected account, and the transaction information with a digital signature;
transmit the identifying certificate, the selected account, the transaction information, and the digital signature to a server; and
receive, from the server, an authorization message for payment authorization, wherein the server authorizes the payment by decrypting and authenticating the digital signature, authorizing the identifying certificate, and determining the selected account has sufficient funds to pay the amount due.
12. The system of claim 11 , wherein the processor is further configured to:
request biometric identifying information including fingerprint from the user when the amount due satisfies a threshold.
13. The system of claim 11 , wherein the processor is further configured to:
receive personal identification number (PIN) associated with the programmable memory device.
14. The system of claim 11 , wherein the identifying certificate is issued by the server and includes the server's digital signature by encryption via public key cryptography.
15. The system of claim 11 , wherein the one or more accounts are account identifiers only readable by the user.
16. The system of claim 11 , wherein the computer is a point of sale terminal operated by a merchant.
17. The system of claim 11 , wherein the programmable memory device is a smart card.
18. The system of claim 11 , wherein the authorization message includes a digital signature signed by the server.
19. The system of claim 11 , wherein the server deposits the amount due into the depositing account of a merchant and posts debit to the selected account of the user.
20. The system of claim 11 , wherein the server authorizes the payment by interacting with a third party financial institution that maintains the user's selected account.