System and method for preventing identity theft using a secure computing device

• US 20050071282A1
• Filed: 12/31/2003
• Published: 03/31/2005
• Est. Priority Date: 09/29/2003
• Status: Active Grant

• Current Assignee: Asad Mahboob Ali, Hongqian Karen Lu
• Original Assignee: Asad Mahboob Ali, Hongqian Karen Lu
• Inventors: Ali, Asad Mahboob, Lu, HongQian Karen
• Granted Patent: US 7,392,534 B2
• Time in Patent Office: Days
• US Class Current: 705/64
• CPC Class Codes: G06F 21/42 using separate channels for security data
• CPC Class Codes: G06F 21/6263 during internet communication, e.g. revealing personal data from cookies
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/346 Cards serving only as information carrier of service
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/3823 combining multiple encryption tools for a transaction
• CPC Class Codes: G06Q 20/40975 using encryption therefor
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215

Abstract

A system and method for effecting secure transactions over a computer network in a manner designed to foil identity theft perpetrated from an untrusted computer. A connection from a client computer to the network wherein the client computer provides a user interface for a user, a connection from a server computer to the network, and a connection from a portable secure computing device to the network provides for secure transmission of private confidential user information from the user to a server. The private information is transmitted directly from the secure computing device to the server over the secure connection without possibility of capture on the computer with which the user is interacting.

Claims

1. A method for effecting secure transactions over a computer network in a manner designed to foil identity theft perpetrated from an untrusted computer, comprising:

connecting a client computer to the network wherein the client computer provides a user interface to interact with a user;

connecting a server computer to the network;

connecting a portable secure computing device to the network;

operating the secure computing device to communicate a list of available services to the client computer;

responsive to receiving the list of available services using the user interface to display the list of available services to a user;

responsive to a selection of one available service by the user, establishing a secure connection from the secure computing device to the server;

securely communicating private information from the secure computing device to the server over the secure connection.

2. The method of claim 1 further comprising:

authenticating a user based on the private information; and

in response to successful authentication of the user, conducting a transaction between the client computer and the server computer.

3. The method of claim 1 further comprising:

transmitting from the secure computing device to the server computer user identifying information.

4. The method of claim 3 wherein the user identifying information includes a secret personal identification number (sPIN).

5. The method of claim 4 further comprising:

responsive to receiving the user identifying information, operating the server computer to establish an association among the user, the client and the secure computing device.

6. The method of claim 4 wherein the secure computing device has a personal identification number (PIN) wherein the sPIN and the PIN are unrelated.

7. The method of claim 4 wherein the server computer uses the sPIN for only one session.

8. The method of claim 1 wherein the portable secure computing device is a smart card.

9. A method for secure transactions over a computer network in a manner designed to foil identity theft perpetrated from an untrusted computer, comprising:

connecting a client computer to the network wherein the client computer provides a user interface to interact with a user;

connecting a server computer to the network;

connecting a secure computing device to the network;

establishing a secure connection from the secure computing device to the server;

securely communicating private information from the secure computing device to the server over the secure connection;

authenticating a user using the private information; and

in response to successfully authenticating the user, conducting a transaction between the client and the server.

10. The method of claim 9 wherein the step of securely communicating private information comprises pushing the private information from the secure computing device to the server computer.

11. The method of claim 10 further comprising:

in response to successfully authenticating a user, operating the client to transmit an indication to the server that the secure computing device will send information necessary for a transaction;

operating the server to wait for the information from the secure computing device;

operating the client to select the information necessary for the transaction; and

in response to selecting the information necessary for the transaction, operating the secure computing device to transmit the selected information securely to the server.

12. The method of claim 9 wherein the step of securely communicating private information comprises operating the server computer to pull the private information from the secure computing device.

13. The method of claim 9 further comprising:

in response to successfully authenticating a user, operating the server to transmit a request to the secure computing device to provide information necessary to complete a transaction;

in response to a request from the server for information necessary to complete a transaction, operating the secure computing device to notify the client that the server has made the request for information necessary to complete a transaction;

in response to notification from the secure computing device that the server is requesting the information necessary to complete a transaction, operating the client to obtain a user'"'"'s approval or denial of the request; and

in response to a user'"'"'s approval, transmitting the requested information from the secure computing device to the server in a secure manner.

14. A system for effecting secure transactions over a computer network in a manner designed to foil identity theft through keystroke logging, comprising:

a server computer connected to a computer network and operable to provide some form of online transactions;

a client computer connected to the computer network and operable to interface with a user;

a secure computing device connected to the computer network and capable of establishing a secure connection with the server computer and the client computer;

wherein the secure computing device has logic operable to store private user information; and

wherein the secure computing device has logic, in response to the initiation of a transaction between a user operating the client computer and the server computer, operable to securely transmit the private user information to the server computer in a manner such that only the server can interpret the private user information.

15. The system for effecting secure transactions over a computer network of claim 14:

wherein the secure computing device has logic to transmit a map to the server computer, the map having the elements clientIP, cardIP, login credentials, and secret personal identification number (sPIN);

wherein the server computer has logic to request a user to enter the sPIN and logic to verify that the entered sPIN matches the sPIN in the map.

16. The system for effecting secure transactions over a computer network of claim 15:

wherein the server computer has logic to destroy the map if the sPIN entered by the user does not match the sPIN of the map.

17. The system for effecting secure transactions over a computer network of claim 14:

wherein the portable secure computing device transmits the private user information upon a request by the user.

18. The system for effecting secure transactions over a computer network of claim 14:

wherein the portable secure computing device transmits the private user information upon a request by the server computer.

19. The system for effecting secure transactions over a computer network of claim 18:

wherein the portable secure computing device transmits the private user information to the server computer only upon permission granted by the user.

20. The system for effecting secure transactions over a computer network of claim 19:

wherein the server computer destroys the map in response to invalid sPIN, denial of permission from the user, and transaction completion.