VIRTUALIZATION AND SECURE PROCESSING OF DATA

• US 20140108263A1
• Filed: 10/17/2013
• Published: 04/17/2014
• Est. Priority Date: 10/17/2012
• Status: Active Grant

• Current Assignee: Royal Bank of Canada (The PNC Financial Services Group, Inc.)
• Original Assignee: Royal Bank of Canada (The PNC Financial Services Group, Inc.)
• Inventors: ORTIZ, Edison U., LEE, Terry W., MANTIA, Linda
• Granted Patent: US 9,082,119 B2
• Time in Patent Office: Days
• US Class Current: 705/71
• CPC Class Codes: G06Q 20/322 Aspects of commerce using mobile devices [M-devices]
• CPC Class Codes: G06Q 20/3221 Access to banking information through M-devices
• CPC Class Codes: G06Q 20/3223 Realising banking transactions through M-devices
• CPC Class Codes: G06Q 20/3278 RFID or NFC payments by means of M-devices
• CPC Class Codes: G06Q 20/36 using electronic wallets or electronic money safes
• CPC Class Codes: G06Q 20/367 involving electronic purses or money safes
• CPC Class Codes: G06Q 20/3672 initialising or reloading thereof
• CPC Class Codes: G06Q 20/38215 Use of certificates or encrypted proofs of transaction rights
• CPC Class Codes: G06Q 20/3823 combining multiple encryption tools for a transaction
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 2220/00 Business processing using cryptography postage metering system using cryptography G06Q2250/05

Abstract

Systems, methods, and non-transient machine-interpretable data representing executable instruction sets and/or other products for the processing of data for the secure creation, administration, manipulation, processing, and storage of electronic data useful in the processing of payment transactions and other secure data processes. In various aspects and embodiments the disclosure provides secure means for the authorization of sensitive and other data processes subject to controlled access. Such processes include, for example the creation, administration, authorization, virtualization, storage, and other manipulation or processing of electronic data representing characteristics of, instructions for, and information associated with consumer, business, and other payment accounts, and other forms of secure payment elements, such as payment tokens; and data useful in processing transactions using such accounts and elements. Information associated with particular payment means, such as accounts or payment tokens, can be stored, for example, in a data set, usually secure, sometimes referred to as a virtual or electronic wallet, or a secure payment token.

Claims

1. A mobile communication device comprising:

at least one wireless communication system;

at least one data processor; and

at least one persistent memory device, the at least one persistent memory device comprising data representing at least;

at least one identifier associated with at least one authorized user of at least one transaction payment account;

at least one identifier associated with the mobile communication device; and

an identifier associated with the at least one transaction payment account;

a machine-executable coded instruction set configured to cause the at least one data processor to;

access the persistent memory device and generate a transaction request data set, the transaction request data set comprising at least;

the at least one identifier associated with at least one authorized user of at least one transaction payment account;

the at least one identifier associated with the mobile communication device; and

the identifier associated with the at least one transaction payment account; and

to

route the generated transaction data request to a transaction adjudication server, using the wireless communication system.

2. The mobile communication device of claim 1, the at least one persistent memory comprising at least one removable memory device.

3. The mobile communication device of claim 1, the at least one persistent memory further comprising data representing at least one encrypted payment token.

4. The mobile communication device of claim 1, the at least one persistent memory further comprising data representing at least one private key useable for at least one of encrypting and decrypting data in accordance with a private key encryption protocol.

5. A method, performed by at least one processor of a mobile communication device comprising persistent memory and a wireless communication system, the method comprising:

generating, using data accessed in the persistent memory, a transaction request data set, the transaction data set comprising at least;

at least one identifier associated with at least one authorized user of at least one transaction payment account;

at least one identifier associated with the mobile communication device; and

identifier associated with the at least one transaction payment account; and

data representing a requested transaction amount; and

routing the generated transaction data request to a transaction adjudication server, using the wireless communication system.

6. A transaction communication device comprising:

at least one network communication system;

at least one data processor; and

at least one persistent memory device, the at least one persistent memory device comprising data representing at least;

at least one identifier associated with at least one authorized user of at least one transaction payment account;

at least one identifier associated with the transaction communication device; and

an identifier associated with the at least one transaction payment account;

a machine-executable coded instruction set configured to cause the at least one data processor to;

access the persistent memory device and generate a transaction request data set, the transaction data set comprising at least;

the at least one identifier associated with at least one authorized user of at least one transaction payment account;

the at least one identifier associated with the transaction communication device; and

the identifier associated with the at least one transaction payment account; and

to

route the generated transaction data request to a transaction adjudication server, using the network communication system.

7. A method, performed by at least one processor of a transaction communication device, the transaction communication device comprising at least one input device and a network communication system, the method comprising:

receiving, from the input device, signals representing a purchaser-defined identifier;

using at least the purchaser-defined identifier, accessing one of a plurality of transaction authorization data sets; and

using at least the accessed transaction authorization data set, generating a transaction request data set, the transaction request data set comprising at least two of;

an identifier associated with at least one authorized user of at least one transaction payment account;

an identifier associated with the transaction communication device; and

an identifier associated with the at least one transaction payment account; and

routing the generated transaction data request to a transaction adjudication server, using the wireless communication system.

8. A server for adjudicating electronically-coded transaction requests, comprising one or more non-transient machine-executable coded instructions configured to cause the server to:

access a transaction request data set generated by a networked purchaser communication device, the transaction request data set comprising machine-interpretable data representing at least;

at least one identifier associated with at least one authorized user of at least one transaction payment account;

at least one identifier associated with the networked purchaser communication device; and

an identifier associated with the at least one transaction payment account;

data representing a transaction amount; and

data representing a transaction authorization routing address;

determine that;

the received identifier associated with an authorized user of the transaction payment account corresponds to at least one authorized user associated with the transaction authorization data set; and

the received identifier associated with a purchaser communication device corresponds to at least one purchaser communication device associated with the transaction authorization data set;

determine that an amount of funds associated with the identified transaction payment account is sufficient to cover the transaction amount; and

conditioned on said determinations, generate an transaction authorization data set; and

route the transaction authorization data set to the transaction authorization routing address.

9. A method of conducting an electronic transaction, the method performed by at least one processor of a financial account holder server and comprising:

receiving a transaction request data set generated by a networked purchaser communication device, the transaction request data set comprising;

an identifier associated with the at least one transaction payment account administered by the financial account holder;

at least one identifier associated with an authorized user of the transaction payment account;

at least one identifier associated with the purchaser communication device;

data representing a transaction amount; and

data representing a transaction authorization routing address;

accessing a transaction authorization data set associated with the transaction payment account represented by the received transaction payment account identifier; and

determining that;

the received identifier associated with an authorized user of the transaction payment account corresponds to at least one authorized user associated with the transaction authorization data set; and

the received identifier associated with a purchaser communication device corresponds to at least one purchaser communication device associated with the transaction authorization data set;

determining that an amount of funds associated with the identified transaction payment account is sufficient to cover the transaction amount; and

conditioned on said determinations, generating an transaction authorization data set; and

route the transaction authorization data set to the transaction authorization routing address.

10. A method of authorizing a data process, the method performed by at least one processor of an authorization adjudication server and comprising:

receiving a data processing request generated by a requesting client device, the data processing request comprising;

data representing at least one identifier associated with an application data set;

data representing at least one identifier associated with a requesting user of a data processing application associated with the application data set; and

at least one identifier associated with the requesting client device;

accessing an authorization data set and determining that;

the received identifier associated with an application data set is compatible with authorization of the data processing request;

the received identifier associated with a requesting user of the data processing application corresponds to at least one authorized user of the data processing application; and

the received identifier associated with the requesting client device corresponds to at least one authorized client device associated with the application authorization data set; and

conditioned on said determination, authorizing the requested data process.

11. An authorization adjudication server comprising at least one network communication system and least one data processor;

the at least one data processor configured to;

receive, via the network communication system, a data processing request generated by an requesting client device, the data processing request comprising;

data representing at least one identifier associated with an application data set;

data representing at least one identifier associated with a requesting user of a data processing application associated with the application data set; and

at least one identifier associated with the requesting client device;

access an authorization data set and determine that;

the received identifier associated with an application data set is compatible with authorization of the data processing request;

the received identifier associated with a requesting user of the data processing application corresponds to at least one authorized user of the data processing application; and

the received identifier associated with the requesting client device corresponds to at least one authorized client device associated with the application authorization data set; and

conditioned on said determination, authorize execution of the requested data process.