SYSTEM AND METHOD OF PERFORMING ELECTRONIC TRANSACTIONS

• US 20100125729A1
• Filed: 03/12/2009
• Published: 05/20/2010
• Est. Priority Date: 11/19/2007
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Weigold, Thomas D., Visegrady, Tamas, Buhler, Peter, Kramp, Thorsten, Eirich, Thomas, Baentsch, Michael, Hermann, Reto
• Granted Patent: US 8,601,256 B2
• Time in Patent Office: Days
• US Class Current: 713/151
• CPC Class Codes: G06Q 20/08 Payment architectures
• CPC Class Codes: G06Q 20/42 Confirmation, e.g. check or permission by the legal debtor of payment
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0471 applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 67/01 Protocols

Abstract

A system and method of performing electronic transactions between a server computer and a client computer. The method implements a communication protocol with encrypted data transmission and mutual authentication between a server and a hardware device via a network, performs a decryption of encrypted server responses, forwards the decrypted server responses from the hardware device to the client computer, displays the decrypted server responses on a client display, receives requests to be sent from the client computer to the server, parses the client requests for predefined transaction information by the hardware device, encrypts and forwards client requests, displays the predefined transaction information upon detection, forwards and encrypts the client request containing the predefined transaction information to the server if a user confirmation is received, and cancels the transaction if no user confirmation is received.

Claims

1. A server computer having a processor device for executing server logic, said server device comprising:

first server logic executed by said processor device for configuring said processor device to execute a first communication protocol with encrypted data transmission and mutual authentication with a hardware device,

second server logic executed by said processor device for configuring said processor device to exchange messages related to electronic transactions with a client computer via a communication network and via the hardware device,

third server logic executed by said processor device for configuring said processor device to parse client requests received from the hardware device for predefined transaction information,

fourth server logic executed by said processor device for configuring said processor device to send, upon detection of predefined transaction information in a client request, a server response comprising a transaction confirmation request to the hardware device,

said processor device responsive to said server response to defer performance of an electronic transaction related to the received predefined transaction information, and,

fifth server logic executed by said processor device for configuring said processor device to perform the deferred electronic transaction upon receipt of a client request from the hardware device comprising a transaction confirmation message that confirms the deferred electronic transaction.

2. The server computer device according to claim 1, further comprising:

additional server logic executed by said processor device for configuring said processor device to include a challenge related to the predefined transaction information in the server response.

3. The server computer according to claim 1, further comprising:

a memory storage device for storing rule data, the rule data defining transaction information that require user confirmation.

4. The server computer according to claim 1, wherein the hardware device is a computer pointer device.

5. The server computer according to claim 1, wherein the first communication protocol is one of:

a Secure Sockets Layer (SSL) protocol or a Transport Layer Security (TLS) protocol including server and/or client authentication.

6. The server computer according to claim 1, further comprising:

a memory storage device for storing client certificates associated with said hardware device for authenticating the hardware device by implementing the client certificates.

7. The server computer according to claim 1, further comprising:

additional server logic executed by said processor device for configuring said processor device to send the transaction confirmation request to the hardware device in a packet header communicated in accordance with the first communication protocol.

8. A hardware device for controlling electronic transactions, the hardware device including a processor device for executing logic, said hardware device comprising:

a user interface for presenting information to a user; and

a hardware device interface unit, wherein the hardware device interface unit is provided for coupling the hardware device to a client computer,

first hardware device logic executed by said processor device for configuring said processor device to run a first communication protocol with encrypted data transmission and mutual authentication with a server computer,

second hardware device logic executed by said processor device for configuring said processor device to receive client requests to be sent from the client computer to the server computer,

third hardware device logic executed by said processor device for configuring said processor device to encrypt and forward client requests to the server computer,

fourth hardware device logic executed by said processor device for configuring said processor device to receive a server response from the server computer comprising a transaction confirmation request related to a previous client request,

fifth hardware device logic executed by said processor device for configuring said processor device to present the transaction confirmation request to a user via said user interface, said transaction confirmation request prompting a user for user confirmation,

sixth hardware device logic executed by said processor device for configuring said processor device to send a client request comprising a transaction confirmation message related to the transaction confirmation request back to the server computer upon user confirmation.

9. The hardware device according to claim 8, wherein the processor device is configured to execute further hardware device logic for configuring said hardware device to:

receive a challenge from the server computer related to the transaction confirmation request,

generate a cryptographic response to the challenge and include the cryptographic response in the transaction confirmation message upon said user confirmation.

10. The hardware device according to claim 8, wherein the processor device executes further hardware device logic for configuring said hardware device to sign the transaction confirmation message.

11. The hardware device according to claim 8, wherein the user interface is a display device.

12. The hardware device according to claim 8, wherein the hardware device comprises a memory storage device for storing one or more client certificates and one or more server certificates.

13. The hardware device according to claim 8, wherein the processor device executes further hardware device logic for configuring said hardware device to parse the header of client requests and/or server responses for information to be presented by the hardware device to prompt for user confirmation.

14. A hardware device for controlling electronic transactions, the hardware device comprising a user interface for presenting information to a user and a hardware device interface unit for coupling the hardware device to a client computer, said hardware device comprising:

a proxy application;

a processor device configured for loading said proxy application on the client computer via the hardware device interface unit, wherein the proxy application on said client computer is configured to forward client requests received from a browser application executing at the client computer to the hardware device; and

,

wherein the proxy application is further configured to;

forward client requests from the hardware device via a communication network to a server computer, and, forward server responses received from the server computer to the hardware device and from the hardware device to the browser application on said client computer.

15. The hardware device according to claim 14, wherein the proxy application configures a processor device to read and write a virtual file on the hardware device.

16. A computer pointer device for a computer system, operable in communication with said computer system for receiving communications there from, said computer pointer device comprising:

at least one processor device for operating in a first operating mode and a second operating mode, wherein the at least one processor device is configured for performing electronic transactions with a server computer by means of a first communication protocol in said second operating mode;

one or more button or key means for responding to information displayed by the pointer device; and

a means for displaying from said device, readable transaction information to a user.

17. The computer pointer device according to claim 16, wherein said processor is operable in a first sub-mode of the second operating mode and a second sub-mode of the second operating mode,

wherein said processor is configured in the first sub-mode to exchange messages between the client computer and the server computer that do not comprise any predefined transaction information while concurrently providing at least a part of the functionality of the first operating mode, and,

wherein said processor is configured in the second sub-mode to interrupt the functionality of the first mode upon detection of predefined transaction information and to present the predefined transaction information by its display means to prompt for user confirmation.

18. The computer pointer device of claim 16, wherein the at least one processor comprises a switch that is controlled by the client computer, wherein the switch controls whether the pointer device operates in said first operating mode or said second operating mode.

19. The computer pointer device of claim 18, wherein the switch is actuated by said proxy application executing in the client computer.

20. The computer pointer device of claim 16, wherein the at least one processor runs a Secure Sockets Layer (SSL) protocol or a Transport Layer Security (TLS) protocol after switching into the second operating mode.

21. A method for executing a secure transaction between a client computer and a server computer via a communication network, said client computer having an associated pointer device operable in a first mode of operation and a second mode of operation, said method comprising:

running, in the second operating mode, a communication protocol with encrypted data transmission and mutual authentication between the pointer device and the server computer;

scanning in a first sub-mode of the second operating mode messages to be exchanged between the client computer and the server computer via the pointer device for predefined transaction information;

switching into a second sub-mode of the second operating mode upon detection of predefined transaction information;

presenting the predefined transaction information in the second sub-mode to the user by the pointer device to prompt for a user confirmation;

forwarding the predefined transaction information to the server computer if a user confirmation is received.

22. The method according to claim 21, further comprising:

providing by the pointer device in the first sub-mode of the second operating mode at least a part of the functionality of the first mode,

interrupting, in the second sub-mode of the second operating mode, the functionality of the first mode,

returning to the first sub-mode of the second operating mode upon said user confirmation.

23. A method of performing an electronic transaction between a server computer and a client computer, the method comprising the steps of:

providing a first communication protocol with encrypted data transmission and mutual authentication between the server computer and a hardware device via a communication network,

exchanging messages related to the electronic transaction with a client computer via the communication network and via the hardware device,

parsing client requests received from the hardware device for predefined transaction information,

sending, upon detection of predefined transaction information in a client request, a server response comprising a transaction confirmation request to the hardware device,

deferring performance of an electronic transaction related to the received predefined transaction information, and,

initiating performance of the deferred electronic transaction upon receipt of a client request from the hardware device comprising a transaction confirmation message that confirms the deferred electronic transaction.

24. The method of claim 23, further comprising the steps of:

sending encrypted server responses to hardware device, the server responses being provided for decryption by the hardware device and for forwarding to the client computer, and,

receiving client requests of the client computer via the hardware device, the client requests being encrypted by the hardware device.

25. The method of claim 23, further comprising the step of:

sending the transaction confirmation request to the hardware device in a packet header communicated in accordance with the first communication protocol.