Secure in-line payments for rich internet applications
Methods and systems are provided for making secure financial transactions, such as purchase payments, using rich Internet applications (RIA) running an RIA runtime (also referred to as a platform or framework) on the user's smart phone or other mobile device. Embodiments differ from the usual way of re-directing a user from a third-party application and authenticating the user by providing secure in-line payments from a rich Internet application running on an RIA runtime. A system includes: a mobile device executing a rich Internet application running on an RIA runtime; a payment library communicating with the RIA runtime and a service provider, for which the payment library communicates with the service provider to authenticate the rich Internet application; and in response to authentication by the service provider, facilitates secure financial transactions via the rich Internet application.
1. A client device system, comprising:
a non-transitory memory storing instructions; and
one or more hardware processors coupled to the non-transitory memory and configured to read the instructions to cause the client device system to perform operations comprising:
accessing a payment library installed on the client device system;
initiating, based on accessing of the payment library, an execution of a rich internet application (RIA) to run on top of a runtime platform of the client device system, wherein the RIA is usable to provide in-line payments via a payment service provider;
sending, to an authentication and authorization service, a request to verify an authenticity of the RIA, the request including a hash value;
receiving, from the authentication and authorization service, an application authorization token;
saving the application authorization token to the payment library;
sending, to the payment service provider, login credentials and the application authorization token via the RIA; and
receiving, from the payment service provider upon the payment service provider verifying the login credentials with the application authorization token, a user authorization token for an activity with the RIA.
2. The client device system of claim 1 , wherein the RIA comprises a plurality of code segments, wherein verifying the authenticity of the RIA to secure the in-line payments with the payment service provider comprises determining code signatures embedded in the plurality of code segments that indicate the RIA is authentic to the payment service provider.
3. The client device system of claim 1 , wherein the operations further comprise: determining information received from the runtime platform indicates a domain name of a server associated with the payment service provider,
wherein verifying the authenticity of the RIA to secure the in-line payments with the payment service provider is further based on the domain name indicated in the information received from the runtime platform.
4. The client device system of claim 1 , wherein verifying the authenticity of the RIA to secure the in-line payments with the payment service provider comprises determining an amount of information received by an authentication library from the runtime platform, wherein verifying the authenticity of the RIA comprises determining the RIA is authentic to further authorize user activities with the client device system based at least on the amount of the information received.
5. The client device system of claim 4 , wherein verifying the authenticity of the RIA to further authorize the user activities with the client device system comprises verifying the authenticity of the RIA to communicate with the authentication library to complete in-line payments of the user activities with the payment service provider.
6. The client device system of claim 1 , wherein verifying the authenticity of the RIA to secure the in-line payments with the payment service provider comprises determining the hash value calculated from information received by an authentication library, wherein the hash value indicates an authentic behavior of the RIA.
7. The client device system of claim 1 , wherein the operations further comprise:
sending information received to a remote server configured to verify a behavior of the RIA; and
receiving a confirmation from the remote server, wherein the confirmation indicates that the RIA is authentic.
8. A method, comprising:
accessing a payment library installed on a client device system;
initiating, based on accessing of the payment library, an execution of a rich internet application (RIA) to run on top of a runtime platform of the client device system, wherein the RIA is usable to provide in-line payments via a payment service provider,
sending, to an authentication and authorization service, a request to verify an authenticity of the RIA, the request including a hash value;
receiving, from the authentication and authorization service, an application authorization token;
saving the application authorization token to the payment library;
sending, to the payment service provider, login credentials and the application authorization token via the RIA; and
receiving, from the payment service provider upon the payment service provider verifying the login credentials with the application authorization token, a user authorization token for an activity with the RIA.
9. The method of claim 8 , wherein the RIA comprises a plurality of code segments, wherein verifying the authenticity of the RIA to secure the in-line payments with the payment service provider comprises determining code signatures embedded in the plurality of code segments that indicate the RIA is authentic to the payment service provider.
10. The method of claim 8 , further comprising:
determining information received from the runtime platform indicates a domain name of a server associated with the payment service provider,
wherein verifying the authenticity of the RIA to secure the in-line payments with the payment service provider is further based on the domain name indicated in the information received from the runtime platform.
11. The method of claim 8 , wherein verifying the authenticity of the RIA to secure the in-line payment with the payment service provider comprises determining an amount of information received by an authentication library from the runtime platform, wherein verifying the authenticity of the RIA comprises determining the RIA is authentic to further authorize user activities with the client device system based at least on the amount of the information received.
12. The method of claim 11 , wherein verifying the authenticity of the RIA to further authorize the user activities with the client device system comprises verifying the authenticity of the RIA to communicate with the authentication library to complete in-line payments of the user activities with the payment service provider.
13. The method of claim 8 , wherein verifying the authenticity of the RIA to secure the in-line payments with the payment service provider comprises determining the hash value calculated from information received by an authentication library, wherein the hash value indicates an authentic behavior of the RIA.
14. The method of claim 8 , further comprising:
sending information received to a remote server configured to verify a behavior of the RIA; and
receiving a confirmation from the remote server, wherein the confirmation indicates that the RIA is authentic.
15. A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations, comprising:
accessing a payment library installed on a client device system;
initiating, based on accessing of the payment library, an execution of a rich internet application (RIA) to run on top of a runtime platform of the client device system, wherein the RIA is usable to provide in-line payments via a payment service provider,
sending, to an authentication and authorization service, a request to verify an authenticity of the RIA, the request including a hash value;
receiving, from the authentication and authorization service, an application authorization token;
saving the application authorization token to the payment library,
sending, to the payment service provider, login credentials and the application authorization token via the RIA; and
receiving, from the payment service provider upon the payment service provider verifying the login credentials with the application authorization token, a user authorization token for an activity with the RIA.
16. The non-transitory machine-readable medium of claim 15 , wherein the RIA comprises a plurality of code segments, wherein verifying the authenticity of the RIA to secure the in-line payments with the payment service provider comprises determining code signatures embedded in the plurality of code segments that indicate the RIA is authentic to the payment service provider.
17. The non-transitory machine-readable medium of claim 15 , wherein the operations further comprise:
determining information received from the runtime platform indicates a domain name of a server associated with the payment service provider,
wherein verifying the authenticity of the RIA to secure the in-line payments with the payment service provider is further based on the domain name indicated in the information received from the runtime platform.
18. The non-transitory machine-readable medium of claim 15 , wherein verifying the authenticity of the RIA to secure the in-line payments with the payment service provider comprises determining an amount of information received by an authentication library from the runtime platform, wherein verifying the authenticity of the RIA comprises determining the RIA is authentic to further authorize user activities with the client device system based at least on the amount of the information received.
19. The non-transitory machine-readable medium of claim 18 , wherein verifying the authenticity of the RIA to further authorize the user activities with the client device system comprises verifying the authenticity of the RIA to communicate with the authentication library to complete in-line payments of the user activities with the payment service provider.
20. The non-transitory machine-readable medium of claim 15 , wherein verifying the authenticity of the RIA to secure the in-line payments with the payment service provider comprises determining the hash value calculated from the information received by an authentication library, wherein the hash value indicates an authentic behavior of the RIA.