Method and apparatus for secure import of information into data aggregation program hosted by personal trusted device

• US 20040159700A1
• Filed: 05/02/2003
• Published: 08/19/2004
• Est. Priority Date: 12/26/2001
• Status: Abandoned Application

• Current Assignee: ViVOtech Incorporated
• Original Assignee: ViVOtech Incorporated
• Inventors: Khan, Mohammad A., Brown, Kerry D., Simon, Stan J., Fernandes, Jorge M.
• Application Number:
  US10/428,910
• Publication Number:
  US 20040159700A1
• Time in Patent Office: Days
• US Class Current: 235/380
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/29 characterised by micropayments
• CPC Class Codes: G06Q 20/322 Aspects of commerce using mobile devices [M-devices]
• CPC Class Codes: G06Q 20/326 Payment applications installed on the mobile devices
• CPC Class Codes: G06Q 20/327 Short range or proximity payments by means of M-devices
• CPC Class Codes: G06Q 20/3572 Multiple accounts on card
• CPC Class Codes: G06Q 20/363 with the personal data of a user
• CPC Class Codes: G06Q 20/3823 combining multiple encryption tools for a transaction
• CPC Class Codes: G06Q 20/388 using mutual authentication without cards, e.g. challenge-response
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G06Q 20/4037 Remote solvency checks
• CPC Class Codes: G06Q 20/425 using two different networks, one for transaction and one for security confirmation
• CPC Class Codes: G07F 17/16 for devices exhibiting advertisements, announcements, pictures or the like
• CPC Class Codes: G07F 7/08 by coded identity card or credit card or other personal identification means without personal verification means G07F7/02
• CPC Class Codes: G07F 7/0866 by active credit-cards adapted therefor G07F7/1008 takes precedence
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0869 : for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/126 : the source of the received data
• CPC Class Codes: H04L 63/18 : using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 9/0827 : involving distinctive intermediate devices or communication paths network architectures or network communication protocols using different networks H04L63/18
• CPC Class Codes: H04W 12/033 : of the user plane, e.g. user's traffic
• CPC Class Codes: H04W 12/06 : Authentication
• CPC Class Codes: H04W 12/10 : Integrity

Abstract

Embodiments in accordance with the present invention allow financial or other confidential information to be securely imported in electronic form into a PTD. The information to be imported is first encrypted. The encrypted information is then transmitted from a source to the PTD. The encrypted information is then stored by the PTD. A decryption key is sent to the PTD user in a manner establishing a strong non-repudiation scheme. For example, the decryption key could be sent from a second device, or through a second communication channel separate and distinct from the first communication channel. Utilizing the decryption key delivered through the second communication channel, the user is able to decrypt and access the information in the PTD for transactional purposes.

Claims

1. A method of communicating information to a personal trusted device (PTD), the method comprising:

encrypting information at a source;

communicating the encrypted information to a receiver of a PTD through a first communication channel;

storing the encrypted information in a memory of the PTD;

transmitting a decryption key to the PTD through a second communication channel different from the first communication channel; and

utilizing the decryption key to decrypt the information.

4. The method of claim 1 wherein communicating the encrypted information comprises transmitting an RF signal to the PTD, the RF signal conforming to the ISO 14443 type A or B standard, or to the ISO 15693 standard.

5. The method of claim 1 wherein the information comprises financial information, and the decryption key is mailed to the PTD user.

6. The method of claim 5 wherein the decryption key is embedded as a portion of a financial statement.

7. The method of claim 1 wherein the source comprises an interface device including a cryptoprocessor, the method further comprising transmitting the information to the source.

8. The method of claim 7 wherein the information is transmitted to the source from one of a magnetic stripe card, an RF proximity chip card, and a second PTD.

9. The method of claim 7 wherein encrypting the stored information comprises encrypting the information with a key embedded in the interface device.

10. The method of claim 7 further comprising:

requiring a user to enter a security code prior to encrypting the information in the interface device; and

requiring a user to enter the security code into the PTD before accessing the encrypted information.

2. The method of claim 2 wherein the first communication channel comprises a short range wireless medium, and the second communication channel is selected from the group consisting of a wired network connection, a long range wireless network connection, a postal channel, and a telephone voice connection.

3. The method of claim 2 wherein communicating the encrypted information comprises transmitting an infra-red signal to the PTD.

11. The method of claim I further comprising communicating a notification message to the source upon decryption

12. A method of communicating information to a personal trusted device (PTD), the method comprising:

communicating encrypted information to a receiver of a PTD from a first device;

storing the encrypted information in a memory of the PTD;

communicating a decryption key to the PTD from a second device; and

utilizing the decryption key to decrypt the information.

13. The method of claim 12 wherein the encrypted information is electronically communicated to the PTD from a first device selected from the group consisting of a personal computer, a second PTD, an RF proximity chip card, an interface device, and a server administered by a party responsible for encrypting the information.

14. The method of claim 12 wherein the decryption key is communicated to the PTD by typing in contents of a document mailed to the PTD user.

15. The method of claim 14 wherein the information comprises credit card information and the decryption key is mailed to the PTD user in a credit card billing statement.

16. The method of claim 15 further comprising communicating a notification message to a credit card issuer upon decryption of the credit card data.

17. A method of activating a credit card account for use on a personal trusted device (PTD), the method comprising:

storing in a memory of the PTD encrypted data identifying a credit card account number;

entering a decryption key into the PTD; and

decrypting the data with the decryption key.

18. The method of claim 17 wherein the decryption key is forwarded to the PTD utilizing a different communication channel than is used to forward the encrypted data to the PTD.

19. The method of claim 17 wherein the decryption key is forwarded to the PTD from a different device than is used to forward the encrypted data to the PTD.

20. The method of claim 17 further comprising communicating a notification message to a credit card issuer upon decryption of the credit card data.

25. The apparatus of claim 20 wherein the transmitter is selected from the group consisting of an infrared (IR) transceiver, a BLUETOOTH transceiver, an IEEE 802.11(a), (b), or (g) transceiver, a WiFi-type transceiver, and an RF transceiver configured to communicate with an RF proximity chip card confirming to ISO 14443 type A or B standard, or ISO 15693 standards.

26. The apparatus of claim 25 wherein the receiver and transmitter communicate utilizing infrared radiation and are combined as a single infrared transceiver.

27. The apparatus of claim 25 wherein the receiver and transmitter communicate utilizing RF radiation and are combined as a single RF transceiver.

21. An apparatus for importing information into a personal trusted device, the apparatus comprising:

a receiver configured to receive information from a source;

a memory in electronic communication with the receiver and configured to store the information;

a processor in electronic communication with the memory and configured to encrypt the information; and

a short range wireless transmitter in electronic communication with the memory and configured to transmit the encrypted information to a PTD.

22. The apparatus of claim 21 wherein the receiver comprises an inductor in magnetic communication with a magnetic card slot.

23. The apparatus of claim 22 wherein the inductor comprises a magnetic reader head.

24. The apparatus of claim 22 wherein the inductor comprises a simulacrum configured to be substantially permanently positioned within a magnetic card slot of an existing magnetic card reader.

28. The apparatus of claim 21 further comprising a cryptoprocessor in electronic communication with the memory and configured to encrypt the information.

29. The apparatus of claim 21 further comprising a wired communication port configured to communicate with a network.

30. The apparatus of claim 21 further comprising a long range wireless transceiver configured to communicate with a network.

31. The apparatus of claim 21 further comprising at least one of a keypad, a display, and a printer to facilitate communication with a PTD comprising an RF proximity chip card.