Account-based digital signature (ABDS) system

• US 7,127,606 B2
• Filed: 03/11/2002
• Issued: 10/24/2006
• Est. Priority Date: 11/09/1998
• Status: Expired due to Term

• Current Assignee: First Data Corporation (Fiserv Incorporated)
• Original Assignee: First Data Corporation (Fiserv Incorporated)
• Inventors: Wheeler, Lynn Henry, Wheeler, Anne M.
• Primary Examiner(s): Zand, Kambiz
• Application Number:
  US10/095,367
• Publication Number:
  US 20020129248A1
• Time in Patent Office: 1,688 Days
• Field of Search: 713/176, 713/156, 705/64, 705/67, 705/75
• US Class Current: 713/156
• CPC Class Codes: G06Q 20/00 Payment architectures, schemes or protocols apparatus for performing or posting payment transactions G07F7/08, G07F19/00; electronic cash registers G07G1/12
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/0855 involving a third party
• CPC Class Codes: G06Q 20/12 specially adapted for electronic shopping systems
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/3823 combining multiple encryption tools for a transaction
• CPC Class Codes: G06Q 20/3825 Use of electronic signatures
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/388 using mutual authentication without cards, e.g. challenge-response
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: G06Q 20/403 Solvency checks
• CPC Class Codes: G06Q 20/40975 using encryption therefor
• CPC Class Codes: G06Q 40/02 Banking, e.g. interest calculation or account maintenance credit or loans G06Q40/03
• CPC Class Codes: G06Q 40/08 Insurance
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: G07F 7/1016 : Devices or methods for securing the PIN and other transaction-data, e.g. by encryption arrangements for secret communication, see H04L9/00
• CPC Class Codes: H04L 2209/56 : Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/88 : Medical equipments
• CPC Class Codes: H04L 63/0823 : using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0861 : using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/12 : Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/126 : the source of the received data
• CPC Class Codes: H04L 9/321 : involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3247 : involving digital signatures

Abstract

A method of authenticating an entity by a receiving party with respect to an electronic communication that is received by the receiving party and that includes both a unique identifier associated with an account maintained by the receiving party and a digital signature for a message regarding the account, consists of the steps of, before receipt of the electronic communication, first associating by the receiving party a public key of a public-private key pair with the unique identifier and, thereafter, only conducting message authentication using the digital signature received by the receiving party in the electronic communication and the public key associated with the account identifier.

Claims

1. A method of making a financial payment by a first party to a second party on an account of the first party maintained by a third party, information pertaining to the account of the first party being retrievable from a database of the third party based on a unique identifier for that account, the method comprising the steps of:

(a) associating by the third party a public key of a public-private key pair with the unique account identifier;

(b) digitally signing by the first party a message including an instruction to make payment to the second party on the account of the first party, the digital signature being generated with a public key of the public-private key pair;

(c) communicating by the first party the message and digital signature in a first electronic communication to the second party;

(d) communicating by the second party the message and digital signature in a second electronic communication to the third party; and

(e) upon receipt of the second electronic communication from the second party, performing by the third party entity authentication with respect to the first party, the entity authentication consisting of solely conducting message authentication using only said generated digital signature and the public key associated with the unique account identifier of the first party.

2. The method of claim 1, wherein the first and second electronic communications each includes the unique account identifier of the first party, and wherein the third party utilizes the unique account identifier received in the second electronic communication to retrieve the public key of the first party for authenticating the message of the second electronic communication.

3. The method of claim 1, wherein the unique account identifier of the first party comprises the public key of the first party.

4. The method of claim 1, wherein the public key of the first party is included in the first electronic communication.

5. The method of claim 4, wherein the public key of the first party is included in the second electronic communication.

6. The method of claim 5, wherein the second electronic communication includes a digital signature of the second party for a message of the second party.

7. The method of claim 6, wherein the message of the second party comprises instructions for making payment to the second party from the account of the first party maintained by the third party.

8. The method of claim 6, wherein the second electronic communication includes a public key of the second party that may be used to decrypt the digital signature.

9. The method of claim 1, wherein the third party makes payment to the second party on the account of the first party upon successful message authentication.

10. The method of claim 1, wherein the third party communicates an electronic communication to the second party authorizing the instructed payment to the second party on the account of the first party.

11. The method of claim 1, wherein the second party provides a service for the first party upon the learning of a successful authentication of the message by the third party.

12. The method of claim 1, wherein the second party provides a product to the first party upon the learning of a successful authentication of the message by the third party.

13. The method of claim 1, wherein the message includes an additional instruction.

14. The method of claim 13, wherein the second party executes the additional instruction upon successful execution by the third party of the instruction.

15. The method of claim 14, wherein the instruction executed by the third party comprises payment to an account of the intermediate party.

16. The method of claim 15, wherein the additional instruction is sent in another electronic communication from the first party to the second party.

17. The method of claim 15, wherein the additional instruction is included in the electronic communication sent from the first party to the second party.

18. The method of claim 17, wherein the additional instruction is removed by the second party from the electronic communication and wherein the electronic communication is then forwarded by the second party to the third party.

19. The method of claim 1, wherein the third party is a financial institution.

20. The method of claim 1, wherein the second party is a merchant.