Validation method and system for use in securing nomadic electronic transactions

• US 9,635,002 B2
• Filed: 12/31/2015
• Issued: 04/25/2017
• Est. Priority Date: 12/18/2008
• Status: Active Grant

• Current Assignee: BCE Incorporated
• Original Assignee: BCE Incorporated
• Inventors: O'Brien, William G, Yeap, Tet Hin, Murray, Sean MacLean
• Primary Examiner(s): HOLDER, BRADLEY W
• Application Number:
  US14/985,676
• Publication Number:
  US 20160110720A1
• Time in Patent Office: 481 Days
• CPC Class Codes: G06K 7/10366 the interrogation device being adapted for miscellaneous applications
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: G06Q 20/322 Aspects of commerce using mobile devices [M-devices]
• CPC Class Codes: G06Q 20/3278 RFID or NFC payments by means of M-devices
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G06Q 20/425 using two different networks, one for transaction and one for security confirmation
• CPC Class Codes: G06Q 2220/00 Business processing using cryptography postage metering system using cryptography G06Q2250/05
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 9/3215 using a plurality of channels network architectures or network communication protocols using different networks H04L63/18
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

A method involving a communication device, which comprises sending a request to a communication device; receiving a response from the communication device over a local communication path; deriving a received data set from said response; determining at least one data set that had been previously transmitted to the communication device over a wireless portion of a second communication path different from the local communication path; and validating the response based on the received data set and the at least one previously transmitted data set.

Claims

1. A method involving a communication device, the method implemented at a server communicatively coupled to the communication device by a network comprising:

sending a request to the communication device from the server;

receiving at the server a response from the communication device over a local communication path;

deriving at the server a received data set from said response;

determining at the server at least one data set that had been previously transmitted to the communication device over a second communication path different from the local communication path; and

validating at the server the response based on the received data set and the at least one previously transmitted data set,

wherein determining the at least one previously transmitted data set comprises determining at least one particular signature expected to be absent from the response if the response is valid, wherein validating the response comprises considering the response to be valid if the received data set does not match any of the at least one particular signature,

wherein the response is a particular response and wherein each of the at least one particular signature is one of the at least one previously transmitted data set that has been included in a valid response already received from the communication device prior to receipt of the particular response,

wherein validating the response further comprises considering the response to be invalid when the received data set matches one of the at least one particular signature.

2. The method defined in claim 1, wherein deriving the received data set from the response comprises decrypting the received data set and an identifier of the communication device using a decryption key.

3. The method defined in claim 1, further comprising sending the at least one previously transmitted data set to the communication device.

4. The method defined in claim 3, wherein said sending the at least one previously transmitted data set is carried out autonomously by a control server.

5. The method defined in claim 3, wherein said sending the at least one previously transmitted data set is carried out by a control server in response to receipt of a message indicating a detected presence of the communication device.

6. The method defined in claim 1 , wherein the response is received during a transaction attempt carried out using the communication device.

7. The method defined in claim 6, wherein if the response is considered valid, the received data set is indicative of a transaction identifier generated by a control server in anticipation of the transaction attempt.

8. The method defined in claim 6, wherein if the response is considered valid, the received data set is indicative of a transaction identifier generated by a control server after being informed of the transaction attempt.

9. The method defined in claim 1, further comprising granting access to a resource upon considering the response to be valid and denying access to the resource upon considering the response to be invalid.

10. The method defined in claim 9, wherein the resource includes a financial resource.

11. The method defined in claim 9, further comprising rendering the granting and denying conditional upon an outcome of a further validation step.

12. The method defined in claim 1, wherein the request is sent over the local communication path.

13. The method defined in claim 1, wherein the local communication path includes a wireless portion that is shared with the second communication path.

14. The method defined in claim 1, wherein the received data set is included within encrypted data included in the response, the method further comprising decrypting the received data from the encrypted data using a decryption key complementary to an encryption key used to encrypt the received data set within the encrypted data.