# US 10,313,383 B2 · Systems and methods for use in evaluating vulnerability risks associated with payment applications

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,313,383 B2
- Document ID: US10313383B2
- Status: Granted
- Kind: B2
- Application number: 15/170,408
- Filed: 2016-06-01
- Published: 2017-12-07
- Granted: 2019-06-04
- Earliest claimed: 2016-06-01
- Assignees: Mastercard International Incorporated
- Applicants: Mastercard International Incorporated
- Inventors: Adam Michael Sommer
- Web page: https://patentgrep.com/patent/US10313383B2

## CPC

- H04L 63/1433: {Vulnerability analysis}
- G06Q 20/356: {Aspects of software for card payments}
- G06Q 20/367: {involving electronic purses or money safes}
- G06Q 20/4016: {involving fraud or risk level assessment in transaction processing}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR

## Abstract

Disclosed are exemplary embodiments of systems and methods for evaluating payment applications based on associated vulnerability risks. In an exemplary embodiment, a method generally includes soliciting, by a computing device, application data associated with a payment application via a vulnerability questionnaire interface, validating, by the computing device, the application data against criterion, and determining, by the computing device, a vulnerability risk score of the application based on the application data. The method also includes approving, by the computing device, the application when the vulnerability risk score satisfies an approval threshold, denying, by the computing device, the application when the vulnerability risk score satisfies a denial threshold, and referring, by the computing device, the application for manual decision when the vulnerability risk score satisfies a manual decision threshold.

## Claims

### Claim 1

A method for evaluating applications based on associated vulnerabilities, the method comprising:
soliciting, by a computing device, application data associated with an application to be evaluated via a vulnerability questionnaire interface;
validating, by the computing device, the application data against each of an infrastructure criterion, a compliance criterion, and a vulnerability criterion;
assigning a first plurality of impact point values to the application data based on validation of the application data against two of: the infrastructure criterion, the compliance criterion, and the vulnerability criterion;
assigning a second plurality of impact point values to the application data based on validation of the application data against the other one of: the infrastructure criterion, the compliance criterion, and the vulnerability criterion;
combining the assigned first and second plurality of impact point values into a vulnerability risk score; and
either:
approving, by the computing device, the application when the vulnerability risk score satisfies an approval threshold;
denying, by the computing device, the application when the vulnerability risk score satisfies a denial threshold; or
referring, by the computing device, the application for manual decision when the vulnerability risk score satisfies a manual decision threshold between the approval threshold and the denial threshold.

### Claim 2 (depends on 1)

The method of claim 1, wherein the infrastructure criterion includes an operating system criterion, a software framework criterion, a build version criterion, a software architecture criterion, a hardware security module criterion, and/or a device type criterion.

### Claim 3 (depends on 1)

The method of claim 1, wherein the compliance criterion includes an environment compliance criterion, a data security compliance criterion, a facility criterion, and/or a token security compliance criterion.

### Claim 4 (depends on 1)

The method of claim 1, wherein one of the first and second plurality of impact point values is further assigned based on validation of: an access control criterion, a suspicious activity response criterion, a multi-factor authentication criterion, a PAN security criterion, and/or a secure data retention and deletion criterion.

### Claim 5 (depends on 1)

The method of claim 1, wherein one of the first and second plurality of impact point values is further assigned based on validation of: a secure internal network criterion, a mutual authentication communication criterion, an encrypted component communication criterion, a validated encryption criterion, a strong encryption security protocol criterion, and/or a vulnerability protection criterion.

### Claim 6 (depends on 1)

The method of claim 1, further comprising provisioning the application with an authorization token when the application is approved.

### Claim 7 (depends on 1)

The method of claim 1, further comprising receiving a decision when the application is referred for manual decision;
approving the application when the received decision indicates approval of the application; and
denying the application when the received decision indicates denial of the application.

### Claim 8

A system for evaluating applications based on associated vulnerabilities, the system comprising:
a processor; and
a memory in communication with the processor, the memory including processor-executable instructions that, when executed by the processor, cause the processor to:
solicit application data, for an application to be evaluated, from a developer of the application via a questionnaire interface;
validate the application data against an infrastructure database;
validate the application data against a compliance database;
assign a first plurality of impact point values to the application data based on the validation of the application data against the infrastructure database and the compliance database;
validate the application data against a vulnerability database;
assign a second plurality of impact point values to the application data based on the validation of the application data against the vulnerability database;
combine the first plurality of impact point values and the second plurality of impact point values into a vulnerability risk score; and
deny the application when the vulnerability risk score satisfies a denial threshold.

### Claim 9 (depends on 8)

The system of claim 8, wherein the memory includes processor-executable instructions that, when executed by the processor, further cause the processor to:
approve the application when the vulnerability risk score satisfies an approval threshold; and
refer the application for manual review when the vulnerability risk score satisfies a manual review threshold.

### Claim 10 (depends on 9)

The system of claim 9, wherein the memory includes processor-executable instructions that, when executed by the processor, further cause the processor to:
receive a decision notification when the application is referred for manual review;
approve the application when the received decision notification indicates approval of the application; and
deny the application when the received decision notification indicates denial of the application.

### Claim 11 (depends on 10)

The system of claim 10, wherein the memory includes processor-executable instructions that, when executed by the processor, further cause the processor to provision the application with an authorization token when the application is approved.

### Claim 12 (depends on 11)

The system of claim 11, wherein the memory includes processor-executable instructions that, when executed by the processor, further cause the processor to:
install an application instance of the application at a communication device when the application is approved;
link a payment account to the application instance; and
facilitate a payment with the payment account via the application instance.

### Claim 13 (depends on 8)

The system of claim 8, wherein the memory includes processor-executable instructions that, when executed by the processor in connection with validating the application data against an infrastructure database, a compliance database, and/or a vulnerability database, further cause the processor to compare the application data to criterion that includes an access control criterion, a suspicious activity response criterion, a multi-factor authentication criterion, a PAN security criterion, a secure data retention and deletion criterion, a secure internal network criterion, a mutual authentication communication criterion, an encrypted component communication criterion, a validated encryption criterion, a strong encryption security protocol criterion, and/or a vulnerability protection criterion.

### Claim 14

A non-transitory computer readable media including processor-executable instructions for evaluating a payment application based on associated vulnerabilities, which when executed by a processor, cause the processor to:
validate application data for a payment application against an infrastructure database;
validate the application data for the payment application against a compliance database;
validate the application data for the payment application against a vulnerability database;
assign first impact points to the application data based on the validation of the application data of the payment application against one of the infrastructure database, the compliance database, and the vulnerability database;
generate a first score for the payment application based on the assigned first impact points;
assign second impact points to the application data based on the validation of the application data of the payment application against the other two of the infrastructure database, the compliance database, and the vulnerability database;
generate a second score for the payment application based on the assigned second impact points;
compile the first score and the second score, to thereby provide a vulnerability risk score for the payment application indicative of trustworthiness of the payment application regarding use of payment account information; and
activate the payment application when the vulnerability risk score satisfies a threshold.

### Claim 15 (depends on 14)

The non-transitory computer readable media of claim 14, wherein the processor-executable instructions, when executed by the processor, further cause the processor to:
either:
deny the payment application when the vulnerability risk score fails to satisfy the threshold; or
refer the payment application for manual review when the vulnerability risk score fails to satisfy the threshold.

### Claim 16 (depends on 14)

The non-transitory computer readable media of claim 14, wherein the processor-executable instructions, when executed by the processor, further cause the processor to solicit the application data from a developer of the payment application via a vulnerability questionnaire interface;
wherein the vulnerability questionnaire interface includes an application provider information section, an application information section, an infrastructure details section, a compliance details section, a design details section, and/or a functional details section.

### Claim 17 (depends on 14)

The non-transitory computer readable media of claim 14, wherein the infrastructure database includes an operating system criterion, a software framework criterion, a build version criterion, a software architecture criterion, a hardware security module criterion, and/or a device type criterion; and
wherein the compliance database includes an environment compliance criterion, a data security compliance criterion, a facility criterion, and/or a token security compliance criterion.

### Claim 18 (depends on 14)

The non-transitory computer readable media of claim 14, wherein the processor-executable instructions, when executed by the processor, cause the processor to assign one of the first impact points and the second impact points further based on: an access control criterion, a multi-factor authentication criterion, and/or a PAN security criterion.

### Claim 19 (depends on 14)

The non-transitory computer readable media of claim 14, wherein the processor-executable instructions, when executed by the processor, cause the processor to assign one of the first impact points and the second impact points further based on: a secure internal network criterion, an encrypted component communication criterion, a validated encryption criterion, a strong encryption security protocol criterion, and/or a vulnerability protection criterion.