Method and Device for End-User Verification of an Electronic Transaction

• US 20150170146A1
• Filed: 03/02/2015
• Published: 06/18/2015
• Est. Priority Date: 02/28/2008
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Ji, Lusheng, Bowen, Donald John, Kormann, David, Miller, Robert R. II, Schryer, Norman L., Killian, Thomas
• Granted Patent: US 10,229,410 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06Q 20/3229 Use of the SIM of a M-device as secure element
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G07F 7/1075 PIN is checked remotely
• CPC Class Codes: G07F 7/125 Offline card verification
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32

Abstract

The present invention provides methods and apparatuses for verifying that a transaction is legitimate. The methods and apparatuses use protected memory space, such as kernel space of an operating system, or a separate memory space, such as is available on a SIM card of a cellular phone. The method of the invention proceeds by creating a transaction identification string (TID) and associating the TID with a transaction. The TID contains data relevant to or associated with the transaction and is typically readable by an end-user. The transaction is then interrupted until a user responds in the affirmative to allow completion of the transaction. Methods and devices used in the invention are particularly well suited to M-commerce, where transactions originating from a device are typically recognized by a merchant as coming from the owner of the device without further authentication.

Claims

1-25. -25. (canceled)

26. A method comprising:

creating a transaction identification string in a memory of an end-user device, the transaction identification string associated with a transaction between the end-user device and a merchant device;

interrupting an electronic communication between the end-user device and the merchant device before completion of the transaction, wherein the electronic communication is associated with the transaction;

displaying the transaction identification string on the end-user device;

disallowing further electronic communication between the end-user device and the merchant device until receipt of user input responsive to the displaying; and

allowing communication between the end-user device and the merchant device about the transaction in response to user input indicating that the transaction should be accepted.

27. The method of claim 26, wherein the memory of the end-user device is one of a separate kernel space, a separate processor core, and a separate processor-memory environment.

28. The method of claim 26, wherein the memory of the end-user device includes a first memory, the method further comprising:

carrying out an action using data stored in a second memory of the end-user device, the first memory separate from the second memory in response to user input.

29. The method of claim 28, wherein the action is to cancel the transaction in response to user input requesting that the transaction be cancelled.

30. The method of claim 28, wherein the action is to allow the transaction in response to user input requesting that the transaction be allowed.

31. The method of claim 30, further comprising:

generating a commit packet comprising the transaction identification string; and

encrypting the commit packet using a key stored in the first memory.

32. The method of claim 26, wherein the transaction identification string comprises transaction information.

33. The method of claim 26, wherein the end-user device is a mobile device.

34. The method of claim 26, further comprising:

authenticating an identity of the end-user with a server.

35. An apparatus comprising:

a processor; and

a memory to store computer program instructions, the computer program instructions when executed on the processor cause the processor to perform operations comprising;

creating a transaction identification string in a memory of an end-user device, the transaction identification string associated with a transaction between the end-user device and a merchant device;

interrupting an electronic communication between the end-user device and the merchant device before completion of the transaction, wherein the electronic communication is associated with the transaction;

displaying the transaction identification string on the end-user device;

disallowing further electronic communication between the end-user device and the merchant device until receipt of user input responsive to the displaying; and

allowing communication between the end-user device and the merchant device about the transaction in response to user input indicating that the transaction should be accepted.

36. The apparatus of claim 35, wherein the memory of the end-user device is one of a separate kernel space, a separate processor core, and a separate processor-memory environment.

37. The apparatus of claim 35, the operations further comprising:

generating a commit packet comprising the transaction identification string; and

encrypting the commit packet using a key stored in the memory of the end-user device.

38. The apparatus of claim 35, the operations further comprising:

authenticating an identity of the end-user with a server.

39. The apparatus of claim 35, wherein the transaction identification string comprises transaction information.

40. A computer readable medium storing computer program instruction, which, when executed on a processor, cause the processor to perform operations comprising:

creating a transaction identification string in a memory of an end-user device, the transaction identification string associated with a transaction between the end-user device and a merchant device;

interrupting an electronic communication between the end-user device and the merchant device before completion of the transaction, wherein the electronic communication is associated with the transaction;

displaying the transaction identification string on the end-user device;

disallowing further electronic communication between the end-user device and the merchant device until receipt of user input responsive to the displaying; and

allowing communication between the end-user device and the merchant device about the transaction in response to user input indicating that the transaction should be accepted.

41. The computer readable medium of claim 40, wherein the memory of the end-user device is one of a separate kernel space, a separate processor core, and a separate processor-memory environment.

42. The computer readable medium of claim 40, the operations further comprising:

generating a commit packet comprising the transaction identification string; and

encrypting the commit packet using a key stored in the memory of the end-user device.

43. The computer readable medium of claim 40, the operations further comprising:

authenticating an identity of the end-user with a server.

44. The computer readable medium of claim 40, wherein the transaction identification string comprises transaction information.

45. The computer readable medium of claim 40, wherein the memory of the end-user device includes a first memory, the operations further comprising:

carrying out an action using data stored in a second memory of the end-user device, the first memory separate from the second memory.