Privacy and security for smartcards in a method, system and program

• US 6,802,007 B1
• Filed: 04/24/2000
• Issued: 10/05/2004
• Est. Priority Date: 04/24/2000
• Status: Expired due to Term

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Canelones, Dawn Marie, Dutta, Rabindranath, Paolini, Michael A.
• Primary Examiner(s): Smithers, Matthew
• Assistant Examiner(s): NGUYEN, MINH DIEU T
• Application Number:
  US09/556,573
• Time in Patent Office: 1,625 Days
• Field of Search: 713/172, 713/182, 713/189, 713/193, 705/67, 705/66, 705/65
• US Class Current: 713/193
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/347 Passive cards
• CPC Class Codes: G06Q 20/367 involving electronic purses or money safes
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: G07C 9/22 in combination with an identity check of the pass holder
• CPC Class Codes: G07F 7/10 together with a coded signal , e.g. in the form of personal identification information, like personal identification number [PIN] or biometric data
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: G07F 7/1075 PIN is checked remotely

Abstract

In a first embodiment, a central database accessible by registered members, including merchants, will contain all of an individual'"'"'s information while a smart card will store a unique id, known as an avatar, that may be utilized to access the information on the server. The central database is accessed through an authentication service to ensure smartcard validity. The unique identity information is retrieved by smartcard readers issued to registered members. In another embodiment, all the information concerning the individual is contained within the smart card itself. In a further embodiment, data on the smartcard and the central database is arranged in an access list with the more sensitive personal information being made available only to the smartcard readers having the highest level of access. At least two avatars, horizontal and vertical, are utilized with the horizontal avatar providing id that is changeable and the vertical avatar providing non-changeable id. Very low levels of identification are contained in memory on the smartcard.

Claims

1. A system for providing a high level of security and privacy in a smart card, comprising:

a smart card including;

storage means for storing a plurality of low level identities of card holders on said smart card and means for choosing among said low level identities to make available to specified classes of smart card readers;

a server connected to a network;

a database for maintaining identity information associated with said a smart card;

a smart card reader with an identifying code connected to said network;

decoding means in said smart card reader for reading a unique code from said smart card;

means for transmitting said unique code and said identifying code to said server;

means for comparing said unique code to said identity information in said database;

means for utilizing said unique code for requesting a specific identity level from said database on said authentication server; and

transmission means for sending information associated with said specific identity level only if said specific identity level is authorized for said requesting smart card reader.

2. The system of claim 1, further comprising:

comparison means for comparing said specific identity level requested with a level previously authorized by said smart card holder.

3. The system of claim 1, further comprising:

means for authorizing a specific level of identity available to each said class of smart card readers.

4. The system of claim 1, further comprising:

means for providing at least two identity classes of said card holder.

5. The system of claim 1, wherein providing at least two identity classes of said card holder, further comprises:

means for installing a first identity class that contains changeable identity information; and

means for installing a second identity class that contains identity information that is not changeable.

6. A portable storage device comprising:

a plurality of identity types associated with a holder of the portable storage device; and

means for restricting access to each given one of said plurality of identity types to a separate specified class of smart card readers.

7. The device of claim 6 wherein at least one of the plurality of identity types is a specific identity type from a plurality of identity levels of non-changing identity information.

8. The device of claim 7 wherein at least one of the plurality of identity types is a specific identity type from a plurality of horizontal avatars having changeable identity information.