Encapsulated security tokens for electronic transactions

• US 10,410,213 B2
• Filed: 05/06/2013
• Issued: 09/10/2019
• Est. Priority Date: 05/04/2012
• Status: Active Grant

• Current Assignee: Institutional Cash Distributors Technology LLC
• Original Assignee: Institutional Cash Distributors Technology LLC
• Inventors: Heyner, Mark A.
• Primary Examiner(s): Obeid, Mamon
• Application Number:
  US13/888,322
• Publication Number:
  US 20130318619A1
• Time in Patent Office: 2,318 Days
• Field of Search: None
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

Functional data for use in one or more digital transactions is secured by using an encapsulated security token (EST). In certain embodiments, the EST is created by encapsulating digital data including the functional data using at least two digital signature systems of two parties. The encapsulation and subsequent de-encapsulation can utilize digital signature systems of the parties that involve a private key for encapsulation and a public key for de-encapsulation. If constructed carefully over a series of rigorous events, the resulting EST can be practically impossible to counterfeit. In addition, a propagation of rights can be tracked for auditing and rights can be easily terminated or modified.

Claims

1. A method for use in securing functional data for use in electronic transactions, comprising:

1) constructing a security token that incorporates a first set of first transaction elements that are required for an electronic transaction, said constructing a security token comprising;

a) operating a first processing system to generate a first data object including at least a first subset of said first set of first transaction elements;

b) transmitting the first data object, directly or indirectly, from said first processing system to a second processing system;

c) first operating the second processing system to generate an at least once-encapsulated data object by encapsulating at least the first data object using a first digital signature system including a first digital signature of a first party, for encapsulating the first data object and a first signature verification for verifying the first signature and de-encapsulating the first data object;

d) transmitting the at least once-encapsulated data object to a third processing system; and

e) second operating the third processing system to generate an at least twice-encapsulated data object by adding at least a second subset of said first transaction elements, different than said first subset, to said once-encapsulated data object and encapsulating at least the at least once-encapsulated data object and said second subset of said first transaction elements using a second digital signature system including a second digital signature of a second party, for encapsulating the at least once-encapsulated data object and a second signature verification for verifying the second signature and de-encapsulating the at least once-encapsulated data object;

wherein said security token comprises said at least twice-encapsulated data object;

2) transmitting said security token to a transaction processing system; and

3) transmitting, to said transaction processing system, signature information sufficient to allow said transaction processing system to use said second signature system to de-encapsulate said at least twice-encapsulated data object so as to obtain said second subset of said first transaction elements and to use said first signature system to de-encapsulate said at least once-encapsulated data object to obtain said first subset of said first transaction elements and to compare said first financial transaction elements of said security token with second financial transaction elements of a transaction request to verify said transaction request.

2. A method as set forth in claim 1, wherein said security token is useful for authenticating transaction functional data in connection with a digital transaction, and at least an element of said digital data encapsulated in said security token is identical to a corresponding element of said transaction functional data.

3. A method as set forth in claim 1, wherein each of said first and second digital signature systems is a public key—

private key system.

4. A method as set forth in claim 3, wherein each of said steps of first establishing and second establishing comprises encapsulating using a private key.

5. A method as set forth in claim 3, wherein one of said steps of first and second operating comprises encapsulating using a public key, and said method further comprises presenting said at least twice-encapsulated data object, for de-encapsulating, to a holder of a private key mated to said public key.

6. A method as set forth in claim 2, wherein said transaction functional data comprises one of personal identification information, financial information and contact information.

7. A method as set forth in claim 2, wherein said digital transaction involves an authorization by san authorizing party to an authorized party for said authorized party to act on said authorizing party'"'"'s behalf, and said encapsulated security token is generated at least partially under the control of said authorizing party.

8. A method as set forth in claim 2, wherein said digital transaction involves allowing an accessing party to access an asset of a controlling party, and said security token is generated at least partially under the control of said controlling party.

9. A method as set forth in claim 8, wherein said asset comprises one of a financial account, an email account, and a phone number.

10. A method as set forth in claim 1, wherein at least one of said processing systems is controlled by an operator of an application requiring authentication of users.

11. A method as set forth in claim 2, wherein said digital transaction involves casting a vote in an election.

12. A method as set forth in claim 2, wherein said digital transaction involves disseminating content.

13. A method as set forth in claim 2, wherein a party controlling authentication of said transaction functional data is the same as a party controlling, at least in part, generation of said security token.

14. A method as set forth in claim 2, wherein a party controlling authentication of said transaction functional data is different than each party controlling generation of said security token.

15. A method as set forth in claim 2, further comprising further encapsulating at least said security token using a further digital signature system.

16. A method as set forth in claim 2, further comprising the step of electronically presenting, in connection with said digital transaction, said security token and said transaction functional data for said digital transaction.

17. A method as set forth in claim 2, further comprising the steps of:

receiving first presented functional data for a digital transaction;

receiving said security token;

de-encapsulating said security token to obtain said first digital data including said first data object; and

using said first presented functional data and said first digital data to control said proposed digital transaction.

18. A method as set forth in claim 17, wherein said step of using comprises comparing said first data object to said first presented functional data.

19. A method as set forth in claim 17, wherein said first digital data comprises an encapsulated data object generated by encapsulating at least second digital data using a further digital signature system including a further digital signature and a further signature verification.

20. A method as set forth in claim 17, wherein said step of using comprises de-encapsulating a plurality of layers of encapsulation to obtain said first digital data including said first data object and comparing said first data object to said first presented functional data.

21. A method as set forth in claim 1, further comprising the steps of:

receiving said security token;

adding to said security token at least first authorization data sufficient to identify an authorized party;

generating a further encapsulated security token by encapsulating at least said security token and said first authorization data using at least a further digital signature system including a further digital signature and a further signature verification; and

propagating said further encapsulated security token to said authorized party.

22. A method as set forth in claim 1, wherein said steps of first and second operating further comprise using tags to identify one of said first and second signature verifications, a date and time of encapsulation and contact information for an authorized party.

23. A method as set forth in claim 2, further comprising the step of:

executing said digital transaction using said security token wherein said security token is encapsulated with two or more layers of digital signatures, each said signature layer involving a digital signature system including a digital signature for encapsulation and a signature verification for de-encapsulation; and

said one or more digital signature layers encoding details of propagation or authorization for said transaction.

24. A method as set forth in claim 1, wherein rights related to said security token are propagated across a propagation tree including multiple propagation branches, each propagation branch involving a digital signature layer, each digital signature layer reflecting propagation of rights to a further party and involving a digital signature system including a digital signature for encapsulation and a signature verification for de-encapsulation, said method further including the steps of pruning said propagation tree by invaliding a signature layer at a selected point in a given branch of said tree, thereby invalidating other signature layers associated with said given branch.

25. A system for use in securing functional data for use in electronic transactions, comprising:

1) a first processing system operative for;

a) receiving a first data object including at least a first subset of first transaction elements that are required for an electronic transaction; and

b) first generating an at least once-encapsulated data object by encapsulating at least the first data object using a first digital signature system including a first digital signature of a first party, for encapsulating the first data object and a first signature verification for verifying the first signature and de-encapsulating the first data object; and

2) a second processing system operative for;

a) receiving the at least once-encapsulated data object, and;

b) second generating an at least twice-encapsulated data object by adding at least a second subset of said first transaction elements to said at least once-encapsulated data object and encapsulating at least the at least once-encapsulated data object and said second subset of said first transaction elements using a second digital signature system including a second digital signature of a second party for encapsulating the once-encapsulated data object and a second signature verification for verifying the second signature and de-encapsulating the at least once-encapsulated cash channel object;

wherein said security token comprises said at least twice-encapsulated data object; and

3) network structure for;

a) transmitting said security token to a transaction processing system; and

b) transmitting, to said transaction processing system, signature information sufficient to allow said transaction processing system to use said second signature system to de-encapsulate said at least twice-encapsulated data object so as to obtain said second subset of said first transaction elements, to use said first signature system to de-encapsulate said at least once-encapsulated data object to obtain said first subset of said first transaction elements, and to compare said first financial transaction elements of said security token with second financial transaction elements of a transaction request to verify said transaction request.

26. A system as set forth in claim 25, wherein said security token is useful for authenticating transaction functional data in connection with a digital transaction, and at least an element of said digital data encapsulated in said encapsulated security token is identical to a corresponding element of said transaction functional data.

27. A system as set forth in claim 25, wherein each of said first and second digital signature systems is a public key—

private key system.

28. A method as set forth in claim 27, wherein each of said first establishing and second generating comprises encapsulating using a private key.

29. A method as set forth in claim 27, wherein one of said first and second generating comprises encapsulating using a public key, and said one or more processors are further operative for presenting said at least twice-encapsulated data object, for de-encapsulating, to a holder of a private key mated to said public key.

30. A system as set forth in claim 26, wherein said transaction functional data comprises one of personal identification information, financial information and contact information.

31. A system as set forth in claim 26, wherein said digital transaction involves an authorization by an authorizing party to an authorized party for said authorized party to act on said authorizing party'"'"'s behalf, and said encapsulated security token is generated at least partially under the control of said authorizing party.

32. A method as set forth in claim 26, wherein said digital transaction involves allowing an accessing party to access an asset of a controlling party, and said security token is generated at least partially under the control of said controlling party.

33. A system as set forth in claim 32, wherein said asset comprises one of a financial account, an email account, and a phone number.

34. A system as set forth in claim 25, wherein at least one of said processing systems is controlled by an operator of an application requiring authentication of users.

35. A system as set forth in claim 26, wherein said digital transaction involves casting a vote in an election.

36. A method as set forth in claim 26, wherein said digital transaction involves disseminating content.

37. A system as set forth in claim 26, wherein a party controlling authentication of said transaction functional data is the same as a party controlling, at least in part, generation of said encapsulated security token.

38. A method as set forth in claim 26, wherein a party controlling authentication of said transaction functional data is different than each party controlling generation of said security token.

39. A system as set forth in claim 25, wherein one or more processors are further operative for further encapsulating at least said security token using a further digital signature system.

40. A system as set forth in claim 26, wherein one or more processors are further operative for electronically presenting, in connection with said digital transaction, said security token and said transaction functional data for said digital transaction.

41. A system as set forth in claim 25, wherein one or more processors are further operative for:

receiving first presented functional data for a digital transaction;

receiving said security token;

de-encapsulating said security token to obtain said first digital data including said first data object; and

using said first presented functional data and said first digital data to control said proposed digital transaction.

42. A system as set forth in claim 41, wherein said using comprises comparing said first data object to said first presented functional data.

43. A system as set forth in claim 41, wherein said first digital data comprises an encapsulated data object generated by encapsulating at least second digital data using a further digital signature system including a further digital signature and a further signature verification.

44. A system as set forth in claim 41, wherein said using comprises de-encapsulating a plurality of layers of encapsulation to obtain said first digital data including said first data object and comparing said first data object to said first presented functional data.

45. A system as set forth in claim 25, wherein one or more processors are further operative for:

receiving said security token;

adding to said security token at least first authorization data sufficient to identify an authorized party;

generating a further security token by encapsulating at least said security token and said first authorization data using at least a further digital signature system including a further digital signature and a further signature verification; and

propagating said further encapsulated security token to said authorized party.

46. A system as set forth in claim 25, wherein said first and second operating further comprise using tags to identify one of said first and second signature verifications, a date and time of encapsulation and contact information for an authorized party.

47. A system as set forth in claim 25, wherein one or more processors are further operative for:

executing said digital transaction using said security token wherein said security token is encapsulated with two or more layers of digital signatures, each said signature layer involving a digital signature system including a digital signature for encapsulation and a signature verification for de-encapsulation;

said one or more digital signature layers encoding details of propagation or authorization for said transaction.

48. A system as set forth in claim 25, wherein rights related to said security token are propagated across a propagation tree including multiple propagation branches, each propagation branch involving a digital signature layer, each digital signature layer reflecting propagation of rights to a further party and involving a digital signature system including a digital signature for encapsulation and a signature verification for de-encapsulation, and said wherein said one or more processors are further operative for pruning said propagation tree by invaliding a signature layer at a selected point in a given branch of said tree, thereby invalidating other signature layers associated with said given branch.