公开(公告)号：US20140351145A1

公开(公告)日：2014-11-27

申请号：US14455130

申请日：2014-08-08

Applicant: EBAY INC.

Inventor： Attaullah Baig

IPC: G06Q20/40 ,  G06Q20/32 ,  G06Q20/38 ,  G06Q20/20

CPC classification number: G06Q20/4012 ,  G06Q20/20 ,  G06Q20/206 ,  G06Q20/322 ,  G06Q20/3829 ,  G07F7/1075 ,  H04L9/0825 ,  H04L9/3226 ,  H04L63/083 ,  H04L2209/56

Abstract: A key is securely injected into a POS PIN pad processor in its usual operating environment. In response to entry of a personal identification number (PIN) into a PIN pad, the processor puts the PIN into a PIN block; puts additional random data into the PIN block; and encrypts the entire PIN block using asymmetric cryptography with a public key derived from the injected key residing in the PIN pad processor. The corresponding private key may be held securely and secretly by an acquirer processor for decrypting the PIN block to retrieve the PIN. The encrypted random data defends the PIN against dictionary attacks. Time stamp data and constant data encrypted with the PIN block enables a defense of the PIN against replay attacks and tampering. The method may also include accepting the PIN from a mobile phone in communication with the processor.

Abstract translation: 在其通常的操作环境中，密钥可靠地注入POS PIN垫处理器。 响应于将个人识别号码（PIN）输入到PIN垫中，处理器将PIN放入PIN块中; 将额外的随机数据放入PIN块; 并且使用具有从驻留在PIN贴片处理器中的注入键导出的公开密钥的非对称加密来加密整个PIN块。 相应的私钥可以被获取者处理器安全地和秘密地保存，用于解密PIN块以检索PIN。 加密的随机数据保护PIN免受字典攻击。 使用PIN块加密的时间戳数据和常量数据可以防止PIN对重放攻击和篡改。 该方法还可以包括从与处理器通信的移动电话接受PIN。

公开(公告)号：US20140258010A1

公开(公告)日：2014-09-11

申请号：US13904910

申请日：2013-05-29

Applicant: EBAY INC.

Inventor： Upendra Mardikar ,  Attaullah Baig

IPC: G06Q20/20

CPC classification number: G06Q20/202

Abstract: A user who is authorizing a delegate to make a purchase using funds from an account of the user sends information to a payment provider. The information includes a picture of the delegate, along with information such as a merchant name, a maximum amount, a type of purchase, item information, and/or any other transaction limitations/restrictions. The payment provider then transmits this information to the merchant. A one-time code or number may be communicated to the delegate. When the delegate is ready to make a payment with the user account, the delegate gives the delegate's name and/or other identifying information to the merchant, along with the payment code. The merchant enters the information and is shown a picture of the delegate. If there is a match, the payment may be submitted for processing. In one embodiment, a photo of the delegate may be taken by the merchant and the image transmitted to the user. The user may then be requested to confirm the delegate as an authorized delegate.

Abstract translation: 授权代表使用来自用户的帐户的资金进行购买的用户将信息发送给支付提供商。 信息包括代表的图片，以及诸如商家名称，最大数量，购买类型，项目信息和/或任何其他交易限制/限制的信息。 然后，支付提供商将该信息发送给商家。 一次性代码或号码可能会传达给代表。 代表准备使用用户帐户进行付款时，委托人将代理人的姓名和/或其他身份信息与付款代码一起提供给商家。 商家输入信息，并显示代表的图片。 如果有比赛，付款可能会被提交处理。 在一个实施例中，委托人的照片可以由商家和发送给用户的图像拍摄。 然后可以请求用户将代理确认为授权代表。