Methods and systems for proofing identities using a certificate authority

• US 20020029279A1
• Filed: 03/16/2001
• Published: 03/07/2002
• Est. Priority Date: 03/17/2000
• Status: Active Grant

• Current Assignee: United States Postal Service (Government of the United States of America)
• Original Assignee: United States Postal Service (Government of the United States of America)
• Inventors: Campbell, Leo J., Cook, Jon L.
• Granted Patent: US 7,484,088 B2
• Time in Patent Office: Days
• US Class Current: 709/229
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/10 specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
• CPC Class Codes: G06Q 20/102 Bill distribution or payments
• CPC Class Codes: G06Q 20/14 specially adapted for billing systems
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: G06Q 30/0601 Electronic shopping [e-shopping]
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 51/214 using selective forwarding
• CPC Class Codes: H04L 51/222 using geographical location information, e.g. messages transmitted or received in proximity of a certain spot or area
• CPC Class Codes: H04L 51/48 Message addressing, e.g. address format or anonymous messages, aliases
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/1408 : by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 67/306 : User profiles
• CPC Class Codes: H04L 69/329 : in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 : Network security protocols

Abstract

A digital certificate is provided to a customer having an electronic account linked to the customer'"'"'s physical address. Using the digital certificate, the customer performs electronic transactions with a third party. A proofing workstation receives a request from a third party to validate the digital certificate. The proofing workstation communicates with a proofing server that maintains a list of valid certificates and a list of revoked certificates. The proofing server sends a response to the proofing workstation, where it is received by the third party.

Claims

1. A method for issuing a digital certificate for a user on a network, comprising the steps of:

receiving a request for a digital certificate for a user having an electronic account, wherein the electronic account is linked to a physical address of the user;

generating, by a certificate authority, the digital certificate for the user, wherein the digital certificate includes information enabling authentication of a transaction on the network; and

linking the digital certificate to the electronic account of the user.

2. The method of claim 1, further comprising the step of:

storing a reference to the digital certificate in a certificate directory at the certificate authority.

3. The method of claim 1, wherein the certificate authority includes a proofing server.

4. The method of claim 3, wherein the certificate authority further includes a proofing workstation.

5. The method of claim 1, wherein the certificate authority is a United States Postal Service digital certificate authority.

6. The method of claim 1, wherein the digital certificate includes an identifier of the user.

7. The method of claim 1, wherein the digital certificate includes a certificate serial number.

8. The method of claim 1, wherein the digital certificate includes a certificate validity period.

9. The method of claim 1, wherein the digital certificate includes a proofing workstation validation.

10. The method of claim 1, wherein the digital certificate includes a public key for authenticating the digital certificate.

11. The method of claim 1, wherein the digital certificate includes an identifier of the certificate authority.

12. The method of claim 1, wherein the digital certificate includes a certificate status.

13. The method of claim 12, wherein the certificate status is set to active.

14. The method of claim 12, wherein the certificate status is set to hold.

15. The method of claim 12, wherein the certificate status is set to revoked.

17. The method of claim 16, further comprising the step of:

linking the digital certificate to a transaction on the network by the user, wherein the digital certificate can be used to authenticate the transaction.

18. The method of claim 16, further comprising the step of:

storing a reference to the digital certificate in a certificate directory at the proofing server.

19. The method of claim 16, further comprising the step of:

setting the status of the digital certificate to revoked.

20. The method of claim 19, further comprising the step of:

storing a reference to the digital certificate in a certificate revocation list at the proofing server.

21. The method of claim 16, further comprising the step of:

sending a private key from the proofing workstation to the proofing server, when the identity of the user is verified.

22. The method of claim 21, further comprising the step of:

verifying the private key, by the proofing server, before setting the status of the digital certificate to active.

23. The method of claim 16, wherein the proofing workstation includes a bar code scanner.

24. The method of claim 23, wherein the identification verification is a bar code.

25. The method of claim 16, wherein the proofing workstation includes a credit card reader.

26. The method of claim 16, wherein the proofing workstation includes a smart card interface.

27. The method of claim 16, wherein the proofing server is a United States Postal Service proofing server.

28. The method of claim 16, wherein the proofing workstation is a United States Postal Service proofing workstation.

30. The method of claim 29, further comprising the step of:

receiving payment from the user at the proofing workstation.

31. The method of claim 30, wherein the payment is received via credit card.

32. The method of claim 30, wherein the payment is received via Smart Card.

33. The method of claim 29, wherein the proofing workstation includes a bar code reader.

34. The method of claim 33, wherein the identification verification is a bar code.

35. The method of claim 29, wherein the proofing workstation is a United States Postal Service proofing workstation.

37. The method of claim 36, further comprising the step of:

storing a reference to the digital certificate in a certificate directory at the proofing server.

38. The method of claim 36, further comprising the step of:

setting the status of the digital certificate to revoked.

39. The method of claim 38, further comprising the step of:

storing a reference to the digital certificate in a certificate revocation list at the proofing server.

40. The method of claim 36, further comprising the step of:

receiving a private key from the proofing workstation, when the identity of the user is verified.

41. The method of claim 40, further comprising the step of:

verifying the private key before setting the status of the digital certificate to active.

42. The method of claim 36, wherein the proofing server is a United States Postal Service proofing server.

16. A method for issuing a digital certificate for a user on a network, comprising the steps of:

receiving, at a proofing server, a request for a digital certificate from a user with an electronic account, wherein the electronic account is linked to a physical address of the user;

generating, by the proofing server, the digital certificate for the user;

setting a status of the digital certificate to hold, by the proofing server;

sending the request for the digital certificate to a proofing workstation;

verifying, at the proofing workstation, the identity of the user;

sending an identification verification from the proofing workstation to the proofing server, when the identity of the user is verified;

setting the status of the digital certificate to active in response to the identification verification; and

storing the digital certificate in the electronic account of the user.

29. A method for processing a request for a digital certificate from a user, comprising the steps of:

receiving, at a proofing workstation, user information for a user with an electronic account, wherein the electronic account is linked to a physical address of the user;

receiving identification information from the user at the proofing workstation;

matching the user information to the identification information by the proofing workstation; and

sending an identification verification from the proofing workstation to a proofing server, when the user information has been matched to the identification information.

36. A method for issuing a digital certificate for a user on a network, comprising the steps of:

receiving, at a proofing server, a request for a digital certificate from a user with an electronic account, wherein the electronic account is linked to a physical address of the user, and wherein the request includes user information;

sending the user information to a proofing workstation via the network;

generating, by the proofing server, the digital certificate for the user;

setting a status of the digital certificate to hold, by the proofing server;

receiving an identification verification from the proofing workstation when the identity of the user has been verified by the proofing workstation;

setting the status of the digital certificate to active in response to the identification verification; and

storing the digital certificate in the electronic account of the user.

43. A system for issuing a digital certificate for a user on a network, comprising:

a receiving component configured to receive a request for a digital certificate for a user having an electronic account, wherein the electronic account is linked to a physical address of the user;

a generating component configured to generate the digital certificate for the user, wherein the digital certificate includes information enabling authentication of a transaction on the network; and

a linking component configured to link the digital certificate to the electronic account of the user.

44. The system of claim 43, further comprising:

a storing component configured to store a reference to the digital certificate in a certificate directory at the generating component.

45. The system of claim 43, wherein the generating component includes a proofing server.

46. The system of claim 45, wherein the generating component further includes a proofing workstation.

47. The system of claim 43, wherein the generating component is a United States Postal Service digital certificate authority.

48. The system of claim 43, wherein the digital certificate includes an identifier of the user.

49. The system of claim 43, wherein the digital certificate includes a certificate serial number.

50. The system of claim 43, wherein the digital certificate includes a certificate validity period.

51. The system of claim 43, wherein the digital certificate includes a proofing workstation validation.

52. The system of claim 43, wherein the digital certificate includes a public key for authenticating the digital certificate.

53. The system of claim 43, wherein the digital certificate includes an identifier of the certificate authority.

54. The system of claim 43, wherein the digital certificate includes a certificate status.

55. The system of claim 54, wherein the certificate status is set to active.

56. The system of claim 54, wherein the certificate status is set to hold.

57. The system of claim 54, wherein the certificate status is set to revoked.

59. The system of claim 58, further comprising:

a linking component configured to link the digital certificate to a transaction on the network by the user, wherein the digital certificate can be used to authenticate the transaction.

60. The system of claim 58, further comprising:

a reference storing component configured to store a reference to the digital certificate in a certificate directory at the proofing server.

61. The system of claim 58, further comprising:

a revoked setting component configured to set the status of the digital certificate to revoked.

62. The system of claim 61, further comprising:

a revoked storing component configured to store a reference to the digital certificate in a certificate revocation list at the proofing server.

63. The system of claim 58, further comprising:

a key sending component configured to send a private key from the proofing workstation to the proofing server, when the identity of the user is verified.

64. The system of claim 63, further comprising:

a key verifying component configured to verify the private key before setting the status of the digital certificate to active.

65. The system of claim 58, wherein the proofing workstation includes a bar code scanner.

66. The system of claim 65, wherein the identification verification is a bar code.

67. The system of claim 58, wherein the proofing workstation includes a credit card reader.

68. The system of claim 58, wherein the proofing workstation includes a smart card interface.

69. The system of claim 58, wherein the proofing server is a United States Postal Service proofing server.

70. The system of claim 58, wherein the proofing workstation is a United States Postal Service proofing workstation.

58. A system for issuing a digital certificate for a user on a network, comprising:

a receiving component configured to receive a request for a digital certificate from a user with an electronic account, wherein the electronic account is linked to a physical address of the user;

a generating component configured to generate the digital certificate for the user;

a hold setting component configured to set a status of the digital certificate to hold, by the proofing server;

a request sending component configured to send the request for the digital certificate to a proofing workstation;

a verifying component configured to verify the identity of the user;

a verification sending component configured to send an identification verification from the proofing workstation to the proofing server, when the identity of the user is verified;

an active setting component configured to set the status of the digital certificate to active in response to the identification verification; and

a storing component configured to store the digital certificate in the electronic account of the user.

71. A system for processing a request for a digital certificate from a user, comprising:

a user information receiving component configured to receive user information for a user with an electronic account, wherein the electronic account is linked to a physical address of the user;

an identification receiving component configured to receive identification information from the user at the proofing workstation;

a matching component configured to match the user information to the identification information by the proofing workstation; and

a verification sending component configured to send an identification verification from the proofing workstation to a proofing server, when the user information has been matched to the identification information.

72. The system of claim 71, further comprising:

a payment receiving component configured to receive payment from the user at the proofing workstation.

73. The system of claim 72, wherein the payment is received via credit card.

74. The system of claim 72, wherein the payment is received via Smart Card.

75. The system of claim 71, wherein the proofing workstation includes a bar code reader.

76. The system of claim 75, wherein the identification verification is a bar code.

77. The system of claim 71, wherein the proofing workstation is a United States Postal Service proofing workstation.

79. The system of claim 78, further comprising:

a reference storing component configured to store a reference to the digital certificate in a certificate directory at the proofing server.

80. The system of claim 78, further comprising:

a revoked setting component configured to set the status of the digital certificate to revoked.

81. The system of claim 80, further comprising:

a revoked storing component configured to store a reference to the digital certificate in a certificate revocation list at the proofing server.

82. The system of claim 78, further comprising:

a key receiving component configured to receive a private key from the proofing workstation, when the identity of the user is verified.

83. The system of claim 82, further comprising:

a key verifying component configured to verify the private key before setting the status of the digital certificate to active.

84. The system of claim 78, wherein the proofing server is a United States Postal Service proofing server.

78. A system for issuing a digital certificate for a user on a network, comprising:

a request receiving component configured to receive a request for a digital certificate from a user with an electronic account, wherein the electronic account is linked to a physical address of the user, and wherein the request includes user information;

a user information sending component configured to send the user information to a proofing workstation via the network;

a certificate receiving component configured to receive the digital certificate for the user;

a hold setting component configured to set a status of the digital certificate to hold, by the proofing server;

a verification receiving component configured to receive an identification verification from the proofing workstation when the identity of the user has been verified by the proofing workstation;

an active setting component configured to set the status of the digital certificate to active in response to the identification verification; and

a storing component configured to store the digital certificate in the electronic account of the user.

85. A computer readable medium having computer readable code embodied therein for issuing a digital certificate for a user on a network, the computer readable code comprising:

a receiving module configured to receive a request for a digital certificate for a user having an electronic account, wherein the electronic account is linked to a physical address of the user;

a generating module configured to generate the digital certificate for the user, wherein the digital certificate includes information enabling authentication of a transaction on the network; and

a linking module configured to link the digital certificate to the electronic account of the user.

86. A computer readable medium having computer readable code embodied therein for issuing a digital certificate for a user on a network, the computer readable code comprising:

a request receiving module configured to receive a request for a digital certificate from a user with an electronic account, wherein the electronic account is linked to a physical address of the user;

a generating module configured to generate the digital certificate for the user;

a hold setting module configured to set a status of the digital certificate to hold, by the proofing server;

a request sending module configured to send the request for the digital certificate to a proofing workstation;

an identity verifying module configured to verify the identity of the user;

a verification sending module configured to send an identification verification from the proofing workstation to the proofing server, when the identity of the user is verified;

an active setting module configured to set the status of the digital certificate to active in response to the identification verification; and

a storing module configured to store the digital certificate in the electronic account of the user.

87. A computer readable medium having computer readable code embodied therein for processing a request for a digital certificate from a user, the computer readable code comprising:

an information receiving module configured to receive user information for a user with an electronic account, wherein the electronic account is linked to a physical address of the user;

an identification receiving module configured to receive identification information from the user at the proofing workstation;

a matching module configured to match the user information to the identification information by the proofing workstation; and

a sending module configured to send an identification verification from the proofing workstation to a proofing server, when the user information has been matched to the identification information.

88. A computer readable medium having computer readable code embodied therein for issuing a digital certificate for a user on a network, the computer readable code comprising:

a request receiving module configured to receive a request for a digital certificate from a user with an electronic account, wherein the electronic account is linked to a physical address of the user, and wherein the request includes user information;

a sending module configured to send the user information to a proofing workstation via the network;

a generating module configured to generate the digital certificate for the user;

a hold setting module configured to set a status of the digital certificate to hold, by the proofing server;

a verification receiving module configured to receive an identification verification from the proofing workstation when the identity of the user has been verified by the proofing workstation;

an active setting module configured to set the status of the digital certificate to active in response to the identification verification; and

a storing module configured to store the digital certificate in the electronic account of the user.

89. A system for issuing a digital certificate for a user on a network, comprising:

means for receiving a request for a digital certificate for a user having an electronic account, wherein the electronic account is linked to a physical address of the user;

means for generating, by a certificate authority, the digital certificate for the user, wherein the digital certificate includes information enabling authentication of a transaction on the network; and

means for linking the digital certificate to the electronic account of the user.

90. A system for issuing a digital certificate for a user on a network, comprising:

means for receiving, at a proofing server, a request for a digital certificate from a user with an electronic account, wherein the electronic account is linked to a physical address of the user;

means for generating, by the proofing server, the digital certificate for the user;

means for setting a status of the digital certificate to hold, by the proofing server;

means for sending the request for the digital certificate to a proofing workstation;

means for verifying, at the proofing workstation, the identity of the user;

means for sending an identification verification from the proofing workstation to the proofing server, when the identity of the user is verified;

means for setting the status of the digital certificate to active in response to the identification verification; and

means for storing the digital certificate in the electronic account of the user.

91. A system for processing a request for a digital certificate from a user, comprising:

means for receiving, at a proofing workstation, user information for a user with an electronic account, wherein the electronic account is linked to a physical address of the user;

means for receiving identification information from the user at the proofing workstation;

means for matching the user information to the identification information by the proofing workstation; and

means for sending an identification verification from the proofing workstation to a proofing server, when the user information has been matched to the identification information.

92. A system for issuing a digital certificate for a user on a network, comprising:

means for receiving, at a proofing server, a request for a digital certificate from a user with an electronic account, wherein the electronic account is linked to a physical address of the user, and wherein the request includes user information;

means for sending the user information to a proofing workstation via the network;

means for generating, by the proofing server, the digital certificate for the user;

means for setting a status of the digital certificate to hold, by the proofing server;

means for receiving an identification verification from the proofing workstation when the identity of the user has been verified by the proofing workstation;

means for setting the status of the digital certificate to active in response to the identification verification; and

means for storing the digital certificate in the electronic account of the user.