METHOD AND APPARATUS FOR THE SECURE IDENTIFICATION OF THE OWNER OF A PORTABLE DEVICE

• US 20090113205A1
• Filed: 01/07/2009
• Published: 04/30/2009
• Est. Priority Date: 02/25/1999
• Status: Abandoned Application

• Current Assignee: Bouyant Holdings Limited
• Original Assignee: Cidway Technologies, Ltd.
• Inventors: Labaton, Isaac J.
• Application Number:
  US12/350,010
• Publication Number:
  US 20090113205A1
• Time in Patent Office: Days
• US Class Current: 713/155
• CPC Class Codes: G06Q 20/10 specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G10L 15/02 Feature extraction for speech recognition; Selection of recognition unit
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0838 using one-time-passwords

Abstract

An authentication system is provided that includes a portable device and a decryption node. An individual uses the portable device, such as a portable device like a cell phone to compute a challenge and a response. The challenge and response is sent to a decryption node. In response, the decryption node computes a presumed response and compares the presumed response to the response of the portable device, in order to authenticate the individual associated with the portable device.

Claims

1. A method for generating a digitally signed document, comprising the steps of:

registering a portable device to a participating entity;

generating, by the portable device, an authorization code corresponding to the portable device;

transmitting, to a certification server, the authorization code and transaction data;

identifying, by the certification server, the participating entity that corresponds to the portable device that transmitted the authorization code;

retrieving data corresponding to the identified participating entity from a database; and

digitally signing the received transaction data.

2. The method of claim 1 further comprising the steps of:

encrypting, by the portable device, the transaction data prior to transmission to the certification server; and

decrypting, by the certification server, the received transaction data.

3. The method of claim 1, wherein the authorization code is a dynamic authorization code.

4. The method of claim 1, wherein the authorization code is a one time password.

5. The method of claim 1, wherein the digital signature is in accordance with public-key cryptography standards (PKCS).

6. The method of claim 1, further comprising the step of computing the digital signature using the certification server'"'"'s private key.

7. The method of claim 1, further comprising the step of computing the digital signature using the participating entity'"'"'s private key.

8. The method of claim 7, wherein the participating entity is the portable device.

9. The method of claim 1, further comprising the step of transmitting the digitally signed document to the participating entity.

10. The method of claim 1, further comprising the step of transmitting the digitally signed document to a specified address.

11. The method of claim 1, wherein the portable device'"'"'s authorization code is entered in a personal computer, and wherein the authorization code and transaction data are transmitted from the personal computer to the certification server.