Secure universal two-step payment authorization system

1. A commercial entity subsystem in communication with an electronic device, a merchant subsystem, and a financial institution subsystem, the commercial entity subsystem comprising:

at least one processor component;

at least one memory component; and

at least one communications component, wherein the commercial entity subsystem is configured to:

receive from the merchant subsystem an encrypted digital representation of a commerce credential for a payment transaction, the commerce credential including at least the financial value of said transaction, and the commerce credential containing no payment credentials usable in any other future transaction;

after the receiving, decrypt the digital representation received from the merchant subsystem, using at least a stored decryption key in the memory component;

after the decrypting, send a payment authorization request to the financial institution subsystem using at least the received digital representation as a basis for a payment credential;

receive an approval-or-denial reply from the financial institution subsystem regarding the payment authorization request, and forward the approval-or-denial reply to the merchant subsystem, or the electronic device, or both;

generate a onetime encryption-decryption key pair for a new transaction, comprising an encryption key and a corresponding decryption key;

after the generating, send the encryption key to the electronic device;

after the generating, store the decryption key in the memory component.

2. The commercial entity subsystem of claim 1 , wherein the commercial entity subsystem is further configured, for each transaction, to store no payment credentials in an explicit form, except in the form of a said digital representation received from the merchant subsystem.

3. An electronic device in communication with a commercial entity subsystem and a merchant subsystem, the electronic device comprising:

at least one processor component;

at least one memory component; and

at least one communications component, wherein the electronic device is configured to:

start an electronic payment process for a payment transaction;

after the starting, generate a digital representation of a commerce credential which at least identifies said payment transaction, the commerce credential containing no payment credentials usable in any other future transaction;

after the generating, encrypt the generated digital representation using an encryption key, which is received from the commercial entity subsystem for the transaction;

after the encrypting, communicate the encrypted digital representation to the merchant subsystem;

after the communicating, receive an approval-or-denial notice for said payment transaction from the commercial entity subsystem;

receive from the commercial entity subsystem a new encryption key for each transaction.

4. The electronic device of claim 3 , wherein said digital representation is a barcode.

5. The electronic device of claim 3 , wherein said digital representation is communicated to the merchant subsystem through optical scanning on a barcode displayed on a display screen.

6. A merchant subsystem in communication with a commercial entity subsystem and an electronic device, the merchant subsystem comprising:

at least one processor component;

at least one memory component; and

at least one communications component, wherein the merchant subsystem is configured to:

receive from the electronic device an encrypted digital representation of a commerce credential for a payment transaction, the commerce credential containing no payment credentials usable in any other future transaction;

generate a transaction report for a purchase corresponding to the payment transaction, the report including at least the financial value of the purchase;

after the receiving and the generating, send a payment authorization request through the commercial entity subsystem, the request including the received digital representation and said generated report, to the financial institution subsystem;

receive an approval-or-denial reply for the payment request regarding the purchase from the commercial entity subsystem.

7. The merchant subsystem of claim 6 , wherein said digital representation is a barcode.

8. The merchant subsystem of claim 6 , wherein said digital representation is communicated to the merchant subsystem through optical scanning on a barcode displayed on a display screen.

9. A commercial entity subsystem in communication with an electronic device, a merchant subsystem, and a financial institution subsystem, the commercial entity subsystem comprising:

at least one processor component;

at least one memory component; and

at least one communications component, wherein the commercial entity subsystem is configured to:

receive an encrypted digital representation of at least a payment commerce credential from the merchant subsystem, the digital representation at least identifying a payment transaction, and the commerce credential containing no payment credentials usable in any other future transaction;

after the receiving, decrypt the received digital representation;

after the decrypting, perform a confirmation process for which the commercial entity subsystem is further configured to:

send a request to the electronic device requesting at least a credential from the user of the electronic device;

send a request to the electronic device requesting the user of the electronic device to confirm said payment transaction;

after receiving from the electronic device a confirmation for said payment transaction, send a payment authorization request to the financial institution subsystem, using at least the received digital representation as a basis for a payment credential.

10. The commercial entity subsystem of claim 9 , wherein said requested user credential includes a personal identification number, or a personal identification code, or a biometric identifier.

11. The commercial entity subsystem of claim 9 , wherein said encrypted digital representation is encrypted with a single-transaction encryption key, said encryption key being previously generated by the commercial entity subsystem.

12. The commercial entity subsystem of claim 9 , wherein the commercial entity subsystem decrypts said encrypted digital representation using a stored decryption key.

13. The commercial entity subsystem of claim 9 , wherein the commercial entity subsystem is further configured, for each transaction, to store no payment credentials in an explicit form, except in the form of a said digital representation received from the merchant subsystem.

14. A commercial entity subsystem in communication with an electronic device, a merchant subsystem, and a financial institution subsystem, the commercial entity subsystem comprising:

at least one processor component;

at least one memory component; and

at least one communications component, wherein the commercial entity subsystem is configured to:

receive from the merchant subsystem an encrypted digital representation of a commerce credential for a payment transaction;

store, for each transaction, no payment credentials in an explicit form, except in the form of a said digital representation received from the merchant subsystem;

after the receiving, decrypt the digital representation received from the merchant subsystem, using at least a stored decryption key in the memory component;

after the decrypting, send a payment authorization request to the financial institution subsystem using at least a payment credential, the payment credential being included in the said received digital representation after decryption;

receive an approval-or-denial reply from the financial institution subsystem regarding the payment authorization request, and forward the approval-or-denial reply to the merchant subsystem, or the electronic device, or both;

generate a onetime encryption-decryption key pair for a new transaction, comprising an encryption key and a corresponding decryption key;

after the generating, send the encryption key to the electronic device;

after the generating, store the decryption key in the memory component.

15. The commercial entity subsystem of claim 14 , wherein said encrypted digital representation is a barcode.