Patent Description:
Conventionally a lot of electronic payment transactions between a merchant and a customer, who wants to pay, for instance, for goods or services of the merchant, often involve an interaction between a point-of-sale (POS) terminal of the merchant and a payment card (e.g. credit card or debit card) of the customer. After the customer interfaces the payment card with the POS terminal, and the POS terminal reads the account number from the payment card, the POS terminal may generate an online authorization request (e.g. authorization amount, and account number), and transmit the authorization request to a payment server. If the customer's account has a credit or balance that is sufficient to process the payment, the payment server generally settles the authorized amount with the customer's account, generates an authorization response message, and transmits the authorization response message to the POS terminal.

Document <CIT> discloses a method and system to determine whether a payment terminal has been tampered with.

Due to the widespread adoption of mobile phones, tablet computers and other types of COTS (commercial-off-the-shelf) devices in more and more electronic payment transactions POS terminals are being replaced, for instance, by mobile phones in that for processing a payment transaction a merchant mobile phone interacts with a payment card and/or a mobile phone of the customer. Often the authorization of the payment transaction requires the customer to enter a PIN or the like, i.e. security relevant data of the customer, into a virtual or physical PIN pad of the merchant mobile phone. Therefore, it has to be ensured that the security relevant data of the customer for authorizing the payment transaction are processed by the merchant mobile phone in a secure manner, i.e. that the security status of the merchant mobile phone is integer.

It is an object of the invention to provide improved devices, methods and a system for secure electronic payment transactions.

According to a first aspect a mobile merchant communication device for processing an electronic payment transaction with a customer payment device of a customer is provided, as defined in claim <NUM>.

The mobile merchant communication device may be, for instance, a mobile phone, a tablet computer or another type of COTS device of the merchant.

The mobile merchant communication device comprises a communication interface configured to transmit a first integrity status data set to a monitoring server, wherein the first integrity status data set is indicative of a current integrity status of the mobile merchant communication device. The communication interface is further configured, in response to a determination of the integrity status of the mobile merchant communication device by the monitoring server, to receive an integrity status message from the monitoring server, wherein the integrity status message comprises information about the integrity status of the mobile merchant communication device determined by the monitoring server and a first time stamp.

The mobile merchant communication device further comprises a processing circuitry configured to generate a second time stamp and to add the second time stamp to the integrity status message.

The communication interface is further configured to forward the integrity status message, including the information about the integrity status of the mobile merchant communication device determined by the monitoring server, the first time stamp and the second time stamp, to a mobile customer communication device of the customer for creating trust of the customer in the mobile merchant communication device.

Advantageously, the first time stamp allows the mobile customer communication device and the customer to verify that the integrity status message originally generated by the monitoring server is not a replay of an old message, while the second time stamp allows the mobile customer communication device and the customer to verify that the mobile merchant communication device is not fraudulent, thereby increasing the security of the payment transaction.

In a further embodiment, the customer payment device is an electronic chip card, e.g. a payment card, wherein the communication interface is configured to communicate with the electronic chip card. In an embodiment, the communication interface of the mobile merchant communication device may comprise, for instance, an NFC interface.

In a further embodiment, the customer payment device is the mobile customer communication device, e.g. a customer mobile phone. In other words, in an embodiment, the mobile merchant communication device is configured to send the integrity status message to the mobile customer communication device and process with electronic payment with the mobile customer communication device, e.g. the customer mobile phone. For instance, the mobile customer communication device may implement a payment card in software.

In a further embodiment, the processing circuitry is further configured to generate a digital signature of the integrity status message, including the information about the integrity status of the mobile merchant communication device determined by the monitoring server, the first time stamp and the second time stamp, and to forward the digital signature together with the integrity status message to the mobile customer communication device.

In a further embodiment, the integrity status message received from the monitoring server further includes a digital signature generated by the monitoring server of the information about the integrity status of the mobile merchant communication device determined by the monitoring server and/or the first time stamp.

In a further embodiment, the communication interface is configured to transmit at a plurality of times a respective second integrity status data set to the monitoring server, wherein the respective second integrity status data set is indicative of the current integrity status of the mobile merchant communication device. In an embodiment, the plurality of times may be regularly spaced in time. In an embodiment, a monitoring client may be implemented by the processing circuitry of the mobile merchant communication device, wherein the monitoring client is configured to actively send at the plurality of scheduled times the respective second integrity status data set to the monitoring server.

In a further embodiment, the first integrity status data set and/or the second integrity status data set comprises data indicative of whether a bootloader of the mobile merchant communication device has been unlocked.

In a further embodiment, the first integrity status data set and/or the second integrity status data set comprises a chain of certificates for attesting the integrity of one or more cryptographic keys of the mobile merchant communication device.

In a further embodiment, the mobile merchant communication device may be configured to execute a payment software application configured to process the payment transaction, wherein the first integrity status data set and/or the second integrity status data set comprises data indicative of a version number of the payment software application.

In a further embodiment, the first integrity status data set and/or the second integrity status data set comprises data from a gyro sensor of the mobile merchant communication device.

In a further embodiment, the first integrity status data set and/or the second integrity status data set comprises a list of software applications installed on the mobile merchant communication device.

According to a second aspect a monitoring server for monitoring an integrity status of a mobile merchant communication device is provided, wherein the mobile merchant communication device is configured to interact with a customer payment device for processing a payment transaction, as defined in claim <NUM>.

The monitoring server comprises a communication interface configured to obtain a first integrity status data set from the mobile merchant communication device, wherein the first integrity status data set is indicative of a current integrity status of the mobile merchant communication device. Moreover, the monitoring server comprises a processing circuitry configured to determine the current integrity status of the mobile merchant communication device based on the first integrity status data set.

The communication interface of the monitoring server is further configured to, in response to the determination of the integrity status of the mobile merchant communication device, transmit an integrity status message to the mobile merchant communication device, wherein the integrity status message comprises information about the integrity status of the mobile merchant communication device determined by the processing circuitry and a first time stamp generated by the processing circuitry.

The communication interface of the monitoring server is configured to, in response to the determination of the integrity status of the mobile merchant communication device, transmit the integrity status message to the mobile merchant communication device for the mobile merchant communication device to generate a second time stamp, to add the second time stamp to the integrity status message and to forward the integrity status message, including the information about the integrity status of the mobile merchant communication device determined by the monitoring server, the first time stamp and the second time stamp, to a mobile customer communication device.

In a further embodiment, the communication interface is further configured to obtain at a plurality of times a respective second integrity status data set from the mobile merchant communication device, wherein each second integrity status data set is indicative of the current integrity status of the mobile merchant communication device and wherein the processing circuitry is configured to determine the current integrity status of the mobile merchant communication device on the basis of the respective second integrity status data set. In an embodiment, the plurality of times may be regularly spaced in time. As will be appreciated, obtaining the respective second integrity status data set from the mobile merchant communication device at a plurality of points in time can be considered as background monitoring of the integrity status of the mobile merchant communication device by the monitoring server.

In a further embodiment, the first integrity status data set and/or the second integrity status data set comprises data indicative of whether a bootloader of the mobile merchant communication device is unlocked.

In a further embodiment, the first integrity status data set and/or the second integrity status data set comprises a chain of certificates for attesting the integrity of one or more cryptographic keys of the mobile merchant communication device, wherein the processing circuitry is configured to determine the current integrity status of the mobile merchant communication device by verifying the integrity of the one or more cryptographic keys of the mobile merchant communication device based on the chain of certificates.

In a further embodiment, the mobile merchant communication device comprises a payment software application configured to process the payment transaction, wherein the first integrity status data set and/or the second integrity status data set comprises data indicative of a version number of the payment software application and wherein the processing circuitry is configured to determine the current integrity status of the mobile merchant communication device based on the version number of the payment software application.

In a further embodiment, the first integrity status data set and/or the second integrity status data set comprises data from a gyro sensor of the mobile merchant communication device, wherein the processing circuitry is configured to determine the current integrity status of the mobile merchant communication device by determining whether the data from the gyro sensor of the mobile merchant communication device indicate a movement and/or rotation of the mobile merchant communication device.

In a further embodiment, the first integrity status data set and/or the second integrity status data set comprises a list of software applications installed on the mobile merchant communication device, wherein the processing circuitry is configured to determine the current integrity status of the mobile merchant communication device by comparing the list of software applications installed on the mobile merchant communication device with a black list of software applications.

In a further embodiment, the respective second integrity status data set comprises more integrity status data indicative of the current integrity status of the mobile merchant communication device than the first integrity status data set. In an embodiment, the first integrity status data set may be a subset of a respective second integrity status data set. In an embodiment, the monitoring server may comprise a database configured to persistently store the first integrity status data set and/or the plurality of second integrity status data sets.

In a further embodiment, the communication interface is configured to obtain prior to obtaining the next second integrity status data set the first integrity status data set from the mobile merchant communication device for processing the payment transaction , in case the time elapsed since obtaining the most recent second integrity status data set is larger than a pre-defined time interval threshold. In other words, in an embodiment, the monitoring server is configured to obtain the first integrity status data set from the mobile merchant communication device "on demand", only if the most recent background monitoring event, i.e. the most recent second integrity status data set has been too long ago, as defined by the time interval threshold.

In a further embodiment, the processing circuitry is configured, in response to a request from the payment server, to determine the current integrity status of the mobile merchant communication device on the basis of the first integrity status data set and/or the second integrity status data set and to send information about the current integrity status of the mobile merchant communication device to the payment server. Based on the information about the current integrity status of the mobile merchant communication device the payment server may further process the payment transaction, e.g. authorize or block the processing of the payment.

In a further embodiment, the communication interface is further configured to receive a digital signature of the first integrity status data set and/or the respective second integrity status data set and to verify the digital signature of the first integrity status data set and/or the respective second integrity status data set with a public key of the mobile merchant communication device.

According to a third aspect an electronic payment system is provided, as defined in claim <NUM>. The electronic payment system comprises a mobile merchant communication device according to a first aspect and a monitoring server according to the second aspect. Moreover, the electronic payment system comprises at least one customer payment device and/or a mobile customer communication device and a payment transaction server. The payment transaction server is configured to transmit a request to the monitoring server for information about a current integrity status of the mobile merchant communication device and to authorize a payment transaction based on the information about the current integrity status of the mobile merchant communication device.

According to a fourth aspect a method for processing an electronic payment transaction with a mobile merchant communication device is provided, as defined in claim <NUM>.

The method according to the fourth aspect of the present invention can be performed by the mobile merchant communication device according to the first aspect of the present invention. Thus, further features of the method according to the fourth aspect of the present invention result directly from the functionality of the mobile merchant communication device according to the first aspect of the present invention as well as its different embodiments described above and below.

A computer program product may comprise a non-transitory computer-readable storage medium for storing program code which causes a computer or a processor to perform the method according to the fourth aspect, when the program code is executed by the computer or the processor, is provided.

Embodiments of the invention can be implemented in hardware and/or software.

In the figures, identical reference signs will be used for identical or at least functionally equivalent features.

In the following detailed description, reference is made to the accompanying drawings, which form part of the disclosure, and in which are shown, by way of illustration, specific aspects in which the present invention may be implemented. It is understood that other aspects may be utilized and structural or logical changes may be made without departing from the scope of the present invention. The following detailed description, therefore, is not to be taken in a limiting sense, as the scope of the present invention is defined by the appended claims.

<FIG> shows a schematic diagram illustrating an electronic payment system <NUM> according to an embodiment for processing an electronic payment transaction between a mobile merchant communication device <NUM> operated by a merchant 120a and a customer payment device 110a. The mobile merchant communication device <NUM> may be, for instance, a mobile phone, tablet computer or the like operated by the merchant 120a. As illustrated in <FIG>, the mobile merchant communication device <NUM> may comprise a processor <NUM> for processing data, a communication interface <NUM> for communicating with the other components of the payment system <NUM> and a memory <NUM> for storing data. The mobile merchant communication device <NUM> may comprise a physical or virtual PIN pad allowing the customer 110a to enter a secret PIN for authorizing the payment transaction.

The customer payment device 110a may be an electronic chip card, i.e. a payment card 110a of a customer or implemented in a mobile customer communication device 110b, e.g. a mobile phone <NUM>0b, operated by the customer. In an embodiment, the communication interface <NUM> of the mobile merchant communication device <NUM> may comprise an NFC interface for communicating with the mobile customer communication device 110b.

In addition to the mobile merchant communication device <NUM> and the mobile customer communication device 110b the electronic payment system <NUM> illustrated in <FIG> further comprises a monitoring server <NUM> for monitoring a security integrity status of the mobile merchant communication device <NUM> and a payment server <NUM> for processing an electronic payment transaction between the mobile merchant communication device <NUM> and the customer payment device 110a. As illustrated in <FIG>, the mobile merchant communication device <NUM> may be configured to communicate with the monitoring server <NUM> and/or the payment server <NUM> via a wireless and/or wired communication network <NUM>. The mobile merchant communication device <NUM> is configured to interact with the customer payment device 110a, e.g. an electronic chip card, i.e. payment card 110a of the customer or the mobile customer communication device <NUM>0b, for processing an electronic payment transaction. In an embodiment, the mobile merchant communication device <NUM> may be a mobile phone, tablet computer or the like of the merchant 120a.

As illustrated in <FIG>, the mobile merchant communication device <NUM> comprises a communication interface <NUM> configured to transmit a fist integrity status data set <NUM> to the monitoring server <NUM>, wherein the first integrity status data set <NUM> is indicative of the current integrity status of the mobile merchant communication device <NUM>. The communication interface <NUM> is further configured, in response to a determination of the integrity status of the mobile merchant communication device <NUM> by the monitoring server <NUM>, to receive an integrity status message from the monitoring server <NUM>, wherein the integrity status message comprises information about the integrity status of the mobile merchant communication device <NUM> determined by the monitoring server <NUM> and a first time stamp.

The mobile merchant communication device <NUM> further comprises a processing circuitry <NUM> configured to generate a second time stamp and to add the second time stamp to the integrity status message. The communication interface <NUM> is further configured to forward the integrity status message, including the information about the integrity status of the mobile merchant communication device <NUM> determined by the monitoring server <NUM>, the first time stamp and the second time stamp, to the mobile customer communication device 110b for processing and authorizing the electronic payment transaction.

As illustrated in <FIG>, the monitoring server <NUM> comprises a communication interface <NUM> configured to obtain the first integrity status data set <NUM> from the mobile merchant communication device <NUM>, wherein, as already described above, the first integrity status data set <NUM> is indicative of a current integrity status of the mobile merchant communication device <NUM>. Moreover, the monitoring server <NUM> comprises a processing circuitry <NUM> configured to determine the current integrity status of the mobile merchant communication device <NUM> based on the first integrity status data set <NUM>. The communication interface <NUM> of the monitoring server <NUM> is further configured to, in response to the determination of the integrity status of the mobile merchant communication device <NUM>, transmit the integrity status message to the mobile merchant communication device <NUM>, wherein, as already described above, the integrity status message comprises information about the integrity status of the mobile merchant communication device <NUM> and the first time stamp generated by the processing circuitry <NUM> of the monitoring server <NUM>.

Advantageously, the first time stamp allows the mobile customer communication device 110b to verify that the integrity status message originally generated by the monitoring server <NUM> is not a replay of an old message, while the second time stamp provided by the mobile merchant communication device <NUM> allows the mobile customer communication device 110b to verify that the mobile merchant communication device <NUM> is not fraudulent or compromised, thereby increasing the security of the payment transaction.

In an embodiment, the communication interface <NUM> of the monitoring server <NUM> is configured to obtain at a plurality of times a respective second integrity status data set <NUM>' from the mobile merchant communication device <NUM>, wherein the data of each second integrity status data set <NUM>' is indicative of a current integrity status of the mobile merchant communication device <NUM>. Moreover, the processing circuitry <NUM> is configured to determine a current integrity status of the mobile merchant communication device <NUM> on the basis of the respective second integrity status data set <NUM>'. As will be appreciated, obtaining the respective second integrity status data set <NUM>' from the mobile merchant communication device <NUM> at a plurality of points in time can be considered as background monitoring of the integrity status of the mobile merchant communication device <NUM> by the monitoring server <NUM>. In an embodiment, the monitoring server <NUM> may be configured to obtain the respective second integrity status data <NUM>' from the mobile merchant communication device <NUM> by actively requesting the respective second integrity status data set <NUM>' from the mobile merchant communication device <NUM> or by receiving the respective second integrity status data set <NUM>' from the mobile merchant communication device <NUM> without a preceding request from the monitoring server <NUM>, for instance, in parallel to an indication by the mobile merchant communication device <NUM> to the payment server <NUM> that an electronic payment is to be processed.

In an embodiment, the communication interface <NUM> of the monitoring server <NUM> is configured to obtain prior to obtaining the next scheduled second integrity status data set <NUM>' the first integrity status data set <NUM> from the mobile merchant communication device <NUM>, in case the time elapsed since obtaining the most recent second integrity status data set <NUM>' is larger than a pre-defined time interval threshold. In other words, the mobile merchant communication device <NUM> is configured to actively send, i.e. push the first integrity status data set <NUM> to the monitoring server <NUM> for processing the payment transaction, only if the most recent background monitoring event has been too long ago, as defined by the time interval threshold. In an embodiment, a monitoring client may be implemented by the processing circuitry <NUM> of the mobile merchant communication device <NUM>, wherein the monitoring client is configured to actively send at the plurality of scheduled times the respective second integrity status data set <NUM>' to the monitoring server <NUM>. The monitoring client may be configured to subscribe with the monitoring server <NUM> for enabling the monitoring server <NUM> to monitor the integrity status of the mobile merchant communication device <NUM>.

In an embodiment, the processing circuitry <NUM> of the monitoring server <NUM> is configured, in response to a request from the payment server <NUM>, to determine the current integrity status of the mobile merchant communication device <NUM> on the basis of the first integrity status data set <NUM> and/or the second integrity status data set <NUM>' and to send information about the current integrity status of the mobile merchant communication device <NUM> to the payment server <NUM>. Based on the information about the current integrity status of the mobile merchant communication device <NUM> the payment server <NUM> may further process the payment transaction, e.g. depending on the current integrity status of the mobile merchant communication device <NUM> authorize or block the further processing of the payment transaction.

In an embodiment, the information about the current integrity status of the mobile merchant communication device <NUM> sent by the monitoring server <NUM> to the payment server <NUM> may comprise binary information, such as "integer" or "non-integer". In a further embodiment, the monitoring server <NUM> may be configured to determine a more differentiated integrity status of the mobile merchant communication device <NUM> on the basis of the first and/or second integrity status data set <NUM>, <NUM>', such as by employing a "traffic light system", including a green integer status, a yellow questionable status and a red non-integer status of the mobile merchant communication device <NUM>. In an embodiment, the monitoring server <NUM> may comprise a database implemented in the memory <NUM> and configured to persistently store the first integrity status data set <NUM> and/or the plurality of second integrity status data sets <NUM>'.

In an embodiment, the first integrity status data set <NUM> and the respective second integrity status data set <NUM>' may comprise the same type of data indicative of the integrity status of the mobile merchant communication device <NUM>. In a further embodiment, the respective second integrity status data set <NUM>' may comprise more, i.e. further integrity status data indicative of the current integrity status of the mobile merchant communication device <NUM> than the first integrity status data set <NUM>. In an embodiment, the first integrity status data set <NUM> may be a subset of a respective second integrity status data set <NUM>'. In a further embodiment, the processing circuitry <NUM> of the monitoring server <NUM> may be configured to implement machine learning, e.g. a neural network for determining the current integrity status on the basis of the first and/or second integrity status data set <NUM>, <NUM>'. As generally the monitoring server <NUM> will monitor a plurality of mobile merchant communication devices like the mobile merchant communication device <NUM> shown in <FIG>, this machine learning implemented by the processing circuitry <NUM> can be trained and continuously improved on the basis of the monitoring data obtained from these devices. This allows the monitoring server <NUM>, for instance, to adapt to new emerging attacks on the mobile merchant communication devices.

In an embodiment, if the monitoring server <NUM> determines the mobile merchant communication device <NUM> on the basis of the first and/or second integrity status data set <NUM>, <NUM>' to be integer, it may respond to the monitoring client implemented on the mobile merchant communication device <NUM> with an indication of when or by when the monitoring server <NUM> expects to receive the next second integrity status data set <NUM>' as part of the regular background monitoring. If the monitoring server <NUM> determines the mobile merchant communication device <NUM> on the basis of the first and/or second integrity status data set <NUM>, <NUM>' to be non-integer (possibly due to an attack by a malicious third party), it may instruct the monitoring client to delete all sensitive data of the payment application.

In an embodiment, the processing circuitry <NUM> of the monitoring server <NUM> is configured, in response to a request from the payment server <NUM>, to determine the current integrity status of the mobile merchant communication device <NUM> on the basis of the most recent second integrity status data set <NUM>' and the first integrity status data set <NUM> and to send information about the current integrity status of the mobile merchant communication device <NUM> determined on the basis of the most recent second integrity status data set <NUM>' and the first integrity status data set <NUM> to the payment server <NUM>. For instance, in an embodiment, where the first integrity status data set <NUM> is a subset of a respective second integrity status data set <NUM>', the processing circuitry <NUM> of the monitoring server <NUM> may be configured to determine the current integrity status of the mobile merchant communication device <NUM> on the basis of the data of the first integrity status data set <NUM> and the additional data of the most recent second integrity status data set <NUM>' not included in the first integrity status data set <NUM>.

In an embodiment, the communication interface <NUM> of the monitoring server <NUM> is configured, in response to the request from the payment server <NUM>, to send information about the current integrity status of the mobile merchant communication device <NUM> determined on the basis of the most recent second integrity status data set <NUM>' to the payment server <NUM>, in case the time elapsed since obtaining the most recent second integrity status data set <NUM>' is not larger than the time interval threshold.

In an embodiment, the plurality of times, when the monitoring server <NUM> obtains the respective second integrity status data set <NUM>', may be regularly spaced in time, i.e. differ in time by a substantially constant value. For instance, in an embodiment the monitoring server <NUM> may be configured to obtain the respective second integrity status data set <NUM>' every <NUM> minutes from the mobile merchant communication device <NUM>. As already described above, in an embodiment, a monitoring client may be implemented by the processing circuitry <NUM> of the mobile merchant communication device <NUM>, wherein the monitoring client is configured to actively send at the plurality of scheduled times the respective second integrity status data set <NUM>' to the monitoring server <NUM>.

In an embodiment, the communication interface <NUM> of the monitoring server <NUM> may be further configured to receive a digital signature of the integrity status data, i.e. the respective second integrity status data set <NUM>' and/or the first integrity status data set <NUM>, signed by the mobile merchant communication device <NUM> and to verify the digital signature of the integrity status data with a public key of the mobile merchant communication device <NUM>.

In an embodiment, the first integrity status data set <NUM> and/or the second integrity status data set <NUM>' comprises data indicative of whether a bootloader of the mobile merchant communication device <NUM> has been unlocked. In an embodiment, the monitoring server <NUM> may determine the integrity status of the mobile merchant communication device <NUM> to be unsafe, i.e. non-integer, in case the first integrity status data set <NUM> and/or the second integrity status data set <NUM>' indicates that the bootloader of the mobile merchant communication device <NUM> has been unlocked.

In an embodiment, the first integrity status data set <NUM> and/or the second integrity status data set <NUM>' comprises a chain of certificates for attesting the integrity of one or more cryptographic keys of the mobile merchant communication device <NUM>, wherein the processing circuitry <NUM> of the monitoring server <NUM> is configured to determine the current integrity status of the mobile merchant communication device <NUM> by verifying the integrity of the one or more cryptographic keys of the mobile merchant communication device <NUM> based on the chain of certificates.

In a further embodiment, the mobile merchant communication device <NUM> may be configured to execute a payment software application configured to process the payment transaction, wherein the first integrity status data set <NUM> and/or the second integrity status data set <NUM>' comprises data indicative of a version number of the payment software application and wherein the processing circuitry <NUM> of the monitoring server <NUM> is configured to determine the current integrity status of the mobile merchant communication device <NUM> based on the version number of the payment software application. In an embodiment, the monitoring server <NUM> may determine the integrity status of the mobile merchant communication device <NUM> to be unsafe, i.e. non-integer, in case the version number of the payment software application running on the mobile merchant communication device <NUM> is not the most recent version of the payment software application.

In an embodiment, the first integrity status data set <NUM> and/or the second integrity status data set <NUM>' comprises data from a gyro sensor of the mobile merchant communication device <NUM>, wherein the processing circuitry <NUM> of the monitoring server <NUM> is configured to determine the current integrity status of the mobile merchant communication device <NUM> by determining whether the data from the gyro sensor of the mobile merchant communication device <NUM> indicates a movement and/or rotation of the mobile merchant communication device <NUM>.

In an embodiment, the first integrity status data set <NUM> and/or the second integrity status data set <NUM>' comprises a list of software applications installed on the mobile merchant communication device <NUM>, wherein the processing circuitry <NUM> of the monitoring server <NUM> is configured to determine the current integrity status of the mobile merchant communication device <NUM> by comparing the list of software applications installed on the mobile merchant communication device <NUM> with a black list of software applications. In an embodiment, the monitoring server <NUM> may determine the integrity status of the mobile merchant communication device <NUM> to be unsafe, i.e. non-integer, in case the list of software applications installed on the mobile merchant communication device <NUM> includes software applications from the blacklist. This blacklist may be maintained in a database stored in the memory <NUM> of the monitoring server <NUM>.

<FIG> shows a signaling diagram illustrating the interaction of the mobile merchant communication device <NUM> and the monitoring server <NUM> with the other components of the electronic payment system <NUM>, i.e. the customer payment device 110a and/or the mobile customer communication device 110b and the payment server <NUM>. In <FIG> the following steps are illustrated, some of which already have been described in the context of <FIG> above.

In step <NUM> of <FIG>, the mobile merchant communication device <NUM> and the monitoring server <NUM> interact such that the monitoring server <NUM> obtains a second integrity status data set <NUM>' from the mobile merchant communication device <NUM>. As already described above, the monitoring server <NUM> may pull the second integrity status data set <NUM>' from the mobile merchant communication device <NUM> or the mobile merchant communication device <NUM> may actively push the second integrity status data set <NUM>' to the monitoring server <NUM>. Based on the second integrity status data set <NUM>' the monitoring server <NUM> may verify and update the current security integrity status of the mobile merchant communication device <NUM>.

In step <NUM> of <FIG>, the mobile merchant communication device <NUM> requests from the payment server <NUM> processing of a payment transaction between the mobile merchant communication device <NUM> and the customer payment device 110a, which, as already described above, may be a physical payment card 110a or implemented in software as a component of the mobile customer communication device 110b.

In step <NUM> of <FIG>, the payment server <NUM> sends an integrity status request to the monitoring server <NUM> for obtaining information about the integrity status of the mobile merchant communication device <NUM>, in response to the request from the mobile merchant communication device <NUM>.

In step <NUM> of <FIG>, which may be performed substantially in parallel with steps <NUM> and/or <NUM>, the monitoring server <NUM> obtains from the mobile merchant communication device <NUM>, as described above, the first integrity status data set <NUM> indicative of the current security integrity status of the mobile merchant communication device <NUM>. As already described above, in an embodiment, the monitoring server <NUM> may skip this step, in case the time passed since the latest regular background monitoring (step <NUM>) indicated as T1 in <FIG> is smaller than the pre-defined time interval threshold. In an embodiment, the time interval threshold may be, for instance, in the range between <NUM> and <NUM> seconds.

In step <NUM> of <FIG>, the processing circuitry <NUM> of the monitoring server <NUM> determines, i.e. verifies the current security integrity status of the mobile merchant communication device <NUM> based on the first integrity status data set <NUM> obtained by the monitoring server <NUM> in step <NUM> (and possibly a portion of the second integrity status data set <NUM>' obtained in the earlier step <NUM>). Moreover, the communication interface <NUM> of the monitoring server <NUM> sends an integrity status message, including information about the current integrity status of the mobile merchant communication device <NUM>, to the payment server <NUM> and the mobile merchant communication device <NUM>. As already described above, the integrity status message for the mobile merchant communication device <NUM> includes a first time stamp indicating the current time of the monitoring server <NUM>.

In step <NUM> of <FIG>, the processing circuitry <NUM> of the mobile merchant communication device <NUM> adds a second time stamp indicating the current time of the mobile merchant communication device <NUM> to the integrity status message. The communication interface <NUM> of the mobile merchant communication device <NUM> forwards the integrity status message, including the information about the current integrity status of the mobile merchant communication device <NUM>, the first time stamp provided by the monitoring server <NUM> and the second time stamp provided by the mobile merchant communication device <NUM>, to the mobile customer communication device 110b.

In step <NUM> of <FIG>, the payment server <NUM>, in response to the integrity status message from the monitoring server <NUM>, authorizes the payment transaction by sending a corresponding message to the mobile merchant communication device <NUM>.

In step <NUM> of <FIG>, the mobile merchant communication device <NUM> interacts with the customer payment device 110a and/or the mobile customer communication device 110b for further processing and completing the payment transaction.

In step <NUM> of <FIG>, the monitoring server <NUM> may interact with the mobile merchant communication device <NUM> for obtaining a further second integrity status data set <NUM>' from the mobile merchant communication device <NUM> as part of the regular, possibly periodic background monitoring. Based on the current integrity status data the monitoring server <NUM> may verify and update the security integrity status of the mobile merchant communication device <NUM>. As illustrated in <FIG> by the time interval T2, the monitoring server <NUM> may be configured to perform the background monitoring of the mobile merchant communication device <NUM> with a constant period of, for instance, <NUM> minutes.

<FIG> shows a flow diagram illustrating steps of a method <NUM> for processing an electronic payment transaction with the mobile merchant communication device <NUM>.

While a particular feature or aspect of the disclosure may have been disclosed with respect to only one of several implementations or embodiments, such feature or aspect may be combined with one or more other features or aspects of the other implementations or embodiments as may be desired and advantageous for any given or particular application.

Furthermore, to the extent that the terms "include", "have", "with", or other variants thereof are used in either the detailed description or the claims, such terms are intended to be inclusive in a manner similar to the term "comprise". Also, the terms "exemplary", "for example" and "e.g." are merely meant as an example, rather than the best or optimal. The terms "coupled" and "connected", along with derivatives may have been used. It should be understood that these terms may have been used to indicate that two elements cooperate or interact with each other regardless whether they are in direct physical or electrical contact, or they are not in direct contact with each other.

Although the elements in the following claims are recited in a particular sequence, unless the claim recitations otherwise imply a particular sequence for implementing some or all of those elements, those elements are not necessarily intended to be limited to being implemented in that particular sequence.

Claim 1:
A mobile merchant communication device (<NUM>) for processing an electronic payment transaction with a customer payment device (110a), wherein the mobile merchant communication device (<NUM>) comprises:
a communication interface (<NUM>) configured to transmit a first integrity status data set (<NUM>) to a monitoring server (<NUM>), wherein the first integrity status data set (<NUM>) is indicative of an integrity status of the mobile merchant communication device (<NUM>), and, in response to a determination of the integrity status of the mobile merchant communication device (<NUM>) by the monitoring server (<NUM>), receive an integrity status message from the monitoring server (<NUM>), wherein the integrity status message comprises information about the integrity status of the mobile merchant communication device (<NUM>) determined by the monitoring server (<NUM>) and a first time stamp; and
a processing circuitry (<NUM>) configured to generate a second time stamp and to add the second time stamp to the integrity status message;
wherein the communication interface (<NUM>) is further configured to forward the integrity status message, including the information about the integrity status of the mobile merchant communication device (<NUM>) determined by the monitoring server (<NUM>), the first time stamp and the second time stamp, to a mobile customer communication device (110b).