CA2161983A1

CA2161983A1 - Confidential information transmission bypassing the internet

Info

Publication number: CA2161983A1
Application number: CA002161983A
Authority: CA
Inventors: Elias Assad
Original assignee: Individual
Current assignee: Individual
Priority date: 1995-11-02
Filing date: 1995-11-02
Publication date: 1997-05-03

Abstract

In computer networks, particularly the Internet, the problem of carrying on transactions that involve confidential information, such as credit card information, stems from the fact that such information can be intercepted by unauthorized persons connected to the same network. Typical solutions to this problem involve various encryption methods where two systems communicate confidential information only in encrypted form. In thisinvention, which applies to an internetworking environment, such as the World Wide Web, another communications channel, using a direct telephone call, is established temporarily between the client and the server to transmit the confidential information, bypassing the Internet. The two methods presented here make it impossible to intercept the transmission without actually wire tapping the vendor or purchaser phone lines.

Description

Specification This invention relates to the transmission of confidential information (like payment information) between two Internet applications. For example, these applications could be a Web browser and a Web server.
It is increasingly common in the Web environment for a client to wish to make a purchase while browsing a Web page residing on a Web server. A transaction involving such a configuration can be a target for unauthorized access. Current solutions involve the use of secure browsers and servers that employ cryptographic methods to encrypt confidential information. This requires conformance to a particular encryption method by the two systems, and changes made to one system may have to be reflected in the other in order to continue to communicate. In addition, such solutions still allow unauthorized persons to gain access to the encrypted information, since it is still being transmitted using the network. Although it can be difficult to do so, it has been repeatedly demonstrated that it is possible to break encryption and gain access to the confidential information itself.
I have found that this problem may be avoided altogether by suspending the browsing session briefly to pass confidential infol~nation in a session between browser and server, or between browser and a payment processing system, using the telephone network. One of the most important advantages of this method is that it does not require modification to existing server technology, making its adoption dependent only on distributing an inexpensive browser program. The following methods follow the above principle toelimin~te the risk of an unauthorized third party gaining access to the confidential information:
Method I
1. Upon establishing a connection with a browser, the server passes a phone number to the browser.

2. When the client wants to send confidential (e.g. payment) inforrnation to the server, the browser program captures and stores the information locally.

~, ~

21619$3 -3. The browser program saves all information required to restore the current network session and disconnects from it.

4. Using the phone number passed by the server, the browser calls the server or another payment processing system over the telephone network, and transmits the confidential information.

5. The server processes the confidential information and disconnects.

6. The browser uses the saved status information (in step 3) to restore the original network session.
Additional steps and tests, including encryption, can be introduced for added security.
Method 2 The second method requires the credit card company, or a company authorized to process credit card payments, to accept transactions from a client system:
1. When the client wants to make a purchase, the server passes the vendor identification code for the credit card of the user's choice, and the amount to be credited to the vendor's account.
2. The browser program collects payment information from the client.
3. The browser program saves all infofmation required to restore the current network session and disconnects from it.
4. The browser program calls the credit card company's system, passes payment information and the vendor's account and disconnects.
5. The browser uses the saved status information to restore the original network session.
Both procedures work equally well in situations where the browser program is connected to the Internet through a gateway on a local area network, but require that a modem on the network be accessible to the browser program.

Claims

The embodiments of the invention in which an exclusive property or privilege is claimed are defined as follows:
A process of communicating confidential information between two internetworking programs, where one of them disconnects from the internetworking session, establishes a separate session with a system over the telephone network to exchange confidential information, and re-establishes the original session once the exchange is completed.
2 A process where a World Wide Web browser program disconnects from an Internet session, establishes a separate session with a system over the telephone network to exchange confidential information, and re-establishes the original session once the exchange is completed.
3 Method 1 above of transmitting confidential information from an Internet application by bypassing the Internet.
4 Method 2 above of transmitting confidential information from an Internet application by bypassing the Internet.