Dynamic pairing system for securing a trusted communication channel

• US 8,924,296 B2
• Filed: 06/22/2010
• Issued: 12/30/2014
• Est. Priority Date: 06/22/2010
• Status: Active Grant

• Current Assignee: American Express Travel Related Services Company, Inc. (American Express Company)
• Original Assignee: American Express Travel Related Services Company, Inc. (American Express Company)
• Inventors: Bailey, JR., Samuel A.
• Primary Examiner(s): Niquette, Robert
• Assistant Examiner(s): Liu, Jennifer
• Application Number:
  US12/820,186
• Publication Number:
  US 20110313925A1
• Time in Patent Office: 1,652 Days
• Field of Search: 705 35- 45
• US Class Current: 705/44
• CPC Class Codes: G06Q 20/322 Aspects of commerce using mobile devices [M-devices]
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G06Q 40/02 Banking, e.g. interest calculation or account maintenance credit or loans G06Q40/03

Abstract

A system for securing a trusted communications channel for a mobile financial transaction is provided by receiving, from a user via an external terminal, a request for an access control entitlement to complete a financial transaction. A total risk level associated with the financial transaction is computed. A required trust score is determined based on the total risk level. User identification data associated with the user is received from one or more data sources. The user identification data is validated. A user trust score associated with the user is computed based on the validated identification data. The user trust score is compared to the required trust score. The access control entitlement is transmitted to the user via the external terminal if the user trust score is greater than or equal to the required trust score.

Claims

1. A method for securing a trusted communications channel for a mobile financial transaction, the method comprising:

receiving, from a user via an external terminal, an access control entitlement request, wherein the request corresponds to a financial transaction;

computing, by a processor included in a machine, a total risk level associated with the financial transaction;

storing, in a database, a table that matches a plurality of total risk levels to a plurality of required trust scores, correspondingly, wherein, for a transaction having one of the plurality of total risk levels, the corresponding required trust score is required in order to be granted the access control entitlement;

determining which of the plurality of required trust scores is required in order to be granted the access control entitlement by;

matching, by the processor, the computed total risk level associated with the financial transaction to a corresponding one of the plurality of total risk levels stored in the database, and

identifying, in the table, one required trust score of the plurality of required trust scores that corresponds to the corresponding one of the plurality of total risk levels obtained by the matching;

receiving user identification data associated with the user from one or more data sources;

validating, by the processor, the user identification data;

computing, by the processor, a user trust score associated with the user based on the validated identification data;

comparing, by the processor, the user trust score to the one required trust score obtained by the identifying; and

transmitting the access control entitlement, to the user via the external terminal, if the user trust score is greater than or equal to the one required trust score obtained by the identifying.

2. The method of claim 1, wherein computing a total risk level associated with the financial transaction further includes:

computing a value of the financial transaction;

retrieving security-related sensor data from trust mediator agents;

computing, based on the security-related sensor data, a probability that financial transaction data will be compromised; and

computing a product of the value of the financial transaction and the probability that the financial transaction data will be compromised.

3. The method of claim 1, wherein receiving user identification data associated with the user further includes at least one of:

receiving user identification data from the user via the external terminal;

receiving user identification data from a third party via a third party external terminal;

or

retrieving user identification data from an external database.

4. The method of claim 1, wherein validating the user identification data further includes:

comparing the user identification data to data retrieved from at least one of (1) a known party database, (2) a third party external terminal, or (3) an external database.

5. The method of claim 1, wherein computing the user trust score further includes:

retrieving, from the database, an individual trust score corresponding to each portion of the validated user identification data, respectively; and

computing the user trust score as a summation of each retrieved individual trust score.

6. A system for securing a trusted communications channel for a mobile financial transaction, the system comprising:

a machine including a processor coupled to a memory, the processor being operable to;

receive, from a user via an external terminal, an access control entitlement request, wherein the request corresponds to a financial transaction;

compute a total risk level associated with the financial transaction;

store, in a database, a table that matches and a plurality of total risk levels to a plurality of required trust scores, correspondingly, wherein, for a transaction having one of the plurality of total risk levels, the corresponding required trust score is required in order to be granted the access control entitlement;

determine which of the plurality of required trust scores is required in order to be granted the access control entitlement by;

matching the computed total risk level associated with the financial transaction to a corresponding one of the plurality of total risk levels stored in the database, and

identifying, in the table, one required trust score of the plurality of required trust scores that corresponds to the corresponding one of the plurality of total risk levels obtained by the matching;

receive user identification data associated with the user from one or more data sources;

validate the user identification data;

compute a user trust score associated with the user based on the validated identification data;

compare the user trust score to the one required trust score obtained by the identifying; and

transmit the access control entitlement, to the user via the external terminal, if the user trust score is greater than or equal to the one required trust score obtained by the identifying.

7. The system of claim 6, wherein the processor is further operable to:

compute a value of the financial transaction;

retrieve security-related sensor data from trust mediator agents;

compute, based on the security-related sensor data, a probability that financial transaction data will be compromised; and

compute a product of the value of the financial transaction and the probability that the financial transaction data will be compromised.

8. The system of claim 6, wherein the processor is further operable to:

receive user identification data from the user via the external terminal;

receive user identification data from a third party via a third party external terminal; and

retrieve user identification data from an external database.

9. The system of claim 6, wherein the processor is further operable to:

compare the user identification data to data retrieved from at least one of (1) a known party database, (2) a third party external terminal, or (3) an external database.

10. The system of claim 6, wherein the processor is further operable to:

retrieve, from the database, an individual trust score corresponding to each portion of the validated user identification data, respectively; and

compute the user trust score as a summation of each retrieved individual trust score.

11. A non-transitory computer-readable medium having stored thereon sequences of instructions, the sequences of instructions including instructions, which, when executed by a computer system, cause the computer system to perform:

receiving, from a user via an external terminal, an access control entitlement request, wherein the request corresponds to a financial transaction;

computing a total risk level associated with the financial transaction;

storing, in a database, a table that matches a plurality of total risk levels to a plurality of required trust scores, correspondingly, wherein, for a transaction having one of the plurality of total risk levels, the corresponding required trust score is required in order to be granted the access control entitlement;

determining which of the plurality of required trust scores is required in order to be granted the access control entitlement by;

matching the computed total risk level associated with the financial transaction to a corresponding one of the plurality of total risk levels stored in the database, and

identifying, in the table, one required trust score of the plurality of required trust scores that corresponds to the corresponding one of the plurality of total risk levels obtained by the matching;

receiving user identification data associated with the user from one or more data sources;

validating the user identification data;

computing a user trust score associated with the user based on the validated identification data;

comparing the user trust score to the one required trust score obtained by the identifying; and

transmitting the access control entitlement, to the user via the external terminal, if the user trust score is greater than or equal to the one required trust score obtained by the identifying.

12. The non-transitory computer-readable medium of claim 11, wherein the sequences of instructions further include instructions, which, when executed by the computer system, cause the computer system to perform:

computing a value of the financial transaction;

retrieving security-related sensor data from trust mediator agents;

computing, based on the security-related sensor data, a probability that financial transaction data will be compromised; and

computing a product of the value of the financial transaction and the probability that the financial transaction data will be compromised.

13. The non-transitory computer-readable medium of claim 11, wherein the sequences of instructions further include instructions, which, when executed by the computer system, cause the computer system to perform:

receiving user identification data from the user via the external terminal;

receiving user identification data from a third party via a third party external terminal; and

retrieving user identification data from an external database.

14. The non-transitory computer-readable medium of claim 11, wherein the sequences of instructions further include instructions, which, when executed by the computer system, cause the computer system to perform:

comparing the user identification data to data retrieved from at least one of (1) a known party database, (2) a third party external terminal, or (3) an external database.

15. The non-transitory computer-readable medium of claim 11, wherein the sequences of instructions further include instructions, which, when executed by the computer system, cause the computer system to perform:

retrieving, from the database, an individual trust score corresponding to each portion of the validated user identification data, respectively; and

computing the user trust score as a summation of each retrieved individual trust score.