Direct personal mobile device user to service provider secure transaction channel
Ensuring security of electronic transactions between a personal mobile device user and a service provider involves establishing trust between a user and a transaction service provider, authenticating the personal mobile device of the user, establishing a secure communication channel between the user and the service provider, and registering the user with the service provider over the secure communications channel.
1. A method comprising:
issuing with a transaction server a first one-time activation code (OTAC) to a user;
receiving with the transaction server a message from a mobile device executing an electronic transaction facility, the mobile device operated by the user, the message comprising a plurality of keys generated on the mobile device and the first OTAC, wherein the first OTAC is entered by the user into the mobile device during a registration process with the transaction server;
authenticating the mobile device and associating the mobile device with the user based on the received message;
updating credentials of a service provider on the mobile device with the transaction server and forwarding credentials of the mobile device to the service provider, thereby providing secure communication directly between the user via the mobile device and the service provider; and
authenticating with the service provider the user of the mobile device, wherein the user is authenticated by verifying a second OTAC sent to the user from the service provider and then received directly from the mobile device after being encrypted on the mobile device using the updated credentials of the service provider.
2. A secure service provider-to-mobile device user transaction channel, comprising:
a mobile device executing an electronic transaction facility;
a service provider server configured to provide a first one-time activation code (OTAC) to a user of the electronic transaction facility; and
a transaction server configured to:
issue a second OTAC to a user of the mobile device;
receive a message comprising a plurality of keys generated on the mobile device, the message further comprising the second OTAC that is entered by the user into the mobile device during a registration process;
authenticate the mobile device during the registration process based on the second OTAC received in the message;
associate the mobile device with the user during the registration process based on the received message;
update credentials of the service provider on the mobile device and forward mobile device credentials to the service provider, thereby providing secure communication directly between the user via the mobile device and the service provider;
wherein the service provider server is further configured to authenticate the mobile device user by verifying the first OTAC received directly from the mobile device where the first OTAC is encrypted using the updated credentials of the service provider.