Personal access management system

• US 5,692,049 A
• Filed: 02/13/1995
• Issued: 11/25/1997
• Est. Priority Date: 02/13/1995
• Status: Expired due to Fees

• Current Assignee: Cyphercomm Incorporated
• Original Assignee: ETA Technologies Corp.
• Inventors: Johnson, William Cedric, McMullen, Charles C.
• Primary Examiner(s): Barron, Jr., Gilberto
• Application Number:
  US08/388,279
• Time in Patent Office: 1,016 Days
• Field of Search: 380/3, 380/4, 380/23-25
• US Class Current: 713/189
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 2211/007 Encryption, En-/decode, En-/decipher, En-/decypher, Scramble, (De-)compress
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/40975 using encryption therefor
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system

Abstract

A multi-component system for linking a user to a product or service provider includes a user processing device, a storage device, and a provider device. The storage device stores provider-specific application software, user-specific data, and a file management program. The storage device and the processing device are coupled to each other to form a user device which communicates with the provider device. Under direction of the file management program, the processing device carries out a recognition methodology which determines whether the processing device and the storage device are authorized to operate with each other. This aspect of the system makes it possible to render the storage device operable only with a specific user processing device, referred to as the principal processing device. This, in turn, reduces the possibility of fraud since the storage device cannot be used without the principal processing device. Once it is determined that the processing and storage devices are authorized to interact with each other, the processing device executes the provider-specific application software to exchange information with the provider device. Together, the user and provider devices implement unique recognition and comprehension methodologies to ensure that the parties are authorized to communicate with each other and to ensure that the information exchanged cannot be understood by third parties. Overall, the system provides a highly secure mechanism for transferring information from one party to another.

Claims

1. In a system comprising an initialized storage device having a set of processed parameters stored thereon, and an uninitialized processing device, a method for initializing the processing device, comprising the steps of:

generating a master key code;

processing said set of processed parameters using said master key code to derive a set of de-processed parameters;

generating a processing device key code;

processing said set of de-processed parameters using said processing device key code to derive a new set of processed parameters; and

storing said new set of processed parameters into the processing device to initialize the processing device.

2. The method of claim 1, wherein the step of processing said set of processed parameters comprises the step of:

decrypting said set of processed parameters using said master key code as a decryption key.

3. The method of claim 1, wherein the step of processing said set of de-processed parameters comprises the step of:

encrypting said set of de-processed parameters using said processing device key code as an encryption key.

4. The method of claim 1, further comprising the step of:

storing said master key code into the processing device.

5. The method of claim 1, wherein the processing device has an identification code stored therein, and wherein said method further comprises the steps of:

processing said identification code using said master key code to derive a processed identification code; and

storing said processed identification code onto the storage device.

6. The method of claim 5, wherein the step of processing said identification code comprises the step of:

encrypting said identification code using said master key code as an encryption key.

7. In a system comprising an initialized storage device having a set of processed parameters stored thereon, and an uninitialized processing device, a method for initializing the processing device, comprising the steps of:

receiving a dynamic personal identification number (DPIN) from a user;

generating a master key code using said DPIN;

verifying that said DPIN is correct;

in response to a determination that said DPIN is correct, processing said set of processed parameters using said master key code to derive a set of de-processed parameters;

generating a processing device key code using said DPIN;

processing said set of de-processed parameters using said processing device key code to derive a new set of processed parameters; and

storing said new set of processed parameters into the processing device to initialize the processing device.

8. The method of claim 7, wherein the step of processing said set of processed parameters comprises the step of:

decrypting said set of processed parameters using said master key code as a decryption key.

9. The method of claim 7, wherein the step of processing said set of de-processed parameters comprises the step of:

encrypting said set of de-processed parameters using said processing device key code as an encryption key.

10. The method of claim 7, further comprising the step of:

storing said master key code into the processing device.

11. The method of claim 7, wherein the processing device has an identification code stored therein, and wherein said method further comprises the steps of:

processing said identification code using said master key code to derive a processed identification code; and

storing said processed identification code onto the storage device.

12. The method of claim 11, wherein the step of processing said identification code comprises the step of:

encrypting said identification code using said master key code as an encryption key.

13. The method of claim 7, wherein the step of generating said master key code comprises the steps of:

generating a master hash code using said DPIN; and

generating said master key code using said master hash code.

14. The method of claim 13, further comprising the step of:

storing said master hash code into the processing device.

15. The method of claim 13, wherein said master hash code is generated using a hashing algorithm known as the Secure Hash Algorithm (SHA).

16. The method of claim 7, wherein the step of generating said processing device key code comprises the steps of:

modifying said DPIN to derive a modified DPIN;

generating a processing device hash code using said modified DPIN; and

generating said processing device key code using said processing device hash code.

17. The method of claim 16, wherein said processing device hash code is generated using a hashing algorithm known as the Secure Hash Algorithm (SHA).

18. The method of claim 16, wherein the processing device has an identification code stored therein, and wherein the step of modifying said DPIN comprises the step of:

combining said identification code with said DPIN to derive said modified DPIN.

19. The method of claim 16, further comprising the step of:

storing said processing device hash code onto the storage device.

20. The method of claim 7, wherein the storage device further has a processed identification code and reference information stored thereon, and wherein the step of verifying said DPIN comprises the steps of:

processing said processed identification code using said master key code to derive a de-processed identification code;

generating a verification parameter using said de-processed identification code; and

comparing said verification parameter to said reference information to determine whether said DPIN is correct.

21. The method of claim 20, wherein the step of verifying said DPIN further comprises the step of:

in response to a determination that said DPIN is incorrect, terminating interaction between the processing device and the storage device.

22. The method of claim 7, wherein the storage device further has an encrypted identification code and reference information stored thereon, and wherein the step of verifying said DPIN comprises the steps of:

decrypting said encrypted identification code using said master key code as a decryption key to derive an unencrypted identification code;

generating a verification parameter using said unencrypted identification code; and

comparing said verification parameter to said reference information to determine whether said DPIN is correct.

23. The method of claim 22, wherein the step of generating said verification parameter comprises the steps of:

combining said unencrypted identification code with said DPIN to derive a modified DPIN;

generating a hash code using said modified DPIN; and

providing said hash code as said verification parameter.

24. The method of claim 23, wherein said hash code is generated using a hashing algorithm known as the Secure Hash Algorithm (SHA).

25. The method of claim 23, further comprising the step of:

in response to a determination that said DPIN is incorrect, terminating interaction between the processing device and the storage device.

26. A storage device for interacting with a processing device having a memory, said storage device comprising:

a first storage unit for storing a set of processed parameters;

means for causing the processing device to generate a master key code;

means for causing the processing device to process said set of processed parameters using said master key code to derive a set of de-processed parameters;

means for causing the processing device to generate a processing device key code;

means for causing the processing device to process said set of de-processed parameters using said processing device key code to derive a new set of processed parameters; and

means for causing the processing device to store said new set of processed parameters into the memory of the processing device to initialize the processing device.

27. The storage device of claim 26, further comprising:

means for causing the processing device to store said master key code into the memory of the processing device.

28. The storage device of claim 26, wherein the processing device has an identification code stored in the memory, and wherein said storage device further comprises:

a second storage unit;

means for causing the processing device to process said identification code using said master key code to derive a processed identification code; and

means for causing the processing device to store said processed identification code into said second storage unit.

29. A storage device for interacting with a processing device having a user interface and a memory, said storage device comprising:

a first storage unit for storing a set of processed parameters;

means for causing the processing device to receive a dynamic personal identification number (DPIN) from a user via the user interface;

means for causing the processing device to generate a master key code using said DPIN;

means for causing the processing device to verify that said DPIN is correct;

means for causing the processing device to process, in response to a determination that said DPIN is correct, said set of processed parameters using said master key code to derive a set of de-processed parameters;

means for causing the processing device to generate a processing device key code using said DPIN;

means for causing the processing device to process said set of de-processed parameters using said processing device key code to derive a new set of processed parameters; and

means for causing the processing device to store said new set of processed parameters into the memory of the processing device to initialize the processing device.

30. The storage device of claim 29, further comprising:

means for causing the processing device to store said master key code into the memory of the processing device.

31. The storage device of claim 29, wherein the processing device has an identification code stored in the memory, and wherein said storage device further comprises:

a second storage unit;

means for causing the processing device to process said identification code using said master key code to derive a processed identification code; and

means for causing the processing device to store said processed identification code into said second storage unit.

32. The storage device of claim 29, wherein said means for causing the processing device to generate said processing device key code comprises:

means for causing the processing device to modify said DPIN to derive a modified DPIN;

means for causing the processing device to generate a processing device hash code using said modified DPIN; and

means for causing the processing device to generate said processing device key code using said processing device hash code.

33. The storage device of claim 32, wherein the processing device has an identification code stored in the memory, and wherein said means for causing the processing device to modify said DPIN comprises:

means for causing the processing device to combine said identification code with said DPIN to derive said modified DPIN.

34. The storage device of claim 32, further comprising:

a second storage unit;

means for causing the processing device to store said processing device hash code into said second storage unit.

35. The storage device of claim 29, wherein said means for causing the processing device to generate said master key code comprises:

means for causing the processing device to generate a master hash code using said DPIN; and

means for causing the processing device to generate said master key code using said master hash code.

36. The storage device of claim 35, further comprising:

means for causing the processing device to store said master hash code into the memory of the processing device.

37. The storage device of claim 29, wherein said storage device further comprises a second storage unit for storing a processed identification code and reference information, and wherein said means for causing the processing device to verify said DPIN comprises:

means for causing the processing device to process said processed identification code using said master key code to derive a de-processed identification code;

means for causing the processing device to generate a verification parameter using said de-processed identification code;

means for causing the processing device to compare said verification parameter with said reference information to determine whether said DPIN is correct; and

means for causing the processing device to terminate interaction between the processing device and said storage device in response to a determination that said DPIN is incorrect.

38. The storage device of claim 29, wherein said storage device further comprises a second storage unit for storing an encrypted identification code and reference information, and wherein said means for causing the processing device to verify said DPIN comprises:

means for causing the processing device to decrypt said encrypted identification code using said master key code as a decryption key to derive an unencrypted identification code;

means for causing the processing device to combine said unencrypted identification code with said DPIN to derive a modified DPIN;

means for causing the processing device to generate a hash code using said modified DPIN;

means for causing the processing device to compare said hash code to said reference information to determine whether said DPIN is correct; and

means for causing the processing device to terminate interaction between the processing device and said storage device in response to a determination that said DPIN is incorrect.

39. A processing assembly, comprising:

a processing device comprising a processor, a memory coupled to said processor, and a storage device interface coupled to said processor for receiving one of a number of individual storage devices; and

a storage device for coupling to said storage device interface, said storage device comprising;

a first storage unit for storing a set of processed parameters;

means for causing said processor to generate a master key code;

means for causing said processor to process said set of processed parameters using said master key code to derive a set of de-processed parameters;

means for causing said processor to generate a processing device key code;

means for causing said processor to process said set of de-processed parameters using said processing device key code to derive a new set of processed parameters; and

means for causing said processor to store said new set of processed parameters into said memory to initialize said processing device.

40. The processing assembly of claim 39, wherein said processing device further comprises:

means for causing said processor to store said master key code into said memory.

41. The processing assembly of claim 39, wherein said memory has an identification code stored therein, and wherein said storage device further comprises:

a second storage unit;

means for causing said processor to process said identification code using said master key code to derive a processed identification code; and

means for causing said processor to store said processed identification code into said second storage unit.

42. A processing assembly, comprising:

a processing device comprising a processor, a memory coupled to said processor, a user interface coupled to said processor, and a storage device interface coupled to said processor for receiving one of a number of individual storage devices; and

a storage device for coupling to said storage device interface, said storage device comprising;

a first storage unit for storing a set of processed parameters;

means for causing said processor to receive a dynamic personal identification number (DPIN) from a user via said user interface;

means for causing said processor to generate a master key code using said DPIN;

means for causing said processor to verify that said DPIN is correct;

means for causing said processor to process, in response to a determination that said DPIN is correct, said set of processed parameters using said master key code to derive a set of de-processed parameters;

means for causing said processor to generate a processing device key code using said DPIN;

means for causing said processor to process said set of de-processed parameters using said processing device key code to derive a new set of processed parameters; and

means for causing said processor to store said new set of processed parameters into said memory to initialize said processing device.

43. The processing assembly of claim 42, wherein said storage device further comprises:

means for causing said processor to store said master key code into said memory.

44. The processing assembly of claim 42, wherein said memory has an identification code stored therein, and wherein said storage device further comprises:

a second storage unit;

means for causing said processor to process said identification code using said master key code to derive a processed identification code; and

means for causing said processor to store said processed identification code into said second storage unit.

45. The processing assembly of claim 42, wherein said means for causing said processor to generate said processing device key code comprises:

means for causing said processor to modify said DPIN to derive a modified DPIN;

means for causing said processor to generate a processing device hash code using said modified DPIN; and

means for causing said processor to generate said processing device key code using said processing device hash code.

46. The processing assembly of claim 45, wherein said memory has an identification code stored therein, and wherein said means for causing said processor to modify said DPIN comprises:

means for causing said processor to combine said identification code with said DPIN to derive said modified DPIN.

47. The processing assembly of claim 45, wherein said storage device further comprises:

a second storage unit;

means for causing said processor to store said processing device hash code into said second storage unit.

48. The processing assembly of claim 42, wherein said means for causing said processor to generate said master key code comprises:

means for causing said processor to generate a master hash code using said DPIN; and

means for causing said processor to generate said master key code using said master hash code.

49. The processing assembly of claim 48, wherein said storage device further comprises:

means for causing said processor to store said master hash code into said memory.

50. The processing assembly of claim 42, wherein said storage device further comprises a second, storage unit for storing a processed identification code and reference information, and wherein said means for causing said processor to verify said DPIN comprises:

means for causing said processor to process said processed identification code using said master key code to derive a de-processed identification code;

means for causing said processor to generate a verification parameter using said de-processed identification code;

means for causing said processor to compare said verification parameter to said reference information to determine whether said DPIN is correct; and

means for causing said processor to terminate interaction with said storage device in response to a determination that said DPIN is incorrect.

51. The processing assembly of claim 42, wherein said storage device further comprises a second storage unit for storing an encrypted identification code and reference information, and wherein said means for causing said processor to verify said DPIN comprises:

means for causing said processor to decrypt said encrypted identification code using said master key code as a decryption key to derive an unencrypted identification code;

means for causing said processor to combine said unencrypted identification code with said DPIN to derive a modified DPIN;

means for causing said processor to generate a hash code using said modified DPIN;

means for causing said processor to compare said hash code with said reference information to determine whether said DPIN is correct; and

means for causing said processor to terminate interaction with said storage device in response to a determination that said DPIN is incorrect.