Methods of exchanging secure messages

• US 20020123967A1
• Filed: 12/21/2001
• Published: 09/05/2002
• Est. Priority Date: 04/27/1998
• Status: Active Grant

• Current Assignee: ServStor Technologies, LLC (IP Investments Group LLC)
• Original Assignee: Esignx Corporation
• Inventors: Wang, Ynjiun P.
• Granted Patent: US 7,107,246 B2
• Time in Patent Office: Days
• US Class Current: 705/51
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: G06Q 20/18 involving self-service terminals [SST], vending machines, kiosks or multimedia terminals
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/3415 Cards acting autonomously as pay-media
• CPC Class Codes: G06Q 20/363 with the personal data of a user
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/40975 using encryption therefor
• CPC Class Codes: G07F 19/20 Automatic teller machines [ATMs]
• CPC Class Codes: G07F 7/0866 by active credit-cards adapted therefor G07F7/1008 takes precedence
• CPC Class Codes: G07F 7/0886 the card reader being portable for interacting with a POS or ECR in realizing a payment transaction
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: G07F 7/1025 Identification of user by a PIN code
• CPC Class Codes: H04L 2463/061 applying further key derivation, e.g. deriving traffic keys from a pair-wise master key cryptographic mechanisms or cryptographic arrangements for generation of secret information including derivation or calculation of cryptographic keys or passwords H04L9/0861
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0414 during transmission, i.e. party's identity is protected against eavesdropping, e.g. by using temporary identifiers, but is known to the other party or parties involved in the communication
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/0853 : using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234

Abstract

The invention enables a registered PEAD user to exchange a secure message with another registered PEAD user by using the user ID and the user public key information in the server. The sender can retrieve the public key information from the server 1201 using the receiver'"'"'s user ID as an index; then the sender can derive the shared secret using the receiver'"'"'s public key. The sender then can encrypt the message with the shared secret and send it over to a server with the other PEAD user'"'"'s (receiver'"'"'s) ID appended with the sender'"'"'s user ID over the wireless network and/or Internet. The server then stores the message and forwards the message to the receiver once the receiver'"'"'s PEAD is polling for messages. (It is understood in the art that the server can push the messages to the receiver'"'"'s PEAD).

The receiving PEAD user can use the sender'"'"'s PEAD user ID and sender'"'"'s public key information to derive the shared secret to decrypt a received secure message. Once a shared secret is computed or established by protocol between two users, that shared secret can be saved in the PEAD for future communication encryption/decryption usage.

Claims

1. A method for receiving a secure message pertaining to an electronic transaction conducted over an electronic network having a server and a portable electronic authorization device, comprising:

Receiving at said portable electronic authorization device first digital data, said first digital data representing said secure message; and

Searching for a share secret from a share secret table in said portable electronic authorization device;

If said share secret is found, decrypt said first digital data;

otherwise compute said share secret in said portable electronic authorization device.

2. A method for transmitting a secure message pertaining to an electronic transaction conducted over an electronic network having a server and a portable electronic authorization device, comprising:

Searching for a share secret from a share secret table in said portable electronic authorization device;

If said share secret is found, encrypt first digital data;

otherwise compute said share secret in said portable electronic authorization device.

Transmitting from said portable electronic authorization device said encrypted first digital data, said encrypted first digital data representing said secure message.

3. A method for receiving a secure message and approving the transaction pertaining to an electronic transaction conducted over a network having a server and a portable electronic authorization device, comprising:

Receiving at said portable electronic authorization device first digital data, said first digital data representing said secure message; and

Searching for a share secret from a share secret table in said portable electronic authorization device;

If said share secret is found, decrypt said first digital data;

otherwise compute said share secret in said portable electronic authorization device;

If a user approve said secure message, by pressing a button, generate a second digital data with a user information and a digital signature generated by said portable electronic authorization device;

Transmitting said second digital data to said electronic transaction system.

4. A method for transmitting a secure message and approving the transaction pertaining to an electronic transaction conducted over an electronic network having a server and a portable electronic authorization device, comprising:

If a user approve first digital data, by pressing a button, generate a digital data including a user information and a digital signature generated by said portable electronic authorization device;

Searching for a share secret from a share secret table in said portable electronic authorization device;

Transmitting at said portable electronic authorization device said encrypted second digital data, said encrypted second digital data representing said secure message.

9. A method is claimed in claim 4 including the further step of the server storing the sender'"'"'s message, and thereafter forwarding the message to the receiver.

5. A method of exchanging secured messages between first and second registered PEAD users over the internet and a server comprising the steps of obtaining public key information using the receiver'"'"'s user ID as an index;

deriving a shared secret using the receiver'"'"'s public key'"'"';

the sender then encrypting a message with the shared secret and sending it with the receiver'"'"'s ID appended with the user'"'"'s ID;

then the receiving PEAD user using the sender'"'"'s user ID and sender'"'"'s public key information to derive the shared secret.

6. A method is claimed in claim 5 including the step storing one or more of the other PEAD users'"'"' share secret using the sender'"'"'s ID as an index.

7. A method is claimed in claim 5 wherein the sender retrieves the public key information using the receiver'"'"'s user ID from the server.

8. A method is claimed in claim 5 including the step of after the sender encrypts the message with the shared secret, sending it to the server with the receiver'"'"'s ID appended.

10. A method as claimed in claim 5 including the step of forwarding the message when the receiver'"'"'s PEAD is polling for messages.

11. A method as claimed in claim 5 including the step of the server pushing the message to the receiver'"'"'s PEAD.

12. A method as claimed in claim 5, including the step of the sender causing the PEAD to down load a key pair comprising a public key and a private key, and then transferring the public key to a server to be stored and indexed by the sender'"'"'s ID.

13. A method as claimed in claim 6 including the step of the receiver checking for a stored shared secret in a shared secret table of the PEAD, and after finding the shares secret using the shared secret to decrypt the senders message.

14. A method as claimed in claim 13 wherein if the receiver does not find a shared secret in the shared secret table of the receiver'"'"'s PEAD, then the receiver retrieves the senders public key information from the server using a sender'"'"'s user ID as an index.

15. A method as claimed in claim 14 including the further step of the receiver using the receiver'"'"'s private key and the now-retrieved sender'"'"'s public key to compute the shared secret.

16. A method as claimed in claim 15 including the further of storing the shared secret, using the senders ID as an index.

17. A method as claimed in claim 16 including the further step of periodically updating the shared secrets stored in the shared secret table to reflect a change in a public key.