System of security that prevents abuse of identity data in global commerce via mobile wireless authorizations

• US 20100229245A1
• Filed: 04/08/2009
• Published: 09/09/2010
• Est. Priority Date: 03/05/2009
• Status: Active Application

• Current Assignee: Tara Chand Singhal
• Original Assignee: Tara Chand Singhal
• Inventors: Singhal, Tara Chand
• Application Number:
  US12/384,718
• Publication Number:
  US 20100229245A1
• Time in Patent Office: Days
• US Class Current: 726/28
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/425 using two different networks, one for transaction and one for security confirmation
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 4/14 Short messaging services, e.g. short message services [SMS] or unstructured supplementary service data [USSD]

Abstract

A system of security that prevents misuse of identity data of an identity data owner in an identity data driven transaction in a global commerce network, that has in the system, a transaction processing entity that after it receives a identity data driven transaction from a transaction initiating entity, puts on hold the processing of the transaction for a period of time and via the identity data owner'"'"'s wireless mobile communication device, contacts the identity data owner for authorization of the transaction before the transaction processing is completed. The system of security for identity data may be used in the identity data driven transaction is one from a group of (i) credit card payment, (ii) bank account payment, (iii) release of credit profile, (iv) release of financial data, and (v) release of medical data.

Claims

1. A system of security that prevents misuse of identity data of an identity data owner in an identity data driven transaction in a global commerce network, the system comprising:

in the system, a transaction processing entity, after receiving an identity data driven transaction from a transaction initiating entity, puts on hold processing of the transaction for a period of time; and

during this period of time the transaction processing entity with a wireless mobile authorization subsystem, contacts the identity data owner'"'"'s wireless mobile communication device, and waits for authorization of the transaction, before the transaction processing is completed.

2. The system of security that prevents misuse of identity data as in claim 1, comprising:

the identity data driven transaction is one from a group of (i) credit card payment, (ii) bank account payment, (iii) release of credit profile, (iv) release of financial data, (v) release of medical data, and (vi) release of any private data that is governed by privacy rules.

3. The system of security that prevents misuse of identity data as in claim 1, comprising:

the mobile authorization subsystem may reduce the need for authorizations for the identity data driven transaction at the transaction initiating entities that require a signature, and additionally a proof of identity or a password PIN.

4. The system of security that prevents misuse of identity data as in claim 1, comprising:

the time period of hold may vary from substantially from 5 seconds to 18 hours for different types of transactions.

5. The system of security that prevents misuse of identity data as in claim 1, comprising:

a service provider manages the mobile authorization subsystem that has a database of mobile contact information and the corresponding mapping of identity data and provides a service to the transaction processing entities that facilitates the mobile authorization contact with the identity data owner for the authorizations.

6. The system of security that prevents misuse of identity data as in claim 1, comprising:

mobile authorization requests by the transaction processing entity via the owner'"'"'s wireless mobile communication device may include a SMS text message that embeds a pre-placed security code.

7. The system of security that prevents misuse of identity data as in claim 1, comprising:

a mobile authorization request text message may include sending to the identity data owner, (i) name of the transaction initiating entity, date and time, and optionally an amount for a payment transaction.

8. The system of security that prevents misuse of identity data as in claim 1, comprising:

a mobile authorization response from the id data owner may include an accept, a reject or a time out due to lack of response, where the time out is set based on the type of the transaction.

9. The system of security that prevents misuse of identity data as in claim 1, comprising:

the mobile authorization subsystem has an enable/disable flag, when the flag is disabled, the subsystem does not seek an authorization enabling processing the transaction without the mobile authorization service, and instead the mobile authorization subsystem sends advisory message to the id data owner for the transaction.

10. The system of security that prevents misuse of identity data as in claim 1, comprising:

the mobile authorization subsystem logs an authorization event in an event log database for use as an authorization record of the transaction.

11. A system for a wireless mobile device based authorization security service, comprising:

a wireless mobile device based security service that contacts identity data owners via the wireless device to authorize identity data driven transactions while being processed by a transaction processing entity, wherein, in a global commerce network, the service prevents misuse of personal identity data of an identity data owner.

12. The system as in claim 11, further comprising:

a. a database of mobile identity that maps the mobile contact information with identity data of the identity data owner, the identity data is one or more from a group of (i) social security number, (ii) bankcards, (iii) bank account numbers, (iv) name, date of birth, zip code, and (viii) a unique customer identifier;

b. a function to receive a request for mobile authorization from a requesting entity from a group of (i) a bank with a bank account information, (ii) a bank with bankcard information, (iii) a credit rating agency, with a social security number, (iv) a medical service provider with name, DOB and zip code;

13. The system as in claim 12, further comprising:

a. a function to look up the mobile contact information and send a message seeking authorization of the transaction,

b. a function to receive a response of accept and reject and forward the response to the requesting entity.

14. The system as in claim 13, further, comprising:

a security process fee is levied to the bank and the credit agency for the service of obtaining authorization via a mobile device of the customer.

15. The system as in claim 13, for a wireless mobile phone based security service for preventing misuse of identity data, comprising:

a pre-set security code between the mobile receiver owner and the mobile authorization service to authenticate mobile authorization responses.

16. A method of preventing misuse of bankcard data for an unauthorized payment transaction comprising the steps of:

a. receiving, by a financial entity which maintains accounts of a customer, (i) a bankcard originated payment authorization request from a merchant point of sale, via a card authorization network and (ii) a payee originated request for payment via a ACH;

b. putting on hold, by the financial entity, the processing of the payment authorization request for a period of time enabling contacting the customer via a wireless mobile device of the customer, with information about the payment authorization request and requesting a response to proceed with the payment authorization;

c. awaiting the response by the entity from the customer for a period of time, and processing the response, where on receiving (i) a yes response approving the request, (ii) on receiving a No response declining the request and (iii) for lack of response, advising the requesting entity to present the request at a later time.

17. The method as in claim 16, further comprising the steps of:

selecting and setting the period of time of response threshold based on the type of the payment request, the identification of the requesting entity, and originating location of the request, to be between 30 seconds and 18 hours.

18. The method as in claim 16, further comprising the steps of:

processing the request for payment without contacting the customer, if the payment amount does not exceed a set amount.

19. The method as in claim 16, further comprising the steps of:

a. eliminating signature and identity proof for a request for payment originating in the form of a credit card transaction;

b. eliminating entry of a PIN for a payment request originating in the form of a check card transaction from a checking account.

20. The method as in claim 16, further comprising one of the steps of:

contacting the customer is in the form of a SMS text message delivered to the mobile phone, requesting a response by pressing a function key, enabling Yes/No response to be automatically sent by the mobile phone, for a return response.

21. The method as in claim 16, further comprising the steps of:

levying a security fee for providing the security service of preventing misuse of bankcard, where the fee may be in the form of annual fee or a per transaction fee built into the mobile contact means.

22. A method of preventing misuse of identity data comprising the steps of:

a. receiving by a credit rating agency a credit profile request from a financial entity for a loan applicant customer and from an entity for an employment applicant customer for character reference;

b. putting on hold, by the credit profile agency, the processing of the profile request for a period of time enabling contacting the customer via a wireless mobile device of the customer, with information about the profile request and requesting a response to proceed with the profile release authorization;

c. awaiting the response by the credit agency from the customer for a period of time, and processing the response, where on receiving a Yes response approving the request, on receiving a No response declining the request and for lack of response, advising the requesting entity to present the request at a later time, thereby eliminating the need of obtaining a written authorization from the identity data owner for release of private data.

23. A system of security that prevents misuse of identity data of an identity data owner in an identity data driven transaction in a global commerce network, the system comprising:

a. wireless mobile device of an identity data owner, the device has security means to securely receive a mobile authorization message requesting authorization of an identity data driven transaction from a mobile authorization service;

b. the device has means to reply to the transaction authorization message with either an accept or reject return response message.

24. The system of security as in claim 23, further comprising:

the device has an accept function key and a reject function key, which when activated launch a function in the device to return the appropriate accept and reject response return message.