Telephone tone security device

• US 5,818,937 A
• Filed: 08/12/1996
• Issued: 10/06/1998
• Est. Priority Date: 08/12/1996
• Status: Expired due to Term

• Current Assignee: NCR Corporation
• Original Assignee: NCR Corporation
• Inventors: Watson, Gary E.
• Primary Examiner(s): Gregory, Bernarr E.
• Application Number:
  US08/695,464
• Time in Patent Office: 785 Days
• Field of Search: 380/9, 380/21, 380/23, 380/24, 380/25, 380/30, 380/49, 380/50, 380/59
• US Class Current: 713/184
• CPC Class Codes: G06Q 20/108 Remote banking, e.g. home banking
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083

Abstract

An encryption device. A user wishes to identify himself to a remote party, over a telephone line. The remote party provides a Transaction Number, TN, to the user. The TN is given to the encryption device. The user gives the encryption device a Personal Identification Number, PIN. The encryption device generates a random number, combines it with the PIN and TN, to form an Authorization Number, AN, and encrypts the AN into cypher text. The cypher text is transmitted to the remote party, together with the user'"'"'s name. The remote party de-crypts the cypher text, to obtain the TN and PIN. Using the name received from the user, and a table of names, and their associated PINs, the remote party verifies whether the PIN obtained from the AN matches the PIN assigned to the name given by the user. If so, the user'"'"'s identity is considered verified, but without requirement that the user disclose a PIN, in plain text form, over a telephone.

Claims

1. An encryption device, comprising:

a) storage means containing a first, public, key;

b) means for accepting a personal identification number (PIN) from a user;

c) means for encrypting the PIN, using the first key; and

d) means for transmitting the encrypted PIN to a receiver, located outside the device.

2. Device according to claim 1, and further comprising means for loading additional keys into the storage means.

3. Device according to claim 2, in which said means for loading comprises a bar code reader.

4. Device according to claim 1, in which said means for transmitting uses Dual-Tone Multi-Frequency signals.

5. Device according to claim 1, in which said means for transmitting comprises a telephone modem.

6. Device according to claim 1, and further comprising:

e) means for receiving a transaction number from a remote party, by telephone.

7. Device according to claim 6, in which the means for encrypting encrypts the transaction number.

8. Device according to claim 1, and further comprising:

e) display means for displaying information entered by the user.

9. A method of verifying identity of a person, comprising the following steps:

a) receiving cyphertext and a name from the person;

b) deriving a derived PIN from the cypher text;

c) maintaining a table which indicates PINs which are assigned to respective names;

d) ascertaining an assigned PIN which is associated with said name; and

e) determining whether the derived PIN matches the assigned PIN.

10. In a transaction wherein a remote party makes contact with a person who wishes to verify identity of said remote party, the improvement comprising the following steps:

a) after said contact is made, making available multiple publicly available keys to the remote party;

b) accepting information from the remote party which selects a public key from the multiple keys; and

c) transmitting the selected key to the remote party.

11. An encryption apparatus, comprising:

a) first means for accepting a Transaction Number, TN, and a Personal Identification Number, PIN, from a user;

b) second means for

i) generating a random number;

ii) combining the random number with the TN and PIN, to form an Authorization Number, AN;

iii) encrypting the AN into cyphertext; and

c) third means, for making the cypher text available outside the encryption apparatus.

12. Apparatus according to claim 11, in which the first means comprises:

i) a keypad for accepting the PIN.

13. Apparatus according to claim 11, in which the first means further comprises:

ii) means for accepting the TN from a telephone.

14. Apparatus according to claim 11, in which the third means comprises a visual display.

15. Apparatus according to claim 11, in which the third means comprises means for transmitting the cyphertext by telephone.

16. A device for connection to a telephone which communicates on a telephone line, comprising:

a) first means for accepting numbers from a keypad, which are keyed in by a user;

b) second means for encrypting said numbers into cyphertext;

c) third means for transmitting said cyphertext on said telephone line and

d) connection means for connecting to said telephone line, while allowing normal operation of said telephone.

17. Device according to claim 16, and further comprising

d) means for generating multiple random numbers which are used as padding with said numbers,

and in which the second means encrypts both the numbers and padding.

18. Device according to claim 16, and further comprising:

a) a public encryption key, stored within the device.

19. Device according to claim 16, in which no secret passwords or keys are permanently stored.

20. Device according to claim 16, in which all passwords and all keys permanently stored therein are publicly available.