# US 9,519,894 B2 · Methods and apparatus for conducting electronic transactions

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 9,519,894 B2
- Document ID: US9519894B2
- Status: Granted
- Kind: B2
- Application number: 13/488,284
- Filed: 2012-06-04
- Published: 2012-09-20
- Granted: 2016-12-13
- Earliest claimed: 1999-08-31
- Assignees: Gula Consulting Limited Liability Company
- Applicants: Fred Alan Bishop; Elliott Harold Glazer; Zygmunt Steven Gorgol; William G. Hohle; Michael G. Johnson; David E. Johnstone; Walter Donald Lake; Coby Royer; Marvin Simkin; Nick Swift; Dirk B. White; Russell Bennett
- Inventors: Fred Alan Bishop; Elliott Harold Glazer; Zygmunt Steven Gorgol; William G. Hohle; Michael G. Johnson; David E. Johnstone; Walter Donald Lake; Coby Royer; Marvin Simkin; Nick Swift; Dirk B. White; Russell Bennett
- Web page: https://patentgrep.com/patent/US9519894B2

## CPC

- G06Q 20/105: {involving programming of a portable memory device, e.g. IC cards, "electronic purses"}
- G06Q 20/341: {Active cards, i.e. cards including their own processing means, e.g. including an IC or chip}
- G06Q 20/363: {with the personal data of a user}
- G06Q 20/367: {involving electronic purses or money safes}
- G06Q 20/3674: {involving authentication}
- G06Q 20/382: {insuring higher security of transaction}
- G06Q 20/401: {Transaction verification}
- G06Q 20/4097: {using mutual authentication between devices and transaction partners}
- G06Q 30/0613: {using intermediate agents}
- G07F 7/0866: {by active credit-cards adapted therefor (G07F7/1008 takes precedence)}
- G07F 7/1008: {Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system}
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G07F: COIN-FREED OR LIKE APPARATUS (coin sorting G07D3/00; coin testing G07D5/00; {handling coins or paper currencies apart from payment activated apparatus G07D; payment architectures, schemes or protocols G06Q20/00})

## Abstract

A system and method for conducting electronic commerce are disclosed. In various embodiments, the electronic transaction is a purchase transaction. A user is provided with an intelligent token, such as a smartcard containing a digital certificate. The intelligent token suitably authenticates with a server on a network that conducts all or portions of the transaction on behalf of the user. In various embodiments a wallet server interacts with a security server to provide enhanced reliability and confidence in the transaction. In various embodiments, the wallet server includes a toolbar. In various embodiments, the digital wallet pre-fills forms. Forms may be pre-filled using an auto-remember component.

## Claims

### Claim 1

A computer-implemented method comprising:
receiving, by a first server from a user device, a request for a transaction;
receiving, by the first server from a second server, an authentication request associated with the transaction and the user device, wherein the user device is allowed to proceed with the transaction in response to the user device providing an authentication of credentials based on the authentication request;
receiving, by the first server, transaction data associated with the transaction, the transaction data comprising executable commands associated with a programming language;
scanning, by the first server, the transaction data to identify the executable commands in the transaction data;
rendering, by the first server, the executable commands in the transaction data unexecutable by a network client by removing a character from the executable commands or replacing particular characters within the executable commands; and
sending, from the first server to the user device, the transaction data comprising the executable commands rendered unexecutable by the network client, wherein the transaction data sent to the user device is usable by the user device to conduct an electronic transaction.

### Claim 2 (depends on 1)

The method of claim 1, wherein the transaction data is received as part of a transaction request from a user for a transaction at a merchant server.

### Claim 3 (depends on 1)

The method of claim 1, further comprising:
forwarding a challenge to a user, wherein the challenge is passed to an intelligent token for processing the challenge, and wherein the intelligent token generates a response to the challenge;
receiving, by a computer, the response from the user based upon the challenge;
processing, by the computer, the response;
verifying, by the computer, the intelligent token;
assembling, by the computer, credentials for a transaction, wherein the credentials comprise a key; and
sending, by the computer, at least a portion of the assembled credentials to the user.

### Claim 4 (depends on 1)

The method of claim 1, further comprising:
receiving, by a computer, a second request from a user, wherein the second request includes the portion of assembled credentials sent to the user;
validating, by the computer, the portion of the assembled credentials with a key of the assembled credentials, wherein the key is usable to authorize access to a transaction service; and
initiating, by the computer, a transaction session for use with the transaction service.

### Claim 5 (depends on 1)

The method of claim 1, further comprising rejecting a request containing the executable commands.

### Claim 6 (depends on 1)

The method of claim 1, further comprising logging the executable commands to form a security log.

### Claim 7 (depends on 6)

The method of claim 6, further comprising reviewing the security log to identify executable commands that are hostile.

### Claim 8 (depends on 1)

The method of claim 1, wherein the executable commands are determined to violate a security policy.

### Claim 9 (depends on 1)

The method of claim 1, wherein the executable commands are included in a predetermined list of security threats.

### Claim 10 (depends on 1)

The method of claim 1, further comprising receiving a request for a connection from the network client.

### Claim 11 (depends on 10)

The method of claim 10, further comprising verifying that a response to the network client is void of the executable commands.

### Claim 12 (depends on 11)

The method of claim 11, further comprising sending the response to the network client.

### Claim 13 (depends on 1)

The method of claim 1, wherein the replacing comprises converting a script format character to another character, wherein the script format character identifies a block of code.

### Claim 14 (depends on 1)

The method of claim 1, wherein the removing comprises removing a script format character, wherein the script format character identifies a block of code.

### Claim 15 (depends on 1)

The method of claim 1, wherein the programming language comprises at least one of javascript, SQL code, XML code or markup language.

### Claim 16 (depends on 1)

The method of claim 1, further comprising rejecting a transaction request in response to said removing or replacing.

### Claim 17 (depends on 1)

The method of claim 1, further comprising rejecting a transaction request in response to a third party request being received from a merchant server.

### Claim 18

A non-transitory computer-readable storage medium having instructions stored thereon that, in response to execution by a computer-based system, cause the computer-based system to perform operations comprising:
receiving, by a first server from a user device, a request for a transaction;
receiving, by the first server from a second server, an authentication request associated with the transaction and the user device, wherein the user device is allowed to proceed with the transaction in response to the user device providing an authentication of credentials based on the authentication request;
receiving, by the first server, a third party transaction data associated with the transaction, the third party transaction data comprising executable commands associated with a programming language;
scanning the third party transaction data to identify the executable commands, at least one of editing or removing, by the computer-based system, at least a portion of the executable commands in the third party transaction data, wherein the at least one of editing or removing comprises at least one of:
rendering the executable commands in the third party transaction data unexecutable by a network client by removing a character of the executable commands, or
rendering the executable commands in the third party transaction data unexecutable by the network client by replacing particular characters within the executable commands; and
sending, from the first server to the user device, the third party transaction data comprising the executable commands rendered unexecutable by the network client, wherein the third party transaction data sent to the user device is usable by the user device to conduct an electronic transaction.

### Claim 19

A system comprising:
a memory communicatively coupled to a server, the memory having instructions stored thereon that, in response to execution by the server, at least cause the server to perform operations comprising:
receiving, by a first server from a user device, a request for a transaction;
receiving, by the first server from a second server, an authentication request associated with the transaction and the user device, wherein the user device is allowed to proceed with the transaction in response to the user device providing an authentication of credentials based on the authentication request;
receiving, by the first server, transaction data associated with the transaction, the transaction data comprising executable commands associated with a programming language;
scanning, by the server, the transaction data to identify the executable commands in the transaction data;
editing, by the server, at least a portion of the executable commands in the transaction data so that the executable commands are unexecutable by a computing device; and
sending, from the first server to the user device, the transaction data comprising the executable commands rendered unexecutable by the computing device, wherein the transaction data sent to the user device is usable by the user device to conduct an electronic transaction.