ABDS System and Verification Status for Authenticating Entity Access

• US 20030126438A1
• Filed: 01/31/2003
• Published: 07/03/2003
• Est. Priority Date: 08/04/2000
• Status: Active Grant

• Current Assignee: First Data Corporation (Fiserv Incorporated)
• Original Assignee: First Data Corporation (Fiserv Incorporated)
• Inventors: Wheeler, Anne M., WHEELER, Henry Lynn
• Granted Patent: US 6,938,156 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06Q 20/00 Payment architectures, schemes or protocols apparatus for performing or posting payment transactions G07F7/08, G07F19/00; electronic cash registers G07G1/12
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/0855 involving a third party
• CPC Class Codes: G06Q 20/12 specially adapted for electronic shopping systems
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/3558 Preliminary personalisation for transfer to user
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/3676 Balancing accounts
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 20/3823 combining multiple encryption tools for a transaction
• CPC Class Codes: G06Q 20/3825 Use of electronic signatures
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/388 using mutual authentication without cards, e.g. challenge-response
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: G06Q 20/403 : Solvency checks
• CPC Class Codes: G06Q 20/40975 : using encryption therefor
• CPC Class Codes: G06Q 50/188 : Electronic negotiation
• CPC Class Codes: G07F 7/0886 : the card reader being portable for interacting with a POS or ECR in realizing a payment transaction
• CPC Class Codes: G07F 7/1008 : Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: G07F 7/1016 : Devices or methods for securing the PIN and other transaction-data, e.g. by encryption arrangements for secret communication, see H04L9/00
• CPC Class Codes: H04L 2209/42 : Anonymization, e.g. involving pseudonyms
• CPC Class Codes: H04L 2209/56 : Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 63/0428 : wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0442 : wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/062 : for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0823 : using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 : using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/12 : Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 9/321 : involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3247 : involving digital signatures

Abstract

Abstract of Disclosure

A system in which a requesting entity seeking access to a controlled resource is authenticated by an access authentication component includes the requesting entity initially opening a security account with the access authentication component, the access authentication component establishing and maintaining a record including information pertaining to the account and being retrievable based on a unique identifier for the requesting entity, and associating a public key of a public-private key pair with the record; the requesting entity originating an electronic message and generating a digital signature using a private key of the key pair, and sending the digitally signed electronic message to the access authentication component with the unique identifier; authenticating the electronic message using the public key associated with the record identified by the unique identifier; and upon successful authentication, authenticating access to the controlled resource. A digitally signed verification status is included with the electronic message.

Claims

1. A system for authenticating a requesting entity for access to a controlled resource by communicating electronically over a communications medium to an access authentication component controlling the controlled resource, comprising,

2. The system of claim 1, including the requesting entity having a device with the public-private key pair in the device.

3. The system of claim 1, including a requesting entity account established in the controlled resource.

4. The system of claim 3, including an instruction regarding the controlled resource account in the electronic message.

5. The system of claim 4, including a component for executing the instruction regarding the controlled resource account contained in the electronic message.

6. The system of claim 3, including a component for granting access to the controlled resource in response to authenticating the requesting entity.

7. The system of claim 3, including a component for authenticating the electronic message after retrieving the public key from the database using the unique identifier.

8. The system of claim 3, including the security account record stored in an account database.

9. The system of claim 3, including personalizing data relating to the requesting entity stored in the device.

10. A system for authenticating a requesting entity for continuing access to a controlled resource by communicating electronically over a communications medium to an access authentication component for the controlled resource, the requesting entity initially entering personal verification data and verifying the data to form a verification status and having sent the verification status to the access authentication component, the access authentication component having evaluated the verification status and authenticated access to the controlled resource for the requesting entity, the access authentication component maintaining business rules and now requesting in accordance with one of the rules that the verification status be reconfirmed by the requesting entity, comprising,

11. The system of claim 10, including the requesting entity having a device with the public-private key pair in the device.

12. The system of claim 10, including a requesting entity account established in the controlled resource.

13. The system of claim 10, including a component for authenticating the electronic message after retrieving the public key from the database using the unique identifier.

14. The system of claim 10, including the security account record stored in an account database.

15. A system for initially authenticating a requesting entity for access to a controlled resource by communicating electronically over a communications medium to an access authentication component for the controlled resource, comprising:

16. The system of claim 15, including the requesting entity having a device with the public-private key pair in the device.

17. The system of claim 15, including a requesting entity account established in the controlled resource.

18. The system of claim 15, including a component for authenticating the electronic message after retrieving the public key from the database using the unique identifier.

19. The system of claim 15, including the security account record stored in an account database.

20. A system for authenticating a requesting entity for access to a controlled resource by communicating electronically over a communications medium to an access authentication component for the controlled resource, comprising:

21. The system of claim 20, including a requesting entity account established in the controlled resource.

22. The system of claim 21, including an instruction regarding the controlled resource account in the electronic message.

23. The system of claim 22, including a component for executing the instruction regarding the controlled resource account contained in the electronic message.

24. The system of claim 20, including a component for granting access to the controlled resource in response to authenticating the requesting entity.

25. The system of claim 20, including a component for authenticating the electronic message after retrieving the public key from the database using the unique identifier.

26. The system of claim 20, including the security account record stored in an account database.

27. The system of claim 20, including personalizing data relating to the requesting entity stored in the device.

28. The system of claim 20, including the security profile stored in a secure database.

29. A system for authenticating a requesting entity for continuing access to a controlled resource by communicating electronically over a communications medium to an access authentication component for the controlled resource, providing the requesting entity with a device and including the public-private key pair in the device, personalizing the device by storing data relating to the requesting entity, the requesting entity having an account in the controlled resource the requesting entity initially entering personal verification data in the device and the device verifying the data to form a verification status and the device having sent the verification status to the access authentication component, the access authentication component having evaluateded the verification status and authenticated access to the controlled resource for the requesting entity, the access authentication component maintaining business rules and now requesting in accordance with one of the rules that the verification status be reconfirmed by the requesting entity, comprising:

30. A system for initially authenticating a requesting entity for access to a controlled resource by communicating electronically over a communications medium to an access authentication component for the controlled resource, comprising: