Methods and apparatus for conducting electronic transactions

• US 20040243520A1
• Filed: 04/09/2004
• Published: 12/02/2004
• Est. Priority Date: 08/31/1999
• Status: Active Grant

• Current Assignee: Liberty Peak Ventures, LLC (Dominion Harbor Enterprises, LLC)
• Original Assignee: American Express Travel Related Services Company, Inc. (American Express Company)
• Inventors: Johnson, Michael G., White, Dirk B., Bishop, Fred Alan, Gorgol, Zygmunt Steven, Hohle, William G., Glazer, Elliot Harold, Lake, Walter Donald, Johnstone, David E., Royer, Coby, Bennett, Russell, Simkin, Marvin, Swift, Nick
• Granted Patent: US 7,801,827 B2
• Time in Patent Office: Days
• US Class Current: 705/75
• CPC Class Codes: G06Q 20/105 involving programming of a portable memory device, e.g. IC cards, "electronic purses"
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/363 with the personal data of a user
• CPC Class Codes: G06Q 20/367 involving electronic purses or money safes
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G06Q 20/4097 using mutual authentication between devices and transaction partners
• CPC Class Codes: G06Q 30/0613 Third-party assisted
• CPC Class Codes: G07F 7/0866 by active credit-cards adapted therefor G07F7/1008 takes precedence
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system

Abstract

A system and method for conducting electronic commerce are disclosed. In various embodiments, the electronic transaction is a purchase transaction. A user is provided with an intelligent token, such as a smartcard containing a digital certificate. The intelligent token suitably authenticates with a server on a network that conducts all or portions of the transaction on behalf of the user. In various embodiments a wallet server interacts with a security server to provide enhanced reliability and confidence in the transaction. In various embodiments, the wallet server includes a toolbar. In various embodiments, the digital wallet pre-fills forms. Forms may be pre-filled using an auto-remember component.

Claims

1-4. -4. (Canceled).

5. A method for protecting a network server from being used as the basis of an attack on a network client, the method comprising:

a. restricting access to said network server to a portion of said network server for at least a selected protocol; and

b. scanning said portion of said network server for particular characters, said particular characters being associated with said selected protocol.

6. The method of claim 5, further comprising removing said particular characters such that a security risk posed by said selected protocol is reduced.

7. The method of claim 5, further comprising replacing said particular characters with benign characters such that a security risk posed by said selected protocol is reduced.

8. The method of claim 5, wherein said characters are hostile characters and wherein if a request contains any of said hostile characters, the request is rejected.

9. The method of claim 5, further comprising logging said particular characters to form a security log.

10. The method of claim 9, further comprising reviewing said security log to determine whether said particular characters are hostile.

11. The method of claim 5, wherein said protection of the network server is accomplished during an electronic purchase transaction.

12. The method of claim 11, wherein the electronic purchase transaction is conducted using a digital wallet.

13-42. -42. (Canceled).

43. A computer-implemented method for protecting a network server from being used as the basis of an attack on a network client, the method comprising:

a. receiving a request for a connection at said server from said network client; and

b. scanning a portion of said network server for particular characters associated with a protocol;

c. verifying that any response from said network server to said network client is void of said particular characters; and

d. providing said response from said network server to said network client.

44. The method of claim 43 further comprising restricting access to said network server for said protocol to said portion of said network server.

45. The method of claim 43 further comprising replacing said particular characters with benign characters such that a security risk posed by said selected protocol is reduced.

46. The method of claim 43 wherein said protocol comprises javascript.

47. The method of claim 43 further comprising logging said particular characters to form a security log.

48. The method of claim 47 further comprising reviewing said security log to determine whether said particular characters are hostile.

49. The method of claim 47 wherein said protection of the network server is accomplished during an electronic purchase transaction.

50. The method of claim 49 wherein the electronic purchase transaction is conducted using a digital wallet.