# US 12,301,574 B2 · Transaction security systems and methods > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,301,574 B2 - Document ID: US12301574B2 - Status: Granted - Kind: B2 - Application number: 18/242,810 - Filed: 2023-09-06 - Published: 2024-07-25 - Granted: 2025-05-13 - Earliest claimed: 2012-10-09 - Assignees: CUPP Computing AS - Applicants: CUPP Computing AS - Inventors: Shlomo Touboul - Web page: https://patentgrep.com/patent/US12301574B2 ## CPC - H04L 63/10: {for controlling access to devices or network resources} - G06F 21/34: involving the use of external additional devices, e.g. dongles or smart cards - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 21/606: {by securing the transmission between two devices or processes} - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/18: {using different networks or channels, e.g. using out of band channels (cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215)} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)} - H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Outbound traffic of a host application may be received from a host device having a host processor. The secure resource may be configured to provide a secure transaction based on the outbound network traffic. Using a second processor different than the host processor, it may be determined whether the host application is authorized to provide the outbound network traffic to the secure resource. The outbound network traffic may be allowed to be forwarded to the secure resource if the host application is authorized. The outbound network traffic may be disallowed to be forwarded to the secure resource if the host application is not authorized. ## Claims ### Claim 1 A method comprising: establishing, by a secure transaction device having a secure transaction device processor, redirection protocols in a host device having a host device processor different than the secure transaction device processor, the host device having a host device network connection, the secure transaction device having a secure transaction device network connection different than the host device network connection, the redirection protocols automatically causing the host device to redirect network traffic to the secure transaction device when first conditions including a condition that the secure transaction device is coupled to the host device are satisfied, the secure transaction device network connection configured to use network configuration details of the host device network connection to mimic the host device network connection to render the secure transaction device transparent to a remote network resource; and when the first conditions are satisfied, receiving, by the secure transaction device from the host device, outbound network traffic originated by a host application on the host device, the outbound network traffic directed to the remote network resource, the remote network resource being remote from the secure transaction device and from the host device; establishing, by the secure transaction device, a secure tunnel between the secure transaction device network connection and the remote network resource; and transmitting the outbound network traffic via the secure tunnel to the remote network resource; the host device being configured to, when second conditions different than the first conditions are satisfied, either transmit the outbound network traffic from the host application via the host device network connection to the remote network resource or block the outbound network traffic from the host application via the host device network connection to the remote network resource. ### Claim 2 (depends on 1) The method of claim 1, wherein the host application comprises a stand-alone application resident on the host device, or an interface resident on the host device that cooperates with a server application resident on at least one server. ### Claim 3 (depends on 1) The method of claim 1, further comprising determining whether the host application is authorized to access the remote network resource. ### Claim 4 (depends on 3) The method of claim 3, wherein the determining whether the host application is authorized to access the remote network resource comprises looking up permissions of the host application on the security policy. ### Claim 5 (depends on 1) The method of claim 1, further comprising determining whether a user of the host application has permission to access sensitive information on the remote network resource. ### Claim 6 (depends on 1) The method of claim 1, wherein the secure transaction device is a device coupled externally to the host device. ### Claim 7 (depends on 1) The method of claim 1, wherein the secure transaction device is a device coupled internally to the host device. ### Claim 8 (depends on 1) The method of claim 1, wherein the establishing redirection protocols in the host device includes injecting redirection code into an operating system of the host device. ### Claim 9 (depends on 1) The method of claim 1, wherein the network configuration details include network protocols and network addresses. ### Claim 10 A secure transaction device comprising: a secure transaction device processor; a secure transaction device network connection; and memory storing computer code that, when processed by the secure transaction device processor, is configured to cause the secure transaction device to perform: establishing redirection protocols in a host device having a host device processor different than the secure transaction device processor, the host device having a host device network connection, the secure transaction device having a secure transaction device network connection different than the host device network connection, the redirection protocols automatically causing the host device to redirect network traffic to the secure transaction device when first conditions including a condition that the secure transaction device is coupled to the host device are satisfied, the secure transaction device network connection configured to use network configuration details of the host device network connection to mimic the host device network connection to render the secure transaction device transparent to a remote network resource; and when the first conditions are satisfied, receiving outbound network traffic originated by a host application on the host device, the outbound network traffic directed to the remote network resource, the remote network resource being remote from the secure transaction device and from the host device; establishing a secure tunnel between the secure transaction device network connection and the remote network resource; and transmitting the outbound network traffic via the secure tunnel to the remote network resource; the host device being configured to, when second conditions different than the first conditions are satisfied, either transmit the outbound network traffic from the host application via the host device network connection to the remote network resource or block the outbound network traffic from the host application via the host device network connection to the remote network resource. ### Claim 11 (depends on 10) The secure transaction device of claim 10, wherein the host application comprises a stand-alone application resident on the host device, or an interface resident on the host device that cooperates with a server application resident on at least one server. ### Claim 12 (depends on 10) The secure transaction device of claim 10, wherein the computer code is further configured to cause the secure transaction device to perform determining whether the host application is authorized to access the remote network resource. ### Claim 13 (depends on 12) The secure transaction device of claim 12, wherein the computer code configured to cause the secure transaction device to perform determining whether the host application is authorized to access the remote network resource comprises computer code configured to cause the secure transaction device to perform looking up permissions of the host application on the security policy. ### Claim 14 (depends on 10) The secure transaction device of claim 10, wherein the computer code is further configured to cause the secure transaction device to perform determining whether a user of the host application has permission to access sensitive information on the remote network resource. ### Claim 15 (depends on 10) The secure transaction device of claim 10, wherein the secure transaction device is a device coupled externally to the host device. ### Claim 16 (depends on 10) The secure transaction device of claim 10, wherein the secure transaction device is a device coupled internally to the host device. ### Claim 17 (depends on 10) The secure transaction device of claim 10, wherein the computer code configured to cause the secure transaction device to perform establishing redirection protocols in the host device comprises computer code configured to cause the secure transaction device to perform injecting redirection code into an operating system of the host device. ### Claim 18 (depends on 10) The secure transaction device of claim 10, wherein the network configuration details include network protocols and network addresses. ### Claim 19 A non-transitory computer-readable medium comprising computer code configured to instruct one or more processors to perform: establishing, by a secure transaction device having a secure transaction device processor, redirection protocols in a host device having a host device processor different than the secure transaction device processor, the host device having a host device network connection, the secure transaction device having a secure transaction device network connection different than the host device network connection, the redirection protocols automatically causing the host device to redirect network traffic to the secure transaction device when first conditions including a condition that the secure transaction device is coupled to the host device are satisfied, the secure transaction device network connection configured to use network configuration details of the host device network connection to mimic the host device network connection to render the secure transaction device transparent to a remote network resource; and when the first conditions are satisfied, receiving, by the secure transaction device from the host device, outbound network traffic originated by a host application on the host device, the outbound network traffic directed to the remote network resource, the remote network resource being remote from the secure transaction device and from the host device; establishing, by the secure transaction device, a secure tunnel between the secure transaction device network connection and the remote network resource; and transmitting the outbound network traffic via the secure tunnel to the remote network resource; the host device being configured to, when second conditions different than the first conditions are satisfied, either transmit the outbound network traffic from the host application via the host device network connection to the remote network resource or block the outbound network traffic from the host application via the host device network connection to the remote network resource.