Patent Application
20150186892
The present disclosure relates to the field of Internet technologies, and, more particularly, to a method and systems for real-time verification of a transaction.
At present, when a user sends a service request to a server, if the server detects a security risk in the service request, the server automatically interrupts (or suspends) the service request so as to ensure the security of user funds and information and/or to avoid security intrusions.
The service request may include a login request, a transaction request, a payment request, a session request, and the like. The service request is interrupted when, for example, a requested transaction exceeds an allowable transaction limit that was preset by the user, or that the previous login of the user to the service server has a security risk. Sometimes, a brief notification is displayed to inform the user of the reason for interrupting the service request. To that end, the user is prompted to initiate the service request again after the security risk is removed. However, it is usually time and energy consuming for a user to remove the security risk, and the service request needs to be initiated again.
In order to address the problems stated in the background section, the embodiments of the present disclosure provide methods and systems for real-time verification of a transaction.
In some embodiments, a method of real-time biometric verification of a transaction is performed at a server system (e.g., server system 108,
In some embodiments, a computer system (e.g., server system 108,
Various advantages of the present application are apparent in light of the descriptions below.
The aforementioned features and advantages of the application as well as additional features and advantages thereof will be more clearly understood hereinafter as a result of a detailed description of preferred embodiments when taken in conjunction with the drawings.
To describe the technical solutions in the embodiments of the present application or in the prior art more clearly, the following briefly introduces the accompanying drawings required for describing the embodiments or the prior art. Apparently, the accompanying drawings in the following description show merely some embodiments of the present application, and persons of ordinary skill in the art may still derive other drawings from these accompanying drawings without creative efforts.
Like reference numerals refer to corresponding parts throughout the several views of the drawings.
Reference will now be made in detail to embodiments, examples of which are illustrated in the accompanying drawings. In the following detailed description, numerous specific details are set forth in order to provide a thorough understanding of the subject matter presented herein. But it will be apparent to one skilled in the art that the subject matter may be practiced without these specific details. In other instances, well-known methods, procedures, components, and circuits have not been described in detail so as not to unnecessarily obscure aspects of the embodiments.
The following clearly and completely describes the technical solutions in the embodiments of the present application with reference to the accompanying drawings in the embodiments of the present application. Apparently, the described embodiments are merely a part rather than all of the embodiments of the present application. All other embodiments obtained by persons of ordinary skill in the art based on the embodiments of the present application without creative efforts shall fall within the protection scope of the present application.
As shown in
In some embodiments, POS devices 122 additionally communicate with merchant servers 124 via one or more networks 110. For example, after a transaction is completed, a respective POS device 122 sends transaction details corresponding to the completed transaction (e.g., a transaction amount, transaction time, transaction location, and the goods and/or services included transaction) to a respective merchant server 124 that is associated with the respective POS device 122 for accounting, inventory, and data collection purposes.
In some embodiments, server-side module 106 includes one or more processors 112, voice verification information 114, one or more user profiles 116, an I/O interface to one or more clients 118, and an I/O interface to one or more POS devices 120. I/O interface to one or more clients 118 facilitates the client-facing input and output processing for server-side module 106, and I/O interface to one or more POS devices 120 facilitates the POS-facing input and output processing for server-side module 106. One or more processors 112 receive a transaction request from a POS device 122, send a confirmation request to a client device 104 for voice verification information to confirm the transaction, and determine whether received voice verification information matches stored account verification data. Voice verification information 114 stores previously received voice verification information, and one or more user profiles 116 store one or more user profiles each associated with a respective user of a client device including information associated with the respective user's account such as account verification data (e.g., social security number, date of birth, security question and answer, biometric voice signature, and the like), account preferences, authorization level, transaction history, verification history, and identified trends and/or likes/dislikes. In some embodiments, server-side module 106 communicates with one or more POS devices 122 (e.g., merchant/retail POS devices, a first device associated with the user, etc.) through one or more networks 110. I/O interface to one or more POS devices 120 facilitates such communications.
Examples of a representative client device 104 include, but are not limited to, a handheld computer, a wearable computing device, a personal digital assistant (PDA), a tablet computer, a laptop computer, a desktop computer, a cellular telephone, a smart phone, an enhanced general packet radio service (EGPRS) mobile phone, a media player, a navigation device, a game console, a television, a remote control, or a combination of any two or more of these data processing devices or other data processing devices.
Examples of a representative POS device 122 include, but are not limited to, a handheld computer, a wearable computing device, a personal digital assistant (PDA), a tablet computer, a laptop computer, a desktop computer, a cellular telephone, a smart phone, an enhanced general packet radio service (EGPRS) mobile phone, a media player, a navigation device, a game console, a television, a remote control, or a combination of any two or more of these data processing devices or other data processing devices.
Examples of one or more networks 110 include local area networks (LAN) and wide area networks (WAN) such as the Internet. One or more networks 110 are, optionally, implemented using any known network protocol, including various wired or wireless protocols, such as Ethernet, Universal Serial Bus (USB), FIREWIRE, Global System for Mobile Communications (GSM), Enhanced Data GSM Environment (EDGE), code division multiple access (CDMA), time division multiple access (TDMA), Bluetooth, Wi-Fi, voice over Internet Protocol (VoIP), Wi-MAX, or any other suitable communication protocol.
Server system 108 is implemented on one or more standalone data processing apparatuses or a distributed network of computers. In some embodiments, server system 108 also employs various virtual devices and/or services of third party service providers (e.g., third-party cloud service providers) to provide the underlying computing resources and/or infrastructure resources of server system 108.
Server-client environment 100 shown in
Each of the above identified elements may be stored in one or more of the previously mentioned memory devices, and corresponds to a set of instructions for performing a function described above. The above identified modules or programs (i.e., sets of instructions) need not be implemented as separate software programs, procedures, or modules, and thus various subsets of these modules may be combined or otherwise re-arranged in various implementations. In some implementations, memory 206, optionally, stores a subset of the modules and data structures identified above. Furthermore, memory 206, optionally, stores additional modules and data structures not described above.
In some embodiments, memory 306 also includes transaction module 330, which initiates a transaction. Transaction module 330 includes, but is not limited to:
In some embodiments, memory 306 also includes data 350 including, but not limited to transaction data 352 associated with the transaction and previously processed transactions.
Each of the above identified elements may be stored in one or more of the previously mentioned memory devices, and corresponds to a set of instructions for performing a function described above. The above identified modules or programs (i.e., sets of instructions) need not be implemented as separate software programs, procedures, modules or data structures, and thus various subsets of these modules may be combined or otherwise re-arranged in various implementations. In some implementations, memory 306, optionally, stores a subset of the modules and data structures identified above. Furthermore, memory 306, optionally, stores additional modules and data structures not described above.
In some embodiments, memory 406 also includes client-side module 102, which provides client-side data processing and functionalities. Client-side module 102 includes, but is not limited to:
In some embodiments, memory 406 also includes client data 450 including, but is not limited to:
Each of the above identified elements may be stored in one or more of the previously mentioned memory devices, and corresponds to a set of instructions for performing a function described above. The above identified modules or programs (i.e., sets of instructions) need not be implemented as separate software programs, procedures, modules or data structures, and thus various subsets of these modules may be combined or otherwise re-arranged in various implementations. In some implementations, memory 406, optionally, stores a subset of the modules and data structures identified above. Furthermore, memory 406, optionally, stores additional modules and data structures not described above.
In some embodiments, at least some of the functions of client-side module 102 are performed by POS device 122, and the corresponding sub-modules of these functions may be located within POS device 122 rather than client-side module 102. In some embodiments, at least some of the functions of POS device 122 are performed by client-side module 102, and the corresponding sub-modules of these functions may be located within client-side module 102 rather than POS device 122. POS device 122 and client device 104 shown in
Attention is now directed towards embodiments of user interfaces and associated processes that may be implemented on a respective POS device 122 with a touch screen 506 (sometimes also herein called a touch screen display) enabled to receive one or more contacts and display information (e.g., media content, webpages and/or user interfaces for a payment/transaction application).
Although some of the examples that follow will be given with reference to inputs on touch screen 506 (where the touch sensitive surface and the display are combined), in some embodiments, the device detects inputs on a touch-sensitive surface that is separate from the display. In some embodiments, the touch sensitive surface has a primary axis that corresponds to a primary axis on the display. In accordance with these embodiments, the device detects contacts with the touch-sensitive surface at locations that correspond to respective locations on the display. In this way, user inputs detected by the device on the touch-sensitive surface are used by the device to manipulate the user interface on the display of the device when the touch-sensitive surface is separate from the display. It should be understood that similar methods are, optionally, used for other user interfaces described herein.
Additionally, while the following examples are given primarily with reference to finger inputs (e.g., finger contacts, finger tap gestures, finger swipe gestures, etc.), it should be understood that, in some embodiments, one or more of the finger inputs are replaced with input from another input device (e.g., a mouse-based, stylus-based, or physical button-based input). For example, a swipe gesture is, optionally, replaced with a mouse click (e.g., instead of a contact) followed by movement of the cursor along the path of the swipe (e.g., instead of movement of the contact). As another example, a tap gesture is, optionally, replaced with a mouse click while the cursor is located over the location of the tap gesture (e.g., instead of detection of the contact followed by ceasing to detect the contact) or depression of a physical button. Similarly, when multiple user inputs are simultaneously detected, it should be understood that multiple computer mice are, optionally, used simultaneously, or a mouse and finger contacts are, optionally, used simultaneously.
In
For example, in response to selection of remote entry affordance 516-1, biometric information (e.g., voice input) associated with information items 512-1 is input via the user's mobile device (i.e., the second device) and checked by server system 108. In this example, when the biometric information checks out, POS device 122 receives a verification notification from server system 108 indicating completion of the transaction of but POS device 122 never receives the actual biometric information. As such, this indirection input of biometric information maintains the user's security and limits the dissemination of the user's sensitive information. In some embodiments, voice input is preferred over other types of biometric information because additional content-based security verification information (e.g., account information, transaction data, personal data, etc.) can be included in the voice input and used to further improve security. In some embodiments, the remote entry of other types of information (e.g., passwords, fingerprints, personal data, etc.) using other input methods is also possible.
Attention is now directed towards embodiments of user interfaces and associated processes that may be implemented on a respective client device 104 with one or more speakers 602 enabled to output sound, zero or more microphones 604 enabled to receive sound input, and a touch screen 606 (sometimes also herein called a touch screen display) enabled to receive one or more contacts and display information (e.g., media content, webpages and/or user interfaces for an application).
Although some of the examples that follow will be given with reference to inputs on touch screen 606 (where the touch sensitive surface and the display are combined), in some embodiments, the device detects inputs on a touch-sensitive surface that is separate from the display. In some embodiments, the touch sensitive surface has a primary axis that corresponds to a primary axis on the display. In accordance with these embodiments, the device detects contacts with the touch-sensitive surface at locations that correspond to respective locations on the display. In this way, user inputs detected by the device on the touch-sensitive surface are used by the device to manipulate the user interface on the display of the device when the touch-sensitive surface is separate from the display. It should be understood that similar methods are, optionally, used for other user interfaces described herein.
Additionally, while the following examples are given primarily with reference to finger inputs (e.g., finger contacts, finger tap gestures, finger swipe gestures, etc.), it should be understood that, in some embodiments, one or more of the finger inputs are replaced with input from another input device (e.g., a mouse based input or stylus input). For example, a swipe gesture is, optionally, replaced with a mouse click (e.g., instead of a contact) followed by movement of the cursor along the path of the swipe (e.g., instead of movement of the contact). As another example, a tap gesture is, optionally, replaced with a mouse click while the cursor is located over the location of the tap gesture (e.g., instead of detection of the contact followed by ceasing to detect the contact). Similarly, when multiple user inputs are simultaneously detected, it should be understood that multiple computer mice are, optionally, used simultaneously, or a mouse and finger contacts are, optionally, used simultaneously.
In
In an example usage scenario, when a user is standing in front of a POS device in a store, and after making a selection for remote entry of required verification information (e.g., as shown in
In some embodiments, the service server obtains (702) a service request submitted by a user at client device 104. In some embodiments, the user uses a user terminal such as a mobile phone, a personal computer, and a tablet computer to submit the service request to the service server through a payment/transaction application, a service submission web page, an instant messaging client, a simple notification service (“SNS”) client, or the like. In some embodiments, the service request includes a login request, a transaction request, a payment request, a session request, and the like, where the transaction request and the payment request may include payment information such as a transaction order and a payment amount.
In some embodiments, the service server detects (704) a security risk in the service request. In some embodiments, in accordance with a preset risk assessment mechanism, the service server performs a risk assessment process on the service request. For example, the service server determines whether the payment amount of the service request exceeds a daily payment limit predetermined by the user, whether a previous login of the user to the service server had a security risk, whether the good or service corresponding to the service request has a security risk, or the like.
If the service server determines that the service request has a security risk, the service server performs step 706. Additionally and/or optionally, in some embodiments, the service server further assigns a security risk level to the service request according to the preset risk assessment mechanism. For example, the security risks are classified into high, medium, and low risk levels. If the service request is assigned a high risk level, the service server rejects the service request. If the service request is assigned a low risk level, the service server performs the service request and returns a message indicating that the service processing is successful. If the service request is assigned a medium risk level, the service server performs step 706.
In some embodiments, the service server sends (706) a voice verification request to the voice processing system. In some embodiments, the voice verification request includes voice contact information preset by the user. In some embodiments, the user submits to the service server voice contact information. In turn, the service server saves the voice contact information and associates it with a user identifier, such as a login name, of the user. For example, the voice contact information is a fixed-line phone number, a mobile phone number, a voice communication platform number, an instant messaging number, an SNS account, or the like.
After detecting a security risk in step 704, the service server sends the voice verification request to the voice processing system. The voice verification request instructs the voice processing system to establish voice communication with the user using the voice contact information included in the voice verification request. In an optional embodiment, the voice verification request further includes verification content information (e.g., transaction amount, date of birth, security question, and so on), which is used by the voice processing system to prompt the user to provide verification information that corresponds to the verification content information.
In some embodiments, the voice processing system establishes (708) voice communication with client device 104. In some embodiments, the voice processing system establishes voice communication with client device 104 according to the voice contact information included in the voice verification request. For example, the voice processing system dials a fixed-line phone number or mobile phone number preset by the user, and after the user answers the call, the voice communication is established. In some embodiments, the voice processing system prompts, manually or by means of automatic voice, the user to provide verification information via the established voice communication. For example, the voice processing system plays a preset voice prompt, such as “Please enter the order number of this payment, and press the pound key.” Additionally and/or optionally, in some embodiments, the voice processing system chooses one of a plurality of voice prompts to play based on the verification content information included in the voice verification request. As such, the user is prompted to enter different verification information. For example, the voice verification request includes one or more items of verification content information such as “order number,” “payment password,” “payment amount,” “registered contact number,” and the like. For example, if the service request is an online payment request, the voice processing system prompts the user to enter payment information such as an order number, a payment amount, or a payment password of this payment request. Further, in an optional embodiment, if the user submits the service request to the service server through a client that supports voice communication (e.g., an instant messaging client or an SNS client) the voice processing system directly sends the voice communication request to the client, so as to establish voice communication with the user through the client.
In some embodiments, the voice processing system obtains (710), by means of the voice communication, the verification information from the user of client device 104. In some embodiments, during voice communication with the voice processing system, the user uses a physical keypad or virtual keys on the user terminal to enter, according to the prompt of the voice processing system, corresponding information related to voice verification request. The verification information fed back by the user includes any one or any combination of: a transaction order number, a payment amount, a payment password, and a registered mobile phone number. For example, the voice processing system gives the following prompt to the user: “Please enter the order number of this payment, and press the pound key.” Continuing with this example, the user enters the order number of this transaction by pressing keys of the user terminal, and the voice processing system obtains, by means of the voice communication with the user, the order number entered by the user. Subsequently, the voice processing system gives the following prompt to the user: “Please enter the amount of this payment, and press the pound key.” Continuing with this example, the user enters the amount of the transaction by pressing keys of the user terminal, and the voice processing system obtains, by means of the voice communication with the user, the payment amount entered by the user. After obtaining all required verification information, which is default or determined according to the verification content information specified in the voice verification request, the voice processing system notifies the user that the voice verification is completed.
Alternatively, in some embodiments, the user provides the verification information to the voice processing system by means of voice. For example, according to the prompt, the user reads the information related to the service request during the voice communication. The voice processing system obtains the voice information which serves as the verification information, and returns the obtained voice information to the service server. Further optionally, the voice processing system prompts the user to read a sentence (e.g., the verification content information, or another piece of information such as “I am XX, and I confirm this payment.”). The voice processing system sends the whole piece of voice information to the service server as a service credential of this service request.
In some embodiments, the voice processing system sends (712) the obtained verification information to the service server.
In some embodiments, the service server performs (714) service processing on the service request according to the verification information from the user. In some embodiments, the service server verifies the obtained verification information by determining whether the verification information is the same as the related information corresponding to the service request (e.g., by comparison). For example, if the service request is a payment request, the service server determines whether the order number included in the verification information is the order number corresponding to the current service request, whether the payment amount included in the verification information is the payment amount corresponding to the current service request, whether the payment password included in the verification information is the payment password preset by the user, whether the password included in the verification information is the payment password preset by the user, or the like. If the verification succeeds, the service server performs subsequent service processing of the service request.
Alternatively and/or additionally, in some embodiments, the verification information includes voice information from the user. In this event, the service server performs voice recognition on the voice information to verify that the voice signature in the voice information matches a voice signature corresponding to the user of the account used to initiate the transaction.
Further, in some embodiments, the service server adjusts the security risk level assessment of the current service request according to the verification result. For example, if the verification succeeds, the security risk is downgraded by one level; in other words, it is determined that the current service request has a lower risk. If the verification fails, the security risk is upgraded by one level; in other words, it is determined that the current service request has a higher risk.
When detecting a security risk in a service request submitted by a user, the service server performs voice communication with the user via a voice processing system, so as to obtain verification information from the user. Moreover, the service server performs service processing on the service request according to the obtained verification information. This reduces the number of failed transaction that occur when the service server interrupts a payment request having a security risk, thereby ensuring transaction security, and improving security verification experience of the user during online payment.
A user submits (802) a payment request to a payment server through a first device (e.g., POS device 122). Specifically, the first user terminal in this embodiment is an Internet enabled device such as a personal computer, a tablet computer, a smart phone, or the like, which can submit the payment request to the payment server through a payment/transaction application, an online transaction web page, an instant messaging client, an SNS client, or the like. In some embodiments, the payment request includes payment information such as a transaction identifier or order number and a payment amount.
In some embodiments, the payment server detects (804) a security risk in the payment request. In some embodiments, in accordance with a preset risk assessment mechanism, the payment server performs a risk assessment process on the payment request. For example, the payment server determines whether the payment amount of the payment request exceeds a daily payment preset by the user, whether a previous login of the user to the payment server had a security risk, whether the good or service corresponding to the payment request has a security risk, or the like.
If the payment server determines that the payment request has a security risk, the payment server performs steps 806 and 808. Additionally and/or optional, in some embodiments, the payment server further assigns a security risk level of the payment request according to the preset risk assessment mechanism. For example, the security risks are classified into high, medium, and low risk levels. If the payment request is assigned a high risk level, the payment server rejects the payment request. If the payment request is assigned a low risk level, the payment server performs the payment request and returns a message indicating that the payment processing is successful. If the payment request is assigned a medium risk level, the payment server performs steps 806 and 808.
In some embodiments, the payment server sends (806) a payment processing suspension notification to the first device. As such, the payment server notifies the user that the payment request has a security risk and that the user needs to provide verification information, by means of voice communication with the voice processing system, in order for the payment server to process the payment request.
In some embodiments, the payment server sends (808) a voice verification request to the voice processing system. In some embodiments, the voice verification request includes voice contact information preset by the user. In an optional embodiment, the voice verification request further includes verification content information (e.g., transaction amount, date of birth, security question, and so on), which is used by the voice processing system to prompt the user to provide verification information that corresponds to the verification content information.
In some embodiments, the voice processing system establishes (810) voice communication with a second device (e.g., client device 104). In some embodiments, the voice processing system establishes voice communication with the second device according to the voice contact information included in the voice verification request. For example, the voice processing system dials a fixed-line phone number or mobile phone number preset by the user, and after the user answers the call, the voice communication is established. Further, after establishing voice communication with the second device, according to the verification content information carried in the voice verification request, the voice processing system prompts, manually or by means of automatic voice, the user to provide verification information corresponding to the verification content information via the established voice communication. For example, the voice verification request includes one or more items of verification content information such as “order number,” “payment password,” “payment amount,” “registered contact number,” and the like. Correspondingly, during the voice communication, the voice processing system prompts the user to provide the corresponding verification information according to the verification content information included in the voice verification request. In another example, if the second device includes a voice communication client, the voice processing system initiates a voice communication request by using a voice communication platform number associated with the voice communication client, thereby establishing voice communication with the second device.
In some embodiments, the voice processing system obtains (812), by means of the voice communication, the verification information from the user of the second device. In some embodiments, during voice communication with the voice processing system, the user uses a physical keypad or virtual keys on the user terminal to enter, according to the prompt of the voice processing system, corresponding information related to voice verification request. Thereby the user provides the entered information related as the verification information to the voice processing system by means of the established voice communication. For example, the voice processing system gives the following prompt to the user: “Please enter the order number of this payment, and press the pound key.” Continuing with this example, the user enters the order number of this transaction by pressing keys of the user terminal, and the voice processing system obtains, by means of the voice communication with the user, the order number entered by the user. Subsequently, the voice processing system gives the following prompt to the user: “Please enter the amount of this payment, and press the pound key.” Continuing with this example, the user enters the amount of the transaction by pressing keys of the user terminal, and the voice processing system obtains, by means of the voice communication with the user, the payment amount entered by the user. After obtaining all required verification information, which is default or determined according to the verification content information specified in the voice verification request, the voice processing system notifies the user that the voice verification is completed.
Alternatively, in some embodiments, the user provides the verification information to the voice processing system by means of voice. For example, the user reads the information related to the service request according to the prompt during the voice communication. The voice processing system obtains the voice information which serves as the verification information, and returns the obtained voice information to the service server. Further optionally, the voice processing system prompts the user to read a sentence (e.g., the verification content information, or another piece of information such as “I am XX, and I confirm this payment.”). The voice processing system sends the whole piece of voice information to the service server as a service credential of this service request.
In some embodiments, the voice processing system sends (814) the obtained verification information to the payment server.
In some embodiments, the payment server processes (816) the payment request according to the verification information. In some embodiments, the payment server verifies the verification information by determining whether the verification information matches stored information corresponding to the verification content information. For example, if the voice verification request instructs the voice processing system to prompt the user to provide the order number, the payment server determines whether the order number provided in the verification information is the order number corresponding to the payment request. In another example, if the voice verification request instructs the voice processing system to prompt the user to provide the payment amount, the payment server determines whether the payment amount provided in the verification information is the payment amount corresponding to the current payment request. If the verification succeeds, the payment server performs processes the payment request.
Further, in some embodiments, the payment server adjusts the security risk level assessment of the current payment request according to the verification result. For example, if the verification succeeds, the security risk is downgraded by one level; in other words, it is determined that the current payment request has a lower risk. If the verification fails, the security risk is upgraded by one level; in other words, it is determined that the current payment request has a higher risk.
In some embodiments, the payment server sends (818) an online payment result to the first device.
Optionally, in some embodiments, when the verification information includes voice information, the payment server saves (820) the obtained voice information of the user as a payment credential of the payment request.
When detecting a security risk in a payment request submitted by a user, the payment server performs voice communication with the user via a voice processing system, so as to obtain verification information from the user. Moreover, the payment server processes the payment request according to the obtained verification information. This reduces the number of failed transaction that occur when the payment server interrupts a payment request having a security risk, thereby ensuring transaction security, and improving security verification experience of the user during online payment.
The server obtains (902) a service request submitted by a user. In some embodiments, the user uses a user terminal such as a mobile phone, a personal computer, and a tablet computer to submit the service request to the service server through a payment/transaction application, a service submission web page, an instant messaging client, an SNS client, or the like. In some embodiments, the service request includes a login request, a transaction request, a payment request, a session request, and the like, where the transaction request and the payment request include payment information such as a transaction order and a payment amount.
The server detects (904) a security risk in the service request. In some embodiments, in accordance with a preset risk assessment mechanism, the service server performs a risk assessment process on the service request. For example, when the service request is a payment request, the server determines whether the payment amount of this service request exceeds a daily payment limit predetermined by the user, whether a previous login of the user to the service server had a security risk, whether the good or service corresponding to the service request has a security risk, or the like.
If the server determines the service request has a security risk, the server performs step 906. Additionally and/or optional, in some embodiments, the service server further assigns a security risk level of the service request according to the preset risk assessment mechanism. For example, the security risks are classified into high, medium, and low risk levels. If the service request is assigned a high risk level, the server rejects the service request. If the service request is assigned a low risk level, the server performs the service request and returns a message indicating that the service processing is successful. If the service request is assigned a medium risk level, the server performs step 906.
Additionally and/or optionally, in some embodiments, after determining that the service request has a security risk, the service server further also provides a notification indicating suspension of service processing to the user. As such, the service server notifies the user that the service request has a security risk and that the user needs to provide verification information, by means of voice communication with the voice processing system, in order for the payment server to process the payment request.
The server requests (906) verification information from the user according to voice contact information preset by the user. Subsequently, the server obtains (908) the verification information from the user.
In some embodiments, the user submits to the service server voice contact information. In turn, the service server saves the voice contact information and associates it with a user identifier, such as a login name, of the user. For example, the voice contact information is a fixed-line phone number, a mobile phone number, a voice communication platform number, an instant messaging number, an SNS account, or the like. After detecting a security risk in step 904, the service server establishes voice communication with the user according to the voice contact information. For example, the service server dials a fixed-line phone number or mobile phone number preset by the user. After the user answers the call, the voice communication is established.
Further, in some embodiments, the service server prompts, manually or by means of automatic voice, the user to provide verification information, by means of the established voice communication, where the verification information is information related to the service request. For example, if the service request is a payment request, the service server prompts the user to enter payment information such as an order number, a payment amount, or a payment password by using a physical keypad or virtual keys on the user terminal to enter, according to the prompt, corresponding payment information. Alternatively, in some embodiments, the user provides the verification information to the service server by means of voice. For example, according to the prompt, the user reads the information related to the service request during the voice communication. After obtaining the voice information from the user, the service server performs voice recognition on the voice information, and uses a recognition result as the voice information of the verification information. Additionally and/or optionally, in some embodiments, after obtaining the voice information from the user, the service server saves the voice information of the user as a service credential of this service request.
Further, in an optional embodiment, if the user submits the service request to the service server through a client that supports voice communication (e.g., an instant messaging client or an SNS client) the service server directly sends the voice communication request to the client, so as to establish voice communication with the user through the client.
Further, in an optional embodiment, a voice processing system (e.g., external from or internal to the server) establishes voice communication with the user and obtains the verification information from the user. Specifically, the optional embodiment includes the following steps:
The server determines (910) whether the obtained verification information matches stored account verification data for the user. In some embodiments, the service server verifies the obtained verification information by determining whether the verification information is the same as the related information corresponding to the service request (e.g., by comparison). For example, if the service request is a payment request, the service server determines whether the order number included in the verification information is the order number corresponding to the current service request, whether the payment amount included in the verification information is the payment amount corresponding to the current service request, whether the payment password included in the verification information is the payment password preset by the user, whether the password included in the verification information is the payment password preset by the user, or the like. If the verification succeeds, the service server performs subsequent service processing of the service request.
In accordance with a determination that the obtained verification information matches the stored account verification data, the server performs (912) the service request. Further, in some embodiments, the service server adjusts the security risk level assessment of the current service request according to the verification result. For example, if the verification succeeds, the security risk is downgraded by one level; in other words, it is determined that the current service request has a lower risk. If the verification fails, the security risk is upgraded by one level; in other words, it is determined that the current service request has a higher risk.
When detecting a security risk in a service request submitted by a user, the server obtains verification information from the user. Moreover, the service server performs service processing on the service request according to the obtained verification information. This reduces the number of failed transaction that occur when the service server interrupts a payment request having a security risk, thereby ensuring transaction security, and improving security verification experience of the user during online payment.
The server system receives (1002) a transaction request from a first device to perform a transaction with an account. In some embodiments, server system 108 or a component thereof (e.g., transaction handling module 222,
In response to receiving the transaction request, the server system determines (1004) a security level for the transaction based on one or more parameters of the transaction and/or the account. In some embodiments, server system 108 or a component thereof (e.g., security determination module 224,
In accordance with a determination that the security level for the transaction meets (1006) a predetermined criterion, the server system: instructs (1008) the first device to suspend the transaction and to display a first interface on the first device indicating suspension of the transaction and sends (1010) a confirmation request to a second device associated with the account to request voice verification for the transaction. In some embodiments, the transaction meets the predetermined criterion when the security risk assigned to the transaction by security determination module 224 is a high or medium level risk.
In some embodiments, the confirmation request includes (1012) a prompt for voice input containing specified information regarding the transaction. In some embodiments, the confirmation request prompts the user of client device 104 to provide a voice input indentifying specific information related to the transaction such as the transaction location, transaction identifier, order number, or purchase amount. In one example, if a thief is attempting to use a credit card at a merchant's POS device, the transaction must be verified by a voice input associated with details of the transaction (e.g., transaction location or transaction amount) received from another device associated with the true credit card holder (e.g., the true credit card account holder's mobile phone). As such, because the credit card is being used by the thief in this example, the true credit card holder cannot provide the details of the transaction to verify the transaction (e.g., because the true credit card holder did not initiate the transaction and the true credit card holder is not present at the location where the transaction was initiated) and the transaction will not be processed.
In some embodiments, the confirmation request includes (1014) a prompt for voice input containing specified account information for the account. In some embodiments, the confirmation request prompts the user of client device 104 to provide a voice input indentifying specific information related to account used to initiate the transaction such as date of birth, social security number, billing address, security question, and the like.
In response to the confirmation request, the server system receives (1016) voice verification information from the second device, where the voice verification information includes audio data provided by a user of the second device.
In some embodiments, the first device also corresponds to (1018) the user. In some embodiments, the first device has limited capabilities (e.g., no voice capture and/or only WiFi capabilities—no GSM/CDMA or other telecommunications capabilities) compared to the second device with voice capture and telecommunication capabilities. In another embodiment, the first and second devices are associated with different users. For example, the first device is associated with a child who has limited purchase authority and the second device is associated with the child's parent who has administrative/super-user authority over the account and, therefore, over the child's purchases.
In some embodiments, the first device is associated with (1020) a merchant. For example, the first device is a POS terminal with a magnetic card reader that is installed at a cashier's station of a merchant/retail store or a mobile POS device.
The server system determines (1022) whether the voice verification information matches stored account verification data corresponding to the account. In some embodiments, server system 108 stores one or more user profiles 116 for a plurality of users with accounts. A respective profile for a respective user includes account verification data 252 corresponding to the account of the respective user such as the social security number, date of birth, security question and answer, biometric voice signature, and/or the like for the respective user. In some embodiments, server system 108 or a component thereof (e.g., verification module 232,
In some embodiments, determining whether the voice verification information matches stored account verification data corresponding to the account further comprises (1024) determining whether the voice verification information includes the specified information regarding the transaction or the specified account information for the account. In some embodiments, server system 108 or a component thereof (e.g., verification module 232,
In some embodiments, determining whether the voice verification information matches stored account verification data corresponding to the account further comprises (1026): extracting a voice signature from the voice verification information; and determining whether the extracted voice signature matches a stored voice signature corresponding to the account. In some embodiments, server system 108 or a component thereof (e.g., voice signature module 234,
In accordance with at least a determination that the voice verification information matches (1028) the stored account verification data corresponding to the account, the server system: processes (1030) the transaction; and instructs (1032) the first device to complete the transaction and to replace display of the first interface on the first device with a second interface indicating completion of the transaction. In some embodiments, in addition to handling security verification, the server is a payment server that also processes the transaction or causes the transaction to be processed by another server (e.g., a server associated with a credit card company).
In some embodiments, receiving the transaction request from the first device, instructing the first device to suspend the transaction, and instructing the first device to complete the transaction occur (1034) at the server system during a single transaction session executed at the first device. In some embodiments, verification of the transaction occurs in real-time during a same transaction session at the first device. For example, the initiator of the transaction cannot go home and then complete the transaction. In some embodiments, verification of the transaction occurs within a predetermined time window.
In some embodiments, in accordance with the determination that the voice verification information matches (1028) the stored account verification data corresponding to the account, the server system (1036): extracts a voice signature from the voice verification information; and associates the extracted voice signature with the account. In some embodiments, when the user profile corresponding to the account does not include a voice signature, server system 108 or a component thereof (e.g., voice signature module 234,
In some embodiments, in accordance with the determination that the security level corresponding to the transaction request meets (1006) the predetermined criterion, the server system (1038) determines whether the first device and the second device are located within a predetermined distance, where processing the transaction and instructing the first device are performed in accordance with both the determination that the voice verification information matches the stored account verification data corresponding to the account and a determination that the first device and the second device are located within the predetermined distance. In some embodiments, server system 108 or a component thereof (e.g., proximity module 238,
Optionally, in some embodiments, verification of the voice verification information AND proximity is only required when security determination module 224 assigns a high security risk to the transaction. Optionally, in some embodiments, a transaction with a high security risk requires verification of the voice verification information AND proximity AND voice signature.
In some embodiments, the server system (1040) extracts a portion of the voice verification information in accordance with predetermined privacy criterion associated with the account, and the server system sends the extracted portion of the voice verification information to the first device. In some embodiments, after determining that the voice verification information matches the stored account verification data corresponding to the account, server system 108 sends a portion of the voice verification information to the first device (e.g., POS device 122,
In some embodiments, service request obtaining module 1110 is configured to obtain a service request submitted by a user of a device. For example, the user uses a user terminal, such as a mobile phone, a personal computer, and a tablet computer, to submit the service request to the service server 1100 through a payment/transaction application, an online transaction web page, an instant messaging client, an SNS client, or the like. For example, the service request includes a login request, a transaction request, a payment request, a session request, and the like. In some embodiments, the service request includes payment information such as a transaction identifier or order number and a payment amount.
In some embodiments, risk monitoring module 1120 is configured to determine whether the service request has a security risk. In some embodiments, in accordance with a preset risk assessment mechanism, risk monitoring module 1120 performs a risk assessment process on the service request. For example, the service server determines whether the payment amount of this service request exceeds a daily payment limit predetermined by the user, whether a previous login of the user to the service server had a security risk, whether the good or service corresponding to the service request has a security risk, or the like.
In some embodiments, when risk monitoring module 1120 detects a security risk in the service request, voice verification module 1130 is configured to establish voice communication with device associated with the user according to preset voice contact information and obtain verification information provided by the user. The voice contact information is, for example, a fixed-line phone number, a mobile phone number, a voice communication platform number, an instant messaging number, an SNS account, or the like. For example, the verification information provided by the user includes any one or any combination of a transaction order number, a payment amount, a payment password, and a registered mobile phone number.
In some embodiments, service processing module 1140 is configured to perform service processing of the service request according to the verification information. In some embodiments, service processing module 1140 verifies the obtained verification information by determining whether the verification information is the same as the related information corresponding to the service request (e.g., by comparison). If the verification succeeds, service processing module 1140 performs service processing on the service request.
In
In some embodiments, verification request sending unit 1132 is configured to send, to a voice processing system, a voice verification request that includes voice contact information preset by the user.
In turn, the voice processing system establishes voice communication with the user according to the voice contact information. For example, according to the voice contact information included in the voice verification request sent by verification request sending unit 1132, the voice processing system dials a fixed-line phone number or a mobile phone number, and after the user answers the call, the voice communication is established. Further, the voice processing system prompts, manually or by means of automatic voice, the user to provide the verification information by means of the established voice communication. Further, in an optional embodiment, if the user submits the service request to the service server through a client that supports voice communication, for example, an instant messaging client or an SNS client, the voice processing system directly sends a voice communication request to the client that supports voice communication, so as to establish voice communication with the user through the client. In an optional embodiment, the voice verification request further includes verification content information. As such, according to verification content information, the voice processing system prompts the user to provide verification information corresponding to the verification content information. After obtaining all required verification information, which is default or determined according to the verification content information specified in the voice verification request, the voice processing system notifies the user that the voice verification is completed.
In some embodiments, verification information obtaining unit 1134 is configured to obtain from the voice processing system the verification information provided by the user.
In
In some embodiments, checking unit 1142 is configured to determine whether the verification information provided by the user matches the information related to the service request and the verification content information. For example, if the voice verification request instructs the voice processing system to prompt the user to provide the order number, checking unit 1142 determines whether the order number provided in the verification information is the order number corresponding to the payment request. In another example, if the voice verification request instructs the voice processing system to prompt the user to provide the payment amount, checking unit 1142 determines whether the payment amount provided in the verification information is the payment amount corresponding to the current payment request.
In some embodiments, in accordance with a determination that the verification by checking unit 1142 succeeds, service processing unit 1144 is configured to perform service processing on the service request.
In some embodiments, payment request obtaining module 1210 is configured to obtain a payment request submitted by a user at a first device.
In some embodiments, risk monitoring module 1220 is configured to determine whether the payment request has a security risk.
In some embodiments, when risk monitoring module 1220 detects a security risk in the payment request, voice verification module 1230 is configured to: establish voice communication with a second device user according to voice contact information preset by the user; and obtain, by means of the voice communication, verification information provided by a user of the second device. In some embodiments, voice verification module 1230 is also configured to determine whether the obtained verification information matches stored account verification data corresponding to the user of the second device.
In some embodiments, when voice verification module 1230 verifies the verification information, payment processing module 1240 is configured to process the payment request.
While particular embodiments are described above, it will be understood it is not intended to limit the application to these particular embodiments. On the contrary, the application includes alternatives, modifications and equivalents that are within the spirit and scope of the appended claims. Numerous specific details are set forth in order to provide a thorough understanding of the subject matter presented herein. But it will be apparent to one of ordinary skill in the art that the subject matter may be practiced without these specific details. In other instances, well-known methods, procedures, components, and circuits have not been described in detail so as not to unnecessarily obscure aspects of the embodiments.
| Number | Date | Country | Kind |
|---|---|---|---|
| 201310744336.4 | Dec 2013 | CN | national |
This application is a continuation application of PCT Patent Application No. PCT/CN2014/083533, entitled “METHODS AND SYSTEMS FOR VERIFYING A TRANSACTION” filed on Aug. 1, 2014, which claims priority to Chinese Patent Application Serial No. 201310744336.4, entitled “METHOD, BUSINESS SERVER, AND SYSTEM FOR SECURITY VERIFICATION,” filed on Dec. 30, 2013, the entirety of which is incorporated herein by reference.
| Number | Date | Country | |
|---|---|---|---|
| Parent | PCT/CN2014/083533 | Aug 2014 | US |
| Child | 14588823 | US |
