Service assisted reliable transaction signing

Patent metadata

Field	Value
Publication number	US-9704158-B2
Application number	US-201313843664-A
Country	US
Kind code	B2
Filing date	Mar 15, 2013
Priority date	Mar 1, 2013
Publication date	Jul 11, 2017
Grant date	Jul 11, 2017

Abstract

Techniques are disclosed for authenticating transactions conducted over computer networks, e.g., online banking transactions or other transactions performed by a financial institution at a customer's request. After receiving a transaction request (and associated transaction details), the transaction signing service signs the transaction data and sends the resulting blob to the user requesting the transaction. After being transmitted to the user, the signed transaction data itself is then signed using PKI credentials of the user, which then returns the twice-signed bundle to the financial institution. Rather than rely on the cryptographic signature of the client, the financial intuition (or other replying party) validates that the transaction data signed using its own highly trusted key has not been altered prior to being signed and returned by the client.

First claim

What is claimed is:

1. A method for validating transactions conducted over computer networks, the method comprising:
receiving, over a network connection, by an application, a request from a client device to perform a transaction, wherein the request specifies one or more transaction details characterizing the requested transaction;
generating, by operation of a processor executing the application, a data structure storing the transaction details;
generating a first digital signature over the data structure;
sending the signed data structure to the requesting client device;
receiving, from the client device, the signed data structure, wherein the signed data structure received from the client device is wrapped with a second digital signature and wherein the second digital signature is generated by the client device;
validating the data structure, of the signed data structure received from the client device, against the first digital signature;
validating the signed data structure received from the client device against the second digital signature; and
upon determining the first digital signature and second digital signature are valid, performing the requested transaction.

2. The method of claim 1 , wherein the client device is configured to:
receive the signed data structure;
present the one or more transaction details; and
prompt the user to accept the transaction details by authorizing the second digital signature to be generated over the signed data structure.

3. The method of claim 1 , wherein the data structure further stores a set of network addresses authorized to host a web-application receiving the request from the client device.

4. The method of claim 1 , further comprising, storing the data structure and first digital signature in a transaction history log.

5. The method of claim 1 , wherein the requested transaction is a funds transfer and wherein the one or more transaction details include at least a source account associated with the client, a recipient account for the funds transfer and an amount for the funds transfer.

6. The method of claim 1 , wherein the data structure is a PKCS blob.

7. A non-transitory computer-readable storage medium storing instructions, which, when executed on a processor, performs an operation for validating transactions conducted over computer networks, the operation comprising:
receiving, over a network connection, a request from a client device to perform a transaction, wherein the request specifies one or more transaction details characterizing the requested transaction;
generating, by operation of a processor, a data structure storing the transaction details;
generating a first digital signature over the data structure;
sending the signed data structure to the requesting client device;
receiving, from the client device, the signed data structure, wherein the signed data structure received from the client device is wrapped with a second digital signature and wherein the second digital signature is generated by the client device;
validating the data structure, of the signed data structure received from the client device, against the first digital signature;
validating the signed data structure received from the client device against the second digital signature; and
upon determining the first digital signature and second digital signature are valid, performing the requested transaction.

8. The non-transitory computer-readable storage medium of claim 7 , wherein the client device is configured to:
receive the signed data structure;
present the one or more transaction details; and
prompt the user to accept the transaction details by authorizing the second digital signature to be generated over the signed data structure.

9. The non-transitory computer-readable storage medium of claim 7 , wherein the data structure further stores a set of network addresses authorized to host a web-application receiving the request from the client device.

10. The non-transitory computer-readable storage medium of claim 7 , wherein the operation further comprises, storing the data structure and first digital signature in a transaction history log.

11. The non-transitory computer-readable storage medium of claim 7 , wherein the requested transaction is a funds transfer and wherein the one or more transaction details include at least a source account associated with the client device, a recipient account for the funds transfer, and an amount for the funds transfer.

12. The non-transitory computer-readable storage medium of claim 7 , wherein the data structure is a PKCS #7 blob.

13. A system, comprising:
a first computing system having at least a processor and a memory hosting a web-application, wherein the web application is configured to perform an operation, comprising:
receiving, over a network connection, a request from a client device to perform a transaction, wherein the request specifies one or more transaction details characterizing the requested transaction,
generating, by operation of a processor, a data structure storing the transaction details,
obtaining, from a transaction signings service, a first digital signature over the data structure,
sending the signed data structure to the requesting client device,
receiving, from the client device, the signed data structure, wherein the signed data structure received from the client device is wrapped with a second digital signature and wherein the second digital signature is generated by the client device,
validating the data structure, of the signed data structure received from the client device, against the first digital signature, and
validating the signed data structure received from the client device against the second digital signature,
upon determining the first digital signature and second digital signatures are valid, performing the requested transaction; and

a second computing system having at least a processor and a memory hosting the transaction signing service, wherein the transaction signing service is configured to generate the first digital signature over the data structure.

14. The system of claim 13 , wherein the client device is configured to:
receive the signed data structure;
present the one or more transaction details; and
prompt the user to accept the transaction details by authorizing the second digital signature to be generated over the signed data structure.

15. The system of claim 13 , wherein the data structure further stores a set of network addresses authorized to host a web-application receiving the request from the client device.

16. The system of claim 13 , wherein the operation further comprises, storing the data structure and first digital signature in a transaction history log.

17. The system of claim 13 , wherein the requested transaction is a funds transfer and wherein the one or more transaction details include at least a source account associated with the client, a recipient account for the funds transfer and an amount for the funds transfer.

18. The system of claim 13 , wherein the data structure is a PKCS #7 blob.

Assignees

• Symantec Inc
• Symantec Corp

Inventors

• Dundas Alan
• Hoang Oanh
• Herskedal Eirik

Classifications

• G06Q20/3825 Primary

  Use of electronic signatures · CPC title

• G06Q20/40

  Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists · CPC title