INVENTOR: PHILIP ATTFIELD

CROSS-REFERENCE TO RELATED APPLICATIONS

[0001] This application is entitled to the benefit of, and claims priority to U.S. Provisional Application 62/062,568, filed on October 10, 2014.

TECHNICAL FIELD

|0002] The present invention relates to the technical fields of Computer Security, Mobile

Computing, Telecommunications, Digital Communications, Computer Technology, and Electronic Commerce.

BACKGROUND OF THE INVENTION

[0003] The use of money as a medium of exchange for payments for goods and services, for payment of debts, and for other transfers of value, dates back many centuries. More recently, after the advent of the internet, online payment services and systems such as PayPal Apple Pay plus secure online banking capabilities are now offered by many banks. Also very recently, Bitcoin (l¾t ¾:/¾ife<?lsi.¾rg), a cryptograph ical ly-based currency, has been proposed that provides for payment of transactions between parties based on cryptographic proof. Furthermore, commonly used systems such as credit card and debit card systems are employing new electronic technologies and other technologies utilizing network capabilities for controlling and monitoring transactions. The demand for all forms of internet-enabled commerce is on the rise,

[0004] Money is a general purpose exchange medium. However, certain crediting, discounting, payment, and reimbursement systems related to purchase transactions may have requirements and limitations with regard to permissible spending. For example, discount coupons are typically only applicable to specific products and vendors. Also, customer loyalty and rewards programs may have internal currencies such as "air miles" for which purchasing options are limited in various ways. Welfare programs and other government services may provide funds for specific purposes. A related example is food stamps, which have a very specific intent regarding what products they can be exchanged for.

[0005] Major credit card providers (e.g. Visa, Mastercard) have corporate programs for employees that have conditional rales associated with them. An employer can participate in these programs whereby employees receive a corporate credit card tied to a corporate account and the card may have rules associated with it (related to travel expenses, for example). However, these programs are tied to only one line of accounting and the rules that govern the allowance or rejection of a specific purchase request are predetermined and are not dynamic nor are they identified by a descriptive rule set tha can he customized by the customer.

[0006] The administrators, managers, and users of such monetary and payment systems may have specific intended purposes for funds, as well as regulatory requirements that must be met. Therefore, there exists a demand for comprehensive, dynamic, rule-based management of modern financial entities that constitute or represent "money", and for related network-supported transaction and payment systems, to prevent spending of funds for purposes other than the intended or otherwise allowed ones, and to prevent malicious, fraudulent, or otherwise criminal use and theft of the funds.

SUMMARY OF THE IN VENTION

[0007] Disclosed herein is an invention for the control of financial transactions based on pre-defined policies. The invention is based in part on a pending patent application that describes a system and methods for managing policy-based rates for access to computing and peripheral resources The same concept is extended here to include policies for financial transactions. The system of the present invention allows for the authoring of policy rales for when and where transactions are to be approved or rejected. The rules can consider time, place, amount, purchase type, or any other restriction imagined. The system includes direct connection to funds accounts from which approved transactions will be charged against. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] Figure 1. Schematic representation of basic system

[0009] Figure 2. Flowchart of example candidate transaction handling sequence

DESCRIPTION OF THE IN VENTION

[0010] U.S. Patent Application 13/945,677, incorporated herein by reference, discloses a system for policy-based access control and management for mobile computing devices. The basic system presented in that application is depicted in Figure 1. The system described therein provides extensive granularity of control over permitted operations, plus network, file system, and device access cm devices controlled by the system. Furtheraiore, the system utilizes one or more policy decision point (PDP) servers which respond to encrypted queries from computing devices controlled by a given instance of the system. These PDP servers may be remote from the computing device, or may even be hosted within the computing device. The queries typically encapsulate requests for use of specific device or network-accessible assets. The PDP response to such a request is then received by the querying device, with subsequent decisions made by the PDP then enforced at the Policy Enforcement Points (PEPs) on the device.

[0011] As noted in U.S. Patent Application 13/945,677, the system utilizes a unique policy object language (POL) for expressing policies and policy sets, and employs a specialized policy processor that synthesizes and outputs source code for later use in building PDP servers. A "policy" consists of rules and restrictions governing how a certain computing device capability, onboard device, or onboard information, or network-accessible information, or any other asset or resource that the computing device might be able to access, control or otherwise utilize, may be accessed and used by the computing device user or by other entities. A "policy set" is a collection of policies and associated information, including policy ownership information. Here, a "policy-owner" is the person or entity having responsibility for the poiicies in a particular policy set. Each 'policy-owner' establishes policies to cover security concerns for some entity. As non-limiting examples, such an entity might be a wireless carrier or other network service provider, or a provider of a service available over a network, or a device manufacturer, or a corporate device owner, or an end user of the device. In some cases, the policy-owner and that entity might be identical.

[0012] The system and method of the present invention employs a policy -based control and management system that is used to comprehensively manage the allocation, spending, and movement of funds, before and throughout transactions, thereby providing a powerful, hierarchical transaction control system.

[0013] First, each funds bundle or funds amount to be governed within the system is assigned to one or more policy sets. The funds bundle may be an amount of money allocated, for example, in a budget or grant. It may be an account balance or other sum of money made available as a source for funding one or more candidate transactions, it is a line of accounting that is made available to the user under a specific set of conditions (the "policy set"). The assignment may be accomplished through a lookup table, a database entry, or by other means. A unique funds bundle identifier may be applied. Such an identifier may incorporate or otherwise utilize a timestamp. Additionally, metadata may be assigned to the candidate transaction that may provide contextual information or other information that can be used in determining applicability of specific policies. When multiple transactions to a common recipient are applied to the same funds source, allowed transactions ma be performed individually or as one aggregated transaction. This may be desired to reduce transaction fees, for example.

[0014] Processing of any candidate transaction, using all or a portion of the funds bundle results in a funds usage request that is intercepted by a PEP. The PEP then issues a query to a PDP in the system that includes the details of the funds bundle and the candidate transaction such that applicable policies can be selected and evaluated. The evaluation will result in an Allow or Deny verdict for the candidate transaction. In addition, stipulations of other actions such as transaction logging or notification of specific parties such as financial governance authorities or other authorities may be performed as specified by policy. A blocked transaction may include an option to switch to a different funds bundle with a different rule set. For example, if a transaction is denied on a corporate account, a personal account may be substituted. This process is presented in Figure 2.

[0015] A policy-based system, according to the present invention, has an unbounded set of potential rales for restricting and specifying use of funds that can be expressed in policies. The invention includes, but is not, limited to, the following rales and variants, which may be used in any combination:

* Purchases must be from specified or qualified vendor(s) * Purchased product(s) must be in allowed categories or of specified product type or product model

® Purchased products must have specified Universal Product Codes (UPCs) or other product-identifiers or product category identifiers codes

« Purchase must be made in a specific country or regional jurisdiction

* Purchase must be made within a specific date range, or before or after specific

dates, or within a specified time interval after an activation step.

* Purchase must be approved by one or more specified parties

® Purchase must be established to be utilized for a specified purpose, prior to release of funds for payment

[0016] Notably, the present invention has direct applications in controlling transactions associated with many business activities, and in accounting for these activities. Beyond rules such as those listed above, the system may also utilize specific accounting standards, such as Generally Accepted Accounting Principles (GAAP) as referenced here httj?://ww as sources of rules to be applied in policies governing transactions, and also as a standard for transaction logging. Furthermore, with regard to accounting, logging activities such as those shown in the flowchart of Figure 2 may include, or may consist of, direct or subsequent entry of transactions into an accounting system. |0017] In one use case of the invention focused at the point of sale, an employee is on an official business trip for her employer. She will use an e Wallet system on her smart phone such as Google Wallet or Apple Pay for all of her transactions. The invention will be used to authorize her purchases. She is authorized for travel -related expenses such as meals, taxis, and hotel, but not for entertainment expenses such as movies. She goes to dinner and pays with her e Wallet. The purchase passes through the PDP which approves the transaction because meals are allowed. She later goes to a movie. Here, the transaction is denied because the PDP blocks it based on the "no entertainment" rule. When she returns from her trip, an accounting of approved transactions is made for her. She needs no reimbursement because all valid transactions were paid directly by her approved line of accounting.

[0018] In another use case of the invention focused after sale, an employee has completed a business trip for his employer and wishes to be reimbursed for travel-related expenses incurred during the trip. Allowable expenses according to corporate policies include transportation and meaS costs, but do not include entertainment. The employee submits a set of expense records such as expense receipts, in some form that they can be entered or otherwise ingested into an instance of the system so that candidate reimbursement transactions can be formed or otherwise represented. Included in the employee's submitted expenses are $400 for airfare, $50 for taxi fare, $100 for meals, and $35 for a movie viewing expense. This results in four distinct candidate reimbursements. The first three (airfare, taxi, and meals expenses) receive an "Allow" result in the system, and the final expense, being entertainment, receives a "Block" result denying the requested transaction. The end result is expense reimbursement from the company to the employee totaling $550.00. This may come in the form of one single aggregated transaction or as individual transactions.

INDUSTRIAL APPLICATION

[0019] The invention applies generally to any industry requiring detailed accounting services and control for authorized expenditures.