GUMP: GRAND UNIFIED META-PROTOCOL FOR SIMPLE STANDARDS-BASED ELECTRONIC COMMERCE TRANSACTIONS

• US 20020069174A1
• Filed: 02/27/1998
• Published: 06/06/2002
• Est. Priority Date: 02/27/1997
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: BECKMAN, BRIAN C., FOX, BARBARA L., LAMACCHIA, BRIAN A.
• Granted Patent: US 7,003,480 B2
• Time in Patent Office: Days
• US Class Current: 705/52
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: G06Q 30/0617 Representative agent
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32

Abstract

A method for facilitating two-party electronic commerce transactions between trading partners on an unsecure network, such as the Internet. In one example, a client makes application for registration by a financial institution in which the client has one or more accounts. The client submits satisfactory proof of identity and a public key portion for a digital signature to the financial institution. The financial institution may provide the client a one time secret by a secure route, such as conventional mail, which can then be used by the client to show proof of its identity. The financial institution authenticates the one time secret and combines it with the client'"'"'s public key in a GUMP Relationship Certificate (GRC), which it issues to the client over the network. Once issued, the GRC can be used by the client to authenticate its right to access its account(s) or other products or services at the financial institution and when conducting other electronic transactions over the network. The client digitally signs any such transaction to authenticate its right to conduct the transaction. A delegate may be enlisted by the client to negotiate the purchase of goods from a seller or for other purposes, using a GUMP Delegate Certificate. The concept can be extended to other three party transactions, such as issuing an electronic Letter of Credit (LOC).

Claims

1. A method for performing an electronic commerce transaction over an unsecure network without requiring encryption, comprising the steps of:

(a) enabling a first party to apply for registration with a second party, the first party having access to financial resources through the second party;

(b) presenting a certified identifier of the first party to the second party, said certified identifier enabling the second party to confirm a true identity of the first party;

(c) transferring a certificate to the first party from the second party over the unsecure network, the certificate being digitally signed by the second party and including the certified identifier that provides an index to the financial resources accessible to the first party through the second party;

(d) providing the certificate to a seller over the unsecure network, the certificate being digitally signed by the first party to indicate that the first party agrees to make a payment for goods provided by the seller in an amount indicated in the certificate as digitally signed; and

(e) said seller presenting the certificate that was digitally signed by the first party to the second party over the unsecure network in exchange for the payment, the second party referencing the amount indicated in said certificate in making the payment to the seller from the financial resources accessible by the first party.

2. The method of claim 1, wherein the step of presenting the identifier further comprises the steps of:

(a) determining a one time secret, the one time secret enabling the second party to initially confirm the identity of the first party in association with a public key of a digital signature of the first party that is submitted to the second party by the first party; and

(b) said one time secret thereafter becoming an unsecret and serving as the index.

3. The method of claim 2, wherein the one time secret is derived from information shared between the first party and the second party.

4. The method of claim 2, wherein the one time secret is derived from information known only to the second party.

5. The method of claim 2, wherein the digital signature is unique to the first party.

6. The method of claim 2, wherein the unsecret is bound to the public key of the digital signature of the first party in the certificate.

7. The method of claim 2, wherein the unsecret comprises a hash value of reference numbers for the financial resources.

8. The method of claim 2, wherein the unsecret comprises a hash value of data known to the second party.

9. The method of claim 2, wherein, the first party submits a certificate issued by a third party to the second party as the certified identifier to prove the true identity of the first party, each additional different certificate thus submitted tending to increase a measure of confidence by the second party that the identity of the first party is true.

10. The method of claim 2, wherein the digital signature is a transformation of the certificate, the transformation being generated by the first party with a private key that is associated with the public key, so that another party may employ the public key to verify the digital signature.

11. The method of claim 10, further comprising the steps of:

(a) said first party applying to a registry for registration of the signature of the first party, the registry confirming the true identity of the first party; and

if confirmed; and

(b) registering the digital signature of the first party with the registry, the digital signature being registered with the registry until the registry is informed that the private key associated with the digital signature is not secure.

12. The method of claim 11, wherein the first party provides to the registry a certificate issued by another registry, the registry employing the certificate issued by the other registry to confirm the true identity of the first party.

13. The method of claim 1, wherein when presented with the certificate digitally signed by the first party, the second party employs a replay detector to determine if the certificate has been previously used for this purpose since it was digitally signed by the first party.

14. The method of claim 1, further comprising the steps of:

(a) issuing a delegation certificate to a delegate over the unsecure network, the delegation certificate providing the delegate with an authority to negotiate with the seller on behalf of the first party;

(b) including with the delegation certificate an authorization for the payment, the first party digitally signing the delegation certificate to provide the authorization and delegate using the delegation certificate to negotiate with the seller;

(c) presenting the delegation certificate to the seller, the delegate providing the delegation certificate with the authorization to the seller as payment for the goods; and

(d) said seller redeeming the delegation certificate with the second party to obtain the payment from the financial resources accessible by the first party.

15. The method of claim 1, wherein the first party is a client and the second party is a financial institution.

16. The method of claim 1, wherein the first party is a customer and the second party is a non-financial institution, including a service provider and a merchant.

17. A computer readable medium having computer executable components for performing the steps recited in claim 1.

18. A computer readable medium having computer executable components for performing the steps recited in claim 2.

19. A computer readable medium having computer executable components for performing the steps recited in claim 14.

20. A method for obtaining a certificate employed to facilitate transactions with a second party over an unsecure network without requiring encryption, the certificate being issued by the second party and assuring an authenticity of the first party, comprising the steps of:

(a) enabling said first party to submit a public key for its digital signature to the second party over the unsecure network and to provide proof of its identity to the second party;

(b) confirming the identity of the first party;

(c) combining the public key with a unique reference identifying the first party in connection with business transacted between the first and the second parties, the combination of the public key and the unique reference being digitally signed by the second party to produce the certificate; and

(d) issuing the certificate to the first party over the unsecure network, said first party being thereafter enabled to digitally sign and submit the certificate to the second party over the unsecure network to prove a right of the first party to transact the business with the second party.

21. A computer readable medium having computer executable components for performing the steps recited in claim 20.

22. A method for performing an electronic commerce transaction for goods on an unsecure network without requiring encryption, using a Letter Of Credit (LOC), comprising the steps of:

(a) applying for a LOC with an opening bank, a buyer being approved for the LOC when the true identity of the buyer and terms of the LOC have been authenticated by the opening bank, the opening bank being associated with accessing the financial resources of the buyer

(b) said buyer providing an identifier of the buyer to the opening bank, the identifier enabling the opening bank to independently determine the true identity of the buyer;

(c) said opening bank issuing a certificate that is digitally signed by the opening bank and which includes the identifier and a reference to the LOC, the opening bank sending the certificate to the client and a seller over the unsecure network;

(d) said seller sending the certificate to an advising bank, the advising bank being associated with a beneficiary of the electronic commerce transaction;

(e) said buyer sending a document to the advising bank over the unsecure network, when the terms of the LOC have been met; and

(f) presenting the certificate to the opening bank for payment of the LOC, the certificate having been digitally signed by the advising bank to indicate that the advising bank guarantees the seller has met all of the terms of the LOC, said opening bank sending the payment for the goods to the advising bank for dispersal to the beneficiary.

23. The method of claim 22, further comprising the steps of:

(a) confirming that the certificate is valid, the advising bank verifying that the client bank has issued the certificate for the LOC; and

(a) confirming the terms of the LOC, the advising bank and the opening bank determining the terms that must be completed before the certificate may be redeemed at the opening bank.

24. The method of claim 22, wherein the terms of the LOC identify a type for the document, said document comprising one of a bill of lading and a receipt.

25. The method of claim 22, further comprising the step of reviewing the performance of the terms of the LOC, the advising bank negotiating with the seller to ensure performance of the terms.

26. The method of claim 25, wherein the advising bank determines that the seller has not met the terms of the LOC, the advising bank advising the opening bank that the terms of the LOC have not been met over the unsecure network.

27. The method of claim 25, wherein the advising bank determines that the seller has only partially completed the terms of the LOC, further comprising the step of the advising bank accepting liability for completion of all terms of the LOC and digitally signing the certificate to confirm acceptance of the liability.

28. The method of claim 22, wherein the beneficiary is identified in the terms of the LOC as a recipient of the payment for the goods.

29. The method of claim 22, wherein the beneficiary is the seller.

30. A computer readable medium having computer executable components for performing the steps recited in claim 22.