Storage and Authentication of Data Transactions

• US 20120260098A1
• Filed: 06/12/2012
• Published: 10/11/2012
• Est. Priority Date: 07/02/2002
• Status: Active Grant

• Current Assignee: The Ascent Group, Ltd.
• Original Assignee: The Ascent Group, Ltd.
• Inventors: Jacobs, Michael
• Granted Patent: US 8,656,166 B2
• Time in Patent Office: Days
• US Class Current: 713/176
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2151 Time stamp
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: H04L 51/23 Reliability checks, e.g. acknowledgments or fault reporting
• CPC Class Codes: H04L 51/42 Mailbox-related aspects, e.g. synchronisation of mailboxes
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/126 the source of the received data

Abstract

Data is transmitted between a first user and a second user via an information technology communications network, in a method comprising the steps of:

• • generating a first hash value for a selected one of the data items;
  • digitally signing and encrypting the first hash value with a secret identifier associated with the first user;
  • transmitting to a second user the encrypted first hash value;
  • receiving and storing the transmitted encrypted first hash value for audit purposes and generating a second hash value for the received encrypted first hash value;
  • encrypting the second hash value with a private identifier associated with a second user and a public identifier associated with the first user; and
  • returning the encrypted second hash value to the first user.

Claims

1. A computer implemented method of transmitting data between a first user and a second user via an information technology communications network, comprising the steps of:

generating a first hash value for a selected one of the data items;

digitally signing and encrypting said first hash value with a secret identifier associated with the first user;

transmitting to a second user said encrypted first hash value;

receiving and storing said transmitted encrypted first hash value for audit purposes and generating a second hash value for said received encrypted first hash value;

encrypting the second hash value with a private identifier associated with a second user and a public identifier associated with the first user; and

returning the encrypted second hash value to the first user.

2. A method according to claim 1, further comprising:

receiving said encrypted second hash value returned to the first user;

decrypting said received encrypted second hash value with the private identifier associated with said second user and the public identifier associated with said first user to derive a hash value therefrom; and

comparing the derived hash value derived with the second hash value generated for said received encrypted first hash value to confirm digital identity of the second user.

3. A method according to claim 2, further comprising, in response to the comparing of confirming digital identity of the second user, encrypting the secret identifier associated with the first user and transmitting to the second user the encrypted secret identifier associated with the first user for decryption and subsequent use in decrypting said encrypted first hash value.

4. A method according to claim 2, further comprising:

in response to the comparing of failing to confirm digital identity of the second user, denying the second user access to the encrypted first hash value.

5. A method according to claim 4, wherein the second user is denied access to the encrypted first hash value by omission of transmitting to the second user the encrypted secret identifier associated with the first user.

6. A method according to claim 5, wherein the encrypted secret identifier has been encrypted with a key that is obtained through transactions between said second user and a third party.

7. A method according to claim 6, wherein at least one of said transactions between said second user and said third party is recorded and time stamped by said third party.

8. A method according to claim 1, wherein the encrypted first hash value is stored remotely from said first and second end users by a third party.

9. Apparatus for storage of data, comprising a computer memory for storing copies of a plurality of data items, a computer output for generating at the end of a predetermined period of time, a data file comprising hash values of each data item created and/or stored during that time, a computer hash value generator for generating a single hash value of said data file, and a transmitter for transmitting said single hash value to a remote location for storage and/or publication thereof, or of data representative thereof.

10. Apparatus according to claim 9, wherein said data file comprises a hash value of each of the data items created and/or stored during said predetermined period of time together with one or more of a file name, a path name, the file size and a time-stamp in relation to each data item.

11. Apparatus according to claim 9, wherein at said remote location, said second data file is created comprising said single hash value and one or more additional data items relating to said single hash value, and a single hash value, and a single hash value said second data file is created for storage and/or publication.

12. A method of storing and authenticating data, comprising the steps of storing copies of a plurality of data items,

generating at the end of a predetermined period of time, a data file comprising hash values of each data item created and/or signed during that time,

generating a single hash value of said data file, and

transmitting said single hash value to a remote location for storage and/or publication thereof (or of data representative thereof).

13. Apparatus for transmitting data between first and second end users via an information technology communications network,

said first end user comprising means for encrypting a data item using a first identifier and transmitting said encrypted data item to said second end user module,

said second end user comprising means for receiving said encrypted data item and transmitting an acknowledgement signal to said first end user,

said first end user further comprising means for encrypting said first identifier using a second identifier and transmitting said encrypted first identifier to said second end user in response to receipt of said acknowledgement signal,

said second end user further comprising means for requesting and receiving said second identifier in response to receipt of said encrypted first identifier,

and means for decrypting said first identifier using said second identifier and for decrypting said data item using said first identifier.

14. Apparatus for verifying by a second end user the authenticity of use of an identifier by a first end user, the apparatus comprising means for identifying the communication of a data item encrypted using or otherwise including an identifier unique to said first end user from said first end user to said second end user across an information technology communications network, means for accessing, in response to such identification, storage means containing information relating to one or more valid recent events or transactions relating to said identifier which have occurred across said information technology communications network, means for obtaining confirmation from said first end user that at least one of said recent events or transactions is valid, and means for preventing further use of said identifier in the event that such confirmation is not received.

15. A computer implemented method for verifying by a second end user the authenticity of use of an identifier by a first end user, the method comprising the steps of

identifying the communication of a data item encrypted using or otherwise including an identifier unique to said first end user from said first end user to said second end user across an information technology communications network,

accessing, in response to such identification, storage means containing information relating to one or more valid recent events or transactions relating to said identifier which have occurred across said information technology communications network,

obtaining confirmation from said first end user that at least one of said recent events or transactions is valid, preventing further use of said identifier in the event that such confirmation is not received.