Apparatus and method for conducting securing financial transactions

• US 9,053,471 B2
• Filed: 08/29/2008
• Issued: 06/09/2015
• Est. Priority Date: 08/31/2007
• Status: Active Grant

• Current Assignee: 4361423 Canada Incorporated
• Original Assignee: 4361423 Canada Incorporated
• Inventors: Mages, Kenneth G., Lo, Chi Wah, Mages, Kent H., Tang, Tai Kwan
• Primary Examiner(s): Coppola, Jacob C.
• Application Number:
  US12/675,621
• Publication Number:
  US 20110099112A1
• Time in Patent Office: 2,475 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: G06Q 20/12 specially adapted for electronic shopping systems
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G07F 7/1075 PIN is checked remotely
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

A system and method are disclosed for conducting secure electronic transactions using dual-authentications. A secure server stores security information for a plurality of users and authorizes transactions being conducted by these users. A user computer system having a trusted platform module is used for storing security information relating to at least one user account. Protected environments are created to facilitate secure connections based on at least the security information stored in the trusted platform module. Transactions between the user/electronic merchants and between the user/secure server are conducted within protected environments. When a user conducts an electronic transaction with an electronic merchant, the transaction is authenticated by the secure server before can be completed.

Claims

1. A method for effecting a secure financial transaction between a user and a merchant, comprising:

establishing a connection between a secure server and a user computer comprising a virtual appliance module that creates a secure program execution space that prevents access from any other processes running on the user computer system, said virtual appliance module containing transaction information, said connection being established without an external point of sale device;

inputting at least one authentication parameter;

retrieving security information located on said virtual appliance module;

encrypting said security information along with said at least one authentication parameter to form an encrypted PIN block;

retrieving said transaction information located on said virtual appliance module;

submitting said encrypted PIN block and said transaction information to said secure server;

verifying said security information within the encrypted PIN block;

verifying said transaction information based on said security information; and

sending an indication of the validity of the security information to said merchant.

2. The method of claim 1 which includes verifying whether said user is authorized to perform said secure financial transaction.

3. The method of claim 2 which includes registering said user to perform said secure financial transaction.

4. The method of claim 3 in which said registering comprises:

supplying said authentication parameter;

establishing a secure connection to a server;

exchanging said security information relating to said user; and

embedding said security information in said virtual appliance module.