Remote portable and universal smartcard authentication and authorization device

• US 20040026496A1
• Filed: 08/09/2002
• Published: 02/12/2004
• Est. Priority Date: 08/09/2002
• Status: Active Grant

• Current Assignee: Bright Smart Corporation
• Original Assignee: Bright Smart Corporation
• Inventors: Zuili, Patrick
• Granted Patent: US 7,083,090 B2
• Time in Patent Office: Days
• US Class Current: 235/379
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G07F 7/0886 the card reader being portable for interacting with a POS or ECR in realizing a payment transaction
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system

Abstract

An autonomous and portable smartcard reader device incorporates a high level of embedded security countermeasures. Data transfers are encrypted with specific input devices, namely a light sensor/DTMF/infrared and PIN or other keyboard entry, and at the output through the use of a dual-tone encoder-decoder. The unit may be used alone or as a plug-in to another device such as a PDA, cell phone, or remote control. The reader may further be coupled to various biometric or plug-in devices to achieve at least five levels of authentication, namely, (1) the smartcard itself; (2) the smartcard reader; (2) the PIN; (3) private-key cryptography (PKI); and (5) the (optional) biometric device. These five levels account for an extremely strong authentication applicable to public networking on public/private computers, and even on TV (satellite, cable, DVD, CD AUDIO, software applications. Transactions including payments may be carried out without any risk of communication tampering, authentication misconduct or identity theft. In essence, the device is a closed box with communication ports. The emulation of the device is therefore extremely complex due to the fact that it involves PKI, hardware serialization for communication and software implementation, in conjunction with a specific hardware embodiment and service usage infrastructure component that returns a response necessary for each unique transaction link to an atomic time synchronization.

Claims

1. A method of authenticating a transaction, comprising the steps of:

providing a portable card reader unit;

initiating a transaction request at the card reader unit;

receiving an optical or multi-tone acoustical signal at the card reader unit to authenticate the transaction; and

executing the transaction, if authorized, through a remote device or third party.

2. The method of claim 1, further including the step of authorizing and executing transactions initiated by one or more smartcards.

3. The method of claim 1, further including the step of authorizing and executing transactions initiated one or more magnetic cards.

4. The method of claim 1, wherein the optical signal received at the card reader unit to authenticate the transaction is a high-contrast optical signal.

5. The method of claim 1, wherein the optical signal received at the card reader unit to authenticate the transaction is generated by a computer display.

6. The method of claim 1, wherein the optical signal received at the card reader unit to authenticate the transaction is generated by a liquid-crystal display.

7. The method of claim 1, wherein the optical signal received at the card reader unit to authenticate the transaction is generated by a light-emitting diode.

8. The method of claim 1, wherein the multi-tone acoustical signal is a DTMF signal.

9. The method of claim 1, wherein the optical signal is an infrared signal.

10. The method of claim 1, wherein the transaction request is initiated by a wireless signal.

11. The method of claim 1, wherein the step of communicating the transaction request to a device or third party involves the use of a multi-tone acoustic signal.

12. The method of claim 11, wherein the multi-tone acoustic signal is a DTMF signal.

13. The method of claim 11, wherein the multi-tone acoustic signal is an AFSK signal.

14. The method of claim 11, wherein the multi-tone acoustic signal is a PL signal.

15. The method of claim 1, wherein:

the portable card reader unit further includes a keyboard; and

the step of initiating a transaction request at the card reader unit includes the entry of a personal identification number (PIN) through the keyboard.

16. The method of claim 15, wherein the keyboard includes a touch-sensitive screen.

17. The method of claim 15, further including the step of terminating the operation of the portable card reader unit if a PIN entry is attempted more than a predetermined number of times.

18. The method of claim 1, wherein:

the portable card reader unit further includes a biometric input; and

the step of initiating a transaction request at the card reader unit includes the receipt of biometric data through the biometric input.

19. The method of claim 18, wherein the biometric input is a fingerprint.

20. The method of claim 1, wherein the transaction request, authentication signal, or both, are encrypted.

21. The method of claim 20, wherein the encryption is based on public-key cryptography.

22. The method of claim 20, wherein the encryption is based on IBE cryptography.

23. The method of claim 1, wherein:

the portable card reader unit includes a memory;

the transaction request and authentication signal constitute a session; and

information regarding the session is stored in the memory.

24. The method of claim 1, wherein the portable card reader unit forms part of a personal digital assistant (PDA).

25. The method of claim 1, wherein the portable card reader unit forms part of cellular telephone.

26. The method of claim 1, wherein the portable card reader unit forms part of a hand-held remote control.

27. The method of claim 1, further including the step of storing an encrypted dynamic credit report.

28. The method of claim 1, further including the step of storing encrypted preapproved payment or banking authorization numbers.

29. The method of claim 1, wherein the authorization includes the step of sending an encrypted credit report to third party credit report company with the approval of the credit owner.

30. The method of claim 1, wherein the portable card reader is further operative to communicate with another card reader.

31. The method of claim 1, further including the step of updating credit report data from a third party credit report company.

32. The method of claim 1, wherein the card is a smartcard, and the method further includes the step of storing encrypted credit report history on the smartcard.

33. The method of claim 1, wherein the card is a smartcard, and the method further includes the step of storing encrypted pre-approved payment or banking authorization numbers on the smartcard.

34. The method of claim 1, further including the step of comparing stored data with data stored on the card.

35. The method of claim 1, further including steps to permit or prevent access to data stored in the reader unit.

36. The method of claim 1, further including steps to permit or prevent access to the card.

37. The method of claim 1, further including steps to permit or prevent access is based on a security policy infrastructure.

38. The method of claim 1, further including the step of storing personal and historical medical data.

39. The method of claim 1, further including the step of storing and caching multiple smartcard at the same time.

40. The method of claim 1, further including the step of providing an identity for the card owner.

41. The method of claim 1, further including the steps of storing, receiving, and sending personal information from the card owner to one or more third parties.

42. The method of claim 1, further including capabilities to permit or prevent physical access to the card reader unit.

43. The method of claim 1, further including the step of storing multiple public and private keys or certificates in memory or on the card.

44. The method of claim 1, further including the step of linking to one or more third parties or services and provide a secure environment to (PKI) infrastructures.

45. The method of claim 1, further including the step of providing a portable authentication through a remote service without allowing to non-secure access.

46. The method of claim 45, wherein the non-secure access is associated with a web café

.

47. The method of claim 45, wherein the non-secure access is associated with a public network.

48. The method of claim 1, wherein the card reader unit is further operative to function as a payment device.

49. The method of claim 1, wherein the card reader unit is further operative to function as an infrared universal remote control.