MOBILE BANKING

• US 20080189759A1
• Filed: 02/04/2007
• Published: 08/07/2008
• Est. Priority Date: 02/04/2007
• Status: Active Grant

• Current Assignee: Bank of America Corp.
• Original Assignee: Bank of America Corp.
• Inventors: Buchhop, Peter K., Bjugan, Ketil, Brown, Douglas Gerard
• Granted Patent: US 7,835,723 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06Q 20/10 specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
• CPC Class Codes: G06Q 20/3223 Realising banking transactions through M-devices
• CPC Class Codes: G06Q 20/325 using wireless networks
• CPC Class Codes: G06Q 20/326 Payment applications installed on the mobile devices
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/088 using filters or firewalls

Abstract

Systems and methods are disclosed for identifying circumstances where end-to-end security is not available to a mobile banking customer. The user may be alerted/warned or restricted from accessing some banking services through his/her WAP-enabled mobile device if the bank server determines that end-to-end security is not available. In some instances, the bank server may access a computer data file containing a list of known end-to-end secure devices and gateways to verify the integrity of the data communication. The server may verify the integrity of the data communication using loose matching.

Claims

1. A method for verifying end-to-end secure wireless communication from a user device to a server, comprising:

receiving a data from the user device comprising software compliant with a wireless protocol, the data relating to a request for access to the server;

identifying a value of a first identifier corresponding to the user device;

identifying a value of a second identifier corresponding to a network device;

determining whether the data is end-to-end secure from the user device to the server, where the data travels through the network device before arriving at the server; and

transmitting a response to the request, where if the data is end-to-end secure, then the response includes an indication that the request for access to the server is granted, else the response includes an indication that the request for access to the server is denied;

where the determining whether the data is end-to-end secure includes loosely comparing the value of the first identifier to a first list of approved values, comparing the value of the second identifier to a second list of approved values.

2. The method of claim 1, where the data is not end-to-end secure if the data is decrypted by the network device, and the network device is a WAP-compliant gateway, and the first identifier comprises a user agent header corresponding to the user device comprising WAP-compliant software, and the value of the second identifier comprises an IP address of the network device.

3. The method of claim 1, where the determining whether the data is end-to-end secure includes determining whether a value of a via header is present in the request for access to the server.

4. The method of claim 1, where the loosely comparing the value of the first identifier includes:

comparing the value of the first identifier with the first list of approved values to determine if an exact match exists;

if the exact match exists does not exist, then identifying a portion of the value of the first identifier and comparing the portion with the first list of approved values to determine if a loose match exists; and

for each determination where a loose match does not exist and the portion is greater than a predetermined threshold size, reducing the portion in size by a predetermined amount until the loose match exists.

5. The method of claim 4, where the predetermined amount is one character, and the predetermined threshold size is five characters.

6. The method of claim 4, where the first list of approved values comprises a list of user agent header values corresponding to user devices comprising WAP-compliant software that communicates the data to the server in an end-to-end secure manner.

7. The method of claim 2, where the second list of approved values comprises a list of IP addresses of network devices that do not decrypt the data when the data travels through the network device.

8. The method of claim 7, where the data does not include a header portion of the communication from the user device to the server.

9. The method of claim 1, where the first identifier is a user agent profile corresponding to the user device, and the value of the first identifier comprises:

a value of a model attribute corresponding to the user agent profile;

a value of a vendor attribute corresponding to the user agent profile; and

a value of a version header corresponding to the user agent profile.

10. The method of claim 9, where loosely comparing the value of the first identifier to the first list of approved values comprises:

loosely comparing the value of the model attribute to a list of approved model values; and

loosely comparing the value of the vendor attribute to a list of approved vendor values.

11. The method of claim 1, further comprising, if the request for access to the server is granted, then the response to the request comprising information corresponding to a login screen.

12. A method for determining whether communication from a user device to a server is end-to-end secure, comprising:

identifying a user device comprising a first WAP-compliant software;

identifying a network device comprising a second WAP-compliant software;

determining whether a data originating from the user device to the network device and then to the server is end-to-end secure;

if the data is end-to-end secure, recording a value of a first identifier corresponding to the user device in a first computer file; and

if the data is end-to-end secure, recording a value of a second identifier corresponding to the network device in a second computer file.

13. The method of claim 12, where the first WAP-compliant software comprises a browser in the user device that is WAP version 2.0 compliant, and the network device comprises a WAP-compliant gateway, and the first identifier comprises a user agent header, and the value of the second identifier comprises an IP address.

14. The method of claim 12, where the data is not end-to-end secure if the data is decrypted by the network device.

15. The method of claim 13, where the data is not end-to-end secure if a value of a via header is present in a header relating to the data.

16. The method of claim 13, where the first identifier comprises a model attribute of a user agent profile corresponding to the user device and a vendor attribute of the user agent profile.

17. The method of claim 12, where the first computer file and the second computer file are part of a single file in XML format.

18. a computer-readable medium comprising computer-executable instructions to perform a method comprising:

receiving a data generated by a user device comprising software compliant with a wireless protocol, the data traveling through a network device to a server;

identifying a value of a user agent header corresponding to the user device;

identifying a value of an IP address corresponding to a network device;

determining whether the data is end-to-end secure from the user device to the server, comprising;

loosely comparing the value of the user agent header to a list of user agent header values;

comparing the value of the IP address to a list of IP address values; and

determining whether a value of a via header is present in a header relating to the data; and

transmitting a response to the user device, where if the data is end-to-end secure, then the response including an indication that access to the server is granted, else the response including an indication that the request for access to the server is denied.

19. The computer-readable medium of claim 18, where the network device is a WAP-compliant gateway.

20. The computer-readable medium of claim 18, where the list of approved user agent header values are stored in a computer data file.

21. A system, comprising:

a user device comprising a software compliant with a wireless protocol;

a gateway for receiving a wireless transmission from the user device; and

a server comprising memory storing computer-readable instructions, and a processor for executing the computer-readable instructions to perform a method comprising;

receiving a data from the user device, the data traveling through the gateway;

identifying a value of a first identifier corresponding to the user device;

identifying a value of a second identifier corresponding to a network device; and

determining whether the data is end-to-end secure from the user device to the server, including loosely comparing the value of the first identifier to a first list of approved values, comparing the value of the second identifier to a second list of approved values.

22. The system of claim 21, where the wireless protocol is WAP and the gateway is a WAP-compliant gateway, the system further comprising:

a data file accessible to the processor of the server, the data file comprising IP addresses of WAP gateways that are approved for permitting end-to-end secure communication, and approved model values and approved vendor values that permit end-to-end secure communication.