Using integrated code to extract device characteristics for online security

Patent metadata

Field	Value
Publication number	US-10097663-B1
Application number	US-201715601302-A
Country	US
Kind code	B1
Filing date	May 22, 2017
Priority date	May 22, 2017
Publication date	Oct 9, 2018
Grant date	Oct 9, 2018

Abstract

A merchant server may integrate device identifying code into a webpage. In response to a device accessing the webpage, the device identifying code may cause the merchant server to obtain characteristics of the device. A device registry may compare the characteristics of the device with known device profiles to determine a risk level of the device. A transaction account issuer may utilize the risk level in performing an authorization evaluation.

First claim

What is claimed is:

1. A method comprising:
transmitting, by a computer-based system, device identifying code to a merchant server,
wherein the device identifying code causes the merchant server to transmit characteristics of a device and a device ID of the device to a device registry;

receiving, by the computer-based system, an authorization request from the merchant server;
receiving, by the computer-based system, an enhanced authorization message comprising the device ID from the merchant server;
receiving, by the computer-based system, a device risk message comprising the device ID from the device registry;
storing, by the computer-based system, the device risk message in a device risk queue;
polling, by the computer-based system, the device risk queue based on the device ID in the enhanced authorization message;
merging, by the computer-based system and based on the device ID, the device risk message, the enhanced authorization message, and the authorization request into an enhanced authorization request;
authorizing, by the computer-based system and based on the enhanced authorization request, the authorization request; and
transmitting, by the computer-based system, an authorization response to the merchant server.

2. The method of claim 1 , wherein the device identifying code transmits the characteristics of the device in response to a check page being accessed, and
wherein the device identifying code generates a random number in response to the checkout page being accessed.

3. The method of claim 1 , wherein the device registry calculates a device risk score for the device based on a device profile stored in the device registry.

4. The method of claim 1 , wherein the device ID comprises the characteristics of the device, wherein the merchant server transmits an IP address of the device to the device registry.

5. The method of claim 1 , wherein the characteristics of the device uniquely identify the device.

6. The method of claim 1 , further comprising:
storing, by the computer-based system, the enhanced authorization message in an enhanced authorization queue; and
polling, by the computer-based system, the enhanced authorization queue in response to the receiving the authorization request.

7. The method of claim 1 , wherein the authorization request is received via a payment processor, and wherein the enhanced authorization message is received via an application programming interface or the payment processor.

8. A computer-based system, comprising:
a processor;
a tangible, non-transitory memory configured to communicate with the processor, the tangible, non-transitory memory having instructions stored thereon that, in response to execution by the processor, cause the processor to perform operations comprising:
transmitting, by the processor, device identifying code to a merchant server,
wherein the device identifying code causes the merchant server to transmit characteristics of a device and a device ID of the device to a device registry;

receiving, by the processor, an authorization request from the merchant server;
receiving, by the processor, an enhanced authorization message comprising the device ID from the merchant server;
receiving, by the processor, a device risk message comprising the device ID from the device registry;
storing, by the processor, the device risk message in a device risk queue;
polling, by the processor, the device risk queue based on the device ID in the enhanced authorization message;
merging, by the processor and based on the device ID, the device risk message, the enhanced authorization message, and the authorization request into an enhanced authorization request;
authorizing, by the processor and based on the enhanced authorization request, the authorization request; and
transmitting, by the processor, an authorization response to the merchant server.

9. The system of claim 8 , wherein the device identifying code transmits the characteristics of the device in response to a check page being accessed, and
wherein the device identifying code generates a random number in response to the checkout page being accessed.

10. The system of claim 8 , wherein the device registry calculates a device risk score for the device based on a device profile stored in the device registry.

11. The system of claim 8 , wherein the device ID comprises the characteristics of the device, wherein the merchant server transmits an IP address of the device to the device registry.

12. The system of claim 8 , wherein the characteristics of the device uniquely identify the device.

13. The system of claim 8 , wherein the operations further comprise:
storing, by the processor, the enhanced authorization message in an enhanced authorization queue; and
polling, by the processor, the enhanced authorization queue in response to the receiving the authorization request.

14. The method of claim 1 , wherein the authorization request is received via a payment processor, and wherein the enhanced authorization message is received via an application programming interface or the payment processor.

15. An article of manufacture including a non-transitory, tangible computer readable storage medium having instructions stored thereon that, in response to execution by a computer-based system, cause the computer-based system to perform operations comprising:
transmitting, by the computer-based system, device identifying code to a merchant server,
wherein the device identifying code causes the merchant server to transmit characteristics of a device and a device ID of the device to a device registry;

receiving, by the computer-based system, an authorization request from the merchant server;
receiving, by the computer-based system, an enhanced authorization message comprising the device ID from the merchant server;
receiving, by the computer-based system, a device risk message comprising the device ID from the device registry;
storing, by the computer-based system, the device risk message in a device risk queue;
polling, by the computer-based system, the device risk queue based on the device ID in the enhanced authorization message;
merging, by the computer-based system and based on the device ID, the device risk message, the enhanced authorization message, and the authorization request into an enhanced authorization request;
authorizing, by the computer-based system and based on the enhanced authorization request, the authorization request; and
transmitting, by the computer-based system, an authorization response to the merchant server.

16. The article of manufacture of claim 15 , wherein the device identifying code transmits the characteristics of the device in response to a check page being accessed, and
wherein the device identifying code generates a random number in response to the checkout page being accessed.

17. The article of manufacture of claim 15 , wherein the device registry calculates a device risk score for the device based on a device profile stored in the device registry.

18. The article of manufacture of claim 15 , wherein the device ID comprises the characteristics of the device, wherein the merchant server transmits an IP address of the device to the device registry.

19. The article of manufacture of claim 15 , wherein the characteristics of the device uniquely identify the device.

20. The article of manufacture of claim 15 , wherein the operations further comprise:
storing, by the computer-based system, the enhanced authorization message in an enhanced au

Assignees

• American Express Travel Related Services Co Inc

Inventors

• Ferenczi Andras
• Garg Vishnu
• Marshall Vernon
• Monga Sulabh
• Rollins Timothy
• Subrahmanyam Vishnuvajhala Venkata

Classifications

• H04L67/32

  Electricity · mapped topic

• G06F17/3089

  Physics · mapped topic

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title

• G06F21/62

  Protecting access to data via a platform, e.g. using keys or access control rules · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title