Validation method and system for use in securing nomadic electronic transactions

Patent metadata

Field	Value
Publication number	US-9231928-B2
Application number	US-200813140656-A
Country	US
Kind code	B2
Filing date	Dec 18, 2008
Priority date	Dec 18, 2008
Publication date	Jan 5, 2016
Grant date	Jan 5, 2016

Abstract

A method involving a communication device, which comprises sending a request to a communication device; receiving a response from the communication device over a local communication path; deriving a received data set from said response; determining at least one data set that had been previously transmitted to the communication device over a wireless portion of a second communication path different from the local communication path; and validating the response based on the received data set and the at least one previously transmitted data set.

First claim

What is claimed is:

1. A method involving a communication device, comprising:
detecting a physical proximity of the communication device over a near field communication path existing between the communication device and a local device;
in response to the detecting, transmitting at least one data set to the communication device over a first communication path that traverses a packet-switched network;
sending a request to the communication device over the near field communication path;
receiving a response from the communication device over the near field communication path;
deriving a received data set from said response;
validating the response based on the received data set and the at least one previously transmitted data set previously transmitted to the communication device over the first communication path;
the first communication path existing between a control server and the communication device, and a second communication path existing between the local device and a processing device.

2. The method defined in claim 1 , wherein deriving the received data set from the response comprises decrypting the received data set and an identifier of the communication device using a decryption key.

3. The method defined in claim 2 , further comprising identifying the decryption key.

4. The method defined in claim 3 , wherein identifying the decryption key is based exclusively on information available prior to receipt of the response.

5. The method defined in claim 3 , wherein the response comprises a key index, wherein identifying the decryption key comprises consulting a database of stored keys and associated stored indexes to identify as the decryption key a stored key associated with the key index.

6. The method defined in claim 1 , further comprising determining from the at least one previously transmitted data set a particular data set expected to be included in the response if the response is valid, wherein validating the response comprises considering the response to be valid if the received data set matches the particular data set.

7. The method defined in claim 1 , further comprising determining from the at least one previously transmitted data set at least one particular data set expected to be absent from the response if the response is valid, wherein validating the response comprises considering the response to be valid if the received data set does not match any of the at least one particular data set.

8. The method defined in claim 1 , further comprising decrypting a putative identifier and a putative code value from the received data set using a decryption key.

9. The method defined in claim 8 , wherein determining the at least one previously transmitted data set comprises determining a particular code value which, when encrypted together with the putative identifier using an encryption key complementary to the decryption key, yields a signature expected to be included in the response if the response is valid, wherein validating the response comprises considering the response to be valid if the putative code value matches the particular code value.

10. The method defined in claim 8 , wherein determining the at least one previously transmitted data set comprises determining at least one particular code value which, when encrypted together with the putative identifier using an encryption key complementary to the decryption key, yields a corresponding signature expected to be absent from the response if the response is valid, wherein validating the response comprises considering the response to be valid if the putative code value does not match any of the at least one particular code value.

11. The method defined in claim 1 , wherein said transmitting at least one data set to the communication device over the first communication path is carried out by the control server in response to receipt of a message indicating a detected physical proximity of the communication device.

12. The method defined in claim 1 , wherein detecting the physical proximity of the communication device comprises obtaining knowledge of an identifier of the communication device.

13. The method defined in claim 12 , wherein knowledge of the identifier of the communication device is obtained from a signal transmitted by the communication device over the near field communication path.

14. The method defined in claim 1 , wherein the response is received during a transaction attempt carried out using the communication device.

15. The method defined in claim 14 , wherein if the response is considered valid, the received data set is indicative of a transaction identifier generated by the control server in anticipation of the transaction attempt.

16. The method defined in claim 14 , wherein if the response is considered valid, the received data set is indicative of a transaction identifier generated by the control server after being informed of the transaction attempt.

17. A non-transitory computer-readable storage medium comprising a set of instructions for execution by a processing device comprising a processor:
where execution of the set of instructions by the processing device causes the processing device to execute a method comprising validating a response received from a communication device over a near field communication path existing between the communication device and a local device, the response having been sent over the near field communication path by the communication device in response to a request sent thereto over the near field communication path, the method further comprising:
deriving a received data set from the response;
determining at least one data set that had been previously transmitted to the communication device over a first communication path traversing a packet-switched network in response to detecting a physical proximity of the communication device over the near field communication path, the first communication path existing between a control server and the communication device; and
validating the response based on the received data set and the at least one previously transmitted data set;
a second communication path existing between the local device and the processing device.

18. The non-transitory computer-readable storage medium defined in claim 17 , wherein a downstream near field communication path exists between the communication device and a system-side receiver of the local device, and an upstream near field communication path exists between the communication device and a system-side transmitter of the local device.

19. A system, comprising:
a control server configured to generate at least one particular data set and transmit the at least one articular data set to a communication device over a first communication path that traverses a packet-switched network in response to detecting a physical proximity of the communication device over a near field communication path, the first communication path existing between the control server and the communication device;
a local device comprising transmit/receive equipment configured to send a request to the communication device over the near field communication path and to obtain a response from the communication device over the near field communication path, the near field communication path existing between the communication device and the local device; and
a processing device comprising a processor communicatively coupled both to the local device over a second communication path and to the control server, the processing device configured to derive a received data set from the resp

Assignees

• Yeap Tet Hin
• O'Brien William G
• Murray Sean Maclean
• Bce Inc

Inventors

• Yeap Tet Hin
• O'Brien William G
• Murray Sean Maclean

Classifications

• H04L2209/56

  Financial cryptography, e.g. electronic payment or e-cash · CPC title

• G06Q20/32

  using wireless devices · CPC title

• H04L2209/805

  Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor · CPC title

• H04L63/0869

  for achieving mutual authentication (cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273) · CPC title

• G06Q20/425

  using two different networks, one for transaction and one for security confirmation · CPC title