Granted Patent B2

US 12,236,427 · App. 18/317,575 · Granted Feb 25, 2025

Inventor: Amie Jackson (Denver, CO)

Assignee: Worldpay, LLC

G06Q20/4012G06Q20/401G06Q30/0203

Abstract

Claims (95)

1. A computer-implemented method of automated validation for proprietary security implementations, the method comprising:

receiving, by a communication interface of a centralized server, a list of security service providers associated with one or more merchants;

enabling, by a portal of the centralized server, a connection with each of the security service providers associated with the one or more merchants;

receiving, by the centralized server, security service information associated with the one or more merchants from a security service provider with connection enabled, the security service provider with connection enabled listed on the list of security service providers;

generating, by a processor of the centralized server, a security service profile for a merchant of the one or more merchants that comprises an assessment of an extent to which the received security service information meets a payment cards industry data security standard (PCI DSS);

storing, by the processor of the centralized server, the security service profile of the merchant of the one or more merchants to an electronic storage medium;

interfering, by the processor of the centralized server, with a payment transaction process involving the merchant of the one or more merchants to prevent an unsecured transaction, based on the assessment of the security service profile of the merchant indicating that the received security service information does not meet the PCI DSS; and

providing, by the processor of the centralized server, a portal allowing an interface for communication with various end users.

2. The method of claim 1 , further comprising,

identifying a questionnaire and/or report pertaining to the PCI DSS of the merchant, wherein the questionnaire and/or report is produced by a source for the data security standards;

receiving from the source for the PCI DSS, the identified questionnaire and/or report;

determining data fields from the received questionnaire and/or report that needs entries;

retrieving, from the electronic storage medium, the security service profile of the merchant;

populating at least some of the determined data fields of the received questionnaire and/or report using the retrieved security service profile of the merchant, to complete or partially complete the questionnaire and/or report; and

transmitting a completed or partially completed questionnaire and/or report to one or more of the merchant or to the source of the PCI DSS.

3. The method of claim 2 , further comprising, prior to identifying a questionnaire and/or report pertaining to the PCI DSS of the merchant,

receiving a request, from the merchant to complete or partially complete the identified questionnaire and/or report pertaining to data security standards of a merchant.

4. The method of claim 2 , wherein the identifying a questionnaire and/or report pertaining to the PCI DSS of the merchant is based on a category of one or more categories which the merchant belongs to, the one or more categories comprising one or more of:

card-not-present merchants that outsource cardholder data functions to third party service providers;

E-commerce merchants who outsource cardholder data functions to third party service providers, and who have website(s) that do not directly receive cardholder data;

merchants using imprint machines or standalone dial-out machines with no electronic cardholder data storage;

merchants using only standalone, PTS-approved payment terminals with an IP connection to a payment processor with no electronic cardholder data storage;

merchants having no electronic cardholder data storage, and who manually enter a single transaction at a time via a keyboard into an Internet-based, virtual payment terminal solution that is provided and hosted by a third-party service provider;

merchants with payment application systems connected to the Internet, no electronic cardholder data storage;

merchants using hardware payment terminals included in and managed via a point to point encryption solution, with no electronic cardholder data storage;

merchants not included in the one or more categories; and

security service providers.

5. The method of claim 4 , wherein the questionnaire and/or report is continually stored on the centralized server via an engine of the centralized server.

6. The method of claim 2 , wherein:

the questionnaire includes a self assessment questionnaire (SAQ) provided by the PCI DSS; and

the report includes the report on compliance (ROC) provided by the PCI DSS.

7. The method of claim 1 , wherein the security service information comprises one or more of:

available tools, products, or services offered by the security service provider that increases data security when implemented by the merchant;

the tools, the products, or the services offered by the security service provider that are already being used being provided to the merchant;

configuration or implementation settings of the merchant for the tools, the products, or the services offered by security service provider and implemented by the merchant; and

data security risk assessment of the merchant based on the tools, the products or the services produced by the security service provider and implemented by the merchant.

8. The method of claim 1 , wherein the security service profile for each merchant comprises one or more of:

a first list of security service providers of a first merchant of the one or more merchants;

a second list of security service providers of a second merchant of the one or more merchants;

a list of tools, products, or services offered by the security service providers of and/or implemented by one of the first merchant and the second merchant;

a list of system components owned or used by one of the first merchant and the second merchant that store, process, or transmit cardholder data; and

the assessment of an extent to which the tools, the products, or the services implemented by the one of the first merchant and the second merchant meets the PCI DSS of the list of system components owned or used by the merchant that store, process, or transmit the cardholder data.

9. The method of claim 1 , wherein the merchant is a security service provider.

10. A system for automated validation for proprietary security implementations, the system comprising:

a data storage device storing instructions for automated validation for proprietary security implementations; and

a processor configured to execute the instructions to perform a method including:

receiving, by a communication interface of a centralized server, a list of security service providers associated with one or more merchants;

enabling, by a portal of the centralized server, a connection with each of the security service providers associated with the one or more merchants;

receiving, by the centralized server, security service information associated with the one or more merchants from a security service provider with connection enabled, the security service provider with connection enabled listed on the list of security service providers;

generating, by a processor of the centralized server, a security service profile for a merchant of the one or more merchants that comprises an assessment of an extent to which the received security service information meets a payment cards industry data security standard (PCI DSS);

storing, by the processor of the centralized server, the security service profile of the merchant of the one or more merchants to an electronic storage medium;

interfering, by the processor of the centralized server, with a payment transaction process involving the merchant of the one or more merchants to prevent an unsecured transaction, based on the assessment of the security service profile of the merchant indicating that the received security service information does not meet the PCI DSS; and

providing, by the processor of the centralized server, a portal allowing an interface for communication with various end users.

11. The system of claim 10 , further comprising,

system components owned or used by each of the one or more merchants that store, process, or transmit cardholder data;

security service providers that offer tools, products, or services to merchants to comply with the PCI DSS; and

a source for the PCI DSS.

12. The system of claim 10 , wherein the processor is further configured for:

identifying a questionnaire and/or report pertaining to the PCI DSS of a merchant of the one or more merchants, wherein the questionnaire and/or report is produced by a source for the PCI DSS;

receiving from the source for the PCI DSS, the identified questionnaire and/or report;

determining data fields from the received questionnaire and/or report that needs entries;

retrieving, from the electronic storage medium, the security service profile of the merchant;

populating at least some of the determined data fields of the received questionnaire and/or report using the retrieved security service profile of the merchant, to complete or partially complete the questionnaire and/or report; and

transmitting a completed or partially completed questionnaire and/or report to one or more of the merchant or to the source of the PCI DSS.

13. The system of claim 12 , wherein the processor is further configured for, prior to identifying a questionnaire and/or report pertaining to the PCI DSS of a merchant of the one or more merchants, receiving a request, from a merchant to complete or partially complete the identified questionnaire and/or report pertaining to data security standards of a merchant.

14. The system of claim 13 , wherein the questionnaire and/or report is continually stored on the centralized server via an engine of the centralized server.

15. The system of claim 12 , wherein:

the questionnaire includes a self assessment questionnaire (SAQ) provided by the PCI DSS; and

the report includes the report on compliance (ROC) provided by the PCI DSS.

16. The system of claim 10 , wherein the security service information comprises one or more of:

available tools, products, or services offered by the security service provider that increases data security when implemented by the merchant;

the tools, the products, or the services offered by the security service provider that are already being used being provided to the merchant;

configuration or implementation settings of the merchant for the tools, the products, or the services offered by security service provider and implemented by the merchant; and

data security risk assessment of the merchant based on the tools, the products or the services produced by the security service provider and implemented by the merchant.

17. The system of claim 10 , wherein the security service profile for a merchant of the one or more merchants comprises one or more of:

the list of security service providers of the merchant;

a list of tools, products, or the services offered by the security service providers of the merchant, and implemented by the merchant;

a list of system components owned or used by the merchant that store, process, or transmit cardholder data; and

the assessment of an extent to which the tools, the products, or the services implemented by the merchant meet the PCI DSS of the list of system components owned or used by the merchant that store, process, or transmit the cardholder data.

18. The system of claim 10 , wherein one or more of the one or more merchants is a security service provider.

19. A non-transitory machine-readable medium storing instructions that, when executed by a processor, cause the processor to perform a method for automated validation for proprietary security implementations, the method including:

receiving, by a communication interface of a centralized server, a list of security service providers associated with one or more merchants;

enabling, by a portal of the centralized server, a connection with each of the security service providers associated with the one or more merchants;

receiving, by the centralized server, security service information associated with the one or more merchants from a security service provider with connection enabled, the security service provider with connection enabled listed on the list of security service providers;

generating, by a processor of the centralized server, a security service profile for a merchant of the one or more merchants that comprises an assessment of an extent to which the received security service information meets a payment cards industry data security standard (PCI DSS);

storing, by the processor of the centralized server, the security service profile of the merchant of the one or more merchants to an electronic storage medium;

interfering, by the processor of the centralized server, with a payment transaction process involving the merchant of the one or more merchants to prevent an unsecured transaction, based on the assessment of the security service profile of the merchant indicating that the received security service information does not meet the PCI DSS; and

providing, by the processor of the centralized server, a portal allowing an interface for communication with various end users.

20. The non-transitory machine-readable medium of claim 19 , further comprising:

identifying a questionnaire and/or report pertaining to the PCI DSS of a merchant of the one or more merchants, wherein the questionnaire and/or report is produced by a source for the PCI DSS;

receiving from the source for the PCI DSS, the identified questionnaire and/or report;

determining data fields from the received questionnaire and/or report that needs entries;

retrieving, from the electronic storage medium, the security service profile of the merchant;

populating at least some of the determined data fields of the received questionnaire and/or report using the retrieved security service profile of the merchant, to complete or partially complete the questionnaire and/or report; and

transmitting a completed or partially completed questionnaire and/or report to one or more of the merchant or to the source of the PCI DSS.

Assignments (6)

Continuity (2)

References Cited (54)