Transaction security method and apparatus

• US 6,012,144 A
• Filed: 10/01/1997
• Issued: 01/04/2000
• Est. Priority Date: 10/08/1996
• Status: Expired due to Fees

• Current Assignee: Thomas E. Pickett
• Original Assignee: Thomas E. Pickett
• Inventors: Pickett, Thomas E.
• Primary Examiner(s): Beausoliel, Jr., Robert W.
• Assistant Examiner(s): Baderman, Scott T.
• Application Number:
  US08/942,570
• Time in Patent Office: 825 Days
• Field of Search: 713/200, 713/201-202, 380/21, 380/23, 380/25, 380/33, 709/217, 709/219, 705/39, 235/380
• US Class Current: 726/26
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/10 specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
• CPC Class Codes: G06Q 20/12 specially adapted for electronic shopping systems
• CPC Class Codes: G06Q 20/24 Credit schemes, i.e. "pay after"
• CPC Class Codes: G06Q 20/4037 Remote solvency checks
• CPC Class Codes: G06Q 20/425 using two different networks, one for transaction and one for security confirmation
• CPC Class Codes: G07F 7/08 by coded identity card or credit card or other personal identification means without personal verification means G07F7/02

Abstract

A method for performing secure transactions, such as credit card purchases, using two or more non-secure networks (such as the Internet and the public telephone system) in such a way that security is insured. A person wishing to initiate a secure transaction sends a message over one of the non-secure networks to a computer. That computer automatically uses the second non-secure network to contact the person back to verify the transaction. The call-back mechanism employs a method to authenticate the identity or authority of the person initiating the transaction. No single wire-tapping or network snooping device sees the entire transaction. No single database contains the entire set of information.

Claims

1. An apparatus of controlling the transmission of sensitive data to a remote data store comprising:

a) means for prompting a user to send a first subset of data, which is non-threatening, to the remote store by means of a first communications path using a first protocol; and

b) means for prompting the user to send a second subset of data, which is also non-threatening, to the remote store by means of a second communications path using a second, different protocol,

wherein said first and second subsets are used to complete a transaction.

2. The apparatus of claim 1 wherein the means for prompting the user for the first subset of data comprises a remote server that prompts or services the user with any one of the following:

a) HTML document, or

b) a client/server data entry form,

and wherein the means for prompting the user for the second subset of data comprises a computer employing any one of the following;

a) automated computer/telephone integration technology,

b) a two-way digital paging system, or

c) an exchange of messages with a personal data assistant.

3. An apparatus for enabling a user to initiate and complete a transmission of sensitive data to a remote data store comprising:

a) means for enabling a user to send a first subset of data, which is non-threatening, to the remote store by means of a first communications path using a first protocol; and

b) means for contacting the user back and prompting that user to send a second subset of data, which is also non-threatening, to the remote store by means of a second communications path using a second, different protocol,

wherein said first and second subsets are used to complete a transaction.

4. The apparatus of claim 3 wherein the means for enabling the user to initiate the transmission comprises any one of the following:

a) a World Wide Web document available on the Internet or on some private but non-secure Intranet,

b) a client/server application available to the user, or

c) an electronic mail facility,

and wherein the means for completing the transmission by contacting and prompting the user for the second subset of data comprises a computer employing any one of the following;

a) automated computer/telephone integration technology,

b) a two-way digital paging system, or

c) an exchange of messages with a personal data assistant.