PRIVATE INFORMATION EXCHANGE IN SMART CARD COMMERCE

• US 20080229108A1
• Filed: 05/30/2008
• Published: 09/18/2008
• Est. Priority Date: 05/03/2006
• Status: Active Grant

• Current Assignee: PayPal, Inc. (PayPal Holdings, Inc.)
• Original Assignee: International Business Machines Corporation
• Inventors: GRUNDY, MICHAEL H., FERRI, RICHARD, CHASE-SALERNO, MICHAEL S., DAGUE, SEAN
• Granted Patent: US 7,870,998 B2
• Time in Patent Office: Days
• US Class Current: 713/172
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/35765 Access rights to memory zones
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system

Abstract

A method, system and computer program product for private information exchange in smart card commerce is disclosed. The method includes, in response to determining that an item of biometric data received on a biometric reader corresponds to an authorized user, unlocking a communication channel on a communication port, exchanging public keys between the user and authorized point of sale, receiving an information request from an external point of sale machine across the communication channel, decrypting an information request and parsing a data token. In response to determining that private data has been requested in the information request, a user is prompted for authorization to release the private information, and private information exchange in smart card commerce is performed by, in response to the user pressing a yes button on the smart card, placing an encrypted copy of the private data in the public area of the smart card for transmission across the communication channel to the external point of sale machine.

Claims

1. A method for performing private information exchange in smart card commerce, said method comprising:

in response to determining that an item of biometric data received on a biometric reader corresponds to an authorized user, unlocking a communication channel on a communication port and exchanging public keys;

in response to determining that a valid information request from an external point of sale machine has been received across said communication channel, decrypting said information request and parsing a data token;

in response to determining that private data has been requested in said information request, prompting a user for authorization to release said private information; and

performing private information exchange in smart card commerce by, in response to said user pressing a yes button on said smart card, placing an encrypted copy of said private data in said public area of said smart card for transmission across said communication channel to said external point of sale machine.

2. The method of claim 1, further comprising the step of receiving said item of biometric data on said biometric reader of said smart card.

3. The method of claim 1, further comprising the step of delivering a public key correlating to said authorized user by placing said public key in said public area of said smart card.

4. The method of claim 1, further comprising the step of receiving said valid public key from said external point of sale machine.

5. The method of claim 1, further comprising the step of transmitting said encrypted copy across said communication channel to said external point of sale machine.

6. The method of claim 1, further comprising the step of encrypting said private data to generate said encrypted copy of said private data.

7. The method of claim 1, further comprising refusing to perform private information exchange in said smart card commerce by, in response to said user pressing a no button on said smart card, closing said communication channel to said external point of sale machine and displaying a failure message on said display unit.

8. A system for performing private information exchange in smart card commerce, said system comprising:

means for, in response to determining that an item of biometric data received on a biometric reader corresponds to an authorized user, unlocking a communication channel on a communication port and exchanging public keys;

means for, in response to determining that a valid information request from an external point of sale machine has been received across said communication channel, decrypting said information request and parsing a data token;

means for, in response to determining that private data has been requested in said information request, prompting a user for authorization to release said private information; and

means for performing private information exchange in smart card commerce by, in response to said user pressing a yes button on said smart card, placing an encrypted copy of said private data in said public area of said smart card for transmission across said communication channel to said external point of sale machine.

9. The system of claim 8, further comprising a biometric reader for receiving said item of biometric data on said smart card.

10. The system of claim 8, further comprising means for delivering a public key correlating to said authorized user by placing said public key in said public area of said smart card.

11. The system of claim 8, further comprising means for receiving said valid public key from said external point of sale machine.

12. The system of claim 8, further comprising means for transmitting said encrypted copy across said communication channel to said external point of sale machine.

13. The system of claim 8, further comprising means for encrypting said private data to generate said encrypted copy of said private data.

14. The system of claim 8, further comprising means for refusing to perform private information exchange in said smart card commerce by, in response to said user pressing a no button on said smart card, closing said communication channel to said external point of sale machine and displaying a failure message on said display unit.

15. A machine-readable medium having a plurality of instructions processable by a machine embodied therein, wherein said plurality of instructions, when processed by said machine, causes said machine to perform a method, said method comprising:

in response to determining that an item of biometric data received on a biometric reader corresponds to an authorized user, unlocking a communication channel on a communication port and exchanging public keys;

in response to determining that a valid information request from an external point of sale machine has been received across said communication channel, decrypting said information request and parsing a data token;

in response to determining that private data has been requested in said information request, prompting a user for authorization to release said private information; and

performing private information exchange in smart card commerce by, in response to said user pressing a yes button on said smart card, placing an encrypted copy of said private data in said public area of said smart card for transmission across said communication channel to said external point of sale machine.

16. The machine-readable medium of claim 15, said method further comprising the step of receiving said item of biometric data on said biometric reader of said smart card.

17. The machine-readable medium of claim 15, said method further comprising the step of delivering a public key correlating to said authorized user by placing said public key in said public area of said smart card.

18. The machine-readable medium of claim 15, said method further comprising the step of receiving said valid public key from said external point of sale machine.

19. The machine-readable medium of claim 15, said method further comprising the step of transmitting said encrypted copy across said communication channel to said external point of sale machine.

20. The machine-readable medium of claim 15, said method further comprising the step of encrypting said private data to generate said encrypted copy of said private data.