Universal secure registry

• US 7,805,372 B2
• Filed: 06/08/2007
• Issued: 09/28/2010
• Est. Priority Date: 02/21/2006
• Status: Expired due to Fees

• Current Assignee: Universal Secure Registry LLC
• Original Assignee: Kenneth P. Weiss
• Inventors: Weiss, Kenneth P.
• Primary Examiner(s): Augustin; Evens J
• Assistant Examiner(s): Cheung; Calvin K
• Application Number:
  US11/760,729
• Publication Number:
  US 20070289000A1
• Time in Patent Office: 1,208 Days
• Field of Search: 705/51, 726 4- 5, 726/8
• US Class Current: 705/51
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G06Q 20/3676 Balancing accounts
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: G06Q 40/02 Banking, e.g. interest calculation or account maintenance credit or loans G06Q40/03
• CPC Class Codes: G07C 9/257 electronically G07C9/26 takes precedence
• CPC Class Codes: G07C 9/26 using a biometric sensor integrated in the pass
• CPC Class Codes: G07C 9/27 with central registration
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04L 63/08 : for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 : using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0853 : using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0861 : using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/10 : for controlling access to devices or network resources
• CPC Class Codes: H04L 9/0891 : Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/3231 : Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3247 : involving digital signatures
• CPC Class Codes: H04L 9/3271 : using challenge-response
• CPC Class Codes: H04W 12/03 : Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 12/06 : Authentication

Abstract

A method and system for controlling access to a plurality of secure computer networks using a secure registry system is disclosed. The secure registry system includes a database containing selected data of a plurality of users each authorized to access at least one of the plurality of secure computer networks. The method and system facilitate receiving authentication information from an entity at a secure computer network, communicating the authentication information to the secure registry system, validating the authentication information at the secure registry system, receiving from the secure registry system an indication of whether the entity is authorized to access the secure computer network, and granting the entity access to the secure computer network when the authentication information of the entity corresponds to one of the plurality of users.

Claims

1. A method of controlling access to a plurality of secure computer networks, the method comprising:

using a secure registry system located remotely from the secure computer networks to control access to the plurality of secure computer networks, the secure computer networks including a first secure computer network and a second secure computer network, the secure registry system including;

a database containing selected data of a plurality of users each authorized to access at least one of the plurality of secure computer networks;

receiving first authentication information including a first non-predictable code at the secure registry system, the first authentication information provided by a first entity to the first secure computer network, the first authentication information generated with a first electronic ID device possessed by the first entity;

validating the first authentication information at the secure registry system, at least in part, by comparing the first non-predictable code to authentication information included in the database to determine whether the first non-predictable code corresponds to any of the plurality of users;

communicating from the secure registry system to the first secure computer network an indication of whether the first entity is authorized to access the first secure computer network, based on the validation, whereby the first entity is granted access to the first secure computer network where the first authentication information corresponds to a first one of the plurality of users and the first entity is denied access to the first secure computer network where the first authentication information does not correspond to any of the plurality of users;

receiving second authentication information including a second non-predictable code at the secure registry system, the second authentication information provided by a second entity to the second secure computer network, the second authentication information generated with a second electronic ID device possessed by the second entity;

validating the second authentication information at the secure registry system, at least in part, by comparing the second non-predictable code to the authentication information included in the database to determine whether the second non-predictable code corresponds to any of the plurality of users; and

communicating from the secure registry system to the second secure computer network an indication of whether the second entity is authorized to access the second secure computer network, based on the validation, whereby the second entity is granted access to the second secure computer network where the second authentication information corresponds to a second one of the plurality of users and the second entity is denied access to the secure computer network where the second authentication information does not correspond to any of the plurality of users.

2. The method of claim 1, wherein the database includes information to authenticate each of the plurality of secure computer networks, and

wherein the method further comprises an act of communicating validation information concerning at least one of the first secure computer network and the second secure computer network to the secure registry system.

3. The method of claim 2, the method further comprising an act of determining, by the secure registry system, whether at least one of the first secure computer network and the second computer network is authorized to access the secure registry system.

4. The method of claim 1, wherein the first non-predictable code includes a first time-varying code, and

wherein the second non-predictable code includes a second time-varying code.

5. The method of claim 4, wherein the first time-varying code and the second time-varying code each include a time-varying multi-character code, respectively.

6. The method of claim 1, wherein the secure registry system is external from the plurality of secure computer networks.

7. The method of claim 1, further comprising an act of controlling access to a physical facility using the secure registry system.

8. The method of claim 7, wherein the indication of whether the first entity is authorized to access the first secure computer network includes an indication of whether the first entity is authorized to access a first physical facility where the first secure computer network is located, and

wherein the indication of whether the second entity is authorized to access the second secure computer network includes an indication of whether the second entity is authorized to access a second physical facility where the second secure computer network is located.

9. The method of claim 1, further comprising acts of locating at least one of the secure computer networks at a first location at a site;

and locating the secure registry system at a second location at the site, wherein access to the second location is, at least in part, controlled independently of access to the first location.

10. The method of claim 1, wherein the plurality of secure computer networks are located geographically remote from the secure registry system.

11. The method of claim 1, further comprising an act of employing the secure registry system to provide a centralized administration and management of the plurality of secure computer networks.

12. The method of claim 11, further comprising an act of maintaining, by the secure registry system, an audit trail concerning a use of the plurality of secure computer networks by at least one of the first user and the second user.

13. The method of claim 12, further comprising acts of:

maintaining a first audit trail concerning the use of the plurality of secure computer networks by the first user; and

maintaining a second audit trail concerning the use of the plurality of secure computer networks by the second user.

14. The method of claim 1, further comprising acts of:

communicating the first authentication information from the first electronic ID device to the first secure computer network via at least one of a Bluetooth signal, an infrared signal and near-field communications, and

communicating the second authentication information from the second electronic ID device to the second secure computer network via at least one of a Bluetooth signal, an infrared signal and near-field communications.

15. The method of claim 14, wherein each of the first electronic ID device and the second electronic ID device include a mobile phone, respectively.

16. The method of claim 15, further comprising acts of:

communicating the first authentication information from the first electronic ID device to the first secure computer network via a first Bluetooth signal, and

communicating the second authentication information from the second electronic ID device to the second secure computer network via a second Bluetooth signal.

17. The method of claim 1, further comprising an act of communicating between each of the first secure computer network and the second computer network, respectively, and the secure registry system over at least one of a wide area network, Internet and a wireless network.

18. The method of claim 17, further comprising an act of communicating at least one of the first authentication information and the second authentication information to the secure registry system over the Internet.

19. The method of claim 1, further comprising acts of:

encrypting, by the first electronic ID device, the first authentication information;

encrypting, by the second electronic ID device, the second authentication information; and

decrypting, by the secure registry system, each of the first authentication information and the second authentication information, respectively.

20. The method of claim 1, further comprising acts of:

encrypting, by the first secure computer network, the first authentication information;

encrypting, by the second secure computer network, the second authentication information; and

decrypting, by the secure registry system, each of the first authentication information and the second authentication information, respectively.

21. A secure registry system for controlling access to a plurality of secure computer networks, the secure registry system comprising:

a database including secure data for each of a plurality of users authorized to access at least one of the plurality of secure computer networks, wherein each user of plurality of users is associated with a non-predictable code, respectively;

a communication link to communicate information between the secure registry system and each of the plurality of secure computer networks; and

a processor coupled to the database and programmed to receive first authentication information including a first non-predictable code via the communication link, the first authentication information generated by a first electronic ID device possessed by a first entity and provided by the first entity to a first secure computer network of the plurality of secure computer networks to which the first entity seeks access, the processor programmed to compare the first non-predictable code to authentication information included in the database to determine whether the first non-predictable code corresponds to any of the plurality of users,

wherein the secure registry system communicates to the first secure computer network, via the communication link, a first indication that the first entity is authorized to access the first secure computer network where the first non-predictable code corresponds to a first user included in the plurality of users,

wherein the processor is programmed to receive second authentication information including a second non-predictable code via the communication link, the second authentication information generated by a second electronic ID device possessed by a second entity and provided by the second entity to a second secure computer network of the plurality of secure computer networks to which the second entity seeks access, the processor programmed to compare the second non-predictable code to the authentication information included in the database to determine whether the second non-predictable code corresponds to any of the plurality of users, and

wherein the secure registry system communicates to the second computer network, via the communication link, a second indication that the second entity is authorized to access the second secure computer network where the second non-predictable code corresponds to a second user included in the plurality of users.

22. The secure registry system of claim 21, wherein the secure registry system is located remotely from the plurality of secure computer networks.

23. The secure registry system of claim 22, wherein communication between the secure registry system and each of the first secure computer network and the second secure computer network includes communication over a wide area network.

24. The secure registry system of claim 21, wherein the first non-predictable code includes a first time-varying multi-character code, and

wherein the second non-predictable code includes a second time-varying multi-character code.

25. The secure registry system of claim 21, wherein the processor is programmed to receive, in the first authentication information, first identifying information that identifies the first secure computer network and

wherein, where the first non-predictable code corresponds to the first user, the processor is further programmed to determine whether the first user is an authorized user of the first secure computer network.

26. The secure registry system of claim 25, wherein the processor is programmed to receive, in the second authentication information, second identifying information that identifies the second secure computer network, and

wherein, where the second non-predictable code corresponds to the second user, the processor is further programmed to determine whether the second user is an authorized user of the second secure computer network.

27. The secure registry system of claim 21, wherein each of the first electronic ID device and the second ID device include a mobile phone, respectively.

28. The secure registry system of claim 27, wherein the first entity communicates the first authentication information to the first secure computer network via a first Bluetooth signal using the first electronic ID device, and

wherein the second entity communicates the second authentication information to the second secure computer network via a second Bluetooth signal using the second electronic ID device.

29. The secure registry system of claim 21, wherein the first authentication information is encrypted by the first electronic ID device,

wherein the second authentication information is encrypted by the second electronic ID device, and

wherein the processor is configured to decrypt each of the first authentication information and the second authentication information, respectively.