Electronic transaction systems utilizing a PEAD and a private key

• US 8,225,089 B2
• Filed: 02/23/2001
• Issued: 07/17/2012
• Est. Priority Date: 12/04/1996
• Status: Expired due to Fees

• Current Assignee: ServStor Technologies, LLC (IP Investments Group LLC)
• Original Assignee: Otomaku Properties Ltd LLC (Intellectual Ventures LLC)
• Inventors: Wang, Ynjiun P., Ding, Joshua C., Grizzard, James A.
• Primary Examiner(s): Moorthy, Aravind
• Application Number:
  US09/792,224
• Publication Number:
  US 20020023215A1
• Time in Patent Office: 4,162 Days
• Field of Search: 713/200, 713183-185, 713/193, 713/194, 713/161, 713/165, 713/168, 713/189, 726/4, 726/26, 726/34, 380/255, 380/285, 380/44, 380/28
• US Class Current: 713/161
• CPC Class Codes: G06Q 20/00 Payment architectures, schemes or protocols apparatus for performing or posting payment transactions G07F7/08, G07F19/00; electronic cash registers G07G1/12
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: G06Q 20/18 involving self-service terminals [SST], vending machines, kiosks or multimedia terminals
• CPC Class Codes: G06Q 20/322 Aspects of commerce using mobile devices [M-devices]
• CPC Class Codes: G06Q 20/327 Short range or proximity payments by means of M-devices
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/3415 Cards acting autonomously as pay-media
• CPC Class Codes: G06Q 20/363 with the personal data of a user
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/3823 combining multiple encryption tools for a transaction
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/40975 using encryption therefor
• CPC Class Codes: G07F 19/20 Automatic teller machines [ATMs]
• CPC Class Codes: G07F 7/0866 by active credit-cards adapted therefor G07F7/1008 takes precedence
• CPC Class Codes: G07F 7/0886 the card reader being portable for interacting with a POS or ECR in realizing a payment transaction
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: G07F 7/1016 Devices or methods for securing the PIN and other transaction-data, e.g. by encryption arrangements for secret communication, see H04L9/00
• CPC Class Codes: G07F 7/1025 Identification of user by a PIN code
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 2463/102 : applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0428 : wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0442 : wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/0853 : using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 9/0897 : involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
• CPC Class Codes: H04L 9/3226 : using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3234 : involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3247 : involving digital signatures

Abstract

The method includes the steps of receiving at the PEAD first digital data representing the transaction request. The PEAD provides information to the user regarding an ability to approve the transaction request. When the transaction request is approved by the user, the PEAD receives second digital data representing the electronic service authorization token. A remote agent server may provided a bridge between the electronic transaction system and the PEAD. In another embodiment, the private key is stored on the portable device, encrypted. The decryption key is stored outside of the device, at a trusted 3^rd party location. When the user attempts to make a signature the software sends a request for the decryption key, along with the user'"'"'s password or pass phrase keyed in at the keyboard of the PDA, smart phone, or cell phone, to a server belonging to the trusted 3^rd party.

Claims

1. In a portable electronic authorization device, a method for approving a transaction request originated from an electronic transaction system, comprising:

receiving at said portable electronic authorization device first digital data, said first digital data representing said transaction request; and

receiving from a user at said portable electronic authorization device a user input signal approving said transaction request;

in response to receiving said user input, encrypting and transmitting a second digital data to said electronic transaction system, said second digital data being encrypted by hardware within said portable electronic authorization device and signifying said user'"'"'s approval of said transaction request.

2. The method of claim 1 wherein said second digital data includes at least a portion of said transaction request.

3. The method of claim 1, wherein encrypting said second digital data includes encrypting said second digital data with a user'"'"'s private key using public key cryptography, said user'"'"'s private key being kept within said portable electronic authorization device thereby eliminating a need to exchange said user'"'"'s private key between said portable electronic authorization device and said electronic transaction system for approving said transaction request.

4. The method of claim 3 wherein said portable electronic authorization device is enclosed in a tamper-proof enclosure, said tamper-proof enclosure being configured to prevent said user'"'"'s private key from being extracted from said portable electronic authorization device if said tamperproof enclosure has been tampered with.

5. The method of claim 1 further comprising:

authenticating said user prior to permitting said user to approve said transaction request using said portable electronic authorization device, said authenticating requires one of a password, a finger print, or a voice print at a user authentication mechanism associated with said portable electronic authorization device.

6. The method of claim 1 further comprising displaying said transaction request for viewing by said user on a display screen associated with said portable electronic authorization device.

7. The method of claim 1 wherein said transaction request represents a request for authenticating an electronic file, said second digital data includes an electronic signature for authenticating said electronic file.

8. The method of claim 1 wherein said first digital data represents an encrypted version of said transaction request encrypted using public key cryptography with a private key associated with a transaction partner, wherein said receiving further comprising decrypting, using decryption logic associated with said portable electronic authorization device, said first digital data using a public key associated with said transaction partner.

9. The method of claim 1 wherein said portable electronic authorization device is implemented on a single chip.

10. The method of claim 1 wherein said transmitting said second digital data is performed via a PC card communication port associated with said portable electronic authorization device.

11. The method of claim 1 wherein said second digital data comprises at least a portion of said transaction request, said transaction approval data further comprising identification data pertaining said user and a time stamp.

12. The method of claim 1 further comprising configuring said portable electronic authorization device for said user by receiving configuration data from an issuer of an account capable of transaction via said portable electronic authorization device, said configuration data includes at least one of identification data pertaining said user or said private key.

13. A portable electronic authorization device for approving a transaction request originated from an electronic transaction system, comprising:

first logic circuit configured to receive first digital data representative of said transaction request;

second logic circuit configured to receive a user input signal from a user approving said transaction request;

third logic circuit configured to form second digital data responsive to said transaction request received by said first logic circuit and in response to said user input signal, said second digital data representing encrypted data signifying an approval by said user of said transaction request; and

a transmitter coupled to said second logic circuit, said transmitter being configured to transmit said second digital data from said portable electronic authorization apparatus to said electronic transaction system if said user approves said transaction request.

14. The portable electronic authorization device of claim 13 wherein said first digital data represents an encrypted version of said transaction request, said first digital data being encrypted using public key cryptography with a private key associated with a transaction partner, wherein said first logic circuit comprises decrypting circuitry configured to decrypt said first digital data using a public key associated with said transaction partner.

15. The portable electronic authorization device of claim 14 further including first memory circuit coupled to said decrypting circuitry, said first memory circuit being configured for storing a user'"'"'s private key for use in forming said second digital data in accordance with a public key cryptography technique, wherein said second logic circuit includes encrypting logic coupled to said first memory circuit for creating said encrypted data with said user'"'"'s private key using said public key cryptography technique, whereby said presence of said user'"'"'s private key in said first memory circuit eliminates a need to exchange said user'"'"'s private key between said portable electronic authorization device and said electronic transaction system for approving said transaction request.

16. The portable electronic authorization device of claim 15 further comprising key generation logic coupled to said first memory means for generating said user'"'"'s private key within said portable electronic authorization device.

17. The portable electronic authorization device of claim 16 wherein said first logic circuit comprises receiving circuit coupled to said decrypting logic, said receiving circuit being configured to receive said first digital data from said electronic transaction system prior to passing said first digital data to said decrypting logic for decryption, said receiving circuit being decoupled from said first memory circuit, wherein said user'"'"'s private key stored in said first memory circuit is inaccessible directly by said receiving logic, thereby preventing said user'"'"'s private key from being accessed from externally without traversing said decrypting logic.

18. The portable electronic authorization device of claim 17 wherein said transmitter is decoupled from said first memory circuit, wherein said user'"'"'s private key stored in said first memory circuit is inaccessible directly by said transmission circuit, thereby preventing said user'"'"'s private key from being accessed from externally without traversing one of said decrypting logic or said encrypting logic.

19. The portable electronic authorization device of claim 13 further comprising:

a user authentication mechanism coupled to said second logic circuit, said user authentication mechanism being configured to authenticate said user prior to permitting said user to approve said transaction request using said portable electronic authorization device, said authentication mechanism requires one of a password, a finger print, or a voice print.

20. The portable electronic authorization device of claim 13 wherein said transmitter includes circuitry configured for communicating with said electronic transaction system using infrared signals.

21. The portable electronic authorization device of claim 13 wherein said transmitter includes circuitry configured for communicating with said electronic transaction system using wireless RF signals.

22. The portable electronic authorization device of claim 13 wherein said transmitter includes a contact-type serial port for communicating with said electronic transaction system.

23. The portable electronic authorization device of claim 13 wherein said transmitter includes a contact-type parallel port for communicating with said electronic transaction system.

24. The portable electronic authorization device of claim 13 further comprising a display coupled to said first logic circuit, said display being configured to display said transaction request for viewing by said user.

25. The portable electronic authorization device of claim 13 further comprising a switch coupled to said second logic circuit, said switch permitting said user to indicate through activating said switch that said transaction request is approved by said user.

26. The portable electronic authorization device of claim 13 further comprising tamper-proof enclosure enclosing said first logic circuit, said second logic circuit, and said transmitter therein, said tamper-proof enclosure being configured to prevent said user'"'"'s private key from being extracted from said portable electronic authorization device if said tamper-proof enclosure has been tampered with.

27. The portable electronic authorization device of claim 13 wherein said first logic circuit, said second logic circuit, and said transmitter are implemented on a single chip.

28. The portable electronic authorization device of claim 13 wherein said transmitter comprises a PC card communication port associated with said portable electronic authorization device.

29. The portable electronic authorization device of claim 13 wherein said second digital data comprises at least a portion of said transaction request, said second digital data further comprising identification data pertaining said user and a time stamp.

30. The portable electronic authorization device of claim 13 wherein said transaction request represents a request for authenticating an electronic file, said second digital data includes an electronic signature for authenticating said electronic file.

31. In a portable electronic authorization device, a method for approving a transaction request originated from an electronic transaction system, comprising:

receiving at said portable electronic authorization device first digital data, said first digital data representing said transaction request; and

in response to said transaction request being approved by a user of said portable electronic authorization device, encrypting and transmitting a second digital data to said electronic transaction system, said second digital data being encrypted by hardware within said portable electronic authorization device and signifying said user'"'"'s approval of said transaction request,

wherein encrypting said second digital data includes encrypting said second digital data with a user'"'"'s private key using public key cryptography, said user'"'"'s private key being kept within said portable electronic authorization device,

wherein said portable electronic authorization device is enclosed in a tamper-proof enclosure, said tamper-proof enclosure being configured to prevent said user'"'"'s private key from being extracted from said portable electronic authorization device.

32. In a portable electronic authorization device, a method for approving a transaction request originated from an electronic transaction system, comprising:

receiving at said portable electronic authorization device first digital data, said first digital data representing said transaction request; and

in response to said transaction request being approved by a user of said portable electronic authorization device, encrypting and transmitting a second digital data to said electronic transaction system, said second digital data being encrypted by hardware within said portable electronic authorization device and signifying said user'"'"'s approval of said transaction request,

wherein said encrypting and transmitting is performed by a single chip.

33. In a portable electronic authorization device, a method for approving a transaction request originated from an electronic transaction system, comprising:

receiving at said portable electronic authorization device first digital data, said first digital data representing said transaction request; and

in response to said transaction request being approved by a user of said portable electronic authorization device, encrypting and transmitting a second digital data to said electronic transaction system, said second digital data being encrypted by hardware within said portable electronic authorization device and signifying said user'"'"'s approval of said transaction request,

wherein said transmitting said second digital data is performed via a PC card of said portable electronic authorization device.

34. A portable electronic authorization device for approving a transaction request originated from an electronic transaction system, comprising:

first logic circuit configured to receive first digital data representative of said transaction request;

second logic circuit configured to form second digital data responsive to said transaction request received by said first logic circuit in response to said transaction request being approved by a user of said portable electronic transaction device, said second digital data representing encrypted data signifying an approval by said user of said transaction request;

a transmitter coupled to said second logic circuit, said transmitter being configured to transmit said second digital data from said portable electronic authorization apparatus to said electronic transaction system if said user approves said transaction request; and

a tamper-proof enclosure enclosing said first logic circuit, said second logic circuit, and said transmitter therein, said tamper-proof enclosure being configured to prevent said user'"'"'s private key from being extracted from said portable electronic authorization device.

35. A portable electronic authorization device for approving a transaction request originated from an electronic transaction system, comprising:

first logic circuit configured to receive first digital data representative of said transaction request;

second logic circuit configured to form second digital data responsive to said transaction request received by said first logic circuit in response to said transaction request being approved by a user of said portable electronic transaction device, said second digital data representing encrypted data signifying an approval by said user of said transaction request; and

a transmitter coupled to said second logic circuit, said transmitter being configured to transmit said second digital data from said portable electronic authorization apparatus to said electronic transaction system if said user approves said transaction request,

wherein said second logic circuit and said transmitter are implemented on a single integrated circuit.

36. A portable electronic authorization device for approving a transaction request originated from an electronic transaction system, comprising:

first logic circuit configured to receive first digital data representative of said transaction request;

second logic circuit configured to form second digital data responsive to said transaction request received by said first logic circuit in response to said transaction request being approved by a user of said portable electronic transaction device, said second digital data representing encrypted data signifying an approval by said user of said transaction request; and

a transmitter coupled to said second logic circuit, said transmitter being configured to transmit said second digital data from said portable electronic authorization apparatus to said electronic transaction system if said user approves said transaction request,

wherein said transmitter comprises a PC card of said portable electronic authorization device.