METHOD AND SYSTEM FOR COMPLETING CROSS-CHANNEL TRANSACTIONS
A high security communication channel between the back-end application and the customer's mobile device is disclosed. An application programming interface that integrates into a service provider's back end application and a software development kit that integrates into a mobile application on the customer's mobile device establish a two-way communication channel between the back-end application and the mobile device. When a customer is ready to complete a transaction in one of the service provider's sales channels, such as online, by phone, in-person, by mobile device, or at a kiosk, the transaction moves to the mobile device for completion. A push message on the mobile device launches the service provider's mobile application and the customer completes the transaction quickly and securely using the advanced automation functions, such as biometrics, GPS, wallet, camera or near field communication, available on the mobile device.
1 . A system for completing a sales transaction, comprising:
an application on a mobile device;
a backend server; and
the application generates a message key, encrypts the message key with a public key, and sends the encrypted message key to the backend server;
the backend server uses a private key matching the public key to decrypt the encrypted message key and generates a session secret;
the backend server calculates a first message authentication code using the decrypted message key and the session secret and sends the push address and the session secret to a push service provider;
the push service provider sends the session secret to the application;
the application calculates a second message authentication code using the message key and the session secret and sends the second message authentication code to the backend server; and
the backend server compares the second message authentication code with the first message authentication code to determine if they match.
2 . The system for completing a sales transaction of claim 1 , wherein the application randomly generates the message key.
3 . The system for completing a sales transaction of claim 1 , wherein the application is provisioned with the public key when the application was published.
4 . The system for completing a sales transaction of claim 1 , wherein the application is provisioned with a push address.
5 . (canceled)
6 . (canceled)
7 . The system for completing a sales transaction of claim 1 , wherein the backend server calculates a message authentication code using the message key as a key and the session secret as a message.
8 . The system for completing a sales transaction of claim 1 , wherein the second message authentication code is a hash message authentication code.
9 . The system for completing a sales transaction of claim 1 , wherein if the second message authentication code matches the first message authentication code the sales transaction is allowed to proceed.
10 . The system for completing a sales transaction of claim 1 , wherein if the second message authentication code matches the first message authentication code the mobile device is authenticated.