WO2007125252A1

WO2007125252A1 - Method and system for managing an electronic payment

Info

Publication number: WO2007125252A1
Application number: PCT/FR2007/051170
Authority: WO
Inventors: Rym Sahnoun; Severine Bernonville
Original assignee: France Telecom
Priority date: 2006-04-26
Filing date: 2007-04-25
Publication date: 2007-11-08

Abstract

System and method for managing at least one payment means of at least one user from among several users (10, 10', 20, 20') for an electronic payment. According to the invention, said system comprises at least one registration server (11) able to order at least one creation and management of at least one main account tied to at least one main user (10, 10') and to at least one payment means, as well as at least one sub-account associated with said main account, and comprises at least one payment manager (12) able to manage said main account and to order at least one authentication corresponding to said electronic payment as a function of at least one rule of said main account. Application to the remote authorization of payment after authenticating the possessor of a payment means, while guaranteeing confidentiality and security.

Description

METHOD AND SYSTEM FOR MANAGING ELECTRONIC PAYMENT

The present invention relates to a method and a system for managing at least one means of payment of a user among several users for an electronic payment.

The invention applies more particularly to the remote authorization of payment after authentication of the possessor of a means of payment, while guaranteeing confidentiality and security.

Currently, when a user proceeds to an entity belonging to an economic agent and will be called "merchant" in the rest of the presentation, to a purchase with remote authentication, for example during an online purchase via a network compliant with the Internet protocol, the merchant sends a request to a bank to validate the transaction and obtain a guarantee of payment after authentication of the user by said bank. The purchase request is redirected to the website of the bank that performs the authentication of the user to authorize the payment. For existing Internet payment architectures, the buyer is necessarily identical to the owner of the payment method, authenticated remotely by the bank from its means of payment.

A telecommunications operator, to which the user is subscribed, can also perform the authentication thereof in place of the bank. In this case, the user is redirected to a website of the operator, reserved for this service, to authenticate including using a PIN, for example PIN (Personal Identification Number, or code personal secret) used by the user on his mobile terminal to secure all access and functions of the terminal. In the same way as before, the buyer is necessarily identical to the owner of the payment method, authenticated remotely by the operator. In all cases, currently, the authentication is linked to the user who authenticates, as well as the payment method attached to this particular user, such as his personal bank card. The bank authorizes the payment after control of the user and the means of payment corresponding to this user. With the current techniques of electronic payment, it is not possible to authorize a payment by a user other than the one with the means of payment used, except to provide a third party with his means of payment or his personal identification. Also a technical problem to be solved by the object of the present invention is to propose a method and a system for managing at least one means of payment of at least one user among several users for an electronic payment, which would make it possible to remedy the disadvantages of existing systems by allowing payment for multiple users with at least one identical means of payment, while ensuring the confidentiality and security of electronic payment.

The present invention offers a solution that does not have these drawbacks by proposing, according to a first aspect, a remarkable process in that it includes at least:

a step of receiving from a merchant, by at least one payment manager, at least one request containing at least one piece of data corresponding to an electronic payment and to a user;

a step of selecting a means of payment corresponding to said electronic payment;

a step of comparing said received data with at least one rule of at least one main account corresponding to said selected payment means;

a step of sending at least one request by said payment manager to at least one authentication server according to said rule;

a step of transmitting at least one authentication response by said authentication server for said payment manager; and a step of transmitting at least one response for payment by said payment manager to said merchant.

According to another of its aspects, the invention relates to a system for managing at least one means of payment for at least one user among several users for an electronic payment, which system comprises: at least one registration server capable of order at least one creation and the management of at least one main account attached to at least one main user and at least one payment means, as well as at least one sub-account associated with said main account, and comprises at least one payment manager able to manage said main account and to order at least one authentication corresponding to said electronic payment according to at least one rule of said main account.

Thus said management system and method allow a so-called "main" user to authorize different people to use at least one of his means of payment through stored rules. An account called "principal" is attached to said main user and at least one means of payment. A sub-account is associated with said main account, ie with at least one means of payment, common to the main account, and at least one user of said payment means, other than a main user; with at least one user, other than a primary user, and at least one means of payment of the main account.

In this way, the invention allows several people to make an electronic payment with at least one payment method. In addition, these rules make it possible to define one or more persons authorized to authorize an electronic payment. This is for example the case for an ascendant, father or mother (primary user), who authorizes his children to make purchases from a distance, the payment of these purchases being debited on a means of payment of the parent.

According to one embodiment, said main account is associated with at least one sub-account, controlled by said main user and attached to at least one user, with at least one means of payment of said main account. A user said "principal" created a main account attached to at least one means of payment and different identifications corresponding to different users. During a remote payment, the data contained in a main account of a main user, taking into account a selected means of payment, are controlled by a payment manager according to rules stored in memory, so as to validate then to allow (or not) an electronic payment.

In this way, the user of the means of payment (the buyer) may be different from the person who actually pays for the purchase (the holder of the means of payment). The purchase made by the user of the means of payment (the buyer) is validated by a user said "principal", after authentication of this user / buyer. There is separation between the buyer, user of the means of payment, and the remote user who authenticates (said main user, the owner of the means of payment), and this on networks that can be completely different. For example, the user of the means of payment (the buyer) may have a personal computer or PC (for an online purchase on the Internet) or be directly at a merchant with a payment terminal, then that the main user, who authenticates remotely, can be contacted on a mobile terminal by his telecommunications operator.

According to one embodiment of the invention, said main account comprises at least one rule for controlling the establishment of at least one communication to at least one main user of said main account to request a payment authorization.

A predefined primary user can be contacted to validate (or not) the electronic payment according to at least one rule of at least one main account, taking into account the means of payment and the user who is the buyer . According to one embodiment, said main account is created by said main user of said payment means and contains at least one identification of said main user.

According to another particular mode, said payment manager automatically validates said electronic payment according to said identification and at least one rule of the main account.

According to another particular mode, the payment manager automatically controls several users for at least one means of payment.

According to the invention, said identification of a user is an identifier recognized by a telecommunications operator to automatically validate said electronic payment, according to at least one rule.

One of the advantages of said management system and method is the possibility of setting up the main account controlled by a main user, so as to automatically adapt the processing of each electronic payment according to predefined rules. With the primary account and the associated sub-account (s), each electronic payment is managed by the payment manager, taking into account the user and the selected payment method, based on at least a rule stored in memory.

The following description with reference to the accompanying drawing, given by way of non-limiting example, will make it clear what the invention is and how it can be achieved.

FIG. 1 represents the general architecture of a system for managing at least one means of payment for at least one user among several users for an electronic payment, according to the invention. A system for managing at least one means of payment for at least one user

10, 10 ', 20, 20', according to the invention, comprises at least one registration server 1 1, a payment manager 12 and an authentication server 13, said system being represented in FIG.

It also includes at least one database for storing all the data necessary for the operation of said system. Said database may or may not be physically included in said management system, in particular included in said registration server 1 1 or in said payment manager 12.

Said registration server 1 1 is configured to control at least one creation and the management of at least one main account attached to at least one payment means and to at least one user called "principal" of the management service of a electronic payment. It is also configured to control at least one creation and the management of a main account with at least one sub-account associated with said main account by a so-called "main" user 10, 10 'who has created the main account. An enrollment in a registration server 1 1 corresponds to the creation of at least one main account attached to at least one payment means and to at least one main user 10, 10 ', as well as at least one subaccount associated with said main account. This service can be provided by a telecommunications operator directly to the users, or to a merchant offering a distance selling, or even a purchase directly from a merchant with a payment terminal.

A user says "principal" 10, 10 'is the user attached to at least one means of payment which is personal to him. A main account is created by a main user 10, 10 'and only a main user 10, 10' has the possibility of creating at least one main account. A sub-account, associated with at least one main account, is also created by said main user 10, 10 ', holder of said main account. A user 20, 20 ', identified in a sub-account, is not a main user. Several main users 10, 10 'can manage one or more payment means or / and one or more sub-accounts. For example, parents are the primary users 10, 10 ', who create one (or each their) main account with at least one means of payment. They also create and control at least one sub-account for their children 20, 20 '. Similarly, in the case of validation by a superior (main user) 10, 10 'of a professional purchase made by employees (sub-account) 20, 20' in an enterprise. The registration server 1 1 is therefore configured to receive and control the storage of at least one registration data of at least one main user 10, 10 'for at least one main account, as well as to control the transmission of said data and for dialogue with at least one payment manager 12.

Said payment manager 12 is configured to dialogue with said registration server 1 1 and with a merchant 21 during an electronic payment to manage a main account. It is configured to receive at least one request from the merchant 21 containing at least one data item corresponding to a user 10, 10 ', 20, 20' and a means of payment for the electronic payment. It is configured to compare the data, corresponding to the electronic payment made, with said data stored for at least one main account. It is also configured to control at least one authentication according to at least one rule of said main account, for example as a function of a means of payment or of a user not possessing the means of payment, or again depending on 'a primary user 10, 10' authorized to authorize a payment for a buyer. The payment manager 12 is able to manage said main account and to order at least one authentication for an electronic payment according to at least one rule of said main account.

At the time of a purchase of a product remotely, the merchant 21 requests a payment manager 12 to obtain authorization (or not) for a payment electronic means of payment. For example, when buying directly from the merchant (in a store for example), the merchant can request the payment manager 12 via a payment terminal. In particular, when the user of the means of payment (the buyer) is not a main user of this means of payment. This is the case, for example, when a child wishes to pay for a purchase with an account of his parents or when an employee uses a professional card for an electronic payment that is debited on the account of his company.

The merchant 21 may in particular be a website on the Internet, on which a user 10, 10 ', 20, 20' makes an online purchase. The merchant 21 may also be represented for example by an intelligent product distributor (such as a beverage or candy dispenser), which requests the system according to the invention to access an electronic purse fed in advance. for small purchases.

The payment manager 12 is therefore configured to communicate with the registration server 1 1 and with at least one merchant 21, in particular to receive at least one request from said merchant 21. It is also configured to communicate with at least one authentication server 13 for an electronic payment, in particular to send at least one authentication request of a user, then to validate said electronic payment according to the response of the server 13 authentication. The authentication server 13 is able to receive at least one authentication request from the payment manager 12. Said authentication server 13 is configured to communicate with the payment manager 12, in particular to receive said authentication request and transmit at least one authentication response, after authentication (or not) of the user. Said authentication server 13 can control the establishment of at least one communication to request authorization for electronic payment, after receiving at least one necessary data from said payment manager 12, depending on the content of the less a rule. In this case, it is a user "said principal" who authenticates remotely. Said authentication server 13 may be specific to the system according to the invention. Said system can also interact with an existing authentication server in a telecommunications network to which the different users are subscribed. Said system can also request any equipment to respond to an authentication request. The payment manager 12 sends a request to obtain authentication to at least one authentication server 13 concerned.

According to the steps of the method of the invention, a user said "principal" 10, 10 'wishes to allow different users 20, 20' a use of at least one of its means of payment. The payment method can be a credit card, an account postpaid with a telecommunications operator or service provider, or a prepaid account with a merchant website, when purchasing a product remotely, including on a website of the network Internet, etc.

The same means of payment can be used by several users, by transmitting a different identification, for example a parent (father and / or mother) authorizes his children to make purchases remotely, the payment of these purchases being debited on his own card parent's bank. In another example, a main user 10, 10 'can select from among various payment methods, in particular, in the case of a purchase on a personal basis or in a professional capacity. To do this, the main user 10, 10 'connects to a registration server 1 1, managed by a telecommunications operator to which he is subscribed. It can connect from any communication terminal, such as a personal computer or PC, a landline phone, a mobile terminal ... by secure access to ensure the security and confidentiality of data. In a registration step, the main user 10, 10 'creates a main account with at least one list of corresponding payment means. The registration server 1 1 then transmits a message to the main user 10, 10 'who has registered. The message contains at least one password that will allow it to access and manage the created master account. The message may for example be transmitted by a short SMS message (short message service) on a mobile terminal of the user whose, for example, it has registered the MSISDN identifier. For verification, the registration server 1 1 then asks the main user 10, 10 'for the confirmation of the transmitted password. Then, any addition, modification, deletion ... on the main account must be validated by the password transmitted, stored as an identification for the main account.

A main account contains at least one identification for a main user 10, 10 '. This identification may be, for example, the MSISDN (Mobile Subscriber ISDN) identifier corresponding to its telephony subscription, or a substitution identifier such as an alias or pseudonym, defined personally by the subscriber. main user 10, 10 '(to preserve confidentiality). Said main account contains at least one identification corresponding to each of the main users 10, 10 'of the main account, with at least one means of payment for said main users.

Therefore, the main account is created by a main user 10, 10 'of a payment means and contains at least one identification of said main user, with at least one means of payment of which he is the owner.

Several main users 10, 10 '(for example both parents) may have only one means of payment (for example an attached bank account), with two different identifiers, for example each of the main users is identified by its own mobile terminal.

When said identification is recognized by the telecommunications operator, for example an MSISDN identifier, the payment manager 12 automatically validates said electronic payment according to said identification and at least one rule of the main account. According to one embodiment of the invention, the identification of a user is an identifier recognized by a telecommunications operator to automatically validate said electronic payment, according to at least one rule. Independently of the system according to the invention, the provided bank data can be controlled through a call to a GT or "Manager of Telepayment". Said call may be commanded by the registration server 1 1 or said registration server 1 1 may control the payment manager 12.

The GT (Tele-Payment Manager) contacts a Banking Authorization Center (CA) to check the validity of the bank data, among other things, check that the payment method is valid, that it is not subject to opposition , etc. .. All bank data corresponding to the means of payment are stored in a database, for example the payment details.

Once all the checks are done, the main account is activated. All registration data is stored in a database.

In this registration step, once the main account is created and active, the main user 10, 10 'can associate at least one sub-account to this main account. To do this, the main user 10, 10 'creates at least one rule associated with the main account. For example, it will associate several identifications with several users, taking into account at least one means of payment (several MSISDN identifiers or several aliases). In this case, said different identifications correspond to different mobile terminals, which are authenticated by the telecommunications operator through the different identifiers MSISDN1, MSISDN2, etc. In this way, the transactions of the sub-accounts can be debited on a means of communication. payment of the main user 10, 10 'of the main account. Each sub-account is associated with at least one means of payment of said main user 10, 10 '.

A master account can be associated with one or more sub-accounts with one or more payment methods. In the same way, a main account can contain one or more means of payment and each means of payment can be associated with one or more sub-accounts. In this way, the sub-accounts define the users who can use the means of payment, as well as the way in which they can use them according to at least one predefined rule. Therefore, the manager 12 Payment automatically controls multiple users for at least one payment method.

In a parameterization step, a sub-account is controlled by at least one main user 10, 10 ', that is to say that said main user manages said sub-account. It can suspend it, activate it again, delete it, consult the transactions made by a user 20, 20 'of the sub-account, etc. It can also set by a rule a ceiling for the amount of an electronic payment. or modify the rule, for example by changing the value of the ceiling.

Therefore, at least one sub-account is controlled by at least one main user 10, 10 'and associated with at least one main account with at least one payment means of the main account. The main account is thus attached, separately or in combination, to at least one (or more) main user 10, 10 ', to at least one (or more) means of payment, to at least one (or more) rules, to at least one (or more) sub-account, at least one (or more) identification. In this parametering step, a main user 10, 10 'can create a rule so as, in particular, to control the establishment of at least one communication to at least one main user 10, 10' of said main account to request authorization payment. Said setting may provide for communication during all payments or only when exceeding a ceiling authorized for payment. The establishment of said communication can be activated, deactivated, deleted ... thanks to the password transmitted, corresponding to the main account. The main account can be set to delete the command to establish a communication to a main user 10, 10 '.

The payment manager 12 sends at least one request to at least one authentication server 13 according to said rule, in particular to control the establishment of the communication to a principal user 10, 10 ', who authenticates himself to allow the payment. The payment manager 12 receives an authentication response from said authentication server 13 and deduces the authorization (or not) according to the corresponding rule. Depending on the configuration, the list of rules, associated with a main account, are the rights associated with a means of payment for the different users of said means of payment.

At the time of an electronic payment, according to the method according to the invention, a merchant 21 transmits at least one request to at least one payment manager 12. Said request contains the data corresponding to an electronic payment, as well as those corresponding to a user 10, 10 ', 20, 20', who is the buyer. If the merchant 21 knows the means of payment corresponding to the buyer, predefined in advance, it sends the payment manager 12 a selected means of payment. The means of payment may also be known by the payment manager 12 (for example a means of payment defined by default). Otherwise, the payment manager 12 transmits a request to the user 10, 10 ', 20, 20' to select a means of payment corresponding to said electronic payment. Once the payment method is selected, if the buyer is a primary user

10, 10 ', it authenticates itself in particular by entering a personal confidential code (for example a PIN code) or it is automatically authenticated thanks to the identifier MSISDN of its mobile terminal, recognized by the operator, according to at least one rule stored in memory, taking into account the payment method selected. The payment manager 12 receives, from the merchant 21, said request containing at least one data item corresponding to a user 10, 10 ', 20, 20' for an electronic payment, as well as to the payment means selected for said electronic payment. . All the data corresponding to a payment, as well as the settings, are stored in a database. An automatic backup is performed to allow access to a history of all electronic payments.

In a verification step, the payment manager 12 compares said received data with at least one rule of the main account, corresponding to a user and the selected payment means. This verification allows, in particular, the use of a means of payment by a user other than the owner of said means of payment or a main user 10, 10 '.

In particular, the payment manager 12 checks in the main account if the received data, corresponding to the buyer, are present. If not, the payment authorization is refused in the response sent by the payment manager 12 to the merchant 21. If yes, the payment manager 12 checks whether these data correspond to a main account or a sub-account.

Whether the buyer is a main user 10, 10 'or a user 20, 20' registered in a sub-account, when the identification of the user is an identifier recognized by the telecommunications operator, the payment manager 12 can automatically validate the electronic payment, according to at least one rule. The identifier, registered in the main account or a sub-account associated with the main account, is authenticated by the telecommunications operator to which the user is subscribed and who provides the service for managing an electronic payment.

The payment manager 12 can also, according to a defined rule, establish a call to a remote payment manager (GT) and / or a bank authorization center (CA) to check the validity of the selected payment method.

In this verification step, if the data corresponds to a sub-account and if said sub-account is not active, the payment is refused by the manager 12 of payment to the merchant 21. If the sub-account is active, the payment manager 12 compares the received data with at least one rule, corresponding to the user and the selected payment means. In particular, it checks the value of the ceiling authorized for payment, if existing. For example, in the case of a sub-account, the MSISDN2 identifier of the buyer's terminal is not that of the terminal of the main user (identifier MSISDN1), given the means of payment selected. The payment can then be validated, without authentication of the main user, according to the setting provided in the sub-account concerned, for example, in the case of small purchases where the amount of the purchase is less than the value mentioned in a ruler. Therefore, the payment manager automatically controls multiple users for at least one payment method.

The payment manager 12 sends at least one request to the authentication server 13, containing at least one authentication request from a user. A rule may include an order to establish a communication to a main user 10, 10 'of the main account to request a payment authorization. The communication can be established, for example, to a mobile phone of the main user 10, 10 'with the MSISDN1 identifier known to the telecommunications operator. The main user 10, 10 'can be contacted via an SMS message on a mobile terminal corresponding to the identifier MSISDN1. In this case, the main user contacted 10, 10 'by the authentication server 13 authenticates himself to authorize (or not) the electronic payment corresponding to the selected payment means, for example by entering a personal confidential code, such as a PIN or other password predefined for this purpose. Therefore, the authentication server 13 can control the establishment of a communication to at least one main user 10, 10 'of said main account to request at least one authentication.

In this step, if the predetermined main user is not available, a new main user 10 'can be contacted, in the case where the existing parameterization allowed the storage of a list with several identifiers for a sub-user. -account. In this case, at least one new identifier MSISDN3 has been registered to establish a communication to another mobile terminal of a main user. This is the case, among other things, for the father and / or the mother who can both authorize a payment for one of their children. For a payment, all the settings are possible by rules such as: ceiling not reached without solicitation of at least one principal user, ceiling not reached but solicitation of a principal user for agreement, reached ceiling and solicitation of a principal user for agreement, ceiling reached and no solicitation of a main user with payment refused, free access to a prepaid account or an electronic purse for small purchases, ceiling for a professional bank card and no ceiling for a private bank card, etc.

The authentication server 13 transmits at least one authentication response to the payment manager 12, containing at least the response to the authentication request of a user.

The payment manager 12 transmits at least one response (authorization or not, depending on the authentication response) for payment to the merchant 21, with the data corresponding to the payment concerned. Said system and method, according to the invention, thus allow to authorize the use of the same means of payment by several users, the buyer may be different from the owner of said means of payment.

A computer program, comprising portions of code, is also provided for the execution of the various steps of the method as defined above, as well as a computer-readable recording medium on which said computer program is recorded. .

Once the authorization has been transmitted to the merchant 21, regardless of the system and the method of the invention, the merchant 21 may request a Tele-Payment Manager (GT) and / or an Authorization Center (CA) concerning the bank validity if necessary. The payment manager 12 can also directly request a GT and / or a CA on behalf of the merchant 21, depending on the setting. In addition, the payment manager 12 may also perform the payment remittance by querying a Call Center (or CTC).

Claims

1. A method of managing at least one payment means of at least one of a plurality of users (10, 10 ', 20, 20') for an electronic payment, after receipt from a merchant (21), by a least one payment manager (12), at least one request containing at least one data item corresponding to an electronic payment and to one of said users (10, 10 ', 20, 20'), and after selecting a payment means payment corresponding to said electronic payment, characterized in that it includes at least: a creation step in at least one registration server (1 1) by one of said users (10, 10 '), said main user of said means of payment, of at least one main account with at least one rule and at least one identification of said main user, a step of comparing said received data with a rule of said main account corresponding to said selected means of payment, a control step of at least s an authentication by said manager

(12) payment to at least one authentication server (13) according to said rule,

a step of transmitting at least one authentication response by said authentication server (13) for said payment manager (12),

a step of transmitting at least one response for payment by said payment manager (12) to said merchant (21).

2. Management method according to claim 1, characterized in that said main account comprises at least one rule for controlling the establishment of at least one communication to at least one main user (10, 10 ') of said main account to request a payment authorization.

3. Management method according to one of claims 1 or 2, characterized in that said payment manager (12) automatically validates said electronic payment according to said identification and at least one rule of the main account.

4. Management method according to any one of claims 1 to 3, characterized in that said main account is associated with at least one sub-account, controlled by said main user (10, 10 ') and attached to at least one user (20, 20 '), with at least one means of payment of said main account.

5. Management method according to any one of claims 1 to 4, characterized in that said main account is attached, separately or in combination, to at least a main user (10, 10 '), at least one payment means, at least one rule, at least one sub-account, at least one identification.

6. Management method according to any one of claims 1 to 5, characterized in that the payment manager (12) automatically controls several users for at least one payment means.

7. Management method according to any one of claims 1 to 6, characterized in that said identification of a user is an identifier recognized by a telecommunications operator to automatically validate said electronic payment, according to at least one rule .

8. Computer program characterized in that it comprises portions of code for performing the steps of the method according to claims 1 to 7.

9. Computer-readable recording medium on which said computer program is recorded according to claim 8.

10. System for managing at least one means of payment for at least one user among several users (10, 10 ', 20', 20 ') for an electronic payment, characterized in that it comprises at least one server ( 1 1) able to order at least one creation and the management of at least one main account attached to at least one main user (10, 10 ') and at least one means of payment, and at least one a sub-account associated with said main account, and comprises at least one payment manager (12) able to manage said main account and to order at least one authentication corresponding to said electronic payment according to at least one rule of said main account.

1 1. Registration server (1 1) adapted to be implemented in a system according to claim 10, characterized in that it is configured to receive and control the storing of at least one registration data of at least one main user (10, 10 ') for at least one main account, as well as for controlling the transmission of said data and dialogue with at least one payment manager (12).

12. Payment manager (12) adapted to be implemented in a system according to claim 10, characterized in that it is configured to interact with said registration server (1 1) and with at least one merchant ( 21), to receive at least one request from said merchant (21) containing at least one data item corresponding to a user (10, 10 ', 20, 20') and to a means of payment for an electronic payment and to validate said payment electronic system according to at least one rule of at least one main account taking into account said means of payment.

13. authentication server (13) adapted to be implemented in a system according to claim 10, characterized in that it is configured to dialogue with the least one payment manager (12) for transmitting at least one response to at least one authentication for an electronic payment.