Secure Intermediary System for Credit Card Data Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current secure communication protocols, such as SSL, do not adequately address the issues of security and trust in electronic commerce, particularly in the transmission of credit card numbers over the Internet, as they do not prevent misuse of credit card information even if the retailer is honest, and require active user intervention for limited-use account numbers, hindering streamlined commerce.
Innovation Solution
A secure intermediary system is positioned between client and server nodes to establish dual secure sessions, allowing for intermediation services that replace credit card numbers with limited-use account numbers, enhancing security by encrypting and decrypting data, and obtaining limited-use payment numbers from a payment server to prevent unauthorized charges.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SSL secure sessions are used to encrypt credit card numbers, then security is improved, but the credit card numbers are still transmitted over public networks and can be accessed by intermediaries
Solution Approach 1:
The patent introduces a payment intermediary that acts as a mediator between the client and server. The intermediary receives encrypted credit card numbers from clients, decrypts them using its private key, processes the payment, and then generates a receipt. This intermediary architecture allows the system to maintain security while enabling the necessary decryption and processing of credit card information without direct client-server exposure.
2Reliability
If certificates are used to verify party identities, then trust is improved, but the complexity of certificate management and validation increases
Solution Approach 1:
The patent makes the payment intermediary serve multiple functions: it acts as a certificate authority by providing certificates to both clients and servers, functions as a payment processor by handling credit card decryption and transaction processing, and serves as a trust intermediary by validating parties through certificate verification. This multi-functionality consolidates what would otherwise require separate systems into a single universal intermediary.
Solution Approach 2:
The intermediary automatically performs certificate validation, encryption key management, and transaction processing without requiring direct user intervention for these complex operations. The system handles certificate verification, key exchange, and security management autonomously, reducing the burden on users while maintaining high security standards.
3Reliability
If limited-use account numbers are used instead of credit card numbers, then security is improved, but user intervention is required to obtain these numbers, hindering streamlined commerce
Solution Approach 1:
The intermediary automatically generates and provides limited-use account numbers to clients before transactions occur, and automatically processes the substitution of these numbers for actual credit card numbers during payment. This preliminary automation eliminates the need for users to manually request or manage limited-use numbers, while still achieving the security benefits of not transmitting actual credit card information over the network.
Data Source
AI summary
In a secure intermediary system, an intermediary is positioned along a communications path between a client and a server. The client sends a request to enter into a secure session, such as a secure socket layer (SSL) session. The intermediary receives the session request and establishes a first secure session between the client and the intermediary and/or a second secure session between the intermediary and the server. After the first and second secure sessions have been established, the intermediary provides intermediation services between the server and the client in an intermediated secure session. The intermediation service may be, for example, detecting whether a message sent by the client includes a credit card number. To prevent the credit card number from being sent over a network, credit card number may be replaced with a one-time use payment number.