US 10,708,054 B2Granted

Secure microform

AssigneeVisa International Service Association

InventorsJames Donaldson, Bartlomiej Prokop, Rhidian John, Thomas Looney

Life of this patent

Estimating the term…

Loading patent…

Abstract

A secure iframe and a combination of security elements are used in rendering a web page of a content provider. The security elements may be both pre-provisioned and executed in real time to allow a third party to securely collect sensitive information while allowing the content provider to retain total control of the look and feel of the web page. A microform within the secure iframe uses a combination of Content Security Policies (CSP), HSTS, and HPKP to generate a secure connection between the iframe and the third party while still allowing the content provider control the look and feel of the iframe. The content provider never handles the sensitive data, reducing the content provider's financial exposure in the event of a data breach. The secure service collects sensitive data and returns a tokenized identifier for use by the content provider when interacting with the customer.

Claims18

Dependent claims

A method of merging secure and unsecure content in a media presentation for securely collecting sensitive payment information, the method comprising:

generating, by a content provider, a web content for display at a client device;
authenticating the content provider at a secure service using a pre-existing cryptographic authentication protocol;
generating, at a secure service, a key pair including a public key and a private key and a keyID responsive to a request from the content provider;
associating, at the secure service, the key pair and keyID with a domain of the content provider so that the key pair is only valid for communication between the secure service and the domain of the content provider and is also valid only for a limited time;
receiving data for activating an iframe represented by a secure application at the web content, the data received via a network, the data including the keyID;
activating the secure application at the client device using the data received via the network;
sending a validation request from the secure application to the secure service, the validation request including the keyID;
confirming the secure application at the secure service, in part by matching the domain of the content provider associated with the keyID with a domain associated with the validation request;
receiving, at the secure application, a validation response to the validation request, the validation response containing a fingerprint for use in validating the secure service;
limiting further communication from the secure application to only the secure service;
passing the fingerprint from the secure application to the web content;
validating the fingerprint at the web content;
responsive to validating the fingerprint at the web content, sending style information from the web content to the secure application for use by the secure application in displaying content, wherein the style information is controlled by the content provider;
receiving, at the secure service, input data received via the secure application;
generating, at the secure service, a token based on the input data;
and
returning the token to the web content via the secure application.

14 more elements

A method for collecting secure data and sensitive payment information from a website, the method comprising:

providing a content provider domain that serves web content, a user device communicatively coupled to the content provider domain, the user device rendering the web content received from the content provider domain, the web content including a first web content and an iframe hosted within the first web content, and a secure service domain coupled to the content provider domain and the user device;
generating a keyID and a key pair including a public key and a private key at the secure service domain responsive to a request from the content provider domain;
associating, at the secure service, the key pair and keyID with a domain of the content provider so that the key pair is only valid for communication between the secure service and the domain of the content provider and is also valid only for a limited time;
providing the public key to the iframe from the secure service domain;
restricting access of the iframe to only the secure service domain and the first web content;
sending style information from the first web content to the iframe in order to display contents, wherein the style information is controlled by the content provider;
receiving confidential data at the iframe via a user interface of the user device;
encrypting the confidential data using the public key;
transporting the encrypted confidential data from the iframe to the secure service domain;
returning, from the secure service domain, to the iframe a token corresponding to the encrypted confidential data together with a digital signature of the token created with the private key;
passing the token from the iframe through the first web content to the content provider domain;
and
verifying an integrity of the token using the public key.

10 more elements

Dependencies are inferred from the claim text.

Facts

Application: 15/782,301Filed 12 Oct 2017
Published: US 2019/0116037 A118 Apr 2019
Granted: 7 Jul 2020
Term ends: Not estimatedThe source records don’t support an estimate.

Classification9 codes

H04L 9/3213
Involving a third party or a trusted authority: using tickets or tokens, e.g. Kerberos
G06F 21/51
Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems: at application…
G06F 21/602
Protecting data: providing cryptographic facilities or services
H04L 9/14
Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols: using a plurality of keys…