Secure transaction object creation, propagation and invocation

• US 10,410,212 B2
• Filed: 05/06/2013
• Issued: 09/10/2019
• Est. Priority Date: 05/04/2012
• Status: Active Grant

• Current Assignee: Tradeweb Markets LLC (Tradeweb Markets, Inc.)
• Original Assignee: Institutional Cash Distributors Technology LLC
• Inventors: Heyner, Mark A.
• Primary Examiner(s): Obeid, Mamon
• Application Number:
  US13/888,233
• Publication Number:
  US 20130317990A1
• Time in Patent Office: 2,318 Days
• Field of Search: None
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

Functional data of a cash channel is encapsulated by at least two parties in succession to define an at least twice-encapsulated data object. The encapsulation and subsequent de-encapsulation can utilize digital signature systems of the parties that involve a private key for encapsulation and a public key for de-encapsulation. If constructed carefully over a series of rigorous events, the resulting at least twice-encapsulated data object can be practically impossible to counterfeit. In addition, a propagation of rights can be tracked for auditing and rights can be easily terminated or modified.

Claims

1. A method for controlling use of a cash channel used for electronic funds transfers, comprising:

1) constructing a security token that incorporates a first set of first financial transaction elements that are required to control operation of a cash channel, said cash channel involving an origination account from which assets are to be withdrawn and a destination account to which assets are to be deposited, said constructing a security token comprising;

a) operating a first processing system to generate a first data object including at least a first subset of said first financial transaction elements;

b) transmitting the first data object, directly or indirectly, from said first processing system to a second processing system;

c) using the second processing system to generate an at least once-encapsulated cash channel object by encapsulating at least the first data object using a first digital signature system including a first digital signature of a first party, for encapsulating the first data object and a first signature verification for verifying the first signature and de-encapsulating the first data object; and

d) transmitting the at least once-encapsulated cash channel object to a third processing system; and

e) operating the third processing system to generate an at least twice-encapsulated cash channel object by adding at least a second subset of said first financial transaction elements, different than said first subset, to said once-encapsulated cash channel object and encapsulating at least the at least once-encapsulated cash channel object and said second subset of said first financial transaction elements using a second digital signature system including a second digital signature of a second party, for encapsulating the at least once-encapsulated cash channel object and said second subset of said first financial transaction elements, and a second signature verification for verifying the second signature and de-encapsulating the at least once-encapsulated cash channel object and said second subset of said first financial transaction elements;

wherein said security token comprises said at least twice-encapsulated cash channel object; and

2) using the security token by;

a) receiving, at a transaction processing system, said security token, including said at least twice-encapsulated cash channel object;

b) receiving, at said transaction processing system, a cash channel request for withdrawing said assets from said origination account and depositing said assets into—

said destination account, said cash channel request comprising a second set of second financial transaction elements;

c) operating said transaction processing system to use said second signature verification to de-encapsulate said at least twice-encapsulated cash channel object so as to obtain said second subset of said first financial transaction elements;

d) operating said transaction processing system to use said first signature verification to de-encapsulate said at least once-encapsulated cash channel object to obtain said first subset of said first financial transaction elements; and

e) comparing, at said transaction processing system, said first financial transaction elements of said security token with said second financial transaction elements of said cash channel request to verify said cash channel request.

2. A method as set forth in claim 1, wherein each of said first and second digital signature systems comprises a public-private key pair having, in each case, a private key for encapsulation and a public key for de-encapsulation.

3. A method as set forth in claim 1, wherein said step of generating a once-encapsulated cash channel object further comprises associating a tag with said once-encapsulated cash channel object, said tag identifying one of said first signature verification, a date and time when said once-encapsulated cash channel object was generated, and contact data for said first one of said first and second parties.

4. A method as set forth in claim 1, wherein one of said first and second parties is a grantor of rights with respect to said cash channel and the other of said first and second parties is a grantee of rights with respect to said cash channel.

5. A method as set forth in claim 1, wherein said cash channel is defined by said first-data object in combination with additional information appended to said first data object prior to encapsulating or further encapsulating said first data object.

6. A method as set forth in claim 1, wherein said constructing said security token further comprises the step of verifying the first data object by de-encapsulating the first data object and confirming the cash channel defined at least in part by the first data object.

7. A method as set forth in claim 1, wherein generating said at least twice-encapsulated cash channel object comprises adding authorization data to a cash channel object including said first data object prior to encapsulating or further encapsulating said cash channel object.

8. A method as set forth in claim 7, wherein said authorization information identifies the first or second party and another party in a chain of propagated rights with respect to said cash channel.

9. A method as set forth in claim 1, wherein said generating said at least twice-encapsulated cash channel object further comprises first propagating authorization with respect to said cash channel by adding first propagation authorization data at least identifying a first authorized user to said twice-encapsulated cash channel object and encapsulating said first propagation authorization data and said twice-encapsulated cash channel object using a third digital signature system to create a first propagated cash channel object, wherein said third digital signature system may be the same as one of said first and second digital signature systems, or may be different from said first and second digital signature systems.

10. A method as set forth in claim 9, wherein said first propagation authorization data defines a first scope of rights of said first authorized user with respect to said cash channel.

11. A method as set forth in claim 9, wherein said generating said at least twice-encapsulated cash channel object further comprises second propagating authorization with respect to said cash channel by adding second propagation authorization data at least identifying a second authorized user to said first propagated cash channel object and encapsulating said second propagation authorization data and first propagated cash channel object using a fourth digital signature system to create a second propagated cash channel data object, wherein said fourth digital signature system may be the same as one of said first and second digital signature systems, or may be different from said first and second digital signature systems.

12. A method as set forth in claim 11, wherein said second propagation authorization data defines a second scope of rights of said second authorized user with respect to said cash channel.

13. A method as set forth in claim 1, wherein said comparing is performed by a processing platform of one of said first and second parties.

14. A method as set forth in claim 1, wherein said processing platform is accessed, to execute said comparing, by an actor, wherein said actor is different than said first and second parties.

15. A method as set forth in claim 1, further comprising:

coupling additional information to said at least twice-encapsulated cash channel object; and

further encapsulating the at least twice-encapsulated cash channel object and said additional information using a further digital signature system including a digital signature for encapsulation and a signature verification for de-encapsulation.

16. A method as set forth in claim 15, wherein the additional information comprises one of a tag identifying one of the first and second signature verification, a date and time said at least twice-encapsulated cash channel object was generated, and contact information for one of said first and second parties, identification information for a trading account, a specification of rights propagated for a trading account or said origination financial account, and an identification of a party to whom rights are being granted.

17. A method as set forth in claim 15, wherein said further digital signature system is associated with a party to whom rights have been granted with respect to said cash channel.

18. A method as set forth in claim 17, further comprising associating a tag with said further encapsulated cash channel object and said additional information, said tag identifying one of the signature verification of said party, a date and time said further cash channel object was generated, and contact information for said party.

19. A method as set forth in claim 1, further comprising:

adding details of a transaction to said—

at least twice-encapsulated cash channel object, said transaction involving one of requesting a trade and invoking said cash channel; and

encapsulating said at least twice-encapsulated cash channel object and said transaction details using a digital signature system including a digital signature for encapsulation and a signature verification for de-encapsulation, thereby forming an encapsulated transaction request.

20. A method as set forth in claim 19, further comprising:

executing a transaction using said encapsulated transaction request wherein said encapsulated transaction request is further encapsulated with one or more layers of digital signatures, each said signature layer involving a digital signature system including a digital signature for encapsulation and a signature verification for de-encapsulation; and

said one or more digital signature layers encoding details of subsidiary investments traceable to funds of said transaction and any intervening investments associated with said signature layers.

21. A method as set forth in claim 20, wherein said signature layers pertain to at least a first plurality of intervening investments, traceable to said transaction, having a cumulative initial value substantially equal to a value of said transaction and a terminal value;

and a second plurality of investments, collectively traceable to said first plurality of intervening investments and said transaction, having a cumulative initial value substantially equal to said terminal value.

22. A method as set forth in claim 1, wherein rights with respect to said cash channel are propagated across a propagation tree including multiple propagation branches, each propagation branch involving an additional digital signature layer applied to an at least twice-encapsulated cash channel object, each digital signature layer reflecting propagation of rights to a further party and involving a digital signature system including a digital signature for encapsulation and a signature verification for de-encapsulation, said method further including the steps of pruning said propagation of tree by invalidating a signature layer at a selected point in a given branch of said tree, thereby invalidating other signature layers associated with said given branch.

23. A system for controlling use of a cash channel used for electronic funds transfers, comprising:

1) a first processing system, operative for;

a) receiving a first data object including at least a first subset of first financial transaction elements, said first financial transaction elements being required to control operation of a cash channel, said cash channel involving an origination account from which assets are to be withdrawn and a destination account to which assets are to be deposited; and

b) generating an at least once-encapsulated cash channel object by encapsulating at least the first data object using a first digital signature system including a first digital signature of a first party, for encapsulating the first data object and a first signature verification for verifying the first signature and de-encapsulating the first data object; and

2) a second processing system operative for receiving the at least once-encapsulated cash channel object, and;

a) generating an at least twice-encapsulated cash channel object by adding at least a second subset of said first financial transaction elements to said at least once-encapsulated cash channel object and encapsulating at least the at least once-encapsulated cash channel object and said second subset of said first financial transaction elements using a second digital signature system including a second digital signature of a second party, for encapsulating the once-encapsulated cash channel object and a second signature verification for verifying the second signature and de-encapsulating the at least once-encapsulated cash channel object;

wherein said at least twice-encapsulated cash channel object defines a security token; and

3) a transaction processing system operative for;

a) receiving said security token, including said at least twice-encapsulated cash channel object;

b) receiving a cash channel request for withdrawing said assets from said origination account and depositing said assets into said destination account, said cash channel request including a second set of second financial transaction elements;

c) operating said transaction processing system to use said second signature system to de-encapsulate said at least twice-encapsulated cash channel object so as to obtain said second subset of said first financial transaction elements;

d) operating said transaction processing system to use said first signature system to de-encapsulate said at least once-encapsulated cash channel object to obtain said first subset of said first financial transaction elements; and

e) comparing said first transaction elements of said security token with said second financial transaction elements of said cash channel request to verify said cash channel request.

24. A system as set forth in claim 23, wherein each of said first and second digital signature systems comprises a public-private key pair having, in each case, a private key for encapsulation and a public key for de-encapsulation.

25. A system as set forth in claim 23, wherein said generating a once-encapsulated cash channel object further comprises associating a tag with said once-encapsulated cash channel object, said tag identifying one of said first signature verification, a date and time said at least once-encapsulated cash channel object was created, and contact information for one of said first and second parties.

26. A system as set forth in claim 23, wherein one of said first and second parties is a grantor of rights with respect to said cash channel and the other of said first and second parties is a grantee of rights with respect to said cash channel.

27. A system as set forth in claim 23, wherein said cash channel is defined by said first data object in combination with additional information appended to said first data object prior to encapsulating or further encapsulating said first data object.

28. A system as set forth in claim 23, wherein said second processing system is further operative for verifying the first data object by de-encapsulating the first data object and confirming the cash channel defined at least in part by the first data object.

29. A system as set forth in claim 23, wherein said generating an at least twice-encapsulated cash channel object comprises adding authorization data to a cash channel object including said first data object prior to encapsulating or further encapsulating said cash channel object.

30. A system as set forth in claim 28, wherein said authorization data identifies the first or second party and another party in a chain of propagated rights with respect to said cash channel.

31. A system as set forth in claim 23, wherein said generating an at least twice-encapsulated cash channel object further comprises first propagating authorization with respect to said at least cash channel by adding first propagation authorization data at least identifying a first authorized user to said twice-encapsulated cash channel object and encapsulating said first propagation authorization data and said at least twice-encapsulated cash channel object using a third digital signature system to create a first propagated cash channel object, wherein said third digital signature system may be the same as one of said first and second digital signature systems, or may be different from said first and second digital signature systems.

32. A system as set forth in claim 31, wherein said first propagation authorization data defines a first scope of rights of said first authorized user with respect to said cash channel.

33. A system as set forth in claim 31, wherein said generating an at least twice-encapsulated cash channel object further comprises second propagating authorization with respect to said cash channel by adding second propagation authorization data at least identifying a second authorized user to said first propagated cash channel object and encapsulating said second propagation authorization data and first propagated cash channel object using a fourth digital signature system to create a second propagated cash channel data object, wherein said fourth digital signature system may be the same as one of said first and second digital signature systems, or may be different from said first and second digital signature systems.

34. A system as set forth in claim 33, wherein said second propagation authorization data defines a second scope of rights of said second authorized user with respect to said cash channel.

35. A system as set forth in claim 23, wherein said comparing comprises matching at least the destination account of the at least twice-encapsulated cash channel object to the destination account of the request.

36. A system as set forth in claim 35, the comparing is performed by a processing platform of one of said first and second parties.

37. A system as set forth in claim 36, wherein said processing platform is accessed, to execute said matching, by said actor, wherein said actor is different than said first and second parties.

38. A system as set forth in claim 23, further comprising one or more processors are further operative for:

coupling additional information to said at least twice-encapsulated cash channel object; and

further encapsulating the at least twice-encapsulated cash channel object and said additional information using a further digital signature system including a digital signature for encapsulation and a signature verification for de-encapsulation.

39. A system as set forth in claim 38, wherein the additional information comprises one of a tag identifying one of the first and second signature verification, a date and time said at least twice-encapsulated cash channel object was created, contact information for one of said first and second parties, identification information for a trading account, a specification of rights propagated for a trading account or said origination financial account, and an identification of a party to whom rights are being granted.

40. A system as set forth in claim 38, wherein said further digital signature system is associated with a party to whom rights have been granted with respect to said cash channel.

41. A system as set forth in claim 40, wherein said one or more processors are further operative for associating a tag with said further encapsulated cash channel object and said additional information, said tag identifying one of the signature verification of said party, a date and time said further encapsulated cash channel object was established, contact information for one said party.

42. A system as set forth in claim 23, wherein said one or more processors are further operative for:

adding details of a transaction to said—

at least twice-encapsulated cash channel object, said transaction involving one of requesting a trade and invoking said cash channel; and

encapsulating said at least twice-encapsulated cash channel object and said transaction details using a digital signature system including a digital signature for encapsulation and a signature verification for de-encapsulation, thereby forming an encapsulated transaction request.

43. A system as set forth in claim 42, wherein said one or more processors are further operative for:

executing a transaction using said encapsulated transaction request wherein said encapsulated transaction request is further encapsulated with one or more layers of digital signatures, each said signature layer involving a digital signature system including a digital signature for encapsulation and a signature verification for de-encapsulation;

said one or more digital signature layers encoding details of subsidiary investments traceable to funds of said transaction and any intervening investments associated with said signature layers.

44. A system as set forth in claim 43, wherein said signature layers pertain to at least a first plurality of intervening investments, traceable to said transaction, having a cumulative initial value substantially equal to a value of said transaction and a terminal value;

and a second plurality of investments, collectively traceable to said first plurality of intervening investments and said transaction, having a cumulative initial value substantially equal to said terminal value.

45. A system as set forth in claim 23, wherein rights with respect to said cash channel are propagated across a propagation tree including multiple propagation branches, each propagation branch involving an additional digital signature layer applied to an at least twice-encapsulated cash channel object, each digital signature layer reflecting propagation of rights to a further party and involving a digital signature system including a digital signature for encapsulation and a signature verification for de-encapsulation, said system further including the steps of pruning said propagation of tree by invalidating a signature layer at a selected point in a given branch of said tree, thereby invalidating other signature layers associated with said given branch.