Methods and apparatus for conducting electronic transactions

• US 7,801,827 B2
• Filed: 04/09/2004
• Issued: 09/21/2010
• Est. Priority Date: 08/31/1999
• Status: Expired due to Fees

• Current Assignee: Liberty Peak Ventures, LLC (Dominion Harbor Enterprises, LLC)
• Original Assignee: American Express Travel Related Services Company, Inc. (American Express Company)
• Inventors: Bennett, Russell, White, Dirk B, Swift, Nick, Simkin, Marvin, Royer, Coby, Lake, Walter Donald, Johnstone, David E, Johnson, Michael G., Hohle, William G., Gorgol, Zygmunt Steven, Glazer, Elliot Harold, Bishop, Fred Alan
• Primary Examiner(s): Agwumezie, Charles C
• Application Number:
  US10/821,379
• Publication Number:
  US 20040243520A1
• Time in Patent Office: 2,356 Days
• Field of Search: 705/51, 705/64, 705/76, 726 22- 25, 709/223
• US Class Current: 705/67
• CPC Class Codes: G06Q 20/105 involving programming of a portable memory device, e.g. IC cards, "electronic purses"
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/363 with the personal data of a user
• CPC Class Codes: G06Q 20/367 involving electronic purses or money safes
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G06Q 20/4097 using mutual authentication between devices and transaction partners
• CPC Class Codes: G06Q 30/0613 Third-party assisted
• CPC Class Codes: G07F 7/0866 by active credit-cards adapted therefor G07F7/1008 takes precedence
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system

Abstract

A system and method for conducting electronic commerce are disclosed. In various embodiments, the electronic transaction is a purchase transaction. A user is provided with an intelligent token, such as a smartcard containing a digital certificate. The intelligent token suitably authenticates with a server on a network that conducts all or portions of the transaction on behalf of the user. In various embodiments a wallet server interacts with a security server to provide enhanced reliability and confidence in the transaction. In various embodiments, the wallet server includes a toolbar. In various embodiments, the digital wallet pre-fills forms. Forms may be pre-filled using an auto-remember component.

Claims

1. A method comprising:

receiving, by a first server comprising a processor and a non-transitory, tangible memory, a transaction request from a user for a transaction at a merchant server;

receiving, by said first server, a third party request comprising executable commands being associated with a selected programming language;

scanning said third party request to find executable commands

at least one of editing and removing at least a portion of said executable commands,

wherein said at least one of editing and removing comprises at least one of

rendering said executable commands unexecutable by a network client by removing a character of said executable commands; and

rendering said executable commands unexecutable by said network client by replacing particular characters within said executable commands;

issuing a challenge to a second server comprising a processor and a non-transitory, tangible memory and forwarding the challenge from said second server to the user, wherein said challenge is passed to an intelligent token for processing said challenge, wherein said intelligent token generates a response to said challenge;

receiving said response by said second server from the user based upon said challenge;

processing said response by said second server and verifying the intelligent token;

assembling credentials for the transaction at said first server, said credentials comprising at least one key;

providing at least a portion of said assembled credentials to said user;

receiving, by said second server, a second request from said user, said second request including said portion of said assembled credentials provided to said user; and

validating, by said second server, said portion of said assembled credentials provided to said user with said key of said assembled credentials providing access to a transaction service.

2. The method of claim 1, further comprising rejecting a request when said request contains said executable commands having a hostile character.

3. The method of claim 1, further comprising logging said executable commands to form a security log.

4. The method of claim 1, wherein said executable commands cause an unwanted action when executed.

5. The method of claim 1, wherein said executable commands are malicious.

6. The method of claim 1, further comprising receiving a request for a connection at said network server from said network client.

7. The method of claim 1 wherein said programming language comprises javascript.

8. The method claim 1, wherein said rendering said executable commands unexecutable by said network client by replacing particular characters within said executable commands comprises converting a script format character to another character, wherein said script format character identifies a block of code.

9. The method claim 1, wherein said rendering said executable commands unexecutable by said network client by removing a character of said executable commands comprises removing a script format character, wherein said script format character identifies a block of code.

10. The method of claim 3, further comprising reviewing said security log to determine whether said executable commands are hostile.

11. The method of claim 6, further comprising verifying that a response from said network server to said network client is void of said executable commands.

12. The method of claim 11, further comprising providing said response from said network server to said network client.