Source: {"pile_set_name": "USPTO Backgrounds"}

Software programs have been developed in the past to provide security for computing sessions during which tasks are executed by computing devices that involve the gathering and use of a user's personal information. For example, computer systems have been developed whereby a user can access a system through a computing device, by which to engage in self-service banking activities. These sessions typically include a log-in process at the onset of the computing session, during which a user is required to input credentials into the system that the system can use to verify the identity of the user and then authorizing the user to access sensitive information from the system based on this verification. Sensitive personal banking information can include stored bank account data maintained for that user by her bank.
The development of self-service banking technologies originated with the development of automated teller machines (ATMs) in the late 1960s. These specialized computing devices made it possible for customers of banks to perform personal transactions with their banks electronically virtually twenty-four hours a day, and seven days a week. At first, these ATMs were directly coupled to the customer's physical bank branch. In short order, they became highly interconnected through intra-bank networks, and then through interbank networks that now permit customers to perform such transactions from any ATM around the world. Thus, customers can perform various activities involving the exchange of highly sensitive and personal banking information with their respective banks, such as withdrawing and depositing funds, making account balance inquires and transferring funds between the customer's various accounts. Notwithstanding the convenience of such commercial terminals, users must still physically travel to an ATM location, and must share those specialized computing terminals with other users.
With the advent of personal computers and the Internet, financial institutions began providing secure web sites with which customers could interact over the Internet through a browser program executed on a customer's personal computer. This technology enabled customers to perform many of the same types of banking transactions from their home or office, using a personal computer, that they were previously performing using an ATM. Such activities include making balance inquiries, viewing monthly statements and summaries of transactions, and even paying their bills through the electronic transfer of funds.
The convenience of online banking has been further increased with the explosion of free public access Wi-Fi Internet hotspots, now physically located in all types of businesses that are open to the public. These hotspots make it possible for bank customers, various mobile personal computing devices, to conduct sensitive banking activities over the Internet from hotels, restaurants, grocery stores, cafes, malls, airports, etc.
Perhaps the biggest revolution in self-service electronic banking has come about only recently, with the now nearly ubiquitous availability of affordable smartphones. Smartphones are capable of running sophisticated software applications such as banking applications, and can reach the Internet through the aforementioned public wireless hotspots, as well as through the mobile telephone network to which the user is subscribed. As a result, customers are now able to access their bank to conduct highly sensitive and personal banking activities, including using the smartphones to sense and gather sensitive personal data for purposes such as depositing physical checks, from virtually anywhere in the world.
While convenience to the user has greatly increased in direct relation to the degree to which they have become increasingly untethered from their physical banks, their vulnerability to those who would seek to steal their money and their sensitive personal information has increased commensurately. While the security of ATMs has been successfully breached in numerous ways, including physical attacks on users late at night, card skimming and shoulder surfing, sensitive banking activities conducted through ATMs are still not as vulnerable as when those activities are performed using personal computing devices. This is largely because ATMs have been historically provided either by the banks themselves, or by trusted third party vendors, and thus the user cannot easily alter the software running on ATM machines. Moreover, because the ATM is not operationally mobile, the link that couples it to the ATM network is dedicated and hardwired to the banking network. This close-coupling and control of ATMs makes this type of computing device relatively secure. Owners of personal computing devices such as smartphones, however, are able to easily access or otherwise alter the operational state of the ATM in many ways. For example, users are able to choose from and download to their personal computing devices a myriad of software applications available from third party developers.
The use of personal computers (PC) for home banking marked the advent of using computing devices owned and controlled by the users themselves, and not the banks, to connect to the banking system and perform sensitive activities. Because the user's bank is not able to control what additional software is loaded onto each user's PC, whether the user is using a secure firewall or an anti-virus software program, on what links the user clicks, or what emails a user opens, the potential for compromising the integrity of the device connecting to the bank's system is so much greater when the computing device used is owned and controlled by the user. Moreover, the use of unsecure public Wi-Fi hotspots with laptops, notebooks and tablet computing devices, as well as the use of near-field wireless device connections such as Bluetooth and NFC, has further opened up secure computing activities such as mobile banking to proximity attacks as well.
But it is the more recent explosion in the use of smartphones for performing sensitive tasks such as mobile banking that has created a veritable avalanche in potential security attacks during the performance of such sensitive activities. First, like the other forms of personal computing devices discussed above, they are owned by, and therefore under the complete control of, the user. Second, the user is free to download virtually unlimited types of software apps and services, mostly developed sold by third party vendors. These apps can perform any number of tasks such as, for example, playing games like Angry Birds, turning on the LED flash of a smartphone's camera for use as a flashlight, and even providing different forms of keyboards that the user finds more desirable than the keyboard provided with the smartphone as purchased. Finally, it is the availability of various data gathering devices installed on smartphones such as cameras, microphones, GPS locating devices, scanning device drivers, port drivers such as USB, as well as proximity interfaces such as Bluetooth and NFC (near field communication chips) that are being used to sense and gather sensitive personal data while executing tasks such as mobile banking, that make personal computing devices such as smartphones so vulnerable to security attacks. These various data gathering devices are often accessible to any software application program or service running on the personal computing device, and that makes them particularly easy to exploit.
FIG. 1A illustrates a high-level representation of a known ATM banking environment 102. The ATM environment 102 is relatively secure. Often, the ATM machine 104 is locked in its own room, and a user must use his/her banking card to gain access to the ATM environment 102 first, with the door locking others from the environment 102 once the user is inside. The ATM environment 102 commonly includes a closed circuit television (CCTV) camera 118 that permits real time and stored monitoring of the entire ATM environment 102. A visible and/or audio alarm 116 is also sometimes provided.
Another camera 106 is also typically provided to capture image data of the user during each transaction. The ATM 104 commonly includes a display 110, a keyboard 108 through which users provide credentials and make menu selections shown on display 110, a card reader 112 for reading the user's personal debit and/or credit card, and cash and receipt dispenser 114. Newer ATMs may also include scanners for reading cash and checks for deposit.
ATM 104 is then typically coupled, through a dedicated link 120, directly to the servers of the data center 122 serving bank 124. Those of skill in the art will appreciate that ATM 102 is directly and physically coupled to the bank data center 122 through dedicated link 120, and it is relatively difficult to hack for purposes of intercepting a user's secure banking transaction data when it is being transmitted between the ATM 104 and the bank data center 122. The software operating system is not readily accessible to a user, so the user is not able to download or install software that may corrupt the secure operating state of the ATM machine.
Thus, sensor devices of the ATM 104, such as camera 106 and/or a deposit scanner 114 as previously discussed, as well as keyboard 108, card reader 112 and display 110 are all under the control of relatively fixed ATM software (the typical user does not have any easy way to alter the software running on the machine). Therefore, it less likely that the information collected by these data gathering sensor components will be intercepted by corrupted software running on the ATM 104. While not as secure as working directly with an employee of a bank in person, the ATM 104 provides a relatively safe and secure system through which to engage in personal banking transactions.
The security risks that are present for mobile banking transactions using personal computing devices such as tablets and smartphones are potentially far more insidious and difficult to control. FIG. 1B represents a high-level illustration of an example of a current mobile banking infrastructure. A user's smartphone 152 is coupled to the bank data center 122 over the Internet 164 via the smartphone's Wi-Fi connection 160 and/or the 3G/4G telephone network 162, to which the user subscribes. With reference to the front view 152a of smartphone 152, an unsecure banking software application 150 is stored on smartphone 152. The unsecure software banking “app” 150 is launched by the user and executed by the smartphone 152, to initiate what the user and the bank 124 believe to be a secure computing session for purposes of engaging in sensitive banking transactions.
Unsecure banking application 150 establishes connectivity with the bank data center 122 using either Wi-Fi connection 160 or telephone network 162, and prompts the user through display 154 to enter user credentials (e.g. user ID and password) using displayed keyboard 156. Once the user credentials are verified and the user is logged into the bank data center 122, the unsecure banking app 150 presents a menu of options to the user on the display 154, by