Managing database for identifying to recipients security features of devices generating digital signatures

• US 7,028,185 B2
• Filed: 02/01/2003
• Issued: 04/11/2006
• Est. Priority Date: 08/04/2000
• Status: Expired due to Term

• Current Assignee: First Data Corporation (Fiserv Incorporated)
• Original Assignee: First Data Corporation (Fiserv Incorporated)
• Inventors: Wheeler, Lynn Henry, Wheeler, Anne M.
• Primary Examiner(s): Zand, Kambiz
• Application Number:
  US10/248,624
• Publication Number:
  US 20030097570A1
• Time in Patent Office: 1,165 Days
• Field of Search: 713/170, 713/176, 713/200, 713/189, 713/193, 380/282, 380/285, 705/64, 705/68, 705/71, 708/135, 710/36, 711/150, 711/163, 709/229
• US Class Current: 713/170
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06Q 20/00 Payment architectures, schemes or protocols apparatus for performing or posting payment transactions G07F7/08, G07F19/00; electronic cash registers G07G1/12
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/0855 involving a third party
• CPC Class Codes: G06Q 20/12 specially adapted for electronic shopping systems
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/3558 Preliminary personalisation for transfer to user
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/3676 Balancing accounts
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 20/3823 combining multiple encryption tools for a transaction
• CPC Class Codes: G06Q 20/3825 Use of electronic signatures
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/388 using mutual authentication without cards, e.g. challenge-response
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: G06Q 20/403 : Solvency checks
• CPC Class Codes: G06Q 20/40975 : using encryption therefor
• CPC Class Codes: G06Q 50/188 : Electronic negotiation
• CPC Class Codes: G07F 7/0886 : the card reader being portable for interacting with a POS or ECR in realizing a payment transaction
• CPC Class Codes: G07F 7/1008 : Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: G07F 7/1016 : Devices or methods for securing the PIN and other transaction-data, e.g. by encryption arrangements for secret communication, see H04L9/00
• CPC Class Codes: H04L 2209/42 : Anonymization, e.g. involving pseudonyms
• CPC Class Codes: H04L 2209/56 : Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 63/0428 : wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0442 : wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/062 : for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0823 : using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 : using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/12 : Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 9/321 : involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3247 : involving digital signatures

Abstract

Managing a database for identification of security features of a device that generates digital signatures includes (a) recording in the database for each of a plurality of devices, (i) a public key of a pair of public-private keys of the device, and (ii) information including security features of the device, the security features being associated with the public key in the database, and (b) identifying security features from the database to a recipient of an electronic message for which a digital signature was originated utilizing a private key of the public-private key pair of a particular one of the devices, the security features being for the particular device.

Claims

1. A method of managing a database by a first party for identification of security features of a device that generates digital signatures, the database existing outside of the device, comprising the steps of:

(a) recording in the database for each of a plurality of devices,

(i) a public key of a public-private key pair of the device, the private key being stored only within the device, and

(ii) information including security features of the device, the security features being associated with the public key in the database, the security features including security characteristics of the device that safeguard against discovery of the private key stored within the device and/or authentication capabilities of the device that safeguard against unauthorized use of the device in generating a digital signature; and

(b) identifying by the first party, without use of a digital certificate, security features from the database to a second party recipient of an electronic message for which a digital signature was originated utilizing a private key of the public-private key pair of a particular one of the devices, the security features being for the particular device.

2. The method of claim 1, further comprising gauging the risk that the digital signature was fraudulently originated based on said identified security characteristics of the particular device in step (b).

3. The method of claim 1, wherein the public key used to authenticate the electronic message is received with the digital signature.

4. The method of claim 1, wherein the public key, with which the security features are associated in the database for the particular device in step (b), is included in the message.

5. The method of claim 1, wherein the information of the particular device in step (b) includes a name of a holder of an account, which account is managed by the recipient of the electronic message.

6. The method of claim 1, wherein the information of the particular device in step (b) includes an address of a holder of an account, which account is managed by the recipient of the electronic message.

7. The method of claim 1, wherein the information of the particular device in step (b) includes a social security number of a holder of an account, which account is managed by the recipient of the electronic message.

8. The method of claim 1, wherein the information of the particular device in step (b) includes a tax identification number of a holder of an account, which account is managed by the recipient of the electronic message.

9. The method of claim 1, wherein the information of the particular device in step (b) includes an account number of an account that is managed by the recipient of the electronic message.

10. The method of claim 1, wherein the information of the particular device in step (b) includes a list of accounts of an account holder, at least one of which is managed by the recipient of the electronic message.

11. The method of claim 1, wherein the security characteristics for each respective device are indexed in the database to that device'"'"'s public key.

12. The method of claim 1, wherein the security characteristics for each respective device are indexed in the database to a unique identifier.

13. A method of managing a database for identification of security features of a device that generates digital signatures, the database existing outside of the device, comprising the steps of:

(a) recording in the database for each of a plurality of devices,

(i) a public key of a public-private key pair of the device, the private key being stored within the device and not accessible from the device, and

(ii) information including security features of the device, the security features being associated with the public key in the database, the security features including security characteristics of the device that safeguard against discovery of the private key stored within the device and/or authentication capabilities of the device safeguard against unauthorized use of the device in generating a digital signature; and

(b) identifying security features from the database by a recipient of an electronic message for which a digital signature was originated utilizing a private key of the public-private key pair of a particular one of the devices, the security features being for the particular device.

14. The method of claim 13, wherein the database is managed by the recipient of the electronic message in step (b).

15. The method of claim 14, further comprising managing an account database by the recipient of the electronic message in step (b), and wherein the electronic message pertains to one of the accounts recorded in the account database.

16. The method of claim 13, wherein the database comprises an account database that is managed by the recipient of the electronic message in step (b), and wherein the electronic message pertains to one of the accounts recorded in the account database.

17. The method of claim 13, wherein the information of the particular device in step (b) includes a current balance for the account.

18. The method of claim 13, wherein the information of the particular device in step (b) includes an available credit for the account.

19. A method of managing a database by a first party for identification of security features of devices that generate digital signatures, the database existing outside of the devices, comprising the steps of:

(a) recording in the database for each of a plurality of devices,

(i) a public key of a public-private key pair of the device, the private key being stored within the device, and

(ii) information including security features of the device, the security features being associated with the public key in the database, the security features including security characteristics of the device that safeguard against discovery of the private key stored within the device and/or authentication capabilities of the device that safeguard against unauthorized use of the device in generating a digital signature; and

(b) identifying security features, without use of a digital certificate, by,

(i) identifying by the first party security features from the database to a second party recipient of an electronic message for which a digital signature was originated utilizing a private key of the public-private key pair of a particular one of the devices, the security features being for the particular one of the devices; and

(ii) identifying by the first party security features from the database to a third party recipient of an electronic message for which a digital signature was originated utilizing a private key of the public-private key pair of another particular one of the devices, the security features being for this other particular one of the devices.

20. The method of claim 19, wherein the second party recipient manages an account to which pertains the electronic message received by the second party recipient, and wherein the third party recipient manages another account to which pertains the electronic message received by the third party recipient.