Gauging Risk in Electronic Communications Regarding Accounts in ABDS System

• US 20030097561A1
• Filed: 02/01/2003
• Published: 05/22/2003
• Est. Priority Date: 08/04/2000
• Status: Active Grant

• Current Assignee: First Data Corporation (Fiserv Incorporated)
• Original Assignee: First Data Corporation (Fiserv Incorporated)
• Inventors: Wheeler, Anne M., WHEELER, Lynn Henry
• Granted Patent: US 7,082,533 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/12 specially adapted for electronic shopping systems
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/3823 combining multiple encryption tools for a transaction
• CPC Class Codes: G06Q 20/3825 Use of electronic signatures
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/388 using mutual authentication without cards, e.g. challenge-response
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G06Q 20/403 Solvency checks
• CPC Class Codes: G06Q 20/40975 using encryption therefor
• CPC Class Codes: G06Q 50/06 Energy or water supply
• CPC Class Codes: G07F 7/0886 the card reader being portable for interacting with a POS or ECR in realizing a payment transaction
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: G07F 7/1016 Devices or methods for securing the PIN and other transaction-data, e.g. by encryption arrangements for secret communication, see H04L9/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263

Abstract

Abstract of Disclosure

A system for communicating electronically over a communications medium regarding an account includes (a) maintaining information pertaining to the account in a database such that the information is retrievable by a unique identifier, the information including security features of a device that generates digital signatures using a private key of a public-private key pair, (b) associating the public key of the device with the unique identifier in the database, (c) receiving an electronic communication including the unique identifier and a digital signature for a message generated by a suspect device (d) authenticating the message using the public key associated with the unique, (e) upon successful authentication of the message, identifying the security features retrievable by the unique identifier as being the security features of the genuine device, and (f) gauging the risk that said generated digital signature was fraudulently sent based on said identified security features of the genuine device.

Claims

1. A system of communicating electronically over a communications medium regarding an account, comprising the steps of:

2. The method of claim 1, wherein said step of maintaining the record is performed by an account authority.

3. The method of claim 1, wherein said step of maintaining the record is performed by a central key authority.

4. 3. The method of claim 1, wherein said step of identifying the security features of the device is performed by an account authority.

5. 4. The method of claim 1, wherein said step of identifying the security features of the device is performed by an central key authority.

6. 5. The method of claim 1, wherein the unique identifier comprises the associated public key.

7. 6. The method of claim 1, wherein the unique identifier comprises an account number.

8. 7. The method of claim 1, wherein the communications medium is open and insecure.

9. 8. The method of claim 1, wherein the communications medium comprises the Internet.

10. 9. The method of claim 1, further comprising gauging the risk that the digital signature was fraudulently originated based on said identified security features.

11. 10. The method of claim 1, wherein the information includes the name of an account holder.

12. 11. The method of claim 1, wherein the information includes the address of an account holder.

13. 12. The method of claim 1, wherein the information includes the social security number of an account holder.

14. 13. The method of claim 1, wherein the information includes the tax identification number of an account holder.

15. 14. The method of claim 1, wherein the information includes an account number for the account

15. The method of claim 1, wherein the information includes a current balance for the account.

16. The method of claim 1, wherein the information includes an available credit for the account.

17. The method of claim 1, wherein the information includes a list of associated accounts.

18. The method of claim 1, wherein the security characteristics for each respective device are indexed in the database to that device'"'"'s public key.

19. The method of claim 1, wherein the security characteristics for each respective device are indexed in the database to a unique identifier.

20. The method of claim 19, further comprising sending the EC received from the user to each of the third-parties.