Method and device for end-user verification of an electronic transaction

• US 20090222660A1
• Filed: 02/28/2008
• Published: 09/03/2009
• Est. Priority Date: 02/28/2008
• Status: Active Grant

• Current Assignee: AT&T Labs Incorporated (AT&T, Inc.)
• Original Assignee: AT&T Labs Incorporated (AT&T, Inc.)
• Inventors: Miller, Robert R. II, Ji, Lusheng, Killian, Thomas, Kormann, David, Bowen, Donald John, Schryer, Norman L.
• Granted Patent: US 8,996,867 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: G06Q 20/3229 Use of the SIM of a M-device as secure element
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G07F 7/1075 PIN is checked remotely
• CPC Class Codes: G07F 7/125 Offline card verification
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32

Abstract

The present invention provides methods and apparatuses for verifying that a transaction is legitimate. The methods and apparatuses use protected memory space, such as kernel space of an operating system, or a separate memory space, such as is available on a SIM card of a cellular phone. The method of the invention proceeds by creating a transaction identification string (TID) and associating the TID with a transaction. The TID contains data relevant to or associated with the transaction and is typically readable by an end-user. The transaction is then interrupted until a user responds in the affirmative to allow completion of the transaction. Methods and devices used in the invention are particularly well suited to M-commerce, where transactions originating from a device are typically recognized by a merchant as coming from the owner of the device without further authentication.

Claims

1. A method for verification of a transaction on an end-user device comprising:

creating a transaction identification string;

interrupting an electronic communication associated with said transaction before completion of said transaction;

exhibiting said transaction identification string to an end-user; and

carrying out a requested action based upon a response of said end-user.

2. The method of claim 1 wherein said method is executed on a computer having a separate memory space, said separate memory space stores data used to carry out at least said steps of creating, interrupting, and displaying.

3. The method of claim 2, wherein said separate memory space is selected from the group consisting of a separate kernel space, a separate processor core, and a separate processor-memory environment.

4. The method of claim 1, wherein said requested action is to cancel said transaction.

5. The method of claim 1, wherein said requested action is to allow said transaction.

6. The method of claim 1, wherein said transaction identification string is readable by a user.

7. The method of claim 6, wherein said transaction identification string comprises transaction information.

8. The method of claim 6, wherein said transaction identification string comprises a nonce string.

9. The method of claim 1, wherein said method is carried out at least in part on a mobile device.

10. The method of claim 1, wherein said step of displaying is carried out on a first input/output channel and said step of carrying out a requested action is carried out on a second input/output channel.

11. The method of claim 1, wherein said step of displaying and said step of carrying out a requested action are carried out on a first input/output channel.

12. The method of claim 1, wherein at least said step of displaying is carried out via a short-range communication method.

13. The method of claim 1, further comprising a step of authenticating said end-user'"'"'s identity with a server.

14. The method of claim 13, wherein said step of authenticating comprises authentication using biometric data.

15. A device capable of interrupting an electronic transaction comprising:

a first memory space in which is stored data used to carry out said transaction;

a second memory space in which is stored data used to interrupt said electronic transaction; and

a display for exhibiting a transaction identification string to an end-user;

wherein

said device is adapted to interrupt a transaction and carry out a requested action of said end-user.

16. The device of claim 15, wherein said requested action is to cancel said transaction.

17. The device of claim 15, wherein said requested action is to allow said transaction.

18. The device of claim 15, wherein said second memory space is selected from the group consisting of a separate kernel space, a separate processor core, and a separate processor-memory environment.

19. The device of claim 15, wherein said device is a mobile device.

20. The device of claim 19, wherein said separate memory space is a SIM card.

21. The device of claim 15, wherein said transaction identification string is readable by a user.

22. The device of claim 21, wherein said transaction identification string comprises transaction information.

23. The device of claim 21, wherein said transaction identification string comprises a nonce string.

24. The device of claim 15, wherein at least said step of signaling is carried out via a short- range communication method.

25. The device of claim 15, further comprising the step of authenticating said end-user'"'"'s identity with a server.