Methods and apparatus for conducting electronic transactions
View Patent ↗A system and method for conducting electronic commerce are disclosed. In various embodiments, the electronic transaction is a purchase transaction. A user is provided with an intelligent token, such as a smartcard containing a digital certificate. The intelligent token suitably authenticates with a server on a network that conducts all or portions of the transaction on behalf of the user. In various embodiments a wallet server interacts with a security server to provide enhanced reliability and confidence in the transaction. In various embodiments, the wallet server includes a toolbar. In various embodiments, the digital wallet pre-fills forms. Forms may be pre-filled using an auto-remember component.
1. A method comprising:
receiving, by a first server from a second server, an authentication request associated with a transaction and a user device, the first and second servers comprising a processor and a memory;
in response to the receiving authentication request, sending, by the second server, a challenge to the first server;
forwarding, by the first server to the user device, the challenge, wherein an intelligent token is configured to generate a challenge response based on the challenge and the user device is configured to send the challenge response to the first server;
receiving, by the second server from the first server, the challenge response;
verifying, by the second server, the intelligent token based upon the challenge response;
in response to the verifying, assembling, by the second server, credentials associated with the user device, wherein the credentials comprise a key;
sending, by the second server, at least a portion of the assembled credentials to the first server;
receiving, by the second server from the first server, an authentication request, wherein the authentication request includes the portion of the assembled credentials;
validating, by the second server, the portion of the assembled credentials with the key; and
in response to the validating, sending, by the second server to the first server, an approval message for the user device, wherein in response to the approval message, the user device is allowed to proceed with the transaction.
2. The method of claim 1 , wherein the challenge is a cryptographic challenge.
3. The method of claim 1 , wherein the challenge is configured to prevent reply attacks.
4. The method of claim 1 , wherein the user device comprises the intelligent token.
5. The method of claim 1 , wherein the authentication request is for an electronic purchase transaction.
6. The method of claim 5 , wherein the electronic purchase transaction is conducted using a digital wallet.
7. The method of claim 1 , wherein the intelligent token is a smartcard.
8. The method of claim 7 , wherein the user device is communicatively coupled to a smart-card reader.
9. The method of claim 1 , further comprising:
accessing information associated with the user device from a second server; and
populating one or more corresponding user purchase forms at said second server with said information, wherein the second server provides the populated user purchase forms and an authorization response message to a merchant for processing and completion of the transaction.
10. The method of claim 9 , wherein the information includes at least one of a user name, user address, shipping address, card number, and payment amount.
11. The method of claim 1 , wherein the user device is a mobile device.
12. The method of claim 11 , wherein the intelligent token is stored in a memory of the mobile device.
13. The method of claim 1 , wherein the transaction request is received from at least one of the user device and the first server.
14. The method of claim 1 , wherein the first server comprises at least one of a wallet server and a merchant server.
15. The method of claim 14 , wherein the first server receives the transaction request from the user device.
16. The method of claim 15 , wherein the first server redirects the authentication request to the server.
17. The method of claim 14 , wherein the transaction is associated with the merchant server.
18. The method of claim 1 , wherein the credentials are associated with at least one of a user account and the user device.
19. An article of manufacture including a non-transitory computer readable medium having instructions stored thereon that, in response to execution by a security server, cause the security server to perform operations comprising:
receiving, by the security server from a wallet server, an authentication request associated with a transaction and a user device;
creating, by the security server, a challenge in response to the authentication request;
forwarding, by the security server, the challenge to the wallet server, wherein an intelligent token communicatively coupled to a user device generates a challenge response based on the challenge and the user device sends the challenge response to the wallet server;
receiving, by the security server from the wallet server, the challenge response;
verifying, by the security server, the intelligent token based upon the challenge response;
in response to the verifying, assembling, by the security server, credentials associated with the user device, wherein the credentials comprise a key;
sending, by the security server, at least a portion of the assembled credentials to the wallet server;
receiving, by the security server from the wallet server, an authentication request, wherein the authentication request includes the portion of the assembled credentials;
validating, by the security server, the portion of the assembled credentials with the key; and
in response to the validating, sending, by the security server to the wallet server, an approval message for the user device, wherein in response to the approval message, the user device is allowed to proceed with the transaction.
20. A system comprising:
memory communicatively coupled to a transaction security server comprising a security processor,
the memory having instructions stored thereon that, in response to execution by the security processor, at least cause:
receiving, from a wallet server, an authentication request associated with a transaction and a user device;
generating a challenge in response to the authentication request;
forwarding the challenge to the wallet server, wherein an intelligent token communicatively coupled to a user device generates a challenge response based on the challenge and the user device sends the challenge response to the wallet server;
receiving from the wallet server the challenge response;
verifying the intelligent token based upon the challenge response;
in response to the verifying, assembling credentials associated with the user device, wherein the credentials comprise a key;
sending at least a portion of the assembled credentials to the wallet server;
receiving from the wallet server an authentication request, wherein the authentication request includes the portion of the assembled credentials;
validating the portion of the assembled credentials with the key; and
in response to the validating, sending, by the security server to the wallet server, an approval message for the user device, wherein in response to the approval message, the user device is allowed to proceed with the transaction.