SYSTEMS AND METHODS FOR DETECTION OF SESSION TAMPERING AND FRAUD PREVENTION

• US 20150221019A1
• Filed: 08/29/2014
• Published: 08/06/2015
• Est. Priority Date: 03/31/2006
• Status: Active Grant

• Current Assignee: The 41st Parameter, Inc. (Experian plc)
• Original Assignee: The 41st Parameter, Inc. (Experian plc)
• Inventors: Eisen, Ori
• Granted Patent: US 9,196,004 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06Q 20/3825 Use of electronic signatures
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G06Q 30/0635 Processing of requisition or of purchase orders
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

The invention provides methods and apparatus for detecting when an online session is compromised. A plurality of device fingerprints may be collected from a user computer that is associated with a designated Session ID. A server may include pages that are delivered to a user for viewing in a browser at which time device fingerprints and Session ID information are collected. By collecting device fingerprints and session information at several locations among the pages delivered by the server throughout an online session, and not only one time or at log-in, a comparison between the fingerprints in association with a Session ID can identify the likelihood of session tampering and man-in-the middle attacks.

Claims

4-1. The method as recited in claim 1 wherein the network is the Internet.

11. A non-transitory computer system loaded with machine readable instructions for carrying out a method of detecting an online transaction tampering, the method comprising:

establishing a Session ID for activity between a computer and a user device over a network, wherein the Session ID is associated with at least two device fingerprints collected while an article is in a virtual shopping cart;

instructing the computer to collect the at least two device fingerprints, while the article is in the virtual shopping cart, from the user device for the corresponding Session ID,

wherein the at least two device fingerprints are collected from at least two different pre-selected pages displaying different content that are configured for an online transaction tampering comparison; and

comparing the at least two device fingerprints, and if the at least two device fingerprints collected from the at least two different pre-selected pages are not identical, detecting the online transaction tampering and providing an alert.

15. The network security system as recited in claim 11, wherein each of the device fingerprints include a time differential between an internal clock of the user device and another reference clock.

16. The network security system as recited in claim 11, wherein the customer device is a desktop computer, laptop computer, personal digital assistant or phone.

17. The network security system as recited in claim 11, wherein the two different pre-selected pages are HTML pages.

18. The network security system as recited in claim 11, wherein the device fingerprints are compared after an order of the article in the virtual shopping cart is finalized.

19. The network security system as recited in claim 11, wherein at least one of the at least two different pre-selected pages includes a page that concludes the online transaction.

12. A network security system for an online merchant that detects when an online transaction is compromised comprising:

a server within an online merchant network for conducting an online transaction with a customer device, wherein the Session ID is associated with device fingerprints collected while an article is in a virtual shopping cart;

a fingerprint collector within the online merchant network for collecting the device fingerprints at predetermined intervals during the online transaction from the customer device, wherein the device fingerprints are collected while the article is in the virtual shopping cart, from at least two different pre-selected pages displaying different content that are configured for an online transaction tampering comparison;

a session collector within the online merchant network for collecting Session ID information at the predetermined intervals from the customer device; and

a memory for storing information collected from the fingerprint collector including the pages where the device fingerprints are obtained in order to enable a comparison between the device fingerprints collected from the at least two different pre-selected pages and the Session ID information that suggests that the online transaction is compromised if the device fingerprints are not identical.

13. The network security system as recited in claim 12, wherein the online transaction occurs after authentication with a one-time password (OTP).

14. The network security system as recited in claim 12, wherein each of the device fingerprints include IP address information for the user device.