Authorization firmware for conducting transactions with an electronic transaction system and methods therefor

• US 6,594,759 B1
• Filed: 12/29/1998
• Issued: 07/15/2003
• Est. Priority Date: 12/04/1996
• Status: Expired due to Term

• Current Assignee: ServStor Technologies, LLC (IP Investments Group LLC)
• Original Assignee: Esignx Corporation
• Inventors: Wang, Ynjiun P.
• Primary Examiner(s): Barron, Gilberto
• Assistant Examiner(s): Zand, Kambiz
• Application Number:
  US09/222,368
• Time in Patent Office: 1,659 Days
• Field of Search: 713/157, 713/150, 713/161, 713/172, 713/182, 713/184, 380/30, 380/247
• US Class Current: 713/182
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: G06Q 20/18 involving self-service terminals [SST], vending machines, kiosks or multimedia terminals
• CPC Class Codes: G06Q 20/327 Short range or proximity payments by means of M-devices
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/3415 Cards acting autonomously as pay-media
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G06Q 20/40975 using encryption therefor
• CPC Class Codes: G07F 19/20 Automatic teller machines [ATMs]
• CPC Class Codes: G07F 7/0886 the card reader being portable for interacting with a POS or ECR in realizing a payment transaction
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: G07F 7/1025 Identification of user by a PIN code
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234

Abstract

A computer configured to authenticate a user to an electronic transaction system is disclosed. The computer includes a central processing unit and electronic authorization firmware disposed within the computer and in electronic communication with the central processing unit. The electronic authorization firmware includes a non-volatile memory circuit configured to store at least one of a user private key and user identification data and a firmware identification data. The electronic authorization firmware further includes decryption logic circuitry disposed between the non-volatile memory circuit and the electronic transaction system. The decryption logic circuitry is configured to prevent unauthorized access to at least one of the user private key and the user identification data in the non-volatile memory circuit. The electronic authorization firmware also includes encryption logic circuit coupled to the electronic transaction system and configured to transmit digital data encrypted using the user private key for transmission to the electronic transaction system. The digital data authenticates the user to the electronic transaction system, wherein the non-volatile memory is inaccessible by the central processing unit without traversing the decryption logic circuitry.

Claims

1. A computer configured to signal approval of an electronic transaction request to an electronic transaction system remote from the computer, comprising:

a central processing unit;

electronic authorization firmware embedded either on a computer'"'"'s motherboard or on a plug-in board that physically plugs into a computer'"'"'s motherboard such that it is located in the secure confines of the enclosure of the computer and in electronic communication with said central processing unit, said electronic authorization firmware including;

a memory circuit configured to store a user private key, and at least one of user identification data or firmware identification data, and

encryption logic circuit coupled to said electronic transaction system, said encryption logic circuit configured to approve a transaction request by encrypting said transaction request using said user private key, said encrypted transaction request signifying the transaction approval to said electronic transaction system.

2. The computer of claim 1 wherein said electronic authorization firmware is embedded on a chipset of said computer.

3. The computer of claim 1 wherein said user private key can be written into said memory circuit after it is decrypted from data that is encrypted using an issuer private key of an issuer of said electronic authorization firmware.

4. The computer of claim 3 wherein at least one of a user identification data or a firmware identification data can be written into said memory circuit after it is decrypted from data that is encrypted using an issuer private key of an issuer of said electronic authorization firmware.

5. The computer of claim 1 wherein said private user key is not transmitted from said electronic authorization firmware during said encryption of said transaction.

6. The computer of claim 1 wherein said user identification data is not transmitted from said electronic authorization firmware during said encryption of said transaction without being encrypted by said user private key.

7. The computer of claim 1 further including means for erasing said at least one of said user private key and said user identification data if said electronic authorization firmware is tampered with.

8. The electronic authorization firmware of claim 1 wherein said transaction request is initiated by said electronic transaction system.

9. The electronic authorization firmware of claim 1 wherein the firmware identification data is digitally signed by at least one of the issuer private key and a manufacturer private key.

10. A method for configuring electronic authorization firmware according to claim 1 to authenticate, in a secure manner, a user to an electronic transaction system, comprising:

receiving at said electronic authorization firmware a first signal requesting configuration;

generating, using a key generation logic within said electronic authorization firmware, a user private key and a user public key;

storing said user private key at a non-volatile memory circuit within said electronic authorization firmware; and

outputting said user public key, thereby permitting said electronic transaction system to decrypt digital data previously encrypted with said user private key by said electronic authorization firmware.

11. The method of claim 10 wherein said user private key exists only in said non-volatile memory circuit of said electronic authorization firmware, said user private key is not transmitted from said electronic authorization firmware during said configuring or subsequent authenticating.

12. The method of claim 10 further comprising erasing said user private key if said electronic authorization firmware is tampered with.

13. The method of claim 10 further comprising erasing said user identification data if said electronic authorization firmware is tampered with.

14. The method of claim 10 wherein said electronic authorization firmware is embedded on a motherboard of a computer.

15. The method of claim 10 wherein said electronic authorization firmware is embedded on a plug-in board that is designed to plug into a motherboard of a computer.

16. The method of claim 10 wherein said electronic authorization firmware is embedded on a Chipset of a computer.

17. The computer of claim 1 wherein decryption logic circuitry is disposed between said memory circuit and said electronic transaction system, said decryption logic circuitry being configured to prevent unauthorized access to said at least one of said user private key and said user identification data in said memory circuit;

wherein said encryption logic circuit is configured to transmit digital data encrypted using said user private key for transmission to said electronic transaction system, said digital data authenticating said user to said electronic transaction system,

and wherein said memory circuit is inaccessible by said central processing unit without traversing said decryption logic circuitry.

18. The computer of claim 17 wherein said memory circuit can be accessed only through said decryption logic circuitry.

19. The computer of claim 17 wherein said memory circuit is inaccessible from said central processing unit without traversing said decryption logic circuitry.

20. The computer of claim 1 wherein the memory is non-volatile.

21. The computer of claim 1 wherein the memory stores at least one of the user private key, user identification data and firmware identification data.

22. An electronic authorization firmware configured to be embedded in a computer, said electronic authorization firmware being configured to authenticate a user of said computer to an electronic transaction system, comprising:

a non-volatile memory circuit, embedded either on a computer'"'"'s motherboard or on a plug-in board that physically plugs into a computer'"'"'s motherboard such that it is located in the secure confines of the enclosure of the computer, configured to store at least one of a user private key and user identification data and firmware identification data;

decryption logic circuitry, embedded either on a computer'"'"'s motherboard or on a plug-in board that physically plugs into a computer'"'"'s motherboard such that it is located in the secure confines of the enclosure of the computer, disposed between said non-volatile memory circuit and said electronic transaction system, said decryption logic circuitry being configured to prevent unauthorized access to said at least one of said user private key and aid user identification data and firmware identification data in said non-volatile memory circuit, and

encryption logic circuit, embedded either on a computer'"'"'s motherboard or on a plug-in board that physically plugs into a computer'"'"'s motherboard such that it is located in the secure confines of the enclosure of the computer, coupled to said electronic transaction system, said encryption logic circuit configured to transmit digital data encrypted using said user private key for transmission to said electronic transaction system, said digital data authenticating said user to said electronic transaction system.

23. The electronic authorization firmware of claim 22 further comprising a random number generator coupled to receive a request by said computer to generate a random seed number, said random number generator being configured to generate said random seed number upon said request.

24. The electronic authorization firmware of claim 23 wherein said random seed number is sampled from data pertaining to at least one of bus utilization, chipset data traffic, firmware temperature, power variation, and current time.

25. The electronic authorization firmware of claim 22 further comprising key generation logic coupled to said non-volatile memory and said decryption logic, said decryption logic, said decryption logic being configured to prevent unauthorized access to said key generation logic, said key generation logic being configured to generate said user private key within said electronic authorization firmware upon request by said computer.