Electronic commerce with cryptographic authentication

• US 9,189,777 B1
• Filed: 09/20/2000
• Issued: 11/17/2015
• Est. Priority Date: 09/20/1999
• Status: Active Grant

• Current Assignee: Security First Innovations, LLC
• Original Assignee: Security First Corp
• Inventors: Dickinson, Alexander G., Ohare, Mark S., Rohrbach, Mark D., Zoccoli, James G., Orsini, Rick L., Brooks, Aaron A., Davenport, Roger S., Clough, Philip W., Clayton, Richard F., Stark, Gregory H., Ferrante, Michelle, Berger, Brian, Dobson, Robert T. Jr.
• Primary Examiner(s): Kim, Steven
• Application Number:
  US09/666,378
• Time in Patent Office: 5,536 Days
• Field of Search: 705/51, 705/64, 705/44, 705/67, 705/50, 705/78, 606/44, 606/67
• US Class Current: 1/1
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/40 by quorum, i.e. whereby two or more security principals are required
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06F 2221/2117 User registration
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/12 specially adapted for electronic shopping systems
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 20/38215 Use of certificates or encrypted proofs of transaction rights
• CPC Class Codes: G06Q 20/3823 combining multiple encryption tools for a transaction
• CPC Class Codes: G06Q 20/3825 Use of electronic signatures
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G07F 7/1016 Devices or methods for securing the PIN and other transaction-data, e.g. by encryption arrangements for secret communication, see H04L9/00
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/80 : Wireless
• CPC Class Codes: H04L 63/0428 : wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0435 : wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/06 : for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/061 : for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0823 : using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 : using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0853 : using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/105 : Multiple levels of security
• CPC Class Codes: H04L 9/0825 : using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/0844 : with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
• CPC Class Codes: H04L 9/085 : Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/0897 : involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
• CPC Class Codes: H04L 9/3073 : involving pairings, e.g. identity based encryption [IBE], bilinear mappings or bilinear pairings, e.g. Weil or Tate pairing
• CPC Class Codes: H04L 9/321 : involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3231 : Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3236 : using cryptographic hash functions
• CPC Class Codes: H04L 9/3247 : involving digital signatures
• CPC Class Codes: H04L 9/3265 : using certificate chains, trees or paths; Hierarchical trust model

Abstract

A method for facilitating an authentication related to an electronic transaction between a first and a second user is provided. Authentication data is received from the first user along with transaction data defining the first user and the electronic transaction to be authenticated. This authentication data is compared to enrollment authentication data associated with the first user in order to verify the identity of the first user. When the user is properly verified, access to at least one private cryptographic key stored on a secure server is available for use in securing the electronic transaction. The particular private cryptographic key need not be released from the secure server. Data indicating the status of the authentication may then be sent to one of either the first or second user.

Claims

1. A method of implementing a cryptographic transaction related to an electronic transaction between a vendor device and a user device, the method comprising:

storing, by a secure server, one or more private keys of a user from a plurality of private cryptographic keys, first one or more authentication data of the user, and a first user identifier of the user, wherein the one or more private keys of the user is unknown to the user;

receiving, by the vendor device, a transaction request and a second user identifier from the user device;

generating, by the vendor device, a unique transaction identifier (TID) of the current transaction, wherein the TID uniquely identifies the current transaction between the vendor and the user;

sending from the vendor device a cryptographic transaction request, the TID, and a current authentication data request to the user device;

sending from the vendor device the TID and the second user identifier to the secure server;

querying the user for second one or more authentication data based on the current authentication data request using the user device;

receiving from the user the second one or more authentication data; and

sending from the user device the TID sent from the vendor device and the second one or more authentication data to the secure server;

retrieving, by the secure server, the first one or more authentication data using the first user identifier and the second user identifier;

comparing, by the secure server, the first one or more authentication data and the second one or more authentication data; and

retrieving, by the secure server, the one or more private keys of the user and performing, by the secure server, one or more cryptographic functions employing the one or more private keys based on the comparison.

2. The method of claim 1 wherein the one or more cryptographic functions include one of digital signing, encryption, decryption, hash creation, key generation, and key destruction.

3. The method of claim 1 wherein the current transaction represents logging into a portal which provides access to one or more services which require authentication of the user.

4. The method of claim 3 additionally comprising unlocking a password vault associated with the user, the password vault providing access to additional data which is used to authenticate the user to additional services.

5. The method of claim 4 wherein the additional data comprises passwords associated with the user.

6. The method of claim 4 wherein the additional data comprises private cryptographic keys associated with the user.

7. The method of claim 4 wherein the vendor is a trust engine and the password vault is associated with the trust engine.

8. The method of claim 4 wherein the vendor is the operator of the portal and the password vault is associated with the vendor.

9. The method of claim 4 wherein the password vault is stored on a system associated with the user.