Patent ID: 7778934

Claim:
A method for authenticating a payment transaction over a network, comprising: at a payment authentication service, storing a public key associated with a public key infrastructure (PKI) key pair in a profile database; linking the PKI key pair to at least a first payment instrument of a buyer; subsequent to the step of linking the PKI key pair to the first payment instrument and in response to receiving an authentication request from the buyer over a network, the authentication request including a description of the payment transaction and an identity of a seller, the seller separate from the payment authentication service, sending a challenge request to the buyer over the network, the challenge request including a summary of the payment transaction; subsequent to the step of linking the PKI key pair to the first payment instrument, receiving a selection of the first payment instrument from the buyer; in response to receiving a challenge response from the buyer over the network, the challenge response including a summary of the payment transaction digitally signed by the buyer, decrypting the digitally signed summary of the payment transaction using the public key; determining, from said decrypting, that the buyer has access to the private key and that the buyer is authorized to use the first payment instrument; storing a digitally signed record of the payment transaction in a transaction archive; and notifying the seller that the buyer is authorized to use the first payment instrument.