This disclosure relates generally to payment security. More specifically, this disclosure relates to a system and method for fraud detection.
With the increased adoption of digitally executed transactions, such as sales and agreements between users of digital apparatus such as mobile phones and tables and counterparties, the sophistication and imagination of digital fraud by bad actors has likewise increased. For example, in the context of an online payment, payment fraud may still occur when bad actors attempt to misrepresent themselves as a known reputable merchant. Alternatively, payment fraud may occur if a device displays a lower value for a transaction amount, but the data for executing the payment corresponds to a higher value. Numerous variations on counterparty fraud in which one set of transaction parameters are displayed, and another, undisplayed set of transaction parameters are executed are possible, and are difficult to detect, in the absence of any evidence or proof of the transaction parameters displayed to the user. Such improvements in techniques for committing digital fraud present opportunities for improvements in device and network security technology.
This disclosure provides a system and method for fraud detection.
In a first embodiment, a method for authenticating a counterparty to a digital transaction includes obtaining, at a mobile terminal from a counterparty, characteristic content associated with the digital transaction to be displayed in a trusted user interface provided by the mobile terminal, sending, by the mobile terminal, data associated with the characteristic content to an authentication server; and obtaining, from the authentication server, a result of an authentication judgment by the authentication server, the authentication judgment based on the data associated with the characteristic content and an item of reference content.
In a second embodiment, a method for authenticating a counterparty to a digital transaction includes obtaining, at an authentication server, from a mobile terminal, data associated with characteristic content of a counterparty to be displayed in a trusted user interface provided by the mobile terminal, performing, by the authentication server, an authentication judgment based on the data associated with the characteristic content and an item of reference content to obtain a result, and sending, by the authentication server, the result of the authentication judgment to the mobile terminal.
In a third embodiment, an apparatus includes a display, a network interface, a processor, and a memory. Further, the memory contains instructions, which when executed by the processor, cause the apparatus to obtain, via the network interface, from a counterparty, characteristic content associated with a digital transaction, the characteristic content to be displayed on the display in a trusted user interface provided by the apparatus, send, via the network interface, data associated with the characteristic content to an authentication server, and obtain, via the network interface, from the authentication server, a result of an authentication judgment by the authentication server, the authentication judgment based on the data associated with the characteristic content and an item of reference content.
In a fourth embodiment, an authentication server includes a network interface, a processor and a memory. Further, the memory contains instructions, which when executed by the processor, cause the authentication server to obtain, from a mobile terminal, data associated with characteristic content of a counterparty to be displayed in a trusted user interface provided by the mobile terminal, perform, by the authentication server, an authentication judgment based on the data associated with the characteristic content and an item of reference content to obtain a result, and send the result of the authentication judgment to the mobile terminal.
In a fifth embodiment, a non-transitory computer-readable medium includes program code, which when executed by a processor, causes an apparatus to obtain, via a network interface, from a counterparty, characteristic content associated with a digital transaction, the characteristic content to be displayed on a display in a trusted user interface provided by the apparatus, send, via the network interface, data associated with the characteristic content to an authentication server, and obtain, via the network interface, from the authentication server, a result of an authentication judgment by the authentication server, the authentication judgment based on the data associated with the characteristic content and an item of reference content.
In a sixth embodiment, a non-transitory computer-readable medium includes program code, which when executed by a processor, causes an authentication server to obtain, from a mobile terminal, data associated with characteristic content of a counterparty to be displayed in a trusted user interface provided by the mobile terminal, perform an authentication judgment based on the data associated with the characteristic content and an item of reference content to obtain a result, and send the result of the authentication judgment to the mobile terminal.
Other technical features may be readily apparent to one skilled in the art from the following figures, descriptions, and claims.
Before undertaking the DETAILED DESCRIPTION below, it may be advantageous to set forth definitions of certain words and phrases used throughout this patent document. The term “couple” and its derivatives refer to any direct or indirect communication between two or more elements, whether or not those elements are in physical contact with one another. The terms “transmit,” “receive,” and “communicate,” as well as derivatives thereof, encompass both direct and indirect communication. The terms “include” and “comprise,” as well as derivatives thereof, mean inclusion without limitation. The term “or” is inclusive, meaning and/or. The phrase “associated with,” as well as derivatives thereof, means to include, be included within, interconnect with, contain, be contained within, connect to or with, couple to or with, be communicable with, cooperate with, interleave, juxtapose, be proximate to, be bound to or with, have, have a property of, have a relationship to or with, or the like. The term “controller” means any device, system or part thereof that controls at least one operation. Such a controller may be implemented in hardware or a combination of hardware and software and/or firmware. The functionality associated with any particular controller may be centralized or distributed, whether locally or remotely. The phrase “at least one of,” when used with a list of items, means that different combinations of one or more of the listed items may be used, and only one item in the list may be needed. For example, “at least one of: A, B, and C” includes any of the following combinations: A, B, C, A and B, A and C, B and C, and A and B and C.
Moreover, various functions described below can be implemented or supported by one or more computer programs, each of which is formed from computer readable program code and embodied in a computer readable medium. The terms “application” and “program” refer to one or more computer programs, software components, sets of instructions, procedures, functions, objects, classes, instances, related data, or a portion thereof adapted for implementation in a suitable computer readable program code. The phrase “computer readable program code” includes any type of computer code, including source code, object code, and executable code. The phrase “computer readable medium” includes any type of medium capable of being accessed by a computer, such as read only memory (ROM), random access memory (RAM), a hard disk drive, a compact disc (CD), a digital video disc (DVD), or any other type of memory. A “non-transitory” computer readable medium excludes wired, wireless, optical, or other communication links that transport transitory electrical or other signals. A non-transitory computer readable medium includes media where data can be permanently stored and media where data can be stored and later overwritten, such as a rewritable optical disc or an erasable memory device.
Definitions for other certain words and phrases are provided throughout this patent document. Those of ordinary skill in the art should understand that in many if not most instances, such definitions apply to prior as well as future uses of such defined words and phrases.
For a more complete understanding of this disclosure and its advantages, reference is now made to the following description, taken in conjunction with the accompanying drawings, in which:
As shown in the non-limiting example of
Applications 162 can include games, social media applications, applications for geotagging photographs and other items of digital content, virtual reality (VR) applications, augmented reality (AR) applications, operating systems, device security (e.g., anti-theft and device tracking) applications or any other applications which access resources of device 100, the resources of device 100 including, without limitation, speaker 130, microphone 120, input/output devices 150, and additional resources 180. According to certain embodiments, applications 162 may include an application associated with a counterparty to a digital transaction (for example, a merchant's shopping application. According to some embodiments, applications 162 comprise a mobile wallet application (for example, SAMSUNG PAY, APPLE PAY, GOOGLE PAY, PAYPAL, etc.) providing a secure, or easy payment service from a user's mobile device. Further, applications 162 may include applications containing program code that when executed by a processor, such as main processor 140, cause the processor to perform steps of methods for monitoring suspicious application access according to certain embodiments of the present disclosure.
The communication unit 110 may receive an incoming RF signal, for example, a near field communication signal such as a Bluetooth® or Wi-Fi® signal. The communication unit 110 can down-convert the incoming RF signal to generate an intermediate frequency (IF) or baseband signal. The IF or baseband signal is sent to the RX processing circuitry 125, which generates a processed baseband signal by filtering, decoding, or digitizing the baseband or IF signal. The RX processing circuitry 125 transmits the processed baseband signal to the speaker 130 (such as for voice data) or to the main processor 140 for further processing (such as for web browsing data, online gameplay data, notification data, or other message data). Additionally, communication unit 110 may contain a network interface, such as a network card, or a network interface implemented through software.
The TX processing circuitry 115 receives analog or digital voice data from the microphone 120 or other outgoing baseband data (such as web data, e-mail, or interactive video game data) from the main processor 140. The TX processing circuitry 115 encodes, multiplexes, or digitizes the outgoing baseband data to generate a processed baseband or IF signal. The communication unit 110 receives the outgoing processed baseband or IF signal from the TX processing circuitry 115 and up-converts the baseband or IF signal to an RF signal for transmission.
The main processor 140 can include one or more processors or other processing devices and execute the OS program 161 stored in the memory 160 in order to control the overall operation of the device 100. For example, the main processor 140 could control the reception of forward channel signals and the transmission of reverse channel signals by the communication unit 110, the RX processing circuitry 125, and the TX processing circuitry 115 in accordance with well-known principles. In some embodiments, the main processor 140 includes at least one microprocessor or microcontroller.
Additionally, operating system 161 is capable of providing an execution environment 165 for applications. According to some embodiments, execution environment 165 includes a trusted execution environment (“TEE”) 167 (for example TRUSTZONE by ARM) and a normal execution environment 169. According to certain embodiments, certain memory and processor resources accessible in TEE 167 are not accessible to applications running in “normal world” 169. In some embodiments, TEE 167 provides a trusted user interface through which content associated with sensitive device functionalities (for example, payments to be made using a mobile wallet application) can be rendered and displayed for a user.
The main processor 140 is also capable of executing other processes and programs resident in the memory 160. The main processor 140 can move data into or out of the memory 160 as required by an executing process. In some embodiments, the main processor 140 is configured to execute the applications 162 based on the OS program 161 or in response to inputs from a user or applications 162. Applications 162 can include applications specifically developed for the platform of device 100, or legacy applications developed for earlier platforms. Additionally, main processor 140 can be manufactured to include program logic for implementing methods for monitoring suspicious application access according to certain embodiments of the present disclosure. The main processor 140 is also coupled to the I/O interface 145, which provides the device 100 with the ability to connect to other devices such as laptop computers and handheld computers. The I/O interface 145 is the communication path between these accessories and the main processor 140.
The main processor 140 is also coupled to the input/output device(s) 150. The operator of the device 100 can use the input/output device(s) 150 to enter data into the device 100. Input/output device(s) 150 can include keyboards, touch screens, mouse(s), track balls or other devices capable of acting as a user interface to allow a user to interact with electronic device 100. In some embodiments, input/output device(s) 150 can include a touch panel, a virtual reality headset, a (digital) pen sensor, a key, or an ultrasonic input device.
Input/output device(s) 150 can include one or more screens, which can be a liquid crystal display, light-emitting diode (LED) display, an optical LED (OLED), an active matrix OLED (AMOLED), or other screens capable of rendering graphics.
The memory 160 is coupled to the main processor 140. According to certain embodiments, part of the memory 160 includes a random access memory (RAM), and another part of the memory 160 includes a Flash memory or other read-only memory (ROM). Although
For example, according to certain embodiments, device 100 can further include a separate graphics processing unit (GPU) 170.
According to certain embodiments, electronic device 100 includes a variety of additional resources 180 which can, if permitted, be accessed by applications 162. According to certain embodiments, resources 180 include an accelerometer or inertial motion unit 182, which can detect movements of the electronic device along one or more degrees of freedom. Additional resources 180 include, in some embodiments, a user's phone book 184, one or more cameras 186 of electronic device 100, and a global positioning system 188.
Although
Server 200 can, in some embodiments, be embodied on a single standalone device, or on a device providing another server function (for example, a gateway server). Alternatively, in some cases, server 200 may be embodied on multiple machines, for example a server communicatively connected to one or more database servers. According to still further embodiments, authentication server 200 is embodied on a cloud computing platform.
As shown in
The processing device 210 executes instructions that can be stored in a memory 230. The processing device 210 can include any suitable number(s) and type(s) of processors or other devices in any suitable arrangement. Example types of processing devices 210 include microprocessors, microcontrollers, digital signal processors, field programmable gate arrays, application specific integrated circuits, and discreet circuitry.
The memory 230 and a persistent storage 235 are examples of storage devices 215 that represent any structure(s) capable of storing and facilitating retrieval of information (such as data, program code, or other suitable information on a temporary or permanent basis). The memory 230 can represent a random access memory or any other suitable volatile or non-volatile storage device(s). The persistent storage 235 can contain one or more components or devices supporting longer-term According to certain embodiments, persistent storage 235 comprises one or databases or interfaces to databases embodied on separate machines. storage of data, such as a ready only memory, hard drive, Flash memory, or optical disc.
The communications unit 220 supports communications with other systems or devices. For example, the communications unit 220 could include a network interface card or a wireless transceiver facilitating communications over the network 102. The communications unit 220 can support communications through any suitable physical or wireless communication link(s).
The I/O unit 225 allows for input and output of data. For example, the I/O unit 225 can provide a connection for user input through a keyboard, mouse, keypad, touchscreen, or other suitable input device. The I/O unit 225 can also send output to a display, printer, or other suitable output device.
Referring to the non-limiting example of
According to certain embodiments, apparatus 305 comprises a device (for example, device 100 in
In the non-limiting example of
According to various embodiments, counterparty application 335 includes mobile wallet software development kit (SDK) 340. In this non-limiting example, mobile wallet SDK 340 is a software toolkit (for example, the SAMSUNG PAY SDK, the PAYDIENT SDK, the APPLE PAY SDK, the GOOGLE PAY SDK, etc.) which provides a framework (such as classes and code modules to support, for example, an API) by which a functionality can be incorporated into an application. In this example, mobile wallet SDK 340 comprises the toolkit and the portions of counterparty application 335 built with mobile wallet SDK 340 to facilitate the exchange of a store of value (for example, money) mediated by the interaction between counterparty application 335 and counterparty server 315.
In some embodiments, mobile wallet application 345 comprises an application running on apparatus 305, which leverages functionalities (for example, encryption, network connectivity, and multi-layer user authentication) of apparatus 305, such that the mobile device can, like a physical wallet, operate as a store of value for exchange in transactions. According to embodiments, mobile wallet application 345 may run in a separate execution environment, (for example, TEE 167 in
In the non-limiting example of
In at least one embodiment according to this disclosure, counterparty server 315 comprises a server which registers the counterparty's transactional parameters (e.g., the counterparty's business name, what items are available for sale, prices, and quantities) and provides content (for example, XML data) representing these transactional parameters to counterparty application 335 for display on apparatus 305. Further, counterparty server 315 hosts and serves content which can be said to be characteristic of a digital transaction (for example, the counterparty's ID, image, or price, quantity or other data to be rendered at apparatus 305) shown prior to receiving an input from a user to proceed with a digital transaction.
According to certain embodiments, authentication server 310 is a server machine (for example, authentication server 200 in
Referring to the non-limiting example of
According to certain embodiments, the content displayed in TUI 415 includes characteristic content 420, which comprises content upon which a user relies in deciding whether to proceed with a digital transaction by using a sensitive resource of apparatus 405. In the non-limiting example of
According to embodiments, prior to receiving an input from a user instructing the apparatus to proceed with a digital transaction with a counterparty (also known herein as a merchant), a process (for example, a process of a mobile wallet application, such as mobile wallet application 345 in
In the non-limiting example of
According to embodiments, authentication server 410 comprises at least the following two data stores, reference database 430 and counterparty ID database 435. In the non-limiting example of
According to various embodiments, reference database 430 comprises a store of items of reference content comprising or representing authentic characteristic content. According to certain embodiments, items of reference content comprise hashes of authentic characteristic content. In some embodiments, authentic characteristic content may be provided from counterparties as part of a registration or onboarding procedure with authentication server 410. For example, authentication server 410 may offer a registration, or onboarding, service for providers of counterparty applications to be included in reference database 430 and counterparty ID database 435. In the non-limiting example of
According to other embodiments, items of reference content, including, without limitation, hashes of authentic characteristic content may be obtained by running trusted instances of counterparty applications (for example, counterparty application 335 in
In
As shown in the non-limiting examples
According to various embodiments, at operation 505, an apparatus (for example, device 100 in
In some embodiments, method 500 comprises operation 510, wherein one or more items of characteristic content (for example, characteristic content received at the apparatus as .XML data) is rendered for viewing on the display of the apparatus. According to certain embodiments, at operation 510, the characteristic content is rendered for display according to settings and properties specific to the apparatus, such as, for example, screen resolution and brightness settings). In some embodiments, at operation 510, the characteristic content is rendered and displayed for a brief interval, so that a snapshot of the rendered characteristic content may be taken at the terminal. In some embodiments, the rendering may be done according to designated resolutions or settings to ensure consistency of the obtained snapshot. In some embodiments, operation 510 is omitted, and the data associated with characteristic content provided to the authentication server does not include content to be rendered at the apparatus.
According to certain embodiments, at operation 515, an apparatus may generate a hash of one or more items of characteristic content, such as characteristic content obtained at operation 505 in a display-ready format (for example, an image file). According to some embodiments, the apparatus may generate a hash of some or all of a snapshot of content rendered at operation 510. In the non-limiting example of
In one embodiment, as a non-limiting example of
In another embodiment, the apparatus may be configured to display a different image from the characteristic content that is provided to the authentication server or a party attempting to commit fraud may cause a different image to be provided as characteristic content from the image displayed. For example, a merchant intent on committing fraud may provide a logo of a reputable company (e.g., Amazon, Walmart, Target, Macy's, etc.) for display but cause its own logo to be provided as characteristic content so as to have a matching comparison with the reference. In such an embodiment, the apparatus may provide to the authentication server the snapshot of the content rendered for display or portions of the snapshot where the logo or other aspects, such as price are located.
As shown in the non-limiting example of
In various embodiments according to this disclosure, at operation 525, the apparatus obtains, from the authentication server, the result of an authentication judgment based on data associated with the characteristic content and a a reference item of content. The format of the result of the authentication judgment received by the apparatus at operation 525 can vary across embodiments according to this disclosure. In some embodiments, the result of the authentication judgment may comprise an indicator, such as a flag as to whether a comparison based on data associated with characteristic content provided by the apparatus to the authentication server matches an item of reference content stored at the authentication server. According to other embodiments, the result of the authentication judgment may comprise the value of a counterparty ID associated with an item of reference content with a matching comparison of the data associated with characteristic content provided by the apparatus to the authentication server. In some further embodiments, the result of the authentication judgment provided in operation 520 may comprise an authorization, such as authorization to generate or release a payload (for example, a payload of payment framework 350 in
In one embodiment, as a non-limiting example of
In some embodiments, operation 530 comprises determining, by the apparatus whether to proceed with a digital transaction based on the received result of the authentication judgment. According to certain embodiments, operation 530 comprises application of a rule stored at the apparatus to a value contained in the result obtained at operation 525. For example, if the apparatus receives an indication that the data associated with an item of characteristic content cannot be matched to an item of reference content stored at the authentication server.
It should be noted that
Referring to the non-limiting example of
According to some embodiments, at operation 610, the authentication server obtains normalization data associated with an item of characteristic content. In the non-limiting example of
In various embodiments according to this disclosure, at operation 615, the authentication server generates a hash of the data associated with characteristic content by applying a hash function (for example, SHA256, MD4, or other hash algorithm) to the data. In some cases, for example, where the data associated with the characteristic content comprises a snapshot of data as rendered for display at an apparatus, the authentication server may, prior to generating a hash, normalize the data to account for apparatus-specific parameters affecting the display of the characteristic content. Such normalization may be performed using normalization data obtained at operation 610. In some embodiments, operation 615 may be optional if the hash is provided as part of the characteristic content from the apparatus or another form of comparison is used to perform the authentication judgment.
According to some embodiments, at operation 620, the authentication server performs an authentication judgment based on data associated with an item of characteristic content and an item of reference content. In some embodiments, the data associated with the item of characteristic content is itself a hash, and the authentication judgment comprises a query to determine if data associated with the item of characteristic content matches an item of reference content maintained in a reference database (for example, reference database 430 in
According to other embodiments, at operation 620, the authentication server generates an item of reference content by generating a snapshot of the characteristic content on a trusted instance of a counterparty application on a device emulating the display properties of the apparatus. In some embodiments, an emulation of the display properties of the apparatus may be created using normalization data obtained by the authentication server, such as during operation 610. In such embodiments, a comparison of a hash of the data associated with the item of characteristic content may be compared against an item of reference content based on the trusted instance of the counterparty application. If there is a match, the generated hash may be stored as an item of reference content in a reference database, along with the normalization settings.
In one embodiment, for the non-limiting example of
According to certain embodiments, as part of operation 620, the authentication server may apply a predetermined rule based on the outcome of the query for a matching item of reference content to obtain a result for the authentication judgment. For example, if no match is found, the authentication server may apply a rule to generate a “permission denied” message to send to the apparatus, instructing the apparatus not to proceed with the digital transaction.
In the non-limiting example of
Referring to the non-limiting example of
None of the description in this application should be read as implying that any particular element, step, or function is an essential element that must be included in the claim scope. The scope of patented subject matter is defined only by the claims. Moreover, none of the claims is intended to invoke 35 U.S.C. § 112(f) unless the exact words “means for” are followed by a participle.
This application claims priority under 35 U.S.C. § 119(e) to U.S. Provisional Patent Application No. 62/505,745 filed on May 12, 2017. The above-identified provisional patent application is hereby incorporated by reference in its entirety.
Number | Date | Country | |
---|---|---|---|
62505745 | May 2017 | US |