Mobile Device Notification for Secure Financial Transaction Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Online banking and financial transaction systems face security vulnerabilities as hackers intercept user credentials to perform unauthorized transactions, necessitating secure user notification and authorization mechanisms for financial transactions.
Innovation Solution
A method and system that securely registers a user's mobile device with a financial institution, enabling secure encryption and authentication of notifications and responses through distinct communication channels, allowing users to authorize or deny transactions via a mobile application.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If user credentials are transmitted through online banking systems, then financial transaction processing is enabled, but security vulnerabilities arise allowing hackers to intercept credentials and perform unauthorized transactions
Solution Approach 1:
The system segments the authentication process into multiple independent components: device registration, notification delivery, and response collection. Each component operates through separate communication channels, so that compromising one channel does not expose all authentication credentials. The notification message is divided into a request sent to the mobile device and a separate response sent back to the server.
Solution Approach 2:
The patent introduces a mobile device as an intermediary between the user and the financial institution's server. This intermediary receives notifications about pending transactions and collects user responses, acting as a secure buffer that prevents direct exposure of user credentials to potential attackers while still enabling transaction authorization.
2Loss of information
If traditional notification methods are used for transaction alerts, then users can be informed of account activity, but secure authentication and fraud prevention are compromised
Solution Approach 1:
The system implements a feedback loop where the server sends a notification message to the mobile device, the user reviews the transaction details, and then provides an explicit response (approval or denial) that is sent back to the server. This closed-loop feedback mechanism ensures that users are actively involved in the authentication process and that transaction authorization is based on informed user decisions rather than passive notification.
Solution Approach 2:
The mobile device is pre-registered with the server before any transactions occur. During registration, the device receives a unique identifier and establishes secure communication channels. This preliminary setup ensures that when transaction notifications are sent, the device is already authenticated and can securely receive and respond to authorization requests without exposing credentials.
3Reliability
If mobile devices are registered with financial institutions for secure notifications, then transaction security is enhanced, but device complexity and registration requirements increase
Solution Approach 1:
The mobile device application performs self-registration with the financial institution's server. The device automatically generates its own identifier and establishes secure communication channels without requiring manual configuration or complex user input. This self-service approach simplifies the registration process while maintaining high security standards.
Solution Approach 2:
The registered mobile device serves multiple functions: receiving transaction notifications, collecting user responses, and providing secure authentication. By making the mobile device a multi-functional security endpoint, the system reduces the need for separate dedicated hardware tokens or additional authentication devices, thereby reducing overall system complexity while maintaining robust security.
Data Source
AI summary
Methods and apparatuses, including computer program products, are described for secure validation of financial transactions. A server computing device registers a mobile device to receive notification messages from the server computing device. The server computing device transmits a notification message via a first communication channel to a notification agent executing on the registered mobile device, where the message identifies activity associated with a financial account of a user of the registered mobile device. The server computing device receives a response to the notification message via a second communication channel from an application executing on the registered mobile device, if the notification message requires a response. The server computing device stores the response in a database coupled to the server computing device, and determines whether to (i) allow, (ii) deny, or (iii) deny and report as fraud the identified activity based upon the response.