Secure wireless authorization system

• US 20050184145A1
• Filed: 02/07/2005
• Published: 08/25/2005
• Est. Priority Date: 02/05/2004
• Status: Active Grant

• Current Assignee: 7611544 Canada, Inc.
• Original Assignee: Xtreme Mobility Incorporated
• Inventors: Law, Simon, Hapuarachchi, Pasan, Law, Jimmy, Tse, Daniel Man
• Granted Patent: US 7,447,494 B2
• Time in Patent Office: Days
• US Class Current: 235/380
• CPC Class Codes: G06Q 20/0855 involving a third party
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/72 Subscriber identity

Abstract

The invention relates to a secure wireless authorization system by which a user can employ a wireless device to authorize a request that is initiated by a remote third party and transmitted to the user by an authorization server. The system includes the authorization server that is linked to the third party by way of a communications connection and a wireless device that is adapted to securely store an encryption scheme and create a secure authorization from the user in response to the third party request and has the ability to establish a secure wireless connection over which the secure authorization is transmitted from the user'"'"'s wireless device to the authorization server. Pre-authorization, real-time authorization and post-authorization methods are disclosed by which user authorized transactions can be completed by way of the authorization system of this invention.

Claims

1. A secure wireless authorization system to enable a user to communicate with an authorization server by way of a secure wireless connection to authorize a particular action associated with a request for authorization initiated by a remote entity and processed by the authorization server, said system comprising:

an authorization server linked to the remote entity by means of a communications connection;

a wireless device of the user to enable the user to send to and receive from said authorization server the request for authorization and to provide to said authorization server a secure authorization in response to the request for authorization processed by the authorization server in order to cause the remote entity to take the particular action, said wireless device adapted to securely store means for encryption, means to create said secure authorization, and means to establish the secure wireless connection depending upon the request for authorization and the stored encryption means; and

a secure wireless connection initiated by the wireless device of the user to the authorization server or by the authorization server to the wireless device of the user over which to transmit said secure authorization from said wireless device to said authorization server.

2. The secure wireless authorization system recited in claim 1, wherein the communications connection is a credit card network.

3. The secure wireless authorization system recited in claim 2, wherein the action to be taken following the receipt of the secure authorization by said authorization server is the approval of a credit card transaction.

4. The secure wireless authorization system recited in claim 1, wherein the remote entity is an on-line merchant.

5. The secure wireless authorization system recited in claim 1, wherein the remote entity is a credit card reader.

6. The secure wireless authorization system recited in claim 1, wherein the remote entity is a financial institution.

7. The secure wireless authorization system recited in claim 1, wherein the remote entity is a medical institution.

8. The secure wireless authorization system recited in claim 1, wherein the remote entity is another wireless device.

9. The secure wireless authorization system recited in claim 1, wherein said authorization server includes a database in which to store information associated with the user so that the request for authorization initiated by the remote entity will only be delivered to the wireless device of the user.

10. The secure wireless authorization system recited in claim 9, wherein said authorization server also stores a set of encryption keys by which to enable the secure authorization to be provided over said secure wireless connection from the wireless device of the user to said authorization server.

11. The secure wireless authorization system recited in claim 1, wherein the means for encryption for creating the secure authorization response to be transmitted over said wireless connection between said authorization server and said wireless device of the user is symmetric-key encryption, and wherein said authorization server and said wireless device are responsive to the same symmetric-key.

12. The secure wireless authorization system recited in claim 11, including a master secret key residing on said authorization server and said wireless device of the user in order to change the symmetric-key of said symmetric-key encryption to which said authentication server and said wireless device of the user are user responsive.

13. The secure wireless authorization system recited in claim 1, wherein the means for encryption for creating the secure authorization to be transmitted over said wireless connection between said authorization server and said wireless device of the user is public-key encryption, and wherein said authorization server and said wireless device are responsive to a public and private key set.

14. The secure wireless authorization system recited in claim 1, further comprising a wireless gateway to interface said authorization server with said secure wireless connection so that the request for information sent by said authorization server will be received by the wireless device of the user and the secure authorization provided by the wireless device of the user in response to the request for authorization will be received by said authorization server.

15. A method for pre-authorizing a remote entity request to complete a transaction by means of the secure wireless authorization system recited in claim 1, said method comprising the steps of:

entering a user'"'"'s pre-authorization transaction information into said wireless device of the user regarding the transaction to be completed;

sending the user'"'"'s pre-authorization transaction information to said authorization server via said secure wireless connection prior to the remote entity request;

storing the user'"'"'s pre-authorization transaction information in said authorization server;

sending the remote entity transaction request to said authorization server by way of said communications connection;

determining in said authorization server whether the remote entity transaction request matches the user'"'"'s pre-authorization transaction information;

executing the transaction request if the remote entity transaction request matches the user'"'"'s pre-authorization transaction information; and

sending a confirmation to the remote entity once the execution is completed.

16. A method to enable a user to authorize a remote entity request to complete a transaction in real time by means of the secure wireless authorization system recited in claim 1, said method comprising the steps of:

sending the remote entity transaction request to said authorization server by way of said communications connection;

sending an authorization request from said authorization server to the wireless device of the user via said secure wireless connection following the transaction request sent to said authorization server by the remote entity;

sending the user'"'"'s response from the user'"'"'s wireless device to said authorization server via said secure wireless connection;

executing the request by said authorization server if an approval response from the user is received; and

sending a confirmation following the user'"'"'s response from said authorization server to the remote entity.

17. The method for a user to authorize a remote entity transaction request as recited in claim 16, wherein the approval response sent by the user is the user'"'"'s personal digital signature entered into said wireless device of the user.

18. The method for a user to authorize a remote entity transaction request as recited in claim 16, wherein the approval response sent by the user is the user'"'"'s personal identification number (PIN) entered into said wireless device of the user.

19. The method for a user to authorize a remote entity transaction request as recited in claim 16, wherein the approval response sent by the user is the user'"'"'s digital certificate on said wireless device of the user.

20. The method for a user to authorize a remote entity transaction request as recited in claim 16, including the additional steps of keeping track in the authorization server the time required for the user to send his approval response following the sending of the authorization request, and denying the remote entity transaction request if the time tracked by the authorization server is greater than a pre-determined time.

21. The method for a user to post-authorize a remote entity transaction request as recited in claim 20, including the additional steps of sending the user'"'"'s approval response and security credentials from the user'"'"'s wireless device to the authorization server after said pre-determined time has elapsed, verifying in said authorization server the security credentials of the user, sending an acknowledgement to the remote entity that the remote entity transaction request has been accepted after said pre-determined time has elapsed provided that the security credentials are correct, executing the request by said authorization server, and sending a confirmation to said remote entity.

22. The method for a user to authorize a remote entity transaction request as recited in claim 16, including the additional step of initiating said secure wireless connection by the user'"'"'s wireless device to the authorization server prior to the step of sending the remote entity transaction request to said authorization server.

23. The method for a user to authorize a remote entity transaction request as recited in claim 16, including the additional step of said authorization server initiating a secure wireless connection by identifying the GUID (global unique identifier) of said wireless device of the user and sending the authorization server transaction request to said wireless device of the user.

24. A method for a user to authorize a remote entity transaction request as recited in claim 23, including the additional step of said wireless device updating said authorization server with changes to said wireless device GUID.

25. The secure wireless authorization system recited in claim 1, wherein the secure wireless connection initiated by the said wireless device of the user to the said authorization server or by the said authorization server to the said wireless device of the user is a connection-oriented type connection or a connection-less type connection.