DETAILED ACTION
This is a non-final office action on the merits. The U.S. Patent and Trademark Office (the Office) has received claims 1 – 22 in application 17/538,351.
Claims 1, 8, and 15 are amended.
Claims 21 and 22 are new.
Claims 1-22 are pending and have been examined on the merits.
Notice of Pre-AIA or AIA Status
The present application, filed on or after 16 March 2013, is being examined under the first inventor to file provisions of the AIA .
Continued Examination Under 37 CFR 1.114
A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 12/03/2025 has been entered.
Response to Arguments
35 U.S.C. 103 Rejections
Applicant's arguments filed on 10/31/2025 with respect to Claim Rejections have been fully considered but they are not persuasive.
Applicant argues Rapanen does not teach “receiving…,via a link generated by the contactless card and directed to an authentication web address, a financial transaction authentication request.” Examiner disagrees. Rapanen teaches the NFC/contactless interaction and sending data to a server for transaction processing/authentication. Applicant acknowledges Rapanen describes an NFC reader that “retrieves an identifier…and sends the identifier to a server,” and that the server then uses that information to obtain payment card information. Representing the contactless/NFC provided data as a “link” (e.g., a URL/URI is a well-known, predictable design choice for the exact same NFC interaction already disclosed by Rapanen. Furthermore, Rapanen’s “identifier” delivered via NFC is functionally causes a server action. Encoding that action as a URL/URI (i.e., “a link…directed to an authentication web address”) is an obvious implementation detail to use standard web-based authentication flows.
New Claims 21 and 22 rejected as below.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquires set forth in Graham v. John Deere Co., 383 U.S. 1, 148 USPQ 459 (1066), that are applied for establishing a background for determining obviousness under 35 U.S.C. § 103 are summarized as follows:
Determining the scope and contents of the prior art.
Ascertaining the differences between the prior art and the claims at issue.
Resolving the level of ordinary skill in the pertinent art.
Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claims 1 – 22 are rejected under 35 U.S.C. § 103 as being unpatentable over Lim et al. (US20140074655A1) hereinafter Lim, in view of Rapanen (US20150363766A1), in further view of Dua (US20150081559A1), in further view of Bishop et al. (US20090140839A1).
Regarding Claim 1. Lim teaches:
receiving, at a financial institution system of a financial institution from a website, a notification that a financial transaction authentication request from a user will be received at the financial institution system […] wherein the notification includes a verification identifier of the user that was input during a transaction session with the website, [A method comprising: receiving, by a wallet server computer from a consumer device, a request to enable a one-tap account addition feature; receiving consumer registration data and consumer payment account data; uploading, by the wallet server computer, consumer device data associated with the consumer device; uploading reader device data of a reader device associated with the consumer device; determining that the reader device is near-field communication capable; storing the consumer registration data, consumer payment account data, and the consumer device data in an electronic wallet associated with a consumer; and enabling, by the wallet server computer, a one-tap add account addition feature for the consumer device (Claim 1, Lim)].
wherein the predetermined time period is established by the website; [Similarly, if in step 712 the appropriate consumer information is not received within a predetermined time, or if in step 714 the consumer data is not authenticated, then the wallet server prompts 726 the consumer to manually authenticate their account to complete checkout, and the process ends (Paragraph 0042, Lim)].
[…] within a predetermined time period of receipt of the notification, […]; [Referring again to FIG. 7, if in step 708 the consumer does not select the one-tap checkout option (in some embodiments, after a predetermined amount of time expires), then the wallet server prompts 726 the consumer to manually authenticate their account to complete checkout, and the process ends. Similarly, if in step 712 the appropriate consumer information is not received within a predetermined time, or if in step 714 the consumer data is not authenticated, then the wallet server prompts 726 the consumer to manually authenticate their account to complete checkout, and the process ends (Paragraph 0042, Lim). If the consumer taps the proximity device onto the proximity reader within the allotted time (i.e., before 20 seconds expires), then in some embodiments an indication is provided to the consumer, such as an audible sound (beep) from the speaker of the consumer's device, that a good read has occurred. The consumer is then presented with the webpage that includes all of the checkout data pre-filled so that the consumer can quickly verify that information and then checkout (pay for the purchase transaction). For example, FIG. 8C is a screen shot of a Checkout webpage of a merchant called “Wintercheck Factory”, showing the results of a successful one-tap checkout process. In particular, fields for a shipping first name 852, shipping last name 854, shipping country 856, shipping address 858, shipping city 860, shipping zip code 862 and shipping phone number 864 have been automatically populated after the consumer has tapped his or her proximity payment device on the proximity reader. Thus, the consumer did not have to manually enter any login credentials (such as a UserID and/or password), and did not have to manually select their payment card account and shipping address on a wallet server website (Paragraph 0046)].
causing a prompt to be presented on a mobile device corresponding to the verification identifier of the user, wherein the presented prompt includes a request for confirmation of a pending transaction via a near-field communication interaction between the mobile device and a contactless card associated with the financial institution; [The one-tap checkout feature permits a consumer to quickly and accurately checkout from an online merchant website. In some implementations, when the consumer registers for the one-tap account addition service (to enable the one-tap “Add a Card” feature), or when the consumer later adds a proximity payment account, he or she may be prompted to opt-in to a one-tap checkout feature for use when online shopping. If the consumer opts-in, then during checkout from a merchant's website the consumer may select the one-tap checkout option and be prompted to tap his or her proximity payment device on the proximity reader associated with his or her consumer device. When the tap is made, the proximity reader reads data from the proximity payment device and transmits that data to the wallet server which authenticates the consumer. The wallet server then transmits consumer data to the merchant's website which is utilized to automatically populate the checkout webpage with required financial data and/or shipping information. In some implementations, a consumer may associate one-tap checkout with one or more of the payment accounts stored in the consumer's mobile wallet. Thus, the one-tap checkout feature enables the consumer to quickly and easily provide checkout data to a merchant's website by tapping his or her proximity payment device on a proximity reader in accordance with the methods presented herein (Paragraph 0018, Lim)].
Lim does not teach:
receiving, in response to a near-field communication interaction responsive to presentation of the presented prompt presented, via a link generated by the contactless card and directed to an authentication web address, a financial transaction authentication request including […] at the authentication web address of the financial institution system as the confirmation of the pending transaction, wherein a portion of the encrypted authentication payload is maintained on the contactless card;
decrypting the encrypted authentication payload;
obtaining […] from the decrypted authentication payload from the encrypted authentication payload as decrypted, wherein one of the […] is an application transaction counter;
[…] an encrypted authentication payload […]
[…] multiple parameters […]
authenticating, by using the application transaction counter to authenticate other ones of the multiple parameters, the user as a holder of the contactless card; and
in response to authenticating the user as the holder of the contactless card, enabling completion of the pending transaction by sending user identifying information to the website.
Rapanen teaches:
receiving, in response to the near-field communication interaction responsive to presentation of the prompt presented, via a link generated by the contactless card and directed to an authentication web address, a financial transaction authentication request including […] at the authentication web address of the financial institution system as the confirmation of the pending transaction, wherein a portion of the encrypted authentication payload is maintained on the contactless card; [According to a third aspect, a system for performing at least partly a transaction is provided wherein the transaction is initiated with near field communication, NFC, interaction. The system comprises a NFC reader configured to interact with a secure element of a subscriber identity module residing in a user terminal in order to obtain an identifier stored in the secure element; a transaction management system for confirming the transaction; and a server communicatively coupled to the NFC reader and to the transaction management system wherein the server is configured to receive a request for the transaction from the NFC reader, the request comprising an amount of the transaction and the identifier obtained from a secure element of the subscriber identity module residing in the user terminal in through the interaction between the user terminal and the NFC reader; obtain a payment card number corresponding to the identifier within the request by initiating a query to data storage accessible to the server, the data storage storing information on at least one identifier and at least one payment card number corresponding to the identifier; initiate a transaction request towards a transaction management system managing transactions with the payment card in question, the transaction request comprising the amount of the transaction and the payment card number; and in response to a successful acknowledgment from the transaction management system to the transaction request, deliver an acknowledgement on successful transaction, and in response to an unsuccessful acknowledgement from the transaction management system to the transaction request, cancel the transaction (Paragraph 0017, Rapanen). The NFC reader 120 is configured to deliver the retrieved identifier to the backbone system 125…request message arranged to be delivered to the server 125 (¶ 0028)].
decrypting the encrypted authentication payload; [According to an example of the invention the received identifier from the secure element through the interaction is encrypted. In such a case the server 130 is configured to conclude, e.g. on a basis of format of a request 210 or content of the request 210, that the request comprises an encrypted identifier for a transaction. In response to this the server 130 is configured to decrypt the identifier with a pre-agreed decryption method and thus, on the basis of decrypted identifier information, to retrieve the corresponding payment card number. The described example of the invention increases a security within the system as typically all transaction related information shall be maintained as secret as possible (Paragraph 0032, Rapanen)].
obtaining […] from the encrypted authentication payload as decrypted, wherein one of the […] is an application transaction counter; [According to an example of the invention the received identifier from the secure element through the interaction is encrypted. In such a case the server 130 is configured to conclude, e.g. on a basis of format of a request 210 or content of the request 210, that the request comprises an encrypted identifier for a transaction. In response to this the server 130 is configured to decrypt the identifier with a pre-agreed decryption method and thus, on the basis of decrypted identifier information, to retrieve the corresponding payment card number. The described example of the invention increases a security within the system as typically all transaction related information shall be maintained as secret as possible (Paragraph 0032, Rapanen)].
It would have been obvious to one of ordinary skill in the art before the effective filing date to modify the receiving of a notification that a financial transaction authentication request from a user and the time period of Lim with the causing a prompt to be presented on a mobile device corresponding to the verification identifier of the user of Rapanen because doing so allows the confirmation of a transaction.
The combination of Lim and Rapanen does not teach:
[…] an encrypted authentication payload […]
[…] multiple parameters […]
authenticating, by using the application transaction counter to authenticate other ones of the multiple parameters, the user as a holder of the contactless card; and
in response to authenticating the user as the holder of the contactless card, enabling completion of the pending transaction by sending user identifying information to the website.
Dua teaches:
[…] an encrypted authentication payload […] [Depending on the situation, SIP messages between the WCM and the wallet application (contactless card) on the wireless device can carry any supported content types in its payload (e.g. WML, HTML, XHTML, gif, text and others). SIP payload content could include encryption keys, encryption algorithms, forms, user authentication information (e.g. usernames, passwords, PINs, and answers to secret questions), software extensions the issuer wants to register with the wallet application, software updates, electronic credentials, updates to existing credentials, graphics that are part of the credentials, and other such information (Paragraph 0206, Dua)].
[…] multiple parameters […] [The established session may initially be used to exchange encryption keys and/or other security information. Subsequent to that, the issuer's system will authenticate the mobile user's identity in real-time to ensure that the person on the receiving end is in fact the person that requested the digital credential. The authentication process can be accomplished by the issuer system prompting the user for some cardholder or accountholder authentication information contained within its system, that only the rightful accountholder would have. The user would see such a request for information within the wallet application screen on the device display. This could include a request for such information such as an existing card account number, card expiration date, cardholder name, mother's maiden name, billing address, social security number, account balance, transaction history, driver's license number, or business identification. The issuer could also request a special code or PIN that was mailed to the user in advance of the issuance as a means to further validate identity and ensure non-repudiation. Some of the input information individually, or a combination of certain input information could be used as a decryption key for a credential that is transmitted to the wireless device. Subsequent to the issuer's system validating the user's identity in real-time, the WCM 510 will transmit the credential to the wallet application (Paragraph 0170, Dua)].
It would have been obvious to one of ordinary skill in the art before the effective filing date to modify the receiving of a notification that a financial transaction authentication request from a user of Lim with the causing a prompt to be presented on a mobile device corresponding to the verification identifier of the user of Rapanen and the encrypted payload and multiple parameters of Dua because doing so allows the authentication of the user as the holder of the contactless card.
The combination of Lim, Rapanen, and Dua does not teach:
in response to authenticating the user as the holder of the contactless card, enabling completion of the pending transaction by sending user identifying information to the website.
Bishop teaches:
in response to authenticating the user as the holder of the contactless card, enabling completion of the pending transaction by sending user identifying information to the website. [It should be noted that completion of a transaction may be performed under any business as usual standard employed by the merchant and/or issuer system 230. For example, merchant server 222 may be configured to communicate transaction data to the appropriate issuer system 230, in real-time or substantially real-time, or by using batch processing at the end of each day. Any suitable means for delivering the transaction data to issuer systems 230 may be used. In one exemplary embodiment of the present invention, the transaction data may be delivered to issuer system 230 via a network 260. Issuer system 230 may receive the transaction information and process the transaction under issuer defined protocol independent of any other protocol used by other issuers to process a transaction. Issuer system 230 may receive the transaction data and provide the merchant with the appropriate satisfaction for the transaction (Paragraph 0149, Bishop)].
authenticating, by using the application transaction counter to authenticate other ones of the multiple parameters, the user as a holder of the contactless card; and [In another embodiment, the non-traditional device may be configured with an RF protocol, such as a protocol in ISO 14443 format or according to Near Field Communication (NFC) formats. In another embodiment, the non-traditional device may be configured to directly communicate with an acquirer/issuer or payment processor to complete payment. For example, the non-traditional device may be a cellular telephone that communicates directly to an acquirer/issuer or payment processor. A typical cellular telephone is already equipped with a microphone, a processor to process authentication using a voice print, and a communication line connecting the cellular telephone directly to an acquirer/issuer. In another embodiment, the non-traditional device may be configured to facilitate transactions using a random number, an authentication tag, a counter, or an encrypted payload. In yet another embodiment, the non-traditional device may not be an RF operable device and may facilitate a payment transaction through voice verification and direct communication between a merchant point of sale device and a voice verification system (Paragraph 0007, Bishop)].
It would have been obvious to one of ordinary skill in the art before the effective filing date to modify the receiving of a notification that a financial transaction authentication request from a user and the time period of Lim with the causing a prompt to be presented on a mobile device corresponding to the verification identifier of the user of Rapanen and the encrypted payload and multiple parameters of Dua and the completion of the transaction of Dua because doing so allows the authentication of the user as the holder of the contactless card and the completion of the pending transaction to be completed.
Regarding Claim 2. The combination of Lim, Rapanen, Dua and Bishop teaches all of the limitations of Claim 1 above. The combination further teaches:
The method of claim 1, further comprising: after expiration of the predetermined time period, receiving a hyperlink corresponding to the transaction session which was deactivated by the website after the expiration of the predetermined time period; maintaining, temporarily, the hyperlink in a data storage in association with information related to the user; and in response to a further notification from the website regarding the user, using the hyperlink to reactivate the transaction session at the website. [If the consumer taps the proximity device that he or she wishes to add to the mobile wallet onto the proximity reader within the allotted time (i.e., before 20 seconds expires), then in some embodiments an indication is provided, such as an audible sound (beep) from the speaker of the consumer's device, that a good read has occurred. The consumer is then presented with the webpage 650 shown in FIG. 6C. In this example, as shown by the webpage 650, information has been automatically populated or filled in, based on the data read by the proximity reader and transmitted by the consumer device to the wallet server, for the data entry fields including the name on card field 604, card number field 606 and the expiration date fields 608. In some embodiments, the card data including the security code will be provided by the device authentication server upon proximity device authentication, and will be pre-populated in an un-editable manner and/or in a suppressed or inactive manner. In addition, in some implementations the card nickname field 602, billing address field 612, and residence address fields 614 must be manually filled in by the consumer. However, in other embodiments, these fields would also be automatically filled in based on information previously supplied by the consumer, or based on card account data read from the proximity payment card that is to be added to the mobile wallet (Paragraph 0039, Lim)].
Regarding Claim 3. The combination of Lim, Rapanen, Dua and Bishop teaches all of the limitations of Claim 1 above. The combination further teaches:
populating a message with instructions executable by the mobile device that causes the mobile device to initiate a near-field communication read of the contactless card and with a hyperlink to the authentication web address of the financial institution; and [The wallet server then transmits consumer data to the merchant's website which is utilized to automatically populate the checkout webpage with required financial data and/or shipping information. In some implementations, a consumer may associate one-tap checkout with one or more of the payment accounts stored in the consumer's mobile wallet. Thus, the one-tap checkout feature enables the consumer to quickly and easily provide checkout data to a merchant's website by tapping his or her proximity payment device on a proximity reader in accordance with the methods presented herein (Paragraph 0018, Lim)].
forwarding the message to the mobile device corresponding to the verification identifier of the user, wherein the message may be formatted as a short message service message, a multimedia messaging service message, or as a financial institution in-application notification. [Furthermore, the NFC reader 120 is coupled to a backbone system 125 and thus arranged to communicate with a server 130 through the backbone system 125. The backbone system may be, but is not limited to, a payment system comprising a server and necessary data storage as well as cash register devices 127. The backbone system, i.e. the payment system, is configured to be used when a transaction between the buyer and seller is done, wherein the initiation of payment is performed through the NFC technology with the user terminal 110. The backbone system may exchange of information with the server 130. The backbone system may either deliver pieces of information relating to a transaction in separate messages to the server 130 or combine multiple pieces of information and deliver those in one message to the server 130 (Paragraph 0025, Rapanen)].
It would have been obvious to one of ordinary skill in the art before the effective filing date to modify the receiving of a notification that a financial transaction authentication request from a user and the time period of Lim with the causing a prompt to be presented on a mobile device corresponding to the verification identifier of the user of Rapanen and the encrypted payload and multiple parameters of Dua and the completion of the transaction of Dua because doing so allows the authentication of the user as the holder of the contactless card and the completion of the pending transaction to be completed.
Regarding Claim 4. The combination of Lim, Rapanen, Dua and Bishop teaches all of the limitations of Claim 1 above. The combination further teaches:
wherein causing the prompt to presented, further comprises: forwarding a message to the mobile device to present the prompt, and initiating a background read of the contactless card by a near-field communication device of the mobile device. [Next the method according to an example of the invention is described by referring to FIG. 2. The method according to the invention is initiated with an NFC interaction of a user terminal 110 equipped with a SIM card comprising a secure element and a NFC reader 120. At least one identifier is stored with the secure element of the SIM card, which identifier may be used in a transaction. More specifically, the identifier stored in the secure element of the SIM card is retrieved during the NCF interaction of the user terminal 110 and the NFC reader. The retrieval of the identifier may be arranged so that it is automatically transferred during the interaction by pushing it to the NFC reader by the user terminal 110 or the NFC reader 120 may be configured to deliver an identifier request message to the user terminal 110, which, in response to a receipt of the request, is configured to retrieve the requested identifier from the secure element of the SIM. In some implementation of the invention the user terminal may comprise a software application installed and executed by a processor of the user terminal. The application may be configured to monitor any information exchange during the NFC interaction and to control an access to the secure element of the SIM card. In some further implementation the application may be arranged to prompt an acceptance from the user if the secure element is to be accessed and in that manner some information, such as the identifier, is retrieved from the secure element of the SIM (Paragraph 0027, Rapanen)].
It would have been obvious to one of ordinary skill in the art before the effective filing date to modify the receiving of a notification that a financial transaction authentication request from a user and the time period of Lim with the causing a prompt to be presented on a mobile device corresponding to the verification identifier of the user of Rapanen and the encrypted payload and multiple parameters of Dua and the completion of the transaction of Dua because doing so allows the authentication of the user as the holder of the contactless card and the completion of the pending transaction to be completed.
Regarding Claim 5. The combination of Lim, Rapanen, Dua and Bishop teaches all of the limitations of Claim 1 above. The combination further teaches:
applying a decryption algorithm to the encrypted authentication payload to obtain the multiple parameters from the encrypted authentication payload usable to authenticate the user. [According to an example of the invention the received identifier from the secure element through the interaction is encrypted. In such a case the server 130 is configured to conclude, e.g. on a basis of format of a request 210 or content of the request 210, that the request comprises an encrypted identifier for a transaction. In response to this the server 130 is configured to decrypt the identifier with a pre-agreed decryption method and thus, on the basis of decrypted identifier information, to retrieve the corresponding payment card number. The described example of the invention increases a security within the system as typically all transaction related information shall be maintained as secret as possible (Paragraph 0032, Rapanen)].
It would have been obvious to one of ordinary skill in the art before the effective filing date to modify the receiving of a notification that a financial transaction authentication request from a user and the time period of Lim with the causing a prompt to be presented on a mobile device corresponding to the verification identifier of the user of Rapanen and the encrypted payload and multiple parameters of Dua and the completion of the transaction of Dua because doing so allows the authentication of the user as the holder of the contactless card and the completion of the pending transaction to be completed.
Regarding Claim 6. The combination of Lim, Rapanen, Dua and Bishop teaches all of the limitations of Claim 5 above. The combination further teaches:
applying a decryption algorithm to the encrypted authentication payload to obtain the multiple parameters from the authentication payload usable to authenticate the user. [According to an example of the invention the received identifier from the secure element through the interaction is encrypted. In such a case the server 130 is configured to conclude, e.g. on a basis of format of a request 210 or content of the request 210, that the request comprises an encrypted identifier for a transaction. In response to this the server 130 is configured to decrypt the identifier with a pre-agreed decryption method and thus, on the basis of decrypted identifier information, to retrieve the corresponding payment card number. The described example of the invention increases a security within the system as typically all transaction related information shall be maintained as secret as possible (Paragraph 0032, Rapanen)].
It would have been obvious to one of ordinary skill in the art before the effective filing date to modify the receiving of a notification that a financial transaction authentication request from a user and the time period of Lim with the causing a prompt to be presented on a mobile device corresponding to the verification identifier of the user of Rapanen and the encrypted payload and multiple parameters of Dua and the completion of the transaction of Dua because doing so allows the authentication of the user as the holder of the contactless card and the completion of the pending transaction to be completed.
Regarding Claim 7. The combination of Lim, Rapanen, Dua and Bishop teaches all of the limitations of Claim 1 above. The combination further teaches:
using one or more of the multiple parameters that include a version number, a unique identifier of the user, an application transaction counter, a one-time password, or a cryptogram usable to validate message integrity, confirm that information related to the user provided by the website is substantially identical to information of the user maintained by the financial institution system. [The established session may initially be used to exchange encryption keys and/or other security information. Subsequent to that, the issuer's system will authenticate the mobile user's identity in real-time to ensure that the person on the receiving end is in fact the person that requested the digital credential. The authentication process can be accomplished by the issuer system prompting the user for some cardholder or accountholder authentication information contained within its system, that only the rightful accountholder would have. The user would see such a request for information within the wallet application screen on the device display. This could include a request for such information such as an existing card account number, card expiration date, cardholder name, mother's maiden name, billing address, social security number, account balance, transaction history, driver's license number, or business identification. The issuer could also request a special code or PIN that was mailed to the user in advance of the issuance as a means to further validate identity and ensure non-repudiation. Some of the input information individually, or a combination of certain input information could be used as a decryption key for a credential that is transmitted to the wireless device. Subsequent to the issuer's system validating the user's identity in real-time, the WCM 510 will transmit the credential to the wallet application (Paragraph 0170, Dua)].
It would have been obvious to one of ordinary skill in the art before the effective filing date to modify the receiving of a notification that a financial transaction authentication request from a user and the time period of Lim with the causing a prompt to be presented on a mobile device corresponding to the verification identifier of the user of Rapanen and the encrypted payload and multiple parameters of Dua and the completion of the transaction of Dua because doing so allows the authentication of the user as the holder of the contactless card and the completion of the pending transaction to be completed.
Regarding Claim 8.
receive, at a financial institution system of a financial institution from a website, a notification that a financial transaction authentication request from a user will be received at the financial institution system […] wherein the notification includes a verification identifier of the user that was input during a transaction session with the website; [A method comprising: receiving, by a wallet server computer from a consumer device, a request to enable a one-tap account addition feature; receiving consumer registration data and consumer payment account data; uploading, by the wallet server computer, consumer device data associated with the consumer device; uploading reader device data of a reader device associated with the consumer device; determining that the reader device is near-field communication capable; storing the consumer registration data, consumer payment account data, and the consumer device data in an electronic wallet associated with a consumer; and enabling, by the wallet server computer, a one-tap add account addition feature for the consumer device (Claim 1, Lim)].
[…] within a predetermined time period of receipt of the notification, […]; [Referring again to FIG. 7, if in step 708 the consumer does not select the one-tap checkout option (in some embodiments, after a predetermined amount of time expires), then the wallet server prompts 726 the consumer to manually authenticate their account to complete checkout, and the process ends. Similarly, if in step 712 the appropriate consumer information is not received within a predetermined time, or if in step 714 the consumer data is not authenticated, then the wallet server prompts 726 the consumer to manually authenticate their account to complete checkout, and the process ends (Paragraph 0042, Lim). If the consumer taps the proximity device onto the proximity reader within the allotted time (i.e., before 20 seconds expires), then in some embodiments an indication is provided to the consumer, such as an audible sound (beep) from the speaker of the consumer's device, that a good read has occurred. The consumer is then presented with the webpage that includes all of the checkout data pre-filled so that the consumer can quickly verify that information and then checkout (pay for the purchase transaction). For example, FIG. 8C is a screen shot of a Checkout webpage of a merchant called “Wintercheck Factory”, showing the results of a successful one-tap checkout process. In particular, fields for a shipping first name 852, shipping last name 854, shipping country 856, shipping address 858, shipping city 860, shipping zip code 862 and shipping phone number 864 have been automatically populated after the consumer has tapped his or her proximity payment device on the proximity reader. Thus, the consumer did not have to manually enter any login credentials (such as a UserID and/or password), and did not have to manually select their payment card account and shipping address on a wallet server website (Paragraph 0046)].
cause a prompt to be presented on a mobile device corresponding to the verification identifier of the user, wherein the presented prompt includes a request for confirmation of a pending transaction via a near-field communication interaction between the mobile device and with a contactless card associated with the financial institution; [The one-tap checkout feature permits a consumer to quickly and accurately checkout from an online merchant website. In some implementations, when the consumer registers for the one-tap account addition service (to enable the one-tap “Add a Card” feature), or when the consumer later adds a proximity payment account, he or she may be prompted to opt-in to a one-tap checkout feature for use when online shopping. If the consumer opts-in, then during checkout from a merchant's website the consumer may select the one-tap checkout option and be prompted to tap his or her proximity payment device on the proximity reader associated with his or her consumer device. When the tap is made, the proximity reader reads data from the proximity payment device and transmits that data to the wallet server which authenticates the consumer. The wallet server then transmits consumer data to the merchant's website which is utilized to automatically populate the checkout webpage with required financial data and/or shipping information. In some implementations, a consumer may associate one-tap checkout with one or more of the payment accounts stored in the consumer's mobile wallet. Thus, the one-tap checkout feature enables the consumer to quickly and easily provide checkout data to a merchant's website by tapping his or her proximity payment device on a proximity reader in accordance with the methods presented herein (Paragraph 0018, Lim)].
Lim does not teach:
receive, in response to a near-field communication interaction responsive to presentation of the presented prompt, a financial transaction authentication request including […] at an authentication web address of the financial institution system as the confirmation of the pending transaction, wherein a portion of the encrypted authentication payload is maintained on the contactless card;
decrypting the encrypted authentication payload;
obtaining […] from the decrypted authentication payload;
Rapanen teaches:
cause a prompt to be presented on a mobile device corresponding to the verification identifier of the user, wherein the presented prompt includes a request for confirmation of a pending transaction via a near-field communication interaction with a contactless card associated with the financial institution; [A method for performing a transaction initiated with near field communication, NFC, interaction between a user terminal including a subscriber identity module residing in the user terminal and a NFC reader. In the method a request including an amount of the transaction and an identifier obtained from a secure element of the subscriber identity module residing in the user terminal is delivered and a payment card number corresponding to the identifier is obtained. Finally, a transaction request is initiated towards a transaction management system and in response to a successful acknowledgment from the transaction management system an acknowledgement on successful transaction is delivered, and in response to an unsuccessful acknowledgement from the transaction management system the transaction request, canceling the transaction (Abstract, Rapanen)].
receive, in response to a near-field communication interaction responsive to presentation of the presented prompt, a financial transaction authentication request including […] at an authentication web address of the financial institution system as the confirmation of the pending transaction, wherein a portion of the encrypted authentication payload is maintained on the contactless card; [According to a third aspect, a system for performing at least partly a transaction is provided wherein the transaction is initiated with near field communication, NFC, interaction. The system comprises a NFC reader configured to interact with a secure element of a subscriber identity module residing in a user terminal in order to obtain an identifier stored in the secure element; a transaction management system for confirming the transaction; and a server communicatively coupled to the NFC reader and to the transaction management system wherein the server is configured to receive a request for the transaction from the NFC reader, the request comprising an amount of the transaction and the identifier obtained from a secure element of the subscriber identity module residing in the user terminal in through the interaction between the user terminal and the NFC reader; obtain a payment card number corresponding to the identifier within the request by initiating a query to data storage accessible to the server, the data storage storing information on at least one identifier and at least one payment card number corresponding to the identifier; initiate a transaction request towards a transaction management system managing transactions with the payment card in question, the transaction request comprising the amount of the transaction and the payment card number; and in response to a successful acknowledgment from the transaction management system to the transaction request, deliver an acknowledgement on successful transaction, and in response to an unsuccessful acknowledgement from the transaction management system to the transaction request, cancel the transaction (Paragraph 0017, Rapanen)].
decrypting the encrypted authentication payload; [According to an example of the invention the received identifier from the secure element through the interaction is encrypted. In such a case the server 130 is configured to conclude, e.g. on a basis of format of a request 210 or content of the request 210, that the request comprises an encrypted identifier for a transaction. In response to this the server 130 is configured to decrypt the identifier with a pre-agreed decryption method and thus, on the basis of decrypted identifier information, to retrieve the corresponding payment card number. The described example of the invention increases a security within the system as typically all transaction related information shall be maintained as secret as possible (Paragraph 0032, Rapanen)].
obtaining […] from the decrypted authentication payload; [According to an example of the invention the received identifier from the secure element through the interaction is encrypted. In such a case the server 130 is configured to conclude, e.g. on a basis of format of a request 210 or content of the request 210, that the request comprises an encrypted identifier for a transaction. In response to this the server 130 is configured to decrypt the identifier with a pre-agreed decryption method and thus, on the basis of decrypted identifier information, to retrieve the corresponding payment card number. The described example of the invention increases a security within the system as typically all transaction related information shall be maintained as secret as possible (Paragraph 0032, Rapanen)].
It would have been obvious to one of ordinary skill in the art before the effective filing date to modify the receiving of a notification that a financial transaction authentication request from a user and the time period of Lim with the causing a prompt to be presented on a mobile device corresponding to the verification identifier of the user of Rapanen because doing so allows the confirmation of a transaction.
The combination of Lim and Rapanen does not teach:
[…] an encrypted authentication payload […]
[…] multiple parameters […]
Dua teaches:
[…] an encrypted authentication payload […] [Depending on the situation, SIP messages between the WCM and the wallet application (contactless card) on the wireless device can carry any supported content types in its payload (e.g. WML, HTML, XHTML, gif, text and others). SIP payload content could include encryption keys, encryption algorithms, forms, user authentication information (e.g. usernames, passwords, PINs, and answers to secret questions), software extensions the issuer wants to register with the wallet application, software updates, electronic credentials, updates to existing credentials, graphics that are part of the credentials, and other such information (Paragraph 0206, Dua)].
[…] multiple parameters […] [The established session may initially be used to exchange encryption keys and/or other security information. Subsequent to that, the issuer's system will authenticate the mobile user's identity in real-time to ensure that the person on the receiving end is in fact the person that requested the digital credential. The authentication process can be accomplished by the issuer system prompting the user for some cardholder or accountholder authentication information contained within its system, that only the rightful accountholder would have. The user would see such a request for information within the wallet application screen on the device display. This could include a request for such information such as an existing card account number, card expiration date, cardholder name, mother's maiden name, billing address, social security number, account balance, transaction history, driver's license number, or business identification. The issuer could also request a special code or PIN that was mailed to the user in advance of the issuance as a means to further validate identity and ensure non-repudiation. Some of the input information individually, or a combination of certain input information could be used as a decryption key for a credential that is transmitted to the wireless device. Subsequent to the issuer's system validating the user's identity in real-time, the WCM 510 will transmit the credential to the wallet application (Paragraph 0170, Dua)].
It would have been obvious to one of ordinary skill in the art before the effective filing date to modify the receiving of a notification that a financial transaction authentication request from a user and the time period of Lim with the causing a prompt to be presented on a mobile device corresponding to the verification identifier of the user of Rapanen and the encrypted payload and multiple parameters of Dua because doing so allows the authentication of the user as the holder of the contactless card.
The combination of Lim, Rapanen, and Dua does not teach:
in response to authenticating the user as the holder of the contactless card, enabling completion of the pending transaction by sending user identifying information to the website.
authenticate, the user as a holder of the contactless card using the application transaction counter to authenticate other ones of the multiple parameters; and
Bishop teaches:
in response to authenticating the user as the holder of the contactless card, enabling completion of the pending transaction by sending user identifying information to the website. [It should be noted that completion of a transaction may be performed under any business as usual standard employed by the merchant and/or issuer system 230. For example, merchant server 222 may be configured to communicate transaction data to the appropriate issuer system 230, in real-time or substantially real-time, or by using batch processing at the end of each day. Any suitable means for delivering the transaction data to issuer systems 230 may be used. In one exemplary embodiment of the present invention, the transaction data may be delivered to issuer system 230 via a network 260. Issuer system 230 may receive the transaction information and process the transaction under issuer defined protocol independent of any other protocol used by other issuers to process a transaction. Issuer system 230 may receive the transaction data and provide the merchant with the appropriate satisfaction for the transaction (Paragraph 0149, Bishop)].
authenticate, the user as a holder of the contactless card using the application transaction counter to authenticate other ones of the multiple parameters; and [In another embodiment, the non-traditional device may be configured with an RF protocol, such as a protocol in ISO 14443 format or according to Near Field Communication (NFC) formats. In another embodiment, the non-traditional device may be configured to directly communicate with an acquirer/issuer or payment processor to complete payment. For example, the non-traditional device may be a cellular telephone that communicates directly to an acquirer/issuer or payment processor. A typical cellular telephone is already equipped with a microphone, a processor to process authentication using a voice print, and a communication line connecting the cellular telephone directly to an acquirer/issuer. In another embodiment, the non-traditional device may be configured to facilitate transactions using a random number, an authentication tag, a counter, or an encrypted payload. In yet another embodiment, the non-traditional device may not be an RF operable device and may facilitate a payment transaction through voice verification and direct communication between a merchant point of sale device and a voice verification system (Paragraph 0007, Bishop)].
It would have been obvious to one of ordinary skill in the art before the effective filing date to modify the receiving of a notification that a financial transaction authentication request from a user and the time period of Lim with the causing a prompt to be presented on a mobile device corresponding to the verification identifier of the user of Rapanen and the encrypted payload and multiple parameters of Dua and the completion of the transaction of Dua because doing so allows the authentication of the user as the holder of the contactless card and the completion of the pending transaction to be completed.
Regarding Claim 9. The combination of Lim, Rapanen, Dua and Bishop teaches all of the limitations of Claim 8 above. The combination further teaches:
The computer-readable storage medium of claim 8, wherein the instructions further cause the processor to: after expiration of the predetermined time period, receive a hyperlink corresponding to the transaction session which was deactivated by the website after the expiration of the predetermined time period; maintain, temporarily, the hyperlink in a data storage in association with information related to the user; and in response to a further notification from the website regarding the user, use the hyperlink to reactivate the transaction session at the website. [If the consumer taps the proximity device that he or she wishes to add to the mobile wallet onto the proximity reader within the allotted time (i.e., before 20 seconds expires), then in some embodiments an indication is provided, such as an audible sound (beep) from the speaker of the consumer's device, that a good read has occurred. The consumer is then presented with the webpage 650 shown in FIG. 6C. In this example, as shown by the webpage 650, information has been automatically populated or filled in, based on the data read by the proximity reader and transmitted by the consumer device to the wallet server, for the data entry fields including the name on card field 604, card number field 606 and the expiration date fields 608. In some embodiments, the card data including the security code will be provided by the device authentication server upon proximity device authentication, and will be pre-populated in an un-editable manner and/or in a suppressed or inactive manner. In addition, in some implementations the card nickname field 602, billing address field 612, and residence address fields 614 must be manually filled in by the consumer. However, in other embodiments, these fields would also be automatically filled in based on information previously supplied by the consumer, or based on card account data read from the proximity payment card that is to be added to the mobile wallet (Paragraph 0039, Lim)].
Regarding Claim 10. The combination of Lim, Rapanen, Dua and Bishop teaches all of the limitations of Claim 8 above. The combination further teaches:
The computer-readable storage medium of claim 8, wherein when generating the prompt for presentation on the mobile device corresponding to the verification identifier of the user, the instructions further cause the processor to: populate a message with instructions executable by the mobile device that causes the mobile device to initiate a near-field communication read of the contactless card and with a hyperlink to the authentication web address of the financial institution system; and forward the message to the mobile device corresponding to the verification identifier of the user, wherein the message may be formatted as a short message service message, a multimedia messaging service message, or as a financial institution in-application notification. [The wallet server then transmits consumer data to the merchant's website which is utilized to automatically populate the checkout webpage with required financial data and/or shipping information. In some implementations, a consumer may associate one-tap checkout with one or more of the payment accounts stored in the consumer's mobile wallet. Thus, the one-tap checkout feature enables the consumer to quickly and easily provide checkout data to a merchant's website by tapping his or her proximity payment device on a proximity reader in accordance with the methods presented herein (Paragraph 0018, Lim)].
Regarding Claim 11. The combination of Lim, Rapanen, Dua and Bishop teaches all of the limitations of Claim 8 above. The combination further teaches:
The computer-readable storage medium of claim 8, wherein the instructions further cause the processor to: forward instructions to the mobile device operable to initiate a background read of the contactless card by a near-field communication device of the mobile device. [Furthermore, the NFC reader 120 is coupled to a backbone system 125 and thus arranged to communicate with a server 130 through the backbone system 125. The backbone system may be, but is not limited to, a payment system comprising a server and necessary data storage as well as cash register devices 127. The backbone system, i.e. the payment system, is configured to be used when a transaction between the buyer and seller is done, wherein the initiation of payment is performed through the NFC technology with the user terminal 110. The backbone system may exchange of information with the server 130. The backbone system may either deliver pieces of information relating to a transaction in separate messages to the server 130 or combine multiple pieces of information and deliver those in one message to the server 130 (Paragraph 0025, Rapanen)].
It would have been obvious to one of ordinary skill in the art before the effective filing date to modify the receiving of a notification that a financial transaction authentication request from a user and the time period of Lim with the causing a prompt to be presented on a mobile device corresponding to the verification identifier of the user of Rapanen and the encrypted payload and multiple parameters of Dua and the completion of the transaction of Dua because doing so allows the authentication of the user as the holder of the contactless card and the completion of the pending transaction to be completed.
Regarding Claim 12. The combination of Lim, Rapanen, Dua and Bishop teaches all of the limitations of Claim 8 above. The combination further teaches:
The computer-readable storage medium of claim 8, wherein when decrypting the encrypted authentication payload, the instructions further cause the processor to: apply a decryption algorithm to the encrypted authentication payload to obtain the multiple parameters from the encrypted authentication payload usable to authenticate the user. [According to an example of the invention the received identifier from the secure element through the interaction is encrypted. In such a case the server 130 is configured to conclude, e.g. on a basis of format of a request 210 or content of the request 210, that the request comprises an encrypted identifier for a transaction. In response to this the server 130 is configured to decrypt the identifier with a pre-agreed decryption method and thus, on the basis of decrypted identifier information, to retrieve the corresponding payment card number. The described example of the invention increases a security within the system as typically all transaction related information shall be maintained as secret as possible (Paragraph 0032, Rapanen)].
It would have been obvious to one of ordinary skill in the art before the effective filing date to modify the receiving of a notification that a financial transaction authentication request from a user and the time period of Lim with the causing a prompt to be presented on a mobile device corresponding to the verification identifier of the user of Rapanen and the encrypted payload and multiple parameters of Dua and the completion of the transaction of Dua because doing so allows the authentication of the user as the holder of the contactless card and the completion of the pending transaction to be completed.
Regarding Claim 13. The combination of Lim, Rapanen, Dua and Bishop teaches all of the limitations of Claim 12 above. The combination further teaches:
The computer-readable storage medium of claim 12, wherein when decrypting the encrypted authentication payload, the instructions further cause the processor to: obtain a version number, a unique identifier of the user, a one-time password, or a cryptogram usable to validate message integrity as the other ones of the multiple parameters in the encrypted authentication payload. [According to an example of the invention the received identifier from the secure element through the interaction is encrypted. In such a case the server 130 is configured to conclude, e.g. on a basis of format of a request 210 or content of the request 210, that the request comprises an encrypted identifier for a transaction. In response to this the server 130 is configured to decrypt the identifier with a pre-agreed decryption method and thus, on the basis of decrypted identifier information, to retrieve the corresponding payment card number. The described example of the invention increases a security within the system as typically all transaction related information shall be maintained as secret as possible (Paragraph 0032, Rapanen)].
It would have been obvious to one of ordinary skill in the art before the effective filing date to modify the receiving of a notification that a financial transaction authentication request from a user and the time period of Lim with the causing a prompt to be presented on a mobile device corresponding to the verification identifier of the user of Rapanen and the encrypted payload and multiple parameters of Dua and the completion of the transaction of Dua because doing so allows the authentication of the user as the holder of the contactless card and the completion of the pending transaction to be completed.
Regarding Claim 14. The combination of Lim, Rapanen, Dua and Bishop teaches all of the limitations of Claim 8 above. The combination further teaches:
The computer-readable storage medium of claim 8, wherein when authenticating the user as the holder of the contactless card, the instructions further cause the processor to: confirm, by using the application transaction counter to authenticate the other ones of the multiple parameters that include a version number, a unique identifier of the user, a one-time password, or a cryptogram usable to validate message integrity, that information related to the user provided by the website is substantially identical to information of the user maintained by the financial institution system. [The established session may initially be used to exchange encryption keys and/or other security information. Subsequent to that, the issuer's system will authenticate the mobile user's identity in real-time to ensure that the person on the receiving end is in fact the person that requested the digital credential. The authentication process can be accomplished by the issuer system prompting the user for some cardholder or accountholder authentication information contained within its system, that only the rightful accountholder would have. The user would see such a request for information within the wallet application screen on the device display. This could include a request for such information such as an existing card account number, card expiration date, cardholder name, mother's maiden name, billing address, social security number, account balance, transaction history, driver's license number, or business identification. The issuer could also request a special code or PIN that was mailed to the user in advance of the issuance as a means to further validate identity and ensure non-repudiation. Some of the input information individually, or a combination of certain input information could be used as a decryption key for a credential that is transmitted to the wireless device. Subsequent to the issuer's system validating the user's identity in real-time, the WCM 510 will transmit the credential to the wallet application (Paragraph 0170, Dua)].
It would have been obvious to one of ordinary skill in the art before the effective filing date to modify the receiving of a notification that a financial transaction authentication request from a user and the time period of Lim with the causing a prompt to be presented on a mobile device corresponding to the verification identifier of the user of Rapanen and the encrypted payload and multiple parameters of Dua and the completion of the transaction of Dua because doing so allows the authentication of the user as the holder of the contactless card and the completion of the pending transaction to be completed.
Regarding Claim 15.
receive a notification that a financial transaction authentication request from a user will be received at the financial institution system […] wherein the notification includes a verification identifier of the user that was input during a transaction session with a website for a pending transaction; [A method comprising: receiving, by a wallet server computer from a consumer device, a request to enable a one-tap account addition feature; receiving consumer registration data and consumer payment account data; uploading, by the wallet server computer, consumer device data associated with the consumer device; uploading reader device data of a reader device associated with the consumer device; determining that the reader device is near-field communication capable; storing the consumer registration data, consumer payment account data, and the consumer device data in an electronic wallet associated with a consumer; and enabling, by the wallet server computer, a one-tap add account addition feature for the consumer device (Claim 1, Lim)].
[…] within a predetermined time period of receipt of the notification, […];[Referring again to FIG. 7, if in step 708 the consumer does not select the one-tap checkout option (in some embodiments, after a predetermined amount of time expires), then the wallet server prompts 726 the consumer to manually authenticate their account to complete checkout, and the process ends. Similarly, if in step 712 the appropriate consumer information is not received within a predetermined time, or if in step 714 the consumer data is not authenticated, then the wallet server prompts 726 the consumer to manually authenticate their account to complete checkout, and the process ends (Paragraph 0042, Lim). If the consumer taps the proximity device onto the proximity reader within the allotted time (i.e., before 20 seconds expires), then in some embodiments an indication is provided to the consumer, such as an audible sound (beep) from the speaker of the consumer's device, that a good read has occurred. The consumer is then presented with the webpage that includes all of the checkout data pre-filled so that the consumer can quickly verify that information and then checkout (pay for the purchase transaction). For example, FIG. 8C is a screen shot of a Checkout webpage of a merchant called “Wintercheck Factory”, showing the results of a successful one-tap checkout process. In particular, fields for a shipping first name 852, shipping last name 854, shipping country 856, shipping address 858, shipping city 860, shipping zip code 862 and shipping phone number 864 have been automatically populated after the consumer has tapped his or her proximity payment device on the proximity reader. Thus, the consumer did not have to manually enter any login credentials (such as a UserID and/or password), and did not have to manually select their payment card account and shipping address on a wallet server website (Paragraph 0046)].
Lim does not teach:
generate for presentation on a mobile device corresponding to the verification identifier of the user, a prompt that includes a request for confirmation of a pending transaction via a near-field communication interaction between the mobile device and with a contactless card associated with a financial institution system;
receive, in response to a near-field communication interaction responsive to presentation of the presented prompt, a financial transaction authentication request including […] at an authentication web address of the financial institution system as the confirmation of the pending transaction, wherein a portion of the encrypted authentication payload is maintained on the contactless card;
decrypting the encrypted authentication payload;
obtaining […] from the decrypted authentication payload as decrypted, wherein one of the multiple parameters is an application transaction counter;
Rapanen teaches:
generate for presentation on a mobile device corresponding to the verification identifier of the user, a prompt that includes a request for confirmation of a pending transaction via a near-field communication interaction between a mobile device and with a contactless card associated with a financial institution system; [A method for performing a transaction initiated with near field communication, NFC, interaction between a user terminal including a subscriber identity module residing in the user terminal and a NFC reader. In the method a request including an amount of the transaction and an identifier obtained from a secure element of the subscriber identity module residing in the user terminal is delivered and a payment card number corresponding to the identifier is obtained. Finally, a transaction request is initiated towards a transaction management system and in response to a successful acknowledgment from the transaction management system an acknowledgement on successful transaction is delivered, and in response to an unsuccessful acknowledgement from the transaction management system the transaction request, canceling the transaction (Abstract, Rapanen)].
receive, in response to the near-field communication interaction responsive to presentation of the prompt presented, a financial transaction authentication request including […] at an authentication web address of the financial institution system as the confirmation of the pending transaction, wherein a portion of the encrypted authentication payload is maintained on the contactless card; [According to a third aspect, a system for performing at least partly a transaction is provided wherein the transaction is initiated with near field communication, NFC, interaction. The system comprises a NFC reader configured to interact with a secure element of a subscriber identity module residing in a user terminal in order to obtain an identifier stored in the secure element; a transaction management system for confirming the transaction; and a server communicatively coupled to the NFC reader and to the transaction management system wherein the server is configured to receive a request for the transaction from the NFC reader, the request comprising an amount of the transaction and the identifier obtained from a secure element of the subscriber identity module residing in the user terminal in through the interaction between the user terminal and the NFC reader; obtain a payment card number corresponding to the identifier within the request by initiating a query to data storage accessible to the server, the data storage storing information on at least one identifier and at least one payment card number corresponding to the identifier; initiate a transaction request towards a transaction management system managing transactions with the payment card in question, the transaction request comprising the amount of the transaction and the payment card number; and in response to a successful acknowledgment from the transaction management system to the transaction request, deliver an acknowledgement on successful transaction, and in response to an unsuccessful acknowledgement from the transaction management system to the transaction request, cancel the transaction (Paragraph 0017, Rapanen)].
decrypt the encrypted authentication payload; [According to an example of the invention the received identifier from the secure element through the interaction is encrypted. In such a case the server 130 is configured to conclude, e.g. on a basis of format of a request 210 or content of the request 210, that the request comprises an encrypted identifier for a transaction. In response to this the server 130 is configured to decrypt the identifier with a pre-agreed decryption method and thus, on the basis of decrypted identifier information, to retrieve the corresponding payment card number. The described example of the invention increases a security within the system as typically all transaction related information shall be maintained as secret as possible (Paragraph 0032, Rapanen)].
obtaining […] from the encrypted authentication payload as decrypted, wherein one of the multiple parameters is an application transaction counter; [According to an example of the invention the received identifier from the secure element through the interaction is encrypted. In such a case the server 130 is configured to conclude, e.g. on a basis of format of a request 210 or content of the request 210, that the request comprises an encrypted identifier for a transaction. In response to this the server 130 is configured to decrypt the identifier with a pre-agreed decryption method and thus, on the basis of decrypted identifier information, to retrieve the corresponding payment card number. The described example of the invention increases a security within the system as typically all transaction related information shall be maintained as secret as possible (Paragraph 0032, Rapanen)].
It would have been obvious to one of ordinary skill in the art before the effective filing date to modify the receiving of a notification that a financial transaction authentication request from a user Lim with the causing a prompt to be presented on a mobile device corresponding to the verification identifier of the user of Rapanen because doing so allows the confirmation of a transaction.
The combination of Lim and Rapanen does not teach:
[…] an encrypted authentication payload […]
[…] multiple parameters […]
Dua teaches:
[…] an encrypted authentication payload […] [Depending on the situation, SIP messages between the WCM and the wallet application (contactless card) on the wireless device can carry any supported content types in its payload (e.g. WML, HTML, XHTML, gif, text and others). SIP payload content could include encryption keys, encryption algorithms, forms, user authentication information (e.g. usernames, passwords, PINs, and answers to secret questions), software extensions the issuer wants to register with the wallet application, software updates, electronic credentials, updates to existing credentials, graphics that are part of the credentials, and other such information (Paragraph 0206, Dua)].
[…] multiple parameters […] [The established session may initially be used to exchange encryption keys and/or other security information. Subsequent to that, the issuer's system will authenticate the mobile user's identity in real-time to ensure that the person on the receiving end is in fact the person that requested the digital credential. The authentication process can be accomplished by the issuer system prompting the user for some cardholder or accountholder authentication information contained within its system, that only the rightful accountholder would have. The user would see such a request for information within the wallet application screen on the device display. This could include a request for such information such as an existing card account number, card expiration date, cardholder name, mother's maiden name, billing address, social security number, account balance, transaction history, driver's license number, or business identification. The issuer could also request a special code or PIN that was mailed to the user in advance of the issuance as a means to further validate identity and ensure non-repudiation. Some of the input information individually, or a combination of certain input information could be used as a decryption key for a credential that is transmitted to the wireless device. Subsequent to the issuer's system validating the user's identity in real-time, the WCM 510 will transmit the credential to the wallet application (Paragraph 0170, Dua)].
It would have been obvious to one of ordinary skill in the art before the effective filing date to modify the receiving of a notification that a financial transaction authentication request from a user of Lim with the causing a prompt to be presented on a mobile device corresponding to the verification identifier of the user of Rapanen and the encrypted payload and multiple parameters of Dua because doing so allows the authentication of the user as the holder of the contactless card.
The combination of Lim, Rapanen, and Dua does not teach:
in response to authenticating the user as the holder of the contactless card, enabling completion of the pending transaction by sending user identifying information to the website.
authenticate, the user as a holder of the contactless card using the application transaction counter to authenticate other ones of the multiple parameters; and
Bishop teaches:
in response to authenticating the user as the holder of the contactless card, enabling completion of the pending transaction by sending user identifying information to the website. [It should be noted that completion of a transaction may be performed under any business as usual standard employed by the merchant and/or issuer system 230. For example, merchant server 222 may be configured to communicate transaction data to the appropriate issuer system 230, in real-time or substantially real-time, or by using batch processing at the end of each day. Any suitable means for delivering the transaction data to issuer systems 230 may be used. In one exemplary embodiment of the present invention, the transaction data may be delivered to issuer system 230 via a network 260. Issuer system 230 may receive the transaction information and process the transaction under issuer defined protocol independent of any other protocol used by other issuers to process a transaction. Issuer system 230 may receive the transaction data and provide the merchant with the appropriate satisfaction for the transaction (Paragraph 0149, Bishop)].
authenticate, the user as a holder of the contactless card using the application transaction counter to authenticate other ones of the multiple parameters; and [The system 300 also includes a wallet server 308 that may be connected to one or more database(s) 310, and may be configured for secure communication via a dedicated communications channel 309 with a device authentication server computer 314. In some embodiments, the device authentication server 314 may be designed and operated by a third party provider, such as the SecureKey Technologies Incorporated company of Toronto, Canada, and may function to authenticate consumer devices. Also depicted are merchant servers 316 which are operably connected to the Internet 310. The merchant servers may be connected via a private network (not shown) to a gateway server 318, which is operably connected to a payment network 320. The wallet server computer 308, device authentication server computer 314 and merchant server computers 316 are all configured for communications via the Internet 310 with each other (and may also be configured for communication with other devices). The merchant server computers 316 may function to provide access to consumers to various shopping websites, and may also be configured to obtain payment transaction credentials and forward them for processing via the gateway server 318 to the payment network 320. It should be understood that a plurality of merchant servers 316 can be connected via the Internet to the gateway server 318 and payment network 320. In addition, other network configurations may be utilized that, for example, include a plurality of gateway servers, payment networks and/or wallet servers that are capable of operating in accordance with processes described herein (Paragraph 0026, Lim)].
It would have been obvious to one of ordinary skill in the art before the effective filing date to modify the receiving of a notification that a financial transaction authentication request from a user of Lim with the causing a prompt to be presented on a mobile device corresponding to the verification identifier of the user of Rapanen and the encrypted payload and multiple parameters of Dua and the completion of the transaction of Dua because doing so allows the authentication of the user as the holder of the contactless card and the completion of the pending transaction to be completed.
Regarding Claim 16. The combination of Lim, Rapanen, Dua and Bishop teaches all of the limitations of Claim 15 above. The combination further teaches:
The computing apparatus of claim 15, wherein the instructions further configure the computing apparatus to: after expiration of the predetermined time period, receive a hyperlink corresponding to the transaction session which was deactivated by the website after the expiration of the predetermined time period; maintain, temporarily, the hyperlink in a data storage in association with information related to the user; and in response to a further notification from the website regarding the user, using the hyperlink to reactivating the transaction session at the website. [The system 300 also includes a wallet server 308 that may be connected to one or more database(s) 310, and may be configured for secure communication via a dedicated communications channel 309 with a device authentication server computer 314. In some embodiments, the device authentication server 314 may be designed and operated by a third party provider, such as the SecureKey Technologies Incorporated company of Toronto, Canada, and may function to authenticate consumer devices. Also depicted are merchant servers 316 which are operably connected to the Internet 310. The merchant servers may be connected via a private network (not shown) to a gateway server 318, which is operably connected to a payment network 320. The wallet server computer 308, device authentication server computer 314 and merchant server computers 316 are all configured for communications via the Internet 310 with each other (and may also be configured for communication with other devices). The merchant server computers 316 may function to provide access to consumers to various shopping websites, and may also be configured to obtain payment transaction credentials and forward them for processing via the gateway server 318 to the payment network 320. It should be understood that a plurality of merchant servers 316 can be connected via the Internet to the gateway server 318 and payment network 320. In addition, other network configurations may be utilized that, for example, include a plurality of gateway servers, payment networks and/or wallet servers that are capable of operating in accordance with processes described herein (Paragraph 0026, Lim)].
Regarding Claim 17. The combination of Lim, Rapanen, Dua and Bishop teaches all of the limitations of Claim 15 above. The combination further teaches:
wherein when generating the prompt for presentation on the mobile device corresponding to the verification identifier of the user, the instructions further configure the computing apparatus to: the computing apparatus of claim 15: populate a message with instructions executable by the mobile device that causes the mobile device to initiate a near-field communication read of the contactless card and with a hyperlink to the authentication web address of the financial institution; and forward the message to the mobile device corresponding to the verification identifier of the user, wherein the message may be formatted as a short message service message, a multimedia messaging service message, or as a financial institution in-application notification. [Referring again to FIG. 5, the wallet server then receives 516 a consumer device identifier and device capabilities (including near field communication (NFC) capability) of the consumer device. If the consumer device includes an associated proximity reader that is capable of reading a proximity device, then the user is presented with a webpage (discussed below with regard to FIG. 6A) that includes a “Tap to Add” payment device option that may be selected by the consumer. If the consumer selects this option, the device authentication server may push a tap request to the reader device associated with the consumer device, which then operates to prompt the consumer to tap his or her proximity payment device on the proximity reader. The proximity reader then reads a tap and transmits contactless payment account data via the consumer device to the wallet server website, and thus the wallet server next receives 518 the payment account data and performs 520 contactless device verification and then stores the data in the mobile wallet. In some embodiments, the wallet server may be configured for communicating with issuer financial institution server computers to authenticate contactless payment device credentials, for example the MasterCard™ contactless payment service may be utilized to authenticate PayPass™ payment card credentials (Paragraph 0035, Lim)].
Regarding Claim 18. The combination of Lim, Rapanen, Dua and Bishop teaches all of the limitations of Claim 15 above. The combination further teaches:
The computing apparatus of claim 15, wherein the instructions further configure the computing apparatus to: forward instructions to the mobile device to initiate a background read of the contactless card by a near-field communication device of the mobile device. [Furthermore, the NFC reader 120 is coupled to a backbone system 125 and thus arranged to communicate with a server 130 through the backbone system 125. The backbone system may be, but is not limited to, a payment system comprising a server and necessary data storage as well as cash register devices 127. The backbone system, i.e. the payment system, is configured to be used when a transaction between the buyer and seller is done, wherein the initiation of payment is performed through the NFC technology with the user terminal 110. The backbone system may exchange of information with the server 130. The backbone system may either deliver pieces of information relating to a transaction in separate messages to the server 130 or combine multiple pieces of information and deliver those in one message to the server 130 (Paragraph 0025, Rapanen)].
It would have been obvious to one of ordinary skill in the art before the effective filing date to modify the receiving of a notification that a financial transaction authentication request from a user and the time period of Lim with the causing a prompt to be presented on a mobile device corresponding to the verification identifier of the user of Rapanen and the encrypted payload and multiple parameters of Dua and the completion of the transaction of Dua because doing so allows the authentication of the user as the holder of the contactless card and the completion of the pending transaction to be completed.
Regarding Claim 19. The combination of Lim, Rapanen, Dua and Bishop teaches all of the limitations of Claim 15 above. The combination further teaches:
The computing apparatus of claim 15, wherein when decrypting the encrypted authentication payload, the instructions further configure the computing apparatus to: apply a decryption algorithm to the encrypted authentication payload to obtain the multiple parameters from the encrypted authentication payload usable to authenticate the user. [According to an example of the invention the received identifier from the secure element through the interaction is encrypted. In such a case the server 130 is configured to conclude, e.g. on a basis of format of a request 210 or content of the request 210, that the request comprises an encrypted identifier for a transaction. In response to this the server 130 is configured to decrypt the identifier with a pre-agreed decryption method and thus, on the basis of decrypted identifier information, to retrieve the corresponding payment card number. The described example of the invention increases a security within the system as typically all transaction related information shall be maintained as secret as possible (Paragraph 0032, Rapanen)].
It would have been obvious to one of ordinary skill in the art before the effective filing date to modify the receiving of a notification that a financial transaction authentication request from a user and the time period of Lim with the causing a prompt to be presented on a mobile device corresponding to the verification identifier of the user of Rapanen and the encrypted payload and multiple parameters of Dua and the completion of the transaction of Dua because doing so allows the authentication of the user as the holder of the contactless card and the completion of the pending transaction to be completed.
Regarding Claim 20. The combination of Lim, Rapanen, Dua and Bishop teaches all of the limitations of Claim 19 above. The combination further teaches:
The computing apparatus of claim 19, wherein the other ones of the multiple parameters in the encrypted authentication payload include a version number, a unique identifier of the user a one-time password, or a cryptogram usable to validate message integrity. [The established session may initially be used to exchange encryption keys and/or other security information. Subsequent to that, the issuer's system will authenticate the mobile user's identity in real-time to ensure that the person on the receiving end is in fact the person that requested the digital credential. The authentication process can be accomplished by the issuer system prompting the user for some cardholder or accountholder authentication information contained within its system, that only the rightful accountholder would have. The user would see such a request for information within the wallet application screen on the device display. This could include a request for such information such as an existing card account number, card expiration date, cardholder name, mother's maiden name, billing address, social security number, account balance, transaction history, driver's license number, or business identification. The issuer could also request a special code or PIN that was mailed to the user in advance of the issuance as a means to further validate identity and ensure non-repudiation. Some of the input information individually, or a combination of certain input information could be used as a decryption key for a credential that is transmitted to the wireless device. Subsequent to the issuer's system validating the user's identity in real-time, the WCM 510 will transmit the credential to the wallet application (Paragraph 0170, Dua)].
It would have been obvious to one of ordinary skill in the art before the effective filing date to modify the receiving of a notification that a financial transaction authentication request from a user and the time period of Lim with the causing a prompt to be presented on a mobile device corresponding to the verification identifier of the user of Rapanen and the encrypted payload and multiple parameters of Dua and the completion of the transaction of Dua because doing so allows the authentication of the user as the holder of the contactless card and the completion of the pending transaction to be completed.
Regarding Claim 21. The combination of Lim, Rapanen, Dua and Bishop teaches all of the limitations of Claim 1 above. The combination further teaches:
The method of claim 1, wherein the link generated by the contactless card includes a uniform resource locator (URL) directed to an authentication web address. The system comprises a NFC reader configured to interact with a secure element of a subscriber identity module residing in a user terminal in order to obtain an identifier stored in the secure element; a transaction management system for confirming the transaction; and a server communicatively coupled to the NFC reader and to the transaction management system wherein the server is configured to receive a request for the transaction from the NFC reader, the request comprising an amount of the transaction and the identifier obtained from a secure element of the subscriber identity module residing in the user terminal in through the interaction between the user terminal and the NFC reader; obtain a payment card number corresponding to the identifier within the request by initiating a query to data storage accessible to the server, the data storage storing information on at least one identifier and at least one payment card number corresponding to the identifier; initiate a transaction request towards a transaction management system managing transactions with the payment card in question, the transaction request comprising the amount of the transaction and the payment card number; and in response to a successful acknowledgment from the transaction management system to the transaction request, deliver an acknowledgement on successful transaction, and in response to an unsuccessful acknowledgement from the transaction management system to the transaction request, cancel the transaction (Paragraph 0017, Rapanen). The NFC reader 120 is configured to deliver the retrieved identifier to the backbone system 125…request message arranged to be delivered to the server 125 (¶ 0028)].
It would have been obvious to one of ordinary skill in the art before the effective filing date to modify the receiving of a notification that a financial transaction authentication request from a user and the time period of Lim with the causing a prompt to be presented on a mobile device corresponding to the verification identifier of the user of Rapanen and the encrypted payload and multiple parameters of Dua and the completion of the transaction of Dua because doing so allows the authentication of the user as the holder of the contactless card and the completion of the pending transaction to be completed.
Regarding Claim 22. The combination of Lim, Rapanen, Dua and Bishop teaches all of the limitations of Claim 1 above. The combination further teaches:
The method of claim 21, wherein the URL generated by the contactless card comprises the encrypted authentication payload. [The system comprises a NFC reader configured to interact with a secure element of a subscriber identity module residing in a user terminal in order to obtain an identifier stored in the secure element; a transaction management system for confirming the transaction; and a server communicatively coupled to the NFC reader and to the transaction management system wherein the server is configured to receive a request for the transaction from the NFC reader, the request comprising an amount of the transaction and the identifier obtained from a secure element of the subscriber identity module residing in the user terminal in through the interaction between the user terminal and the NFC reader; obtain a payment card number corresponding to the identifier within the request by initiating a query to data storage accessible to the server, the data storage storing information on at least one identifier and at least one payment card number corresponding to the identifier; initiate a transaction request towards a transaction management system managing transactions with the payment card in question, the transaction request comprising the amount of the transaction and the payment card number; and in response to a successful acknowledgment from the transaction management system to the transaction request, deliver an acknowledgement on successful transaction, and in response to an unsuccessful acknowledgement from the transaction management system to the transaction request, cancel the transaction (Paragraph 0017, Rapanen). The NFC reader 120 is configured to deliver the retrieved identifier to the backbone system 125…request message arranged to be delivered to the server 125 (¶ 0028)].
It would have been obvious to one of ordinary skill in the art before the effective filing date to modify the receiving of a notification that a financial transaction authentication request from a user and the time period of Lim with the causing a prompt to be presented on a mobile device corresponding to the verification identifier of the user of Rapanen and the encrypted payload and multiple parameters of Dua and the completion of the transaction of Dua because doing so allows the authentication of the user as the holder of the contactless card and the completion of the pending transaction to be completed.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant’s disclosure.
Das et al. (US20100146263A1)
The invention relates to a method of authentication for a provider comprising requesting a verification system for authentication of a transaction initiated by a user by transmitting to the verification system details of the transaction initiated; requesting the user to authenticate the transaction on a mobile device by transmitting to the user mobile device details of the transaction; validating the authentication request received from the verification system on the mobile device and prompting the user to enter a personal identification number, displaying to the user transaction details on receiving a valid personal identification number and requesting user to authenticate transaction; generating on receiving user authentication an authentication parameter for transmission to the verification system; and authenticating the transaction to the provider on receiving a valid authentication parameter from user mobile device.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to CHRISTINA C STEVENSON whose telephone number is (571)270-7280 and whose email is christina.mention@uspto.gov. The examiner can normally be reached M-F 8am-5pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Patrick McAtee can be reached on (571) 272-7575. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/C.C.S./Examiner, Art Unit 3698
/PATRICK MCATEE/Supervisory Patent Examiner, Art Unit 3698