Methods for operating infrastructure and applications for cryptographically-supported services

• US 7,184,988 B1
• Filed: 01/27/2000
• Issued: 02/27/2007
• Est. Priority Date: 01/28/1999
• Status: Expired due to Fees

• Current Assignee: Certco
• Original Assignee: Certco
• Inventors: Frankel, Yair, MONTGOMERY, CHARLES T., Stubblebine, Stuart, Yung, Marcel M.
• Primary Examiner(s): Reagan, James A
• Application Number:
  US09/492,534
• Time in Patent Office: 2,588 Days
• Field of Search: 705/1, 705/26, 705/53, 705/67, 709/203, 709/217, 709223-229, 707/10, 370/469, 370/352, 370/235
• US Class Current: 705/67
• CPC Class Codes: G06Q 20/00 Payment architectures, schemes or protocols apparatus for performing or posting payment transactions G07F7/08, G07F19/00; electronic cash registers G07G1/12
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: G06Q 20/10 specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G06Q 30/018 Certifying business or products

Abstract

In an infrastructure in which some of a plurality of entities provide cryptographically supported services, a method of registering a subscriber entity of a plurality of entities at a principal entity of a plurality of entities, the method comprising the subscriber entity requesting service from the principal entity by sending a request message to a registrar entity of the plurality of entities; the registrar entity verifying the subscriber entity and forwarding the request for service to the principal entity; the principal entity storing the forwarded request and transmitting an acknowledgement message to the registrar entity, the acknowledgement stating acceptance and authentication/authorization information that the subscriber entity requires for the requested service; and the registrar entity verifying the authenticity of the received acknowledgement message, and, if correct, forwarding the acknowledgement message to the subscriber entity.

Claims

1. In an infrastructure in which some of a plurality of entities provide cryptographically supported services, a method of registering a subscriber entity of a plurality of entities at a principal entity of a plurality of entities, the method comprising:

the subscriber entity requesting service from the principal entity by sending a request message to a registrar entity of the plurality of entities;

the registrar entity verifying the subscriber entity and forwarding the request for service to the principal entity;

the principal entity storing the forwarded request and transmitting an acknowledgement message to the registrar entity, the acknowledgement stating acceptance and authentication/authorization information that the subscriber entity requires to obtain or access the requested service; and

the registrar entity verifying the authenticity of the received acknowledgement message, and, if correct, forwarding the acknowledgement message to the subscriber entity,

wherein the request message contains an indication of a type of service requested by the subscriber entity and contains one or more selected from the following;

(a) a unique reference to the subscriber entity;

(b) attributes about the subscriber entity;

(c) authentication information to be used to authenticate use of the service;

(d) transactional verification information;

(e) a representation by the subscriber entity agreeing to what the subscriber entity accepts;

(f) a preferred service relationship;

or

(g) a subscriber entity'"'"'s authenticator.

2. A method as in claim 1 wherein the unique reference to the subscriber entity is at least one selected from (a) the subscriber entity'"'"'s identity, (b) a pseudonym for one-time service, or (c) a pseudonym for continued use of the service.

3. A method as in claim 1 wherein a session identifier links future responses to this particular request.

4. A method as in claim 1 wherein the attributes about the subscriber entity include:

(a) a self-representation; and

(b) a third-party representation asserting attributes.

5. A method as in claim 4 wherein said representation and attribute include at least some selected from:

(a) an address;

(b) employment information;

(c) information from one or more other entities needed for service provisioning;

or

(d) an authorization from another party.

6. A method as in claim 1 further comprising:

modifying the registration of the subscriber entity at the principal entity.

7. A method as in claim 6 wherein modification is supervised by one or more authorities.

8. A method as in claim 6 wherein registration modification transactions involve managing capabilities.

9. A method as in claim 6 wherein registration modification transactions involve cryptographic key management.

10. A method as in claim 1 further comprising:

moving the registration for service from the principal entity to another entity of said plurality of entities.

11. A method as in claim 10 wherein moving of services is supervised by one or more authorities.

12. A method as in claim 1 wherein the service includes:

operating a cryptographically-supported transaction involving the subscriber entity, the principal entity and possibly one or more additional entities.

13. A method as in claim 1 wherein the subscriber entity comprises a plurality of elements.

14. A method as in claim 13 wherein the plurality of elements are associated with an entity.

15. A method as in claim 1 wherein said service is a subset of a totality of services.

16. A method as in claim 15 wherein another subset of the totality of services to the subscriber entity is provided by an entity different from the principal entity.

17. A method as in claim 1 wherein said service is a warranty service.

18. A method as in claim 16 wherein the subscriber entity can modify the subset of totality of services between entities.

19. A method as in claim 17 wherein said warranty service involves correctness of representation of information.

20. A method as in claim 19 wherein said representation of information is at least one selected from:

(a) identity information, (b) financial information;

or (c) information derived from provision of service within said infrastructure.

21. A method as in claim 17 wherein the infrastructure includes a mechanism to initiate claims against failed warranty.

22. A method as in claim 1 wherein provision of service may involve an additional entity from said plurality of entities.

23. A method as in claim 22 wherein provision of service is split between said principal entity and said additional entity.

24. A method as in claim 1 wherein provision of service by said principal entity on behalf of said subscriber entity is given by said operating infrastructure to an entity within said plurality of entities.

25. A method as in claim 1 wherein said provision of service by said principal entity involves other entities within said plurality of entities.

26. A method as in claim 1 wherein provision of service involves control of access.

27. A method as in claim 1 wherein at least one of said plurality of entities is an enterprise.

28. A method as in claim 1 wherein at least one of said plurality of entities is a financial institute.

29. A method as in claim 1 wherein said principal entity is a group of elementary entities.

30. A method as in claim 1 wherein provision of service by said principal entity is directed by said subscriber entity.

31. A method as in claim 1 further comprising:

providing, by the principal entity, at least one of a set of various service transactions to the subscriber entity.

32. A method as in claim 31 wherein said providing involves the certification of digital identities.

33. A method as in claim 31 wherein at least one of said service transactions involves assuring an entity'"'"'s state.

34. A method as in claim 31 wherein at least one of said service transactions involves assuring financial information.

35. A method as in claim 31 wherein at least one of said service transactions involves assurance of identity and assurance of entity'"'"'s state.

36. A method as in claim 1 wherein some of said plurality of entities are supervised by one or more other entities in at least one transaction.

37. A method as in claim 1, wherein service involves a fee based on a service agreement and contract.

38. A method as in claim 1, wherein added management and one or more additional entities assure integrity of transactions within the infrastructure.

39. A method as in claim 38 wherein integrity of the management function is enhanced by providing two or more independent reports.

40. A method as in claim 38 wherein the management function controls actions of assurance offering entities on a per transaction basis.

41. In an infrastructure in which some of a plurality of entities provide cryptographically supported services, a method of registering a subscriber entity of a plurality of entities at a principal entity of a plurality of entities, the method comprising:

a registrar entity of the plurality of entities receiving a request message from the subscriber entity requesting service from the principal entity;

the registrar entity verifying the subscriber entity and forwarding the request for service to the principal entity for storage by the principal entity; and

the registrar entity receiving from the principal entity an acknowledgement message, the acknowledgement stating acceptance and authentication/authorization information that the subscriber entity requires to obtain or access the requested service, verifying the authenticity of the received acknowledgement message, and, if correct, forwarding the acknowledgement message to the subscriber entity,

wherein the request message contains an indication of a type of service requested by the subscriber entity and contains one or more selected from the following;

(a) a unique reference to the subscriber entity;

(b) attributes about the subscriber entity;

(c) authentication information to be used to authenticate use of the service;

(d) transactional verification information;

(e) a representation by the subscriber entity agreeing to what the subscriber entity accepts;

(f) a preferred service relationship;

or

(g) a subscriber entity'"'"'s authenticator.

42. A method as in claim 41, wherein the service includes:

operating a cryptographically-supported transaction involving the subscriber entity, the principal entity and possibly one or more additional entities.

43. A method as in claim 41, further comprising:

moving the registration for service from the principal entity to another entity of said plurality of entities.

44. In an infrastructure in which some of a plurality of entities provide cryptographically supported services, a method of registering a subscriber entity of a plurality of entities at a principal entity of a plurality of entities, the method comprising:

the principal entity receiving from a registrar entity of the plurality of entities a forwarded request message by the subscriber entity for service from the principal entity, the request for service sent to the registrar entity by the subscriber entity and the subscriber entity being verified by the registrar entity; and

the principal entity storing the forwarded request message and transmitting an acknowledgement message, the acknowledgement stating acceptance and authentication/authorization information that the subscriber entity requires to obtain or access the requested service, to the registrar entity for verification by the registrar entity of the authenticity of the received acknowledgement message, and, if correct, forwarding the acknowledgement message by the registrar entity to the subscriber entity,

wherein the forwarded request message contains an indication of a type of service requested by the subscriber entity and contains one or more selected from the following;

(a) a unique reference to the subscriber entity;

(b) attributes about the subscriber entity;

(c) authentication information to be used to authenticate use of the service;

(d) transactional verification information;

(e) a representation by the subscriber entity agreeing to what the subscriber entity accepts;

(f) a preferred service relationship;

or

(g) a subscriber entity'"'"'s authenticator.

45. A method as in claim 44, wherein the service includes:

operating a cryptographically-supported transaction involving the subscriber entity, the principal entity and possibly one or more additional entities.

46. A method as in claim 44, further comprising:

moving the registration for service from the principal entity to another entity of said plurality of entities.