Induction based transactions at a moble device with authentication

What is this patent about?

'771 is related to the field of secure mobile transactions, specifically using Near Field Communication (NFC). The background involves the increasing use of mobile devices for payments, which raises concerns about security, especially if the device is lost or stolen. Existing solutions often involve storing sensitive data on the device itself, creating a vulnerability.

The underlying idea behind '771 is to minimize the storage of sensitive payment information on the mobile device itself. Instead, the mobile application acts as a secure interface to a remote server. The mobile app uses a session key to communicate with the server, and this key can be invalidated remotely to disable the application if the device is compromised. User authentication, including biometric data, is performed locally on the device before initiating an NFC transaction.

The claims of '771 focus on a method, a mobile device, and a non-transitory computer readable medium for conducting a Near Field Communication (NFC) transaction using an NFC protocol. The claims cover storing a non-browser based application in a mobile device memory, receiving user authentication information including biometric data, authenticating the user before the NFC transaction, executing a secure element application by the NFC processor in response to a near field communication inductive signal by an NFC terminal, and transmitting an identification code via a second communication channel to the NFC terminal for processing the near field communication transaction.

In practice, when a user wants to make a payment, the mobile application first authenticates the user using biometric data. Upon successful authentication, the application activates the NFC transceiver. When the phone is brought near an NFC terminal, the secure element transmits an identification code to the terminal. This code is then sent to a remote server, which processes the transaction using the payment method associated with that code. The biometric authentication step ensures that only the authorized user can initiate the transaction, even if the device is unlocked.

This approach differs from prior solutions by minimizing the amount of sensitive data stored on the mobile device. By relying on a remote server for transaction processing and using a session key that can be remotely invalidated, the risk of data theft is significantly reduced. The use of biometric authentication adds another layer of security, preventing unauthorized use even if the device is lost or stolen. Furthermore, the application can be remotely locked, and cached data can be deleted, further mitigating the risk of compromise.