Methods for authenticating self-authenticating documents

• US 20050038754A1
• Filed: 07/24/2003
• Published: 02/17/2005
• Est. Priority Date: 07/24/2003
• Status: Abandoned Application

• Current Assignee: Unisys Corporation
• Original Assignee: Unisys Corporation
• Inventors: Hayosh, Thomas D., Geist, Bruce K.
• Application Number:
  US10/626,287
• Publication Number:
  US 20050038754A1
• Time in Patent Office: Days
• US Class Current: 705/64
• CPC Class Codes: G06Q 20/042 characterized in that the payment protocol involves at least one cheque
• CPC Class Codes: G06Q 20/347 Passive cards
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/389 Keeping log of transactions for guaranteeing non-repudiation of a transaction
• CPC Class Codes: G07F 7/10 together with a coded signal , e.g. in the form of personal identification information, like personal identification number [PIN] or biometric data
• CPC Class Codes: G07F 7/1066 PIN data being compared to data on card
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 9/3066 involving algebraic varieties, e.g. elliptic or hyper-elliptic curves
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3252 using DSA or related signature schemes, e.g. elliptic based signatures, ElGamal or Schnorr schemes
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

Methods of authenticating self-authenticating documents presented at a point of purchase or financial institution. Data contained on the value document may be signed with a first digital signature and authenticated with a public key certificate. A unique personal identification number (PIN) may be included in the document data that is signed by a second digital signature. The signed data and a public key certificate are stored on the value document. At a point of purchase, a merchant or teller can scan and read the stored data and together with the PIN the customer provides, can authenticate the value document thus presented using the second digital signature. Alternatively, if the customer is not present, the document may be verified using a PIN-generating algorithm. The first digital signature alone may be used to authenticate the document even when the PIN is not available.

Claims

1. A method of authenticating a self-authenticating document, comprising the steps of:

processing machine-readable data on said self-authenticating document to obtain digital signature data and a public key certificate;

processing said public key certificate to obtain public key certificate data including an authentic public key;

assembling critical document data from said self-authenticating document, wherein said critical document data includes at least magnetic ink character recognition (MICR) data printed on said self-authenticating document;

determining whether an authentic personal identification number (PIN) is available for appending to said critical document data;

wherein, if said authentic PIN is available;

appending said authentic PIN to said critical document data to create an authenticatable data string; and

,

applying said authentic public key to said digital signature data to validate said authenticatable data string, wherein said self-authenticating document is authenticated if said authenticatable data string is validated.

2. The authenticating method of claim 1, wherein said self-authenticating document is a personal check, and wherein said critical document data includes ASCII text printed on said personal check.

3. The authenticating method of claim 1, further comprising the steps of:

determining whether a first digital signature is present in said digital signature data, if it is determined that said authentic personal identification number (PIN) is not available;

applying said authentic public key to said digital signature data to validate said critical document data, wherein said self-authenticating document is authenticated if said critical document data is validated.

4. The authenticating method of claim 3, wherein if it is determined that said authentic PIN is not available and that said first digital signature is not present in said digital signature data, further comprising the steps of:

determining whether a second digital signature is present in said digital signature data, and,

if said second digital signature is present;

generating a plurality of PINs;

appending each of said plurality of PINs to said critical document data to create a plurality of verifiable data strings; and

,

applying said authentic public key to said second digital signature in order to validate one of said verifiable data strings as said authenticatable data string and to authenticate said self-authenticating document.

5. The authenticating method of claim 4, wherein said step of generating PINs is carried out in a document reading system executing a PIN-generating algorithm.

6. The authenticating method of claim 3, wherein said machine-readable data is bar-code data, said machine-readable data processing step including the substeps of:

retrieving said bar code data from said self-authenticating document; and

,

parsing data fields in said bar code data to obtain at least said public key certificate, said digital signature data, and k, where k, is the total number of bytes in said bar code data.

7. The authenticating method of claim 3, wherein said public key certificate data processing step includes the substeps of:

validating said public key certificate with a third-party public key; and

,

parsing said public key certificate to obtain said authentic public key;

8. The authenticating method of claim 7, wherein said public key certificate includes a third-party digital signature, and wherein said public key certificate validating step further comprises the substep of applying said third-party public key to said third-party digital signature.

9. The authenticating method of claim 7, wherein said third party is a certificate authority.

10. The authenticating method of claim 7, wherein said public key certificate is comprised of m bytes, and wherein said public key certificate parsing substep includes the further substeps of:

retrieving at least a first byte, c₁, of said m bytes from said public key certificate, wherein said at least a first byte c₁ is a binary representation of said number of bytes m in said public key certificate;

determining whether said binary representation of said number of bytes m in said at least a first byte c₁, is greater than the number of bytes of data in said digital signature data, n;

retrieving the remainder of said m bytes, if said determining step determines that said at least a first byte c₁ is greater than the number of bytes of data in said digital signature data, n; and

,

applying said authentic public key to said digital signature data in order to verify said at least one of said first and second digital signatures.

11. The authenticating method of claim 10, wherein said public key certificate parsing substep includes the further substeps of:

retrieving public key validity date data from said public key certificate;

determining if said public key validity date data is within an accepted date range; and

,

validating said public key certificate with said public key validity date data, if said public key validity date data is within said accepted date range.

12. The authenticating method of claim 11, wherein said public key certificate parsing substep Includes the further substep of:

issuing an alert if said public key validity date data is not within an accepted date range.

13. The authenticating method of claim 12, wherein said public key certificate parsing substep includes the further substeps of:

deciding whether to validate said public key certificate if said public key validity date data is not within an accepted date range, by checking guidelines issued by said third party.

14. The authenticating method of claim 12, wherein said public key certificate parsing substep includes the further substeps of:

deciding whether to validate said public key certificate if said public key validity date data is not within an accepted date range, by consulting a public key certificate database.

15. The authenticating method of claim 3, further comprising the step of:

presenting said self-authenticating document by an owner of said self-authenticating document to a commercial entity for authentication, wherein said presenting step is carried out prior to said machine-readable data processing step.

16. The authenticating method of claim 15, wherein said authentic PIN-determining step further includes the substep of:

determining whether an owner of said self-authenticating document is available to input said authentic PIN, wherein said PIN-availability step determines that said authentic PIN is not available if said owner of said self-authenticating document is not available.