Methods and systems for proofing identities using a certificate authority

• US 7,802,093 B2
• Filed: 07/18/2008
• Issued: 09/21/2010
• Est. Priority Date: 03/17/2000
• Status: Expired due to Term

• Current Assignee: United States Postal Service (Government of the United States of America)
• Original Assignee: United States Postal Service (Government of the United States of America)
• Inventors: Campbell, Leo J., Cook, Jon L.
• Primary Examiner(s): Truong; Thanhnga B
• Application Number:
  US12/219,269
• Publication Number:
  US 20090031127A1
• Time in Patent Office: 795 Days
• Field of Search: 713/156, 713/157, 713/173, 713/175, 705/39, 705/44
• US Class Current: 713/156
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/10 specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
• CPC Class Codes: G06Q 20/102 Bill distribution or payments
• CPC Class Codes: G06Q 20/14 specially adapted for billing systems
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: G06Q 30/0601 Electronic shopping [e-shopping]
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 51/214 using selective forwarding
• CPC Class Codes: H04L 51/222 using geographical location information, e.g. messages transmitted or received in proximity of a certain spot or area
• CPC Class Codes: H04L 51/48 Message addressing, e.g. address format or anonymous messages, aliases
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/1408 : by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 67/306 : User profiles
• CPC Class Codes: H04L 69/329 : in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 : Network security protocols

Abstract

A digital certificate is provided to a customer having an electronic account linked to the customer'"'"'s physical address. Using the digital certificate, the customer performs electronic transactions with a third party. A proofing workstation receives a request from a third party to validate the digital certificate. The proofing workstation communicates with a proofing server that maintains a list of valid certificates and a list of revoked certificates. The proofing server sends a response to the proofing workstation, where it is received by the third party.

Claims

1. A method for issuing a digital certificate to a user having an electronic account on a network, comprising the steps of:

receiving, at a proofing server, a request for a digital certificate from the user with the electronic account;

sending, by the proofing server, user information to a proofing workstation via the network;

generating, by the proofing server, the digital certificate for the user;

setting, by the proofing server, a status of the digital certificate to hold;

receiving, by the proofing server, an identification verification from the proofing workstation when the identity of the user has been verified in person at the proofing workstation based on an identification verification form previously sent to a physical address of the user;

setting by the proofing server the status of the digital certificate to active in response to the in person identification verification; and

storing at the proofing workstation, the digital certificate in the electronic account of the user.

2. The method of claim 1, further comprising the step of:

storing a reference to the digital certificate in a certificate directory at the proofing server.

3. The method of claim 1, further comprising the step of:

setting the status of the digital certificate to revoked.

4. The method of claim 3, further comprising the step of:

storing a reference to the digital certificate in a certificate revocation list at the proofing server.

5. The method of claim 1, further comprising the step of:

receiving a private key from the proofing workstation, when the identity of the user is verified in person.

6. The method of claim 5, further comprising the step of:

verifying the private key before setting the status of the digital certificate to active.

7. The method of claim 1, wherein the proofing server is a United States Postal Service proofing server.

8. A system for issuing a digital certificate to a user having an electronic account on a network, comprising:

a request receiving component configured to receive, at a proofing server, a request for a digital certificate from the user with the electronic account;

a user information sending component configured to send by the proofing server user information to a proofing workstation via the network;

a certificate generating component configured to generate the digital certificate for the user;

a hold setting component configured to set, by the proofing server, a status of the digital certificate to hold;

a verification receiving component configured to receive, by the proofing server, an identification verification from the proofing workstation when the identity of the user has been verified in person at the proofing workstation based on an identification verification form previously sent to a physical address of the user;

an active setting component configured to set by the proofing server the status of the digital certificate to active in response to the in person identification verification; and

a storing component configured to store at the proofing server the digital certificate in the electronic account of the user.

9. The system of claim 8, further comprising:

a reference storing component configured to store a reference to the digital certificate in a certificate directory at the proofing server.

10. The system of claim 8, further comprising:

a revoked setting component configured to set the status of the digital certificate to revoked.

11. The system of claim 10, further comprising:

a revoked storing component configured to store a reference to the digital certificate in a certificate revocation list at the proofing server.

12. The system of claim 8, further comprising:

a key receiving component configured to receive a private key from the proofing workstation, when the identity of the user is verified in person.

13. The system of claim 12, further comprising:

a key verifying component configured to verify the private key before setting the status of the digital certificate to active.

14. The system of claim 8, wherein the proofing server is a United States Postal Service proofing server.

15. A computer readable medium having computer readable code embodied therein for issuing a digital certificate to a user having an electronic account on a network, the computer readable code comprising:

a request receiving module configured to receive, at a proofing server, a request for a digital certificate from the user with the electronic account;

a user information sending module configured to send by the proofing server user information to a proofing workstation via the network;

a generating module configured to generate the digital certificate for the user;

a hold setting module configured to set, by the proofing server, a status of the digital certificate to hold;

a verification receiving module configured to receive, by the proofing server, an identification verification from a proofing workstation when the identity of the user has been verified in person at the proofing workstation based on an identification verification form previously sent to a physical address of the user;

an active setting module configured to set by the proofing server the status of the digital certificate to active in response to the in person identification verification; and

a storing module configured to store at the proofing server the digital certificate in the electronic account of the user.

16. A system for issuing a digital certificate to a user having an electronic account on a network, comprising:

means for receiving a request for a digital certificate from the user with the electronic account;

means for sending user information to a proofing workstation;

means for generating the digital certificate for the user;

means for setting a status of the digital certificate to hold;

means for receiving an identification verification from the proofing workstation when the identity of the user has been verified in person at the proofing workstation based on an identification verification form previously sent to a physical address of the user;

means for setting the status of the digital certificate to active in response to the in person identification verification; and

means for storing the digital certificate in the electronic account of the user.