Systems and methods for detection of session tampering and fraud prevention

• US 9,196,004 B2
• Filed: 08/29/2014
• Issued: 11/24/2015
• Est. Priority Date: 03/31/2006
• Status: Active Grant

• Current Assignee: The 41st Parameter, Inc. (Experian plc)
• Original Assignee: The 41st Parameter, Inc. (Experian plc)
• Inventors: Eisen, Ori
• Primary Examiner(s): LEWIS, LISA C
• Application Number:
  US14/473,818
• Publication Number:
  US 20150221019A1
• Time in Patent Office: 452 Days
• US Class Current: 1/1
• CPC Class Codes: G06Q 20/3825 Use of electronic signatures
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G06Q 30/0635 Processing of requisition or of purchase orders
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

The invention provides methods and apparatus for detecting when an online session is compromised. A plurality of device fingerprints may be collected from a user computer that is associated with a designated Session ID. A server may include pages that are delivered to a user for viewing in a browser at which time device fingerprints and Session ID information are collected. By collecting device fingerprints and session information at several locations among the pages delivered by the server throughout an online session, and not only one time or at log-in, a comparison between the fingerprints in association with a Session ID can identify the likelihood of session tampering and man-in-the middle attacks.

Claims

1. A method for detecting an online transaction tampering, the method comprising:

establishing a Session ID for activity between a computer and a user device over a network, wherein the Session ID is associated with at least two device fingerprints collected while an article is in a virtual shopping cart;

instructing the computer to collect the at least two device fingerprints, while the article is in the virtual shopping cart, from the user device for the corresponding Session ID, wherein the at least two device fingerprints are collected from at least two different pre-selected pages displaying different content that are configured for an online transaction tampering comparison; and

comparing the at least two device fingerprints, and if the at least two device fingerprints collected from the at least two different pre-selected pages are not identical, detecting the online transaction tampering and providing an alert.

2. The method as recited in claim 1 wherein each of the at least two device fingerprints include IP address information for the user device.

3. The method as recited in claim 1 wherein each of the at least two device fingerprints include a time differential between an internal clock of the user device and another reference clock.

4. The method as recited in claim 1 further comprising the step of collecting Session ID information corresponding to the two device fingerprints at the same times as collecting the two device fingerprints.

5. The method as recited in claim 1 wherein the network is the Internet.

6. The method as recited in claim 1 wherein the computer is a server for an online merchant.

7. The method as recited in claim 1 wherein the user device is a desktop computer, laptop computer, personal digital assistant or phone.

8. The method as recited in claim 1 wherein the two different pre-selected pages are HTML pages.

9. The method as recited in claim 1 wherein the two device fingerprints are compared after an order of the article in the virtual shopping cart is finalized.

10. The method as recited in claim 9 wherein the order of the article in the virtual shopping cart is finalized after the user goes to a site checkout page to effect payment.

11. The method as recited in claim 1 wherein at least one of the two device fingerprints is collected when an order of the article in the virtual shopping cart is finalized.

12. A non-transitory computer system loaded with machine readable instructions for carrying out a method of detecting an online transaction tampering, the method comprising:

establishing a Session ID for activity between a computer and a user device over a network, wherein the Session ID is associated with at least two device fingerprints collected while an article is in a virtual shopping cart;

instructing the computer to collect the at least two device fingerprints, while the article is in the virtual shopping cart, from the user device for the corresponding Session ID, wherein the at least two device fingerprints are collected from at least two different pre-selected pages displaying different content that are configured for an online transaction tampering comparison; and

comparing the at least two device fingerprints, and if the at least two device fingerprints collected from the at least two different pre-selected pages are not identical, detecting the online transaction tampering and providing an alert.

13. A network security system for an online merchant that detects when an online transaction is compromised comprising:

a server within an online merchant network for conducting an online transaction with a customer device, wherein the Session ID is associated with device fingerprints collected while an article is in a virtual shopping cart;

a fingerprint collector within the online merchant network for collecting the device fingerprints at predetermined intervals during the online transaction from the customer device, wherein the device fingerprints are collected while the article is in the virtual shopping cart, from at least two different pre-selected pages displaying different content that are configured for an online transaction tampering comparison;

a session collector within the online merchant network for collecting Session ID information at the predetermined intervals from the customer device; and

a memory for storing information collected from the fingerprint collector including the pages where the device fingerprints are obtained in order to enable a comparison between the device fingerprints collected from the at least two different pre-selected pages and the Session ID information that suggests that the online transaction is compromised if the device fingerprints are not identical.

14. The network security system as recited in claim 13, wherein the online transaction occurs after authentication with a one-time password (OTP).

15. The network security system as recited in claim 13, wherein each of the device fingerprints include IP address information for the user device.

16. The network security system as recited in claim 13, wherein each of the device fingerprints include a time differential between an internal clock of the user device and another reference clock.

17. The network security system as recited in claim 13, wherein the customer device is a desktop computer, laptop computer, personal digital assistant or phone.

18. The network security system as recited in claim 13, wherein the two different pre-selected pages are HTML pages.

19. The network security system as recited in claim 13, wherein the device fingerprints are compared after an order of the article in the virtual shopping cart is finalized.

20. The network security system as recited in claim 13, wherein at least one of the at least two different pre-selected pages includes a page that concludes the online transaction.