Account authority digital signature (AADS) system using transactional account information

• US 7,032,112 B2
• Filed: 08/25/2004
• Issued: 04/18/2006
• Est. Priority Date: 11/09/1998
• Status: Expired due to Term

• Current Assignee: First Data Corporation (Fiserv Incorporated)
• Original Assignee: First Data Corporation (Fiserv Incorporated)
• Inventors: Wheeler, Anne M., Wheeler, Henry Lynn
• Primary Examiner(s): Zand, Kambiz
• Application Number:
  US10/711,127
• Publication Number:
  US 20050005117A1
• Time in Patent Office: 601 Days
• Field of Search: 713/172, 713/176, 713/182, 380/282, 380/285, 705/57, 705/64, 705/67
• US Class Current: 713/182
• CPC Class Codes: G06Q 20/00 Payment architectures, schemes or protocols apparatus for performing or posting payment transactions G07F7/08, G07F19/00; electronic cash registers G07G1/12
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/10 specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/3825 Use of electronic signatures
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

In a system for performing an action regarding an account in response to an electronic communication received from a sender by a receiver, wherein the electronic communication includes sender identity information associated with the account and a digital signature derived from an electronic message using a private key of a public-private key pair, and wherein the public key of the pair has been associated with the account by the receiver such that the public key is retrievable based on the sender identity information, a method of validating the identity of the sender for the electronic communication includes: (a) retrieving the public key based on the received sender identity information; and (b) comparing a function of the public key and the digital signature with a function of the electronic message. Neither a PIN nor a password is required to be transmitted to the receiver for validating the identity of the sender.

Claims

1. In a system for performing an action, in response to an electronic communication regarding an account, which electronic communication is received from a sender by a receiver, a method comprising the steps of:

(a) initially, associating by the receiver, sender identity information and a public key of a public-private key pair with the account such that the public key is retrievable based on the sender identity information, wherein the account comprises transactional account information, and wherein the public key is associated with the account in a computer database; and

thereafter

(b) receiving the electronic communication from the sender,

(i) wherein the electronic communication was created after the association of the sender identity information and the public key with the account in step (a),

(ii) wherein the electronic communication comprises,

(A) the sender identity information, and

(B) a digital signature derived from an electronic message using the private key of the pair, and

(iii) wherein the electronic communication is communicated electronically from the sender; and

(c) validating the identity of the sender for the electronic communication by only performing the steps of,

(i) utilizing the sender identity information received in the electronic communication to retrieve the public key based on the association of the sender identity information and the public key with the account performed in step (a), and

(ii) comparing a function of the public key and the digital signature with a function of the electronic message, wherein the function of the public key and the digital signature comprises decrypting the digital signature using the public key,

whereby a comparison resulting in a match validates the identity of the sender.

5. The method of claim 1, 2, 3, or 4, wherein the electronic communication includes the electronic message.

6. The method of claim 1, 2, 3, or 4, wherein the electronic message is implied from the receipt of the electronic communication.

7. The method of claim 1, 2, 3, or 4, wherein the digital signature is derived within a smart card of the sender.

8. The method of claim 1, 2, 3, or 4, wherein the digital signature is received from the sender within a terminal of a third-party and then forwarded to the receiver.

9. The method of claim 1, 2, 3, or 4, wherein the electronic communication is received over a secure network.

10. The method of claim 1, 2, 3, or 4, wherein the electronic communication is received over an insecure network.

11. The method of claim 10, wherein the network comprises the Internet.

12. The method of claim 1, 2, 3, or 4, wherein the electronic communication is received encrypted.

13. The method of claim 1, 2, 3, or 4, wherein the electronic communication is received unencrypted.

14. The method of claim 1, 2, 3, or 4, wherein the receiver is a financial institution and the action on the account comprises a financial transaction.

15. The method of claim 1, 2, 3, or 4, wherein the electronic communication includes the public key.

16. The method of claim 1, 2, or 4, wherein the sender identity information comprises the account number.

17. The method of claim 1, 2, or 4, wherein the sender identity information comprises other than the account number.

18. The method of claim 1, 2, 3, or 4, wherein the public key was associated with the account when the account was first established.

19. The method of claim 18, wherein the public key was provided by the sender to the receiver.

20. The method of claim 18, wherein the public key was provided to the sender by the receiver.

21. The method of claim 1, 2, 3, or 4, wherein the transactional account information includes information required to process the action.

22. The method of claim 1, 2, 3, or 4, wherein the transactional account information includes a personal identification number (PIN).

23. The method of claim 1, 2, 3, or 4, wherein the transactional account information includes an account balance representing funds in the account.

24. The method of claim 1, 2, 3, or 4, wherein the transactional account information includes information validated when the account was established.

25. The method of claim 1, 2, 3, or 4, wherein the transactional account information includes information that was validated in a face-to-face acknowledgement between the sender and the receiver.

26. The method of claim 1, 2, 3, or 4, wherein the account comprises a checking account.

27. The method of claim 1, 2, 3, or 4, wherein the transactional account information includes a history of ledger transactions in the account.

28. The method of claim 1, 2, 3, or 4, wherein the transactional account information includes the social security number of the sender.

29. The method of claim 1, 2, 3, or 4, wherein the transactional account information includes the address of the sender.

30. The method of claim 1, 2, 3, or 4, wherein the transactional account information includes the mother'"'"'s maiden name of the sender.

31. The method of claim 1, 2, 3, or 4, wherein the transactional account information includes entity information of the sender.

32. The method of claim 1, 2, 3, or 4, wherein the transactional account information only includes entity information of the sender.

33. The method of claim 1, 2, 3, or 4, wherein the transactional account information includes business process information.

34. The method of claim 1, 2, 3, or 4, wherein the transactional account information is stored in fields in records in a computer database.

35. The method of claim 34, wherein the records comprise an account file.

36. The method of claim 34, wherein the records further comprise a transactions file.

37. The method of claim 1, 2, 3, or 4, wherein the digital signature is derived within a hand-held device of the sender.

38. The method of claim 1, 2, 3, or 4, wherein the function of the electronic message comprises applying a hashing algorithm to the electronic message.

2. In a system for performing an action, in response to an electronic communication regarding an account, which electronic communication is received from a sender by a receiver, a method comprising the steps of:

(a) initially, associating by the receiver, sender identity information and a public key of a public-private key pair with the account such that the public key is retrievable based on the sender identity information, wherein the account comprises transactional account information,

and wherein the public key is associated with the account in a computer database; and

thereafter

(b) receiving the electronic communication from the sender,

(i) wherein the electronic communication was created after the association of the sender identity information and the public key with the account in step (a),

(ii) wherein the electronic communication comprises,

(A) the sender identity information, and

(B) a digital signature derived from an electronic message using the private key of the pair, and

(iii) wherein the electronic communication is communicated electronically from the sender; and

(c) validating the identity of the sender for the electronic communication by,

(i) utilizing the sender identity information received in the electronic communication to retrieve the public key based on the association of the sender identity information and the public key with the account performed in step (a), and

(ii) comparing a function of the public key and the digital signature with a function of the electronic message, wherein the function of the public key and the digital signature comprises decrypting the digital signature using the public key,

whereby a comparison resulting in a match validates the identity of the sender, and wherein neither a PIN nor a password is required to be transmitted to the receiver for validating the identity of the sender.

3. In a system for performing an action, in response to an electronic communication regarding an account, which electronic communication is received from a sender by a receiver, a method comprising the steps of:

(a) initially, associating by the receiver, sender identity information and a public key of a public-private key pair with the account such that the public key is retrievable based on the sender identity information, wherein the account comprises transactional account information and the sender identity information comprises other than an account number, and wherein the public key is associated with the account in a computer database; and

thereafter

(b) receiving the electronic communication from the sender,

(i) wherein the electronic communication was created after the association of the sender identity information and the public key with the account in step (a),

(ii) wherein the electronic communication comprises,

(A) the sender identity information, and

(B) a digital signature derived from an electronic message using the private key of the pair, and

(iii) wherein the electronic communication is communicated electronically from the sender; and

(c) validating the identity of the sender for the electronic communication by,

(i) utilizing the sender identity information received in the electronic communication to retrieve the public key based on the association of the sender identity information and the public key with the account performed in step (a), and

(ii) comparing a function of the public key and the digital signature with a function of the electronic message, wherein the function of the public key and the digital signature comprises decrypting the digital signature using the public key,

whereby a comparison resulting in a match validates the identity of the sender.

4. In a system for performing an action, in response to an electronic communication regarding an account, which electronic communication is received from a sender by a receiver, a method comprising the steps of:

(a) initially, associating by the receiver, sender identity information and a public key of a public-private key pair with the account such that the public key is retrievable based on the sender identity information, wherein the account comprises transactional account information, and wherein the public key is associated with the account in a computer database; and

thereafter

(b) receiving the electronic communication from the sender,

(i) wherein the electronic communication was created after the association of the sender identity information and the public key with the account in step (a),

(ii) wherein the electronic communication comprises,

(A) the sender identity information, and

(B) a digital signature derived from an electronic message using the private key of the pair,

(iii) wherein the electronic communication is communicated electronically from the sender, and

(iv) wherein the electronic communication is the only electronic communication received from the sender by the receiver relating to the action; and

(c) validating the identity of the sender for the electronic communication by,

(i) utilizing the sender identity information received in the electronic communication to retrieve the public key based on the association of the sender identity information and the public key with the account performed in step (a), and

(ii) comparing a function of the public key and the digital signature with a function of the electronic message, wherein the function of the public key and the digital signature comprises decrypting the digital signature using the public key,

whereby a comparison resulting in a match validates the identity of the sender.