Preventing identity theft

• US 20070011100A1
• Filed: 06/20/2006
• Published: 01/11/2007
• Est. Priority Date: 06/21/2005
• Status: Abandoned Application

• Current Assignee: Assa Abloy AB
• Original Assignee: Assa Abloy AB
• Inventors: Libin, Phil, Engberg, David
• Application Number:
  US11/471,273
• Publication Number:
  US 20070011100A1
• Time in Patent Office: Days
• US Class Current: 705/65
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06Q 20/24 Credit schemes, i.e. "pay after"
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/346 Cards serving only as information carrier of service
• CPC Class Codes: G06Q 20/367 involving electronic purses or money safes
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G07C 9/30 not involving the use of a pass
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: G07F 7/122 Online card verification

Abstract

Determining whether to remotely authorize an action on behalf of a requester includes having the requester provide a privacy token, remotely obtaining data from the privacy token, and authorizing the action if the data from the privacy token verifies that the requester is authorized to take the action. The action may include issuing a credit card for the requester. The privacy token may be a smart card. The data may be digitally signed. Determining whether to remotely authorize an action on behalf of a requester may also include authorizing the action if the requester had previously indicated a desire not to require presentation of the privacy token. The action may be authorized only if the data from the privacy token verifies the identity of the requester.

Claims

1. A method of determining whether to remotely authorize an action on behalf of a requester, comprising:

having the requester provide a privacy token;

remotely obtaining data from the privacy token; and

authorizing the action if the data from the privacy token verifies that the requester is authorized to take the action.

2. A method, according to claim 1, wherein the action includes issuing a credit card for the requester.

3. A method, according to claim 1, wherein the privacy token is a smart card.

4. A method, according to claim 1, wherein the data is digitally signed.

5. A method, according to claim 1, further comprising:

authorizing the action if the requester had previously indicated a desire not to require presentation of the privacy token.

6. A method, according to claim 1, wherein the action is authorized only if the data from the privacy token verifies that the requester is authorized to take the action.

7. A method, according to claim 1, wherein the data provided in the privacy token is encrypted to inhibit directly ascertaining identifying information about the requester.

8. A method, according to claim 7, wherein the data is encrypted using a one-way hash function.

9. A method, according to claim 8, further comprising:

applying the one-way hash function to identifying information about the requester and comparing the result thereof with the data provided in the privacy token.

10. A method, according to claim 1, wherein the requester provides the privacy token in response to obtaining a particular credit score for the requester.

11. A computer readable medium having computer executable instructions for performing the steps recited in claim 1.

12. A privacy token, comprising:

an electronic identifier that stores data;

a data communicator coupled to the electronic identifier; and

data, provided on the electronic identifier, that binds the privacy token to a holder thereof, wherein the data is authenticated by an authority that is trusted by a provider of service to the holder.

13. A privacy token, according to claim 12, wherein the data is digitally signed by the authority.

14. A privacy token, according to claim 12, wherein the data provided in the privacy token is encrypted using a one-way hash function to inhibit directly ascertaining identifying information about the requester.

15. A method of administering privacy tokens that have data that binds each of the privacy tokens to a holder thereof using authenticated data, the method comprising:

receiving, from a token issuing authority, authenticated information indicating that a particular privacy token has been issued; and

providing a transaction authority with authenticated information indicating that the particular privacy token has been issued by the token issuing authority, wherein the transaction authority authorizes use of the privacy token in response to receiving the second authenticated information.

16. A method, according to claim 15, wherein the authenticated information received from the token issuing authority is different from the authenticated information provided to the transaction authority.

17. A method, according to claim 15, wherein the authenticated information received from the token issuing authority is the same as the authenticated information provided to the transaction authority.

18. A method, according to claim 15, wherein an authority granting agency communicates information indicating particular token issuing privileges of the token issuing authority.

19. A method, according to claim 18, wherein the authenticated information provided to the transaction authority depends, at least in part, on information provided by the authority granting agency.

20. A computer readable medium having computer executable instructions for performing the steps recited in claim 15.