System and method for ensuring safety of online transactions

Patent metadata

Field	Value
Publication number	US-9898739-B2
Application number	US-201414166496-A
Country	US
Kind code	B2
Filing date	Jan 28, 2014
Priority date	Sep 26, 2013
Publication date	Feb 20, 2018
Grant date	Feb 20, 2018

Abstract

Online transaction security is improved by detecting a start of an online financial transaction between a user-controlled online transaction application and a remote payment service. A protected data input module, a protected environment module, and a safe data transfer module each provides a corresponding set of protection operations. A risk level of conducting the financial transaction is assessed based on a vulnerability assessment and on present condition of the local computing system. An initial degree of protection for each of the modules is set, and subsequently adjusted based on the risk level.

First claim

What is claimed is:

1. In a computing system that includes a processor, data storage, and input/output devices including a network interface device configured to communicate over a network, and an operating system, a method for securing online financial transactions, the method comprising:
detecting, by the computing system, a start of an online financial transaction over the network between a user-controlled online transaction application executing on the computing system and a remote payment service based on at least one of a launch of the online transaction application, access of the remote payment service over the network, transmission of content indicative of a connection to the remote payment service, or a predefined pattern of activity;
executing, by the computing system, a protected data input module configured to apply a selected protection scheme to limit access by unauthorized processes to an input sequence via at least one of the input/output devices over the network while permitting the input sequence to be accepted by an authorized process;
executing, by the computing system, a protected environment module configured to apply a selected protection scheme to protect the user-controlled online transaction application from being compromised by malware;
executing, by the computing system, a safe data transfer module configured to apply a selected protection scheme to determine whether a connection with the remote payment service over the network is a correct connection with a reputable party;
in response to detection of the start of the financial transaction, assessing, by the computing system, a risk level of conducting the financial transaction on the network based on a vulnerability assessment and on a present condition of the computing system including the input device operated by the user, wherein the vulnerability assessment includes a weighted determination including consideration of vulnerabilities of the online financial transaction application, incidents logged in the operating system, incidents having occurred on a local network computing system, update status of an antivirus program installed on the computing system, use of hardware authentication modules on the computing system, frequency of online financial transactions by the computing system, and a nature of data having been accessed by the user;
setting, by the computing system, an initial protection scheme for each of the protected data input module, the protected environment module, and the safe data transfer module based on the risk level;
adjusting, by the computing system, a protection scheme for at least one of the protected data input module, the protected environment module, and the safe data transfer module based on the risk level to a different protection scheme than the initial protection scheme for each of the at least one corresponding modules,
wherein adjusting the protection scheme includes accessing a plurality of protection settings that represent each item of protective functionality facilitated by the protected data input module, the protected environment module, and the safe data transfer module, and changing at least one of the protection settings of the plurality of protection settings to either increase, or decrease, an extent of functionality of protection commensurately with the risk level, wherein the plurality of protection settings includes a range of protection levels for the respective protective functionality facilitated by the protected data input module, the protected environment module, and the safe data transfer module, wherein at least one of
a protected data input level is adjusted among a predetermined range of protected data input levels that differs from the protected data input level set at the initial protection scheme,
a protected environment module level is adjusted among a predetermined range of protected environment levels that differs from the protected environment module level set at the initial protection scheme, or
a safe data transfer level is adjusted among a predetermined range of safe data transfer levels that differs from the safe data transfer level set at the initial protection scheme, and

detecting, by the computing system, completion of the online financial transaction by determining that all data related to the online financial transaction has been transferred on the network; and
automatically ending, by the computing system, the protection scheme upon detection that the online financial transaction has completed.

2. The method of claim 1 , further comprising:
assessing, by the computing system, user preferences based on responses taken by the user of the computing system corresponding to operation of at least one of the protected data input module, the protected environment module, and the safe data transfer module; and
wherein the adjusting of the protection scheme is further based on the user preferences.

3. The method of claim 1 , wherein detecting the start of an online financial transaction includes at least one of: monitoring for a launch of the online transaction application, monitoring for a connection to the remote payment service via the online transaction application, monitoring for reception of content indicative of a connection to a payment service, or any combination thereof.

4. The method of claim 1 , wherein detecting the start of an online financial transaction includes monitoring for access to remote services that are known to redirect connections to payment services.

5. The method of claim 1 , wherein executing the protected environment module includes initiating at least one of:
initiating a sandbox program;
checking for changes in an address space of a process corresponding to the online transaction application;
tracking of suspicious operations during execution of streams a process corresponding to the online transaction application;
initiating a virtual machine in which the online transaction application is to be executed;
launching a substitute application in place of the online transaction application, wherein the substitute application implements certain capabilities of the online transaction application but lacks certain other capabilities of the online transaction application.

6. The method of claim 1 , wherein executing the protected data input module includes initiating at least one of: a virtual keyboard, a clipboard protection program, a dedicated protected device driver for a hardware input device to operate in lieu of a keyboard device driver provided by the operating system.

7. The method of claim 1 , wherein assessing the user preferences includes monitoring a user action of opting out of an operation by at least one of the protected data input module, the protected environment module, and the safe data transfer module.

8. The method of claim 1 , wherein assessing the user preferences includes monitoring a user action of indicating a preference for operation by at least one of the protected data input module, the protected environment module, and the safe data transfer module.

9. The method of claim 1 , wherein assessing the user preferences includes providing a user interface facilitating accepting entry, by the user, of a preference for speeding up responsiveness of the computing system.

10. The method of claim 1 , wherein adjusting the protection scheme includes accessing a hierarchy of protection settings that represent each item of protective functionality facilitated by the protected data input module, the protected environment module, and the safe data transfer module in terms of its protection scheme and its burden on user experience of using the computing system.

11. The method of claim 1 , wherein adjus

Assignees

• Kaspersky Lab Zao
• AO Kaspersky Lab

Inventors

• Monastyrsky Alexey V
• Golovanov Sergey Y
• Martynenko Vladislav V
• Rusakov Vyacheslav E

Classifications

• G06Q20/4016

  involving fraud or risk level assessment in transaction processing · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title

• G06Q20/382 Primary

  insuring higher security of transaction · CPC title

• G06F21/10

  Protecting distributed programs or content, e.g. vending or licensing of copyrighted material (protection in video systems or pay television H04N7/16) {; Digital rights management [DRM]} · CPC title

• G06F21/34 Primary

  involving the use of external additional devices, e.g. dongles or smart cards · CPC title