# US 2014/0156531 A1 · System and Method for Authenticating Transactions Through a Mobile Device

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2014/0156531 A1
- Document ID: US20140156531A1
- Status: Published application
- Kind: A1
- Application number: 14/173,089
- Filed: 2014-02-05
- Published: 2014-06-05
- Earliest claimed: 2010-12-14
- Assignees: SALT Technology Inc.
- Applicants: SALT Technology Inc.
- Inventors: Dennis POON; Simon LAW; Richard BURNISON
- Web page: https://patentgrep.com/patent/US20140156531A1

## CPC

- G06Q 20/027: {involving a payment switch or gateway}
- G06Q 20/20: Point-of-sale [POS] network systems
- G06Q 20/322: {Aspects of commerce using mobile devices [M-devices]}
- G06Q 20/3229: {Use of the SIM of a M-device as secure element}
- G06Q 20/326: {Payment applications installed on the mobile devices}
- G06Q 20/3825: {Use of electronic signatures}
- G06Q 20/389: {Keeping log of transactions for guaranteeing non-repudiation of a transaction}
- G06Q 20/40: Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
- G06Q 20/4014: {Identity check for transactions}
- G06Q 20/4016: {involving fraud or risk level assessment in transaction processing}
- G06Q 20/407: {Cancellation of a transaction}
- G06Q 20/4097: {using mutual authentication between devices and transaction partners}
- H04M 15/00: Arrangements for metering, time-control or time indication {; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP}
- H04W 4/24: Accounting or billing
- H04W 12/06: Authentication
- H04W 12/102: Route integrity, e.g. using trusted paths
- H04W 12/106: Packet or message integrity
- H04W 12/108: Source integrity
- H04L 63/0869: {for achieving mutual authentication (cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273)}
- H04L 2463/101: applying security measures for digital rights management
- H04W 8/26: Network addressing or numbering for mobility support
- H04W 60/00: Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration
- H04W 88/16: Gateway arrangements
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- H04M: TELEPHONIC COMMUNICATION (circuits for controlling other apparatus via a telephone cable and not involving telephone switching apparatus G08)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A user may claim to have not made or allowed a transaction and that the transaction was made in error. Where it appears the user has not authorized the transaction, the funds of the transaction are returned to the user, or are charged back. Systems and methods provide a way to confirm whether or not a transaction was actually authorized by the user, thereby settling a chargeback dispute for a previously executed transaction. The method comprises receiving the dispute regarding the transaction including associated transaction data, and retrieving a digital signature associated with the transaction data, the digital signature computed by signing the transaction data. The digital signature is then verified using a public key, wherein the public key corresponds to a private key stored on a mobile device. It is then determined whether or not the transaction is fraudulent based on a verification result of the digital signature.

## Claims

### Claim 1

A method for authenticating a transaction on a mobile device, the mobile device having stored thereon a mobile device ID, the method performed on the mobile device comprising:
the mobile device receiving through a transaction GUI a supplemental ID for verifying a payment ID;
the mobile device sending the supplemental ID and the mobile device ID to a payment gateway, the payment gateway having stored thereon the payment ID and the mobile device ID in association with each other; and
the mobile device receiving from the payment gateway a confirmation that the transaction is complete.

### Claim 2 (depends on 1)

The method of claim 1 wherein the mobile device sends at least one of the supplemental ID and the payment ID without storing the supplemental ID and the payment ID on the mobile device.

### Claim 3 (depends on 1)

The method of claim 1 further comprising a registration process for storing the mobile device ID on the mobile device, the method further comprising:
the mobile device receiving from a registration GUI at least the payment ID of a payment account and the supplemental ID, and transmitting the payment ID and the supplemental ID to the payment gateway without storing the payment ID and the supplemental ID on the mobile device;
the mobile device receiving from the payment gateway a confirmation that the payment ID and the supplemental ID are successfully verified; and,
the mobile device obtaining data for generating the mobile device ID, the mobile device ID stored on the mobile device.

### Claim 4 (depends on 3)

The method of claim 3 wherein the mobile device obtains the data for the mobile device ID by at least one of generating and receiving the data.

### Claim 5 (depends on 1)

The method of claim 1 wherein the payment ID is comprised of at least one of: a credit card number, an expiry date, a bank card number, a banking number, and a points account number.

### Claim 6 (depends on 1)

The method of claim 1 wherein the supplemental ID is comprised of at least one of: a Card Security Value (CSV), a Card Security Code (CSC), a Card Verification Value (CVV or CVV2), a Card Verification Value Code (CVVC), a Card Verification Code (CVC or CVC2), a Verification Code (V-Code or V Code), a Card Code Verification (CCV), a PIN, a password, biometric data, and voice data.

### Claim 7 (depends on 1)

The method of claim 1 wherein the mobile device ID includes at least one of: subscriber identity information stored on a SIM card or IMEI of the mobile device, networking information, an IP address, a phone carrier identification, a port address, a DNS name, a GPS coordinate of the mobile device, the battery temperature of the mobile device, a geographical location of the mobile device, an accelerometer reading of the mobile device, a cookie, a user agent, and a header, wherein the cookie, the user agent and the header are provided by a browser on the mobile device or a DOM storage on the mobile device.

### Claim 8 (depends on 1)

The method of claim 1 wherein the mobile device ID is randomly generated.

### Claim 9 (depends on 1)

The method of claim 1 wherein the mobile device ID is replaced by a new mobile device ID and is associated with the payment ID for each subsequent execution of the transaction process.

### Claim 10

A non-transitory computer readable medium for authenticating a transaction on a mobile device, the computer readable medium comprising computer executable instructions for execution on the mobile device, the computer executable instructions comprising:
the mobile device receiving through a transaction GUI a supplemental ID for verifying a payment ID;
the mobile device sending the supplemental ID and the mobile device ID to a payment gateway, the payment gateway having stored thereon the payment ID and the mobile device ID in association with each other; and
the mobile device receiving from the payment gateway a confirmation that the transaction is complete.

### Claim 11 (depends on 10)

The non-transitory computer readable medium of claim 10 wherein the mobile device sends at least one of the supplemental ID and the payment ID without storing the supplemental ID and the payment ID on the mobile device.

### Claim 12 (depends on 10)

The non-transitory computer readable medium of claim 10 wherein the instructions further comprise a registration process for storing the mobile device ID on the mobile device, the instructions further comprising:
the mobile device receiving from a registration GUI at least the payment ID of a payment account and the supplemental ID, and transmitting the payment ID and the supplemental ID to the payment gateway without storing the payment ID and the supplemental ID on the mobile device;
the mobile device receiving from the payment gateway a confirmation that the payment ID and the supplemental ID are successfully verified; and,
the mobile device obtaining data for generating the mobile device ID, the mobile device ID stored on the mobile device.

### Claim 13 (depends on 12)

The non-transitory computer readable medium of claim 12 wherein the mobile device obtains the data for the mobile device ID by at least one of generating and receiving the data.

### Claim 14 (depends on 10)

The non-transitory computer readable medium of claim 10 wherein the payment ID is comprised of at least one of: a credit card number, an expiry date, a bank card number, a banking number, and a points account number.

### Claim 15 (depends on 10)

The non-transitory computer readable medium of claim 10 wherein the supplemental ID is comprised of at least one of: a Card Security Value (CSV), a Card Security Code (CSC), a Card Verification Value (CVV or CVV2), a Card Verification Value Code (CVVC), a Card Verification Code (CVC or CVC2), a Verification Code (V-Code or V Code), a Card Code Verification (CCV), a PIN, a password, biometric data, and voice data.

### Claim 16 (depends on 10)

The non-transitory computer readable medium of claim 10 wherein the mobile device ID includes at least one of: subscriber identity information stored on a SIM card or IMEI of the mobile device, networking information, an IP address, a phone carrier identification, a port address, a DNS name, a GPS coordinate of the mobile device, the battery temperature of the mobile device, a geographical location of the mobile device, an accelerometer reading of the mobile device, a cookie, a user agent, and a header, wherein the cookie, the user agent and the header are provided by a browser on the mobile device or a DOM storage on the mobile device.

### Claim 17 (depends on 10)

The non-transitory computer readable medium of claim 10 wherein the mobile device ID is randomly generated.

### Claim 18 (depends on 10)

The non-transitory computer readable medium of claim 10 wherein the mobile device ID is replaced by a new mobile device ID and is associated with the payment ID for each subsequent execution of the transaction process.