Computer implemented systems and methods for fraud prevention in data transactions across disparate computing networks

• US 10,445,740 B2
• Filed: 12/29/2015
• Issued: 10/15/2019
• Est. Priority Date: 12/29/2015
• Status: Active Grant

• Current Assignee: Ariba Incorporated (SAP SE)
• Original Assignee: Ariba Incorporated (SAP SE)
• Inventors: Chandramouli, Vijay, Hu, Xiangqun, Shah, Tanvi, Tung, Yuan
• Primary Examiner(s): Nigh, James D
• Application Number:
  US14/982,517
• Publication Number:
  US 20170186004A1
• Time in Patent Office: Days
• Field of Search: 705 71
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G06Q 20/405 Establishing or using transaction specific rules
• CPC Class Codes: G06Q 20/42 Confirmation, e.g. check or permission by the legal debtor of payment
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]

Abstract

In one embodiment, a local computer network includes profile information local identifications for multiple organizations. Remote profile information is stored on a remote computer network and transferred to the local network to perform secure transactions with other computer networks. Embodiments of the disclosure include linking remote and local identifications. In another embodiment, remote and local identifications are linked by generated multiple messages to different users in different roles to prevent fraud, for example.

Claims

1. A method comprising:

receiving, by a local computer network, a request initiated by a buyer;

sending, in response to the request initiated by the buyer, first profile information corresponding to a first organization from the local computer network to a first remote card computer network, the first remote card computer network performing secure data transactions between organizations on banking computer networks;

receiving, by the local computer network, from the first remote card computer network, second profile information corresponding to the first organization, the second profile information comprising a first remote identification, a partial transaction number, a designation of a first user having a first fraud prevention role in the first organization, first messaging information for the first user, a designation of a second user having a second fraud prevention role in the first organization, and second messaging information for the second user, wherein a first portion of the second profile information is security related information from the first remote card computer network that is not exposed to users;

generating, by the local computer network, a first message to the first user using the first messaging information, the first message comprising at least a portion of the first profile information, a first local identification associated with the first profile information, at least a portion of the second profile information, and the first remote identification;

receiving, by the local computer network, a first confirmation approving an association between the first local identification and the first remote identification;

generating, by the local computer network, a second message to the second user using the second messaging information, the second message comprising the portion of the first profile information, the first local identification, the portion of the second profile information, and the first remote identification;

receiving, by the local computer network, a second confirmation approving the association between the first local identification and the first remote identification;

determining, by the local computer network, if the first confirmation and the second confirmation have been received;

associating, by the local computer network, the first local identification and the first remote identification if the first confirmation and the second confirmation have been received;

receiving, from the buyer, by the local computer network, a data transfer instruction comprising the first local identification, a second local identification associated with a second organization of the buyer, and information specifying a data transaction;

mapping, by the local computer network, the first local identification from the data transfer instruction to the first remote identification and the second local identification from the data transfer instruction to a second remote identification to generate a remote execution instruction comprising the first remote identification, the second remote identification, and the information specifying the data transaction;

sending, by the local computer network, the remote execution instruction to the first remote card computer network; and

in response to receiving the remote execution instruction, the first remote card computer network;

accessing a first banking computer network using secure access information associated with the second remote identification to perform a debit operation; and

accessing a second banking computer network using secure access information associated with the first remote identification to perform a deposit operation.

2. The method of claim 1 wherein the second profile information comprises a name of the first organization and an address of the first organization, and wherein the first remote identification is a merchant identification associated with profile information for the first organization on the first remote card computer network, and wherein the partial transaction number is a partial account number for data stored on one of said banking computer networks.

3. The method of claim 1, wherein the first user and the second user do not have an account on the local computer network, the first message further comprising:

a session key;

the first messaging information for the first user;

the first role of the first user; and

the first remote identification,

wherein the session key, the messaging information, the first role, and the first remote identification are encrypted and not displayed to the first user in the first message.

4. The method of claim 3 wherein the session key, the messaging information, the first role, and the first remote identification are encrypted in a universal resource locator (URL) selectable by the first user.

5. The method of claim 4 wherein, in response to the first user selecting the URL, the method further comprises dynamically generating a web page comprising the portion of the first profile information, the portion of the second profile information, and a data entry box, wherein receiving the first confirmation approving the association between the first local identification and the first remote identification comprises receiving, in the data entry box, said partial transaction number.

6. The method of claim 5, the second message comprising a second session key, the second messaging information, the second role, and the first remote identification encrypted in a second universal resource locator (URL) selectable by the second user, wherein, in response to the second user selecting the second URL, the method further comprises dynamically generating a second web page comprising the portion of the first profile information, the portion of the second profile information, and the data entry box, wherein receiving the second confirmation approving the association between the first local identification and the first remote identification comprises receiving, in the data entry box, said partial transaction number.

7. The method of claim 1 wherein the first profile information is stored on the local computer network separately from the second profile information.

8. The method of claim 1 further comprising:

storing the first remote identification in a first data element of a schema;

storing a first designation of approval in a second data element of the schema in response to receiving the first confirmation;

storing a second designation of approval in a third data element of the schema in response to receiving the second confirmation;

storing a third designation of completed approval in a fourth data element of the schema in response to storing the first and second designations of approval; and

storing the first local identification in a fifth data element of the schema in response to storing the third designation,

wherein associating the first local identification and the first remote identification is based on the first remote identification in the first data element of the schema and the first local identification in the fifth data element of the schema.

9. A plurality of non-transitory machine-readable mediums storing a program executable by at least one processing unit of a device, the program comprising sets of instructions for:

receiving, by a local computer network, a request initiated by a buyer;

sending, in response to the request initiated by the buyer, first profile information corresponding to a first organization from the local computer network to a first remote card computer network, the first remote card computer network performing secure data transactions between organizations on banking computer networks;

receiving, by the local computer network from the first remote card computer network, second profile information corresponding to the first organization, the second profile information comprising a first remote identification, a partial transaction number, a designation of a first user having a first fraud prevention role in the first organization, first messaging information for the first user, a designation of a second user having a second fraud prevention role in the first organization, and second messaging information for the second user, wherein a first portion of the second profile information is security related information from the first remote card computer network that is not exposed to users;

generating, by the local computer network, a first message to the first user using the first messaging information, the first message comprising at least a portion of the first profile information, a first local identification, at least a portion of the second profile information, and the first remote identification;

receiving, by the local computer network, a first confirmation approving an association between the first local identification and the first remote identification;

generating, by the local computer network, a second message to the second user using the second messaging information, the second message comprising the portion of the first profile information, the first local identification, the portion of the second profile information, and the first remote identification;

receiving, by the local computer network, a second confirmation approving the association between the first local identification and the first remote identification;

determining, by the local computer network, if the first confirmation and the second confirmation have been received;

associating, by the local computer network, the first local identification and the first remote identification if the first confirmation and the second confirmation have been received;

receiving, from the buyer, by the local computer network, a data transfer instruction comprising the first local identification, a second local identification associated with a second organization of the buyer, and information specifying a data transaction;

mapping, by the local computer network, the first local identification from the data transfer instruction to the first remote identification and the second local identification from the data transfer instruction to a second remote identification to generate a remote execution instruction comprising the first remote identification, the second remote identification, and the information specifying the data transaction;

sending, by the local computer network, the remote execution instruction to the first remote card computer network; and

in response to receiving the remote execution instruction, the first remote card computer network;

accessing a first banking computer network using secure access information associated with the second remote identification to perform a debit operation; and

accessing a second banking computer network using secure access information associated with the first remote identification to perform a deposit operation.

10. The plurality of non-transitory machine-readable mediums of claim 9, wherein the second profile information comprises a name of the first organization and an address of the first organization, and wherein the first remote identification is a merchant identification associated with profile information for the first organization on the first remote card computer network, and wherein the partial transaction number is a partial account number for data stored on one of said banking computer networks.

11. The plurality of non-transitory machine-readable mediums of claim 9, wherein the first user and the second user do not have an account on the local computer network, the first message further comprising:

a session key;

the first messaging information for the first user;

the first role of the first user; and

the first remote identification,

wherein the session key, the messaging information, the first role, and the first remote identification are encrypted and not displayed to the first user in the first message.

12. The plurality of non-transitory machine-readable mediums of claim 9, wherein the session key, the messaging information, the first role, and the first remote identification are encrypted in a universal resource locator (URL) selectable by the first user.

13. The plurality of non-transitory machine-readable mediums of claim 9, in response to the first user selecting the URL, further comprising dynamically generating a web page comprising the portion of the first profile information, the portion of the second profile information, and a data entry box, wherein receiving the first confirmation approving the association between the first local identification and the first remote identification comprises receiving, in the data entry box, said partial transaction number.

14. The plurality of non-transitory machine-readable mediums of claim 9, the second message comprising a second session key, the second messaging information, the second role, and the first remote identification encrypted in a second universal resource locator (URL) selectable by the second user, and, in response to the second user selecting the second URL, further comprising dynamically generating a second web page comprising the portion of the first profile information, the portion of the second profile information, and the data entry box, wherein receiving the second confirmation approving the association between the first local identification and the first remote identification comprises receiving, in the data entry box, said partial transaction number.

15. The plurality of non-transitory machine-readable mediums of claim 9, wherein the first profile information is stored on the local computer network separately from the second profile information.

16. The plurality of non-transitory machine-readable mediums of claim 9, further comprising:

storing the first remote identification in a first data element of a schema;

storing a first designation of approval in a second data element of the schema in response to receiving the first confirmation;

storing a second designation of approval in a third data element of the schema in response to receiving the second confirmation;

storing a third designation of completed approval in a fourth data element of the schema in response to storing the first and second designations of approval; and

storing the first local identification in a fifth data element of the schema in response to storing the third designation,

wherein associating the first local identification and the first remote identification is based on the first remote identification in the first data element of the schema and the first local identification in the fifth data element of the schema.

17. A computer system comprising:

a plurality of processors;

a plurality of memories; and

a plurality of software programs comprising instructions, executable on said processors, the software programs configured to;

receive, by a local computer network, a request initiated by a buyer;

send, by a local computer network, in response to the request initiated by the buyer, first profile information corresponding to a first organization from the local computer network to a first remote card computer network, the first remote card computer network performing secure data transactions between organizations on banking computer networks;

receive, by the local computer network, from the first remote card computer network, second profile information corresponding to the first organization, the second profile information comprising a first remote identification, a partial transaction number, a designation of a first user having a first fraud prevention role in the first organization, first messaging information for the first user, a designation of a second user having a second fraud prevention role in the first organization, and second messaging information for the second user, wherein a first portion of the second profile information is security related information from the first remote card computer network that is not exposed to users;

generate, by the local computer network, a first message to the first user using the first messaging information, the first message comprising at least a portion of the first profile information, a first local identification, at least a portion of the second profile information, and the first remote identification;

receive, by the local computer network, a first confirmation approving an association between the first local identification and the first remote identification;

generate, by the local computer network, a second message to the second user using the second messaging information, the second message comprising the portion of the first profile information, the first local identification, the portion of the second profile information, and the first remote identification;

receive, by the local computer network, a second confirmation approving the association between the first local identification and the first remote identification;

determine, by the local computer network, if the first confirmation and the second confirmation have been received;

associate, by the local computer network, the first local identification and the first remote identification if the first confirmation and the second confirmation have been received;

receive, from the buyer, by the local computer network, a data transfer instruction comprising the first local identification, a second local identification associated with a second organization of the buyer, and information specifying a data transaction;

map, by the local computer network, the first local identification from the data transfer instruction to the first remote identification and the second local identification from the data transfer instruction to a second remote identification to generate a remote execution instruction comprising the first remote identification, the second remote identification, and the information specifying the data transaction;

send, by the local computer network, the remote execution instruction to the first remote card computer network; and

in response to receiving the remote execution instruction, the first remote card computer network;

accessing a first banking computer network using secure access information associated with the second remote identification to perform a debit operation; and

accessing a second banking computer network using secure access information associated with the first remote identification to perform a deposit operation.

18. The computer system of claim 17, wherein the first user and the second user do not have an account on the local computer network the first message further comprising:

a session key;

the first messaging information for the first user;

the first role of the first user; and

the first remote identification,

wherein the session key, the messaging information, the first role, and the first remote identification are encrypted and not displayed to the first user in the first message.

19. The computer system of claim 17 wherein the session key, the messaging information, the first role, and the first remote identification are encrypted in a universal resource locator (URL) selectable by the first user.

20. The computer system of claim 17 the software programs further configured to:

store the first remote identification in a first data element of a schema;

store a first designation of approval in a second data element of the schema in response to receiving the first confirmation;

store a second designation of approval in a third data element of the schema in response to receiving the second confirmation;

store a third designation of completed approval in a fourth data element of the schema in response to storing the first and second designations of approval; and

store the first local identification in a fifth data element of the schema in response to storing the third designation,

wherein associating the first local identification and the first remote identification is based on the first remote identification in the first data element of the schema and the first local identification in the fifth data element of the schema.