DEVICE AND METHOD FOR LOADING MANAGING AND USING SMARTCARD AUTHENTICATION TOKEN AND DIGITAL CERTIFICATES IN E-COMMERCE

• US 20090198618A1
• Filed: 01/14/2009
• Published: 08/06/2009
• Est. Priority Date: 01/15/2008
• Status: Abandoned Application

• Current Assignee: Henry Fung, Yuen Wah Eva Chan
• Original Assignee: Henry Fung, Yuen Wah Eva Chan
• Inventors: Fung, Henry, Chan, Yuen Wah Eva
• Application Number:
  US12/353,944
• Publication Number:
  US 20090198618A1
• Time in Patent Office: Days
• US Class Current: 705/66
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: G06Q 20/12 specially adapted for electronic shopping systems
• CPC Class Codes: G06Q 20/3672 initialising or reloading thereof
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/38215 Use of certificates or encrypted proofs of transaction rights
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes

Abstract

Device, system, and method for loading, managing and using smartcard authentication token and digital certificates in e-commerce. System for making and accepting payments in on-line transaction between parties including transaction server coupled with storage device in which subscriber data structure is defined and stores transaction subscriber information and configured to communicate via network with certificate issuer and with card issuer. Computer implemented method for making and accepting payments in online transaction. Computer implemented method of issuing authentication certificate. Authentication token (smart card or SIM card) apparatus. Device for performing reading and/or writing operation to dual media smart card and SIM cards. Device, system, and method for using unique digital values to prevent fraudulent access or use of authentication token embedded with security digital certificate. System and method and business model for enabling payments to be made using Internet on secure basis using certificates and transaction facilitator payments portal.

Claims

1. A system for making and accepting payments in an on-line network transaction between a first and second parties, the system comprising:

an on-line networked transaction server coupled with a tangible storage device in which a subscriber data structure is defined and which stores transaction portal subscriber information;

the transaction server configured to communicate via the network with an issuer of digital certificates and with an issuer of bank cards;

the issuer of bank cards configured to communicate via the network and issuing bank cards having an integrated circuit defining a memory for storing a digital certificate and processing logic for protecting the memory from unauthorized access; and

the issuer of digital certificates configured to communicate via the network and issuing digital certificates that are associated with a identifier (ID) and maintaining a certificate database storing issued digital certificates and digital certificate status.

2. A system as in claim 1, wherein the system further comprises a bank server associated with the issuer of bank cards.

3. A system as in claim 1, wherein the system further comprises a certificate authority server associated with the certificate authority.

4. A system as in claim 1, wherein the issued bank cards further including a certificate loader control logic for controlling the writing of the digital certificate to the bank card.

5. A system as in claim 1, wherein the first and second parties comprise first and second transaction portal subscribers comprise a payor and a payee.

6. A system as in claim 1, wherein the subscriber information comprises payor and payee subscriber information.

7. A system as in claim 1, wherein the system further comprises the issuer of digital certificates and the issuer of bank cards.

8. A system as in claim 1, wherein the integrated circuit defining a memory for storing a digital certificate and processing logic for protecting the memory from unauthorized access stores a cryptographic hash of the identifier and optionally of other information.

9. A system as in claim 1, wherein the identifier comprises a personal, merchant, business, utility, organizational, or governmental identifier.

10. A system as in claim 1, wherein the digital certificate status is selected from the set of status types consisting of at least one of a valid status, an invalid status, a revoked status, and a suspended status.

11. A system as in claim 1, wherein the certificate loader control logic comprises an application certificate loader software or firmware loaded on the bank card that is particularized to the identity of the owner of the digital certificate that is loaded onto the bank card.

12. A system as in claim 1, wherein at least one of the digital certificate issuing certificate authority and the bank card issuer bank provide a certificate status update to alter the digital certificate status over the network without the involvement of the owner of the digital certificate.

13. A system as in claim 1, wherein the transaction server establishes separate relationships between the first and second parties and the first and second parties do not need to have a separate prior transaction to conduct an on-line transaction with each other through the transaction portal.

14. A system as in claim 1, wherein the transactions between the first and second parties are performed in a closed-loop digital certification environment where first and second party identity and digital certificate validity status are tested at each stage of the transaction before the transaction is permitted to go to completion.

15. A system as in claim 1, wherein the transaction portal maintains an electronic log of the transaction so that the transaction may be verified and not be subject to repudiation by either the first party or the second party.

16. A system as in claim 1, wherein the transaction portal collects a financial remuneration or fee from at least one of the first and second parties for each transaction concluded.

17. A system as in claim 1, wherein the first party and/or the second party communicate with the network by one of a personal computer, a PDA, a cellular telephone, a public information terminal, and an information appliance.

18. A computer implemented method for making and accepting payments in an online network transaction, the method comprising:

at a network on-line transaction portal, receiving a transaction instruction from a first party regarding an action to be taken relative to a second party;

verifying with a certificate authority database in substantially real time that both the first party and the second party have currently valid digital certificates issued by a recognized digital certificate authority and associated with their unique identifier;

verifying with a financial institution in substantially real time that the first party and the second party are capable of completing the transaction instruction; and

maintaining an electronic transaction log to document the transaction and mitigate attempted repudiation of the transaction by the first party or the second party.

19. A method as in claim 18, wherein the transaction instruction comprises a payment instruction.

20. A method as in claim 18, wherein first party is a buyer or payor.

21. A method as in claim 18, wherein the first party is an individual person and the second party is a merchant organization.

22. A method as in claim 18, wherein the first party is an individual person and the second party is a governmental entity.

23. A method as in claim 18, wherein the certificate authority is a governmental entity.

24. A method as in claim 18, wherein the second party is a seller or payee.

25. A method as in claim 18, wherein the verifying that both the first party and the second party have currently valid digital certificates issued by a recognized digital certificate authority are completed in substantially real-time by accessing a CDL LDAP database.

26. A method as in claim 18, wherein the transaction is a purchase of goods and/or services, and the first party has sufficient documented monetary resources to purchase the goods and/or services, and the second party has a documented ability to sell the contracted for goods and/or services.

27. A computer implemented method of issuing a digital security and authentication certificate, comprising:

opening, by a certificate issuing authority, over a computer interface, an interface with a network server, to initiate a certificate issuance application;

inputting an identification information of the applicant;

generating a key pair including a private key and public key and an applicant specific digital certificate for the applicant;

storing the digital certificate into a tangible computer or machine readable storage medium; and

after successful issuance of the certificate, publishing the corresponding public certificate to a certificate repository.

28. A method as in claim 27, wherein:

the identification information comprises a name and/or identification (ID) number.

29. A method as in claim 27, wherein:

the digital certificate is a PKCS#12 and PKCS#11 compatible format.

30. A method as in claim 27, wherein:

the digital certificate is a PKCS#12 and PKCS#11 format.

31. A method as in claim 27, wherein:

the tangible computer or machine readable storage medium is selected from the set consisting of a floppy disk, electronic certificate File Card, a smart card, a USB storage module, a semiconductor storage device, or other memory device.

32. A method as in claim 27, further comprising:

deleting or erasing the digital certificate from storage other than the a tangible computer or machine readable storage medium onto which it was stored.

33. A method as in claim 27, wherein:

the certificate repository is a Lightweight Directory Access Protocol (LDAP) repository.

34. An authentication token apparatus comprising:

an integrated circuit having a processing logic unit and a storage unit coupled to the processing logic unit;

a substrate for carrying the integrated circuit;

the storage unit storing a certificate loader and control program comprising a plurality of certificate loader and control executable instructions; and

the plurality of certificate loader and control executable instructions being operable to cause the integrated circuit to interact with the authentication token control manager (card control manager) executing in the computer or information appliance.

35. An apparatus as in claim 34, wherein the authentication token comprises a smart card or a SIM card.

36. An apparatus as in claim 34, wherein the storage unit further storing a hash value of a digital certificate.

37. An apparatus as in claim 34, wherein the information from the electronic certificate memory or SIM card is retained in an internal non-volatile memory of the read/writer device so that the certificate information may be embedded on additional membership cards as the internal memory may be non-volatile memory.

38. An apparatus as in claim 34, wherein the information from the electronic certificate memory or SIM card is not retained in an internal non-volatile memory of the read/writer device or the internal memory is configured as a volatile memory so that the information from the electronic certificate memory or SIM card is not retained.

39. An apparatus as in claim 34, wherein the information from the electronic certificate memory or SIM card is automatically cleared when the device is disconnected from a power source or the powered USB interface.

40. An apparatus as in claim 34, wherein the information from the electronic certificate memory or SIM card is automatically cleared or deleted on the command of the cardholder user or under programmatic control.

41. An apparatus as in claim 34, wherein a synergistic combination of the Card Control Management software and its executable instructions, a USB-interface based dual-media reader/writer, and the embedding of the smart card with the certificate loader and control program, provides an operating system and environment with novel and unique features and capabilities.

43. A device as in claim 41, wherein the first physical connector comprises a SIM card slot for electrically interfacing with a SIM card first object or media type.

44. A device as in claim 41, wherein the second physical connector comprises a smart card slot for electrically interfacing with a smart card first object or media type.

45. A device as in claim 41, wherein the a third object comprises a computer, information appliance or workstation.

46. A device as in claim 41, wherein the a third object comprises USB connector for connecting to an external computer.

47. A device as in claim 41, wherein the controller unit comprises a micro-controller unit (MCU)) for enabling and controlling communications between the first, second, and third objects.

48. A device as in claim 41, wherein the controller unit comprises a micro-controller unit (MCU) for enabling and controlling communications for enabling and controlling communications between a SIM card as the first object, a smart card as the second object, and a computer, information appliance, or workstation as the third object.

49. A device as in claim 41, wherein the third physical connector comprises a USB connector.

50. A device as in claim 41, wherein the device comprises a USB hub for connecting and enabling communication between and among the computer, information appliance, or workstation that may be connected thereto and the SIM card (or other first object or media type) and the smart card (or other second object or media type).

51. A device as in claim 41, wherein the controller provides the internal memory used when copying and/or converting the digital certificates between the first object or first media type and the second object or second media type.

52. A device as in claim 51, the controller provide the only internal memory used when copying or converting the digital certificates between the first object or first media type and the second object or second media type, and the controller protects the internal memory from reading, writing, or interrogation from an unauthorized agent.

53. A device as in claim 51, wherein the digital certificates may be deployed to the authentication token media as wither PKCS#11 and PKCS#12 format.

42. A device for performing a reading and/or writing operation for two objects each of which has a memory storage, the device comprising:

a first physical connector for electrically interfacing with a first object or media type;

a second physical connector for electrically interfacing with a second object or media type;

a third physical connector for electrically interfacing with a third object; and

a controller unit for enabling and controlling communications between the first, second, and third objects.

54. A method for using unique digital values to prevent fraudulent access or use of an authentication token embedded with a security digital certificate, the method characterized in that a cryptographic hash value of that ID includes hashing a unique user ID is stored on the token and when the internally stored hash is accessed by a user password or PIN, a comparison of the stored hash value against the user ID is made to determine a match before access is permitted.

55. A device for using unique digital values to prevent fraudulent access or use of an authentication token embedded with a security digital certificate, the device characterized in that a cryptographic hash value of that ID includes hashing a unique user ID is stored on the token and when the internally stored hash is accessed by a user password or PIN, a comparison of the stored hash value against the user ID is made to determine a match before access is permitted.