Reliably Identifying Information of Device Generating Digital Signatures

• US 20030097569A1
• Filed: 02/01/2003
• Published: 05/22/2003
• Est. Priority Date: 08/04/2000
• Status: Active Grant

• Current Assignee: First Data Corporation (Fiserv Incorporated)
• Original Assignee: First Data Corporation (Fiserv Incorporated)
• Inventors: Wheeler, Anne M., WHEELER, Lynn Henry
• Granted Patent: US 6,915,430 B2
• Time in Patent Office: Days
• US Class Current: 713/176
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06Q 20/00 Payment architectures, schemes or protocols apparatus for performing or posting payment transactions G07F7/08, G07F19/00; electronic cash registers G07G1/12
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/0855 involving a third party
• CPC Class Codes: G06Q 20/12 specially adapted for electronic shopping systems
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/3558 Preliminary personalisation for transfer to user
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/3676 Balancing accounts
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 20/3823 combining multiple encryption tools for a transaction
• CPC Class Codes: G06Q 20/3825 Use of electronic signatures
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/388 using mutual authentication without cards, e.g. challenge-response
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: G06Q 20/403 : Solvency checks
• CPC Class Codes: G06Q 20/40975 : using encryption therefor
• CPC Class Codes: G06Q 50/188 : Electronic negotiation
• CPC Class Codes: G07F 7/0886 : the card reader being portable for interacting with a POS or ECR in realizing a payment transaction
• CPC Class Codes: G07F 7/1008 : Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: G07F 7/1016 : Devices or methods for securing the PIN and other transaction-data, e.g. by encryption arrangements for secret communication, see H04L9/00
• CPC Class Codes: H04L 2209/42 : Anonymization, e.g. involving pseudonyms
• CPC Class Codes: H04L 2209/56 : Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 63/0428 : wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0442 : wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/062 : for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0823 : using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 : using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/12 : Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 9/321 : involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3247 : involving digital signatures

Abstract

Abstract of Disclosure

Information of a device that generates digital signatures is reliably identified by (a) for each of a plurality of devices manufactured in an environment, (i) creating a public-private key pair within the environment, (ii) linking within the environment in a secure manner the public key with other information associated with the device, and (iii) before release of the device from the environment, storing the private key within the device for generating a digital signature for an electronic message, and (b) thereafter, when a said linked public key successfully authenticates a digitally signed message, identifying the other information associated with said linked public key as pertaining to the device to which belongs the private key utilized in digitally signing the message. Manufacturing the devices includes creating a public-private key pair within the secure environment, and storing the private key within the device against the possibility of divulgement thereof by the device.

Claims

1. A method in which information of a device that generates digital signatures is reliably identified, comprising the steps of,

2. The method of claim 1, wherein the secure manner of linking comprises recording the linked public keys and Security Profiles in a database and maintaining the database in an environment having a security rating at least comparable to a security level of each device for which the public key thereof is linked.

3. The method of claim 1, wherein the secure manner of linking comprises,

4. The method of claim 1, wherein the other information is identified by a recipient of the digitally signed message.

5. The method of claim 1, wherein the other information is identified to a recipient of the digitally signed message.

6. The method of claim 1, further comprising gauging a risk that the private key was fraudulently used to digitally sign the message based at least in part on said identified Security Profile.

7. The method of claim 1, wherein the Security Profile of a device comprises security characteristics of the device.

8. The method of claim 7, wherein the security characteristics of a respective manufactured device include an algorithm used by the device in originating digital signatures.

9. The method of claim 1, wherein the Security Profile of a device comprises authentication capabilities of the device.

10. The method of claim 9, wherein the authentication capabilities include whether the device performs Factor A and Factor B Entity Authentication.

11. The method of claim 1, wherein the Security Profile of a device comprises all of the security features of the device.

12. The method of claim 2, wherein the secure environment includes multiple physical locations.

13. The method of claim 3, wherein the secure environment includes multiple physical locations.

14. The method of claim 1, wherein the electronic message represents a financial transaction.

15. The method of claim 1, wherein the electronic message represents a legal action.

16. The method of claim 1, wherein the electronic message represents a request for access to information.

17. The method of claim 1, wherein the electronic message represents a request for access to a physical location.

18. The method of claim 1, wherein each pair of keys of a manufactured device is created in the respective device.

19. The method of claim 18, wherein only the public key of each pair is exportable from the respective device.

20. The method of claim 18, wherein the private key is not exportable from the respective device.

21. A method of manufacturing devices that generate digital signatures such that each device may be reliably and uniquely identified, the devices being manufactured within a secure environment, comprising the steps of,

22. The method of claim 21, wherein each private-public key pair is created within each device based on a random number produced by a random number generator disposed within each device.

23. The method of claim 22, wherein the random number generator is a high quality random number generator.

24. The method of claim 22, wherein the only the public key is exportable from the device.

25. The method of claim 22, wherein each digital signature generated by each device is a random number.

26. The method of claim 22, wherein the other information comprises respective security features of each device.

27. The method of claim 22, further comprising identifying a particular manufactured device by authenticating a message using one of said linked public keys, a digital signature for the message having been generated by the particular manufactured device.