Secure Transaction Systems and Methods

• US 20110082801A1
• Filed: 03/31/2010
• Published: 04/07/2011
• Est. Priority Date: 10/06/2009
• Status: Abandoned Application

• Current Assignee: Synaptics Incorporated
• Original Assignee: Validity Sensors Incorporated (Synaptics Incorporated)
• Inventors: Schwab, Frank, Baghdasaryan, Davit, Hattery, Larry, Chan, Philip Yiu Kwong, Kesanupalli, Ramesh
• Application Number:
  US12/751,964
• Publication Number:
  US 20110082801A1
• Time in Patent Office: Days
• US Class Current: 705/75
• CPC Class Codes: G06Q 20/10 specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/40145 Biometric identity checks

Abstract

A transaction request containing transaction details from a requesting device is generated by a web-enabled application executing on the requesting device. A secure signature associated with the transaction details is calculated using a secret key. The transaction details and the secure signature associated with the transaction details are communicated to the requesting device. Confirmation information is received from the requesting device and validated. If the confirmation information is valid, the requested transaction is implemented.

Claims

1. A computer-implemented method comprising:

receiving a transaction request containing transaction details from a requesting device, wherein the transaction request is generated by a web-enabled application executing on the requesting device;

calculating a secure signature associated with the transaction details using a secret key;

communicating the transaction details and the secure signature associated with the transaction details to the requesting device;

receiving confirmation information from the requesting device;

validating the confirmation information; and

implementing the requested transaction if the confirmation information is valid.

2. The method of claim 1, wherein the confirmation information includes biometric information associated with a user of the requesting device.

3. The method of claim 2, wherein the biometric information includes fingerprint characteristics.

4. The method of claim 1, wherein the confirmation information includes a one-time use password.

5. The method of claim 1, wherein the confirmation information includes a one-time use password based on RSA SecurID technology.

6. The method of claim 1, wherein the confirmation information includes a one-time use password based on HOTP (OATH) standard.

7. The method of claim 1, wherein the confirmation information includes a one-time use password based on TOTP (OATH) standard.

8. The method of claim 1, wherein the confirmation information includes a one-time use password based on OCRA (OATH) standard.

9. The method of claim 1, wherein the confirmation information includes an RSA signature.

10. The method of claim 1, wherein the secure signature is created using a cryptographic algorithm by signing transaction details with the secret key.

11. The method of claim 1, wherein the secure signature is created using a cryptographic algorithm by signing transaction details and additional data with the secret key.

12. The method of claim 1, wherein the secure signature is created using a public key cryptography based algorithm.

13. The method of claim 1, wherein the secure signature is created using a public key cryptography based algorithm by signing transaction details and random buffer data with the secret key.

14. The method of claim 1, further comprising communicating a random challenge to the requesting device along with the transaction details and the secure signature associated with the transaction details.

15. The method of claim 1, wherein the web-enabled application is a web browser application.

16. The method of claim 1, wherein the web-enabled application is a web browser plug-in.

17. The method of claim 1, wherein the web-enabled application is a web browser add-on.

18. The method of claim 1, wherein the web-enabled application is a web browser extension.

19. The method of claim 1, wherein the secret key is shared between the requesting device and a web server.

20. A computer comprising:

a processor; and

a memory coupled to the processor, the memory comprising computer-executable instructions that when executed by the processor perform operations including;

receiving a transaction request containing transaction details from a web-enabled application executing on a requesting device;

calculating a secure signature associated with the transaction details using a secret key;

communicating the transaction details and the secure signature associated with the transaction details to the requesting device;

receiving confirmation information from the requesting device;

validating the received confirmation information; and

implementing the requested transaction if the confirmation information is valid.

21. The computer of claim 20, wherein the received confirmation information includes biometric information associated with a user of the requesting device.

22. The computer of claim 20, wherein the received confirmation information includes fingerprint characteristics associated with a user'"'"'s finger.