METHOD, SYSTEM AND APPARATUS FOR PROVIDING TRANSACTION VERIFICATION

• US 20110213711A1
• Filed: 03/01/2010
• Published: 09/01/2011
• Est. Priority Date: 03/01/2010
• Status: Active Application

• Current Assignee: Entrust Corp.
• Original Assignee: Entrust Incorporated (Entrust Corp.)
• Inventors: Skinner, Eric R., Neville, Steve Robert, Moir, Michael Andrew
• Application Number:
  US12/715,199
• Publication Number:
  US 20110213711A1
• Time in Patent Office: Days
• US Class Current: 705/71
• CPC Class Codes: G06F 21/43 wireless channels
• CPC Class Codes: G06F 21/6263 during internet communication, e.g. revealing personal data from cookies
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/425 using two different networks, one for transaction and one for security confirmation
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications

Abstract

A system and method provides electronic transaction verification using multiple different units. A first unit initiates an electronic transaction in response to user authentication affirmation by, for example, a server (such as a web server). After the user has been authenticated, another unit, such as a mobile device, receives a transaction confirmation request for the electronic transaction that is ongoing via the first unit. In addition, the second unit also receives from, for example, the server, transaction information based on the electronic transaction. The second device through a user interface and without requiring a user to enter transaction information, provides the received transaction information from the server for evaluation by a user of the second unit. The second unit requests from the user, in response to the transaction confirmation request, confirmation of the transaction. The second unit generates a transaction confirmation code based on the received transaction information if the transaction is confirmed by the user of the second unit and sends it to the server for verification by the server.

Claims

1. A method for providing transaction verification comprising:

initiating an electronic transaction via by a first unit and a server in response to an initial user authentication;

during the electronic transaction, receiving from the server, by a second unit, a transaction confirmation request for the transaction and transaction information via a back channel based on the transaction;

providing through a user interface, by the second unit, the received transaction information for evaluation by a user of the second unit;

requesting by the second unit, in response to the transaction confirmation request, confirmation of the transaction by the user of the second unit;

generating, by the second unit, a transaction confirmation code based on the received transaction information in response to a transaction confirmation by the user of the second unit; and

sending the transaction confirmation code that is based on the received transaction information to the server for verification.

2. The method of claim 1 comprising generating an expected transaction confirmation code for the second unit and comparing the expected transaction confirmation code with the received transaction confirmation code from the second unit to verify whether the transaction should be allowed.

3. The method of claim 1 wherein the second unit generates the transaction confirmation code by electronically signing the received transaction information using a cryptographic key associated with the second unit.

4. The method of claim 1 comprising displaying on the second unit a user interface that visually presents the received transaction information in clear text and wherein the user interface comprises controls operable to confirm or cancel the transaction.

5. The method of claim 1 comprising sending a transaction cancellation message to the server from the second unit in response to user cancellation of the transaction via a cancellation indication entered by the user of the second unit in response to presentation of the received transaction information from the server.

6. The method of claim 3 wherein the second unit generates the transaction confirmation code by electronically signing the received transaction information using at least one of:

a shared secret key assigned to the second unit and to the server, or by using an asymmetric cryptographic algorithm.

7. An electronic transaction system comprising:

a server operative to provide a transaction session and communicate via a back channel with a second unit;

a first unit operative to initiate an electronic transaction with the server in response to user authentication affirmation;

the second unit operative to;

receive during the transaction, a transaction confirmation request for the electronic transaction and transaction information based on the electronic transaction from the server

provide through a user interface without user intervention, the received transaction information for evaluation by a user of the second unit

request, in response to the transaction confirmation request, confirmation of the transaction by the user;

generate a transaction confirmation code based on the received transaction information in response to a transaction confirmation by the user; and

send the transaction confirmation code that is based on the received transaction information to the server for verification.

8. The system of claim 7 wherein the server is operative to cryptographically generate an expected transaction confirmation code for the second unit and compare the expected transaction confirmation code with the received transaction confirmation code from the second unit to verify whether the transaction should be allowed.

9. The system of claim 7 wherein the second unit generates the transaction confirmation code by electronically signing the received transaction information using a cryptographic key associated with the device.

10. The system of claim 7 wherein the second unit is a wireless mobile unit and is operative to provide an user interface that visually presents the received transaction information in clear text on the user interface and wherein the user interface comprises user controls operable to confirm or cancel the transaction.

11. The system of claim 10 wherein the second unit is operative to send a transaction cancellation message to the server in response to user cancellation of the transaction via a cancellation indication entered by the user of the second unit in response to presentation of the received transaction information from the server.

12. The system of claim 9 wherein the second unit generates the transaction confirmation code by electronically signing the received transaction information using at least one of:

a shared secret key assigned to the second unit and to the server, or by using an asymmetric cryptographic algorithm.

13. The system of claim 7 wherein the second unit is operative to store and display on a user interface, transaction history data corresponding to a plurality of electronic transactions that were confirmed or cancelled using the second unit.

14. A wireless mobile device comprising:

a wireless transceiver;

one or more processors operatively coupled to the wireless transceiver;

memory comprising executable instructions that when executed cause the one or more processors to;

receive from the transceiver during the transaction, a transaction confirmation request for the electronic transaction and transaction information based on the electronic transaction from the web server

provide through a user interface, the received transaction information for evaluation by a user of the mobile device

request, in response to the transaction confirmation request, confirmation of the transaction by the user of the mobile device;

generate a transaction confirmation code based on the received transaction information in response to a transaction confirmation by the user of the mobile device; and

send, via the wireless transceiver, the transaction confirmation code that is based on the received transaction information to the web server for verification.

15. The wireless mobile device of claim 14 wherein the one or more processors are operative to generate the transaction confirmation code by electronically signing the received transaction information using a cryptographic key associated with the device.

16. The wireless mobile device of claim 14 wherein the one or more processors are operative to display a user interface that visually presents the received transaction information in clear text and wherein the user interface comprises controls operable to confirm or cancel the transaction.

17. The wireless mobile device of claim 14 wherein the one or more processors are operative to send a transaction cancellation message to a server in response to user cancellation of the transaction via a cancellation indication entered by the user of the device in response to presentation of the received transaction information from the server.

18. The wireless mobile device of claim 15 wherein the one or more processors are operative to generate the transaction confirmation code by electronically signing the received transaction information using at least one of:

a shared secret key assigned to the mobile device and to a server, or by using an asymmetric cryptographic algorithm.

19. The wireless mobile device of claim 14 wherein the one or more processors are operative to store and display on a user interface, transaction history data corresponding to a plurality of electronic transactions that were confirmed or cancelled using the mobile device.