Methods and apparatus for conducting electronic transactions
View Patent ↗A system and method for conducting electronic commerce are disclosed. In various embodiments, the electronic transaction is a purchase transaction. A user is provided with an intelligent token, such as a smartcard containing a digital certificate. The intelligent token suitably authenticates with a server on a network that conducts all or portions of the transaction on behalf of the user. In various embodiments a wallet server interacts with a security server to provide enhanced reliability and confidence in the transaction. In various embodiments, the wallet server includes a toolbar. In various embodiments, the digital wallet pre-fills forms. Forms may be pre-filled using an auto-remember component.
1. A method comprising:
receiving, by a first server comprising a processor and a non-transitory, tangible memory, a transaction request from a user for a transaction at a merchant server;
receiving, by said first server, a third party request comprising executable commands being associated with a selected programming language;
scanning said third party request to find executable commands
at least one of editing and removing at least a portion of said executable commands,
wherein said at least one of editing and removing comprises at least one of
rendering said executable commands unexecutable by a network client by removing a character of said executable commands; and
rendering said executable commands unexecutable by said network client by replacing particular characters within said executable commands;
issuing a challenge to a second server comprising a processor and a non-transitory, tangible memory and forwarding the challenge from said second server to the user, wherein said challenge is passed to an intelligent token for processing said challenge, wherein said intelligent token generates a response to said challenge;
receiving said response by said second server from the user based upon said challenge;
processing said response by said second server and verifying the intelligent token;
assembling credentials for the transaction at said first server, said credentials comprising at least one key;
providing at least a portion of said assembled credentials to said user;
receiving, by said second server, a second request from said user, said second request including said portion of said assembled credentials provided to said user; and
validating, by said second server, said portion of said assembled credentials provided to said user with said key of said assembled credentials providing access to a transaction service.
2. The method of claim 1 , further comprising rejecting a request when said request contains said executable commands having a hostile character.
3. The method of claim 1 , further comprising logging said executable commands to form a security log.
4. The method of claim 1 , wherein said executable commands cause an unwanted action when executed.
5. The method of claim 1 , wherein said executable commands are malicious.
6. The method of claim 1 , further comprising receiving a request for a connection at said network server from said network client.
7. The method of claim 1 wherein said programming language comprises javascript.
8. The method claim 1 , wherein said rendering said executable commands unexecutable by said network client by replacing particular characters within said executable commands comprises converting a script format character to another character, wherein said script format character identifies a block of code.
9. The method claim 1 , wherein said rendering said executable commands unexecutable by said network client by removing a character of said executable commands comprises removing a script format character, wherein said script format character identifies a block of code.
10. The method of claim 3 , further comprising reviewing said security log to determine whether said executable commands are hostile.
11. The method of claim 6 , further comprising verifying that a response from said network server to said network client is void of said executable commands.
12. The method of claim 11 , further comprising providing said response from said network server to said network client.