Method and system for secure guaranteed transactions over a computer network

• US 6,957,334 B1
• Filed: 06/20/2000
• Issued: 10/18/2005
• Est. Priority Date: 06/23/1999
• Status: Active Grant

• Current Assignee: Mastercard International Incorporated (MasterCard Incorporated)
• Original Assignee: Mastercard International Incorporated (MasterCard Incorporated)
• Inventors: Goldstein, Theodore C., Rubin, Paul H.
• Primary Examiner(s): Peeso, Thomas R.
• Application Number:
  US09/598,016
• Time in Patent Office: 1,946 Days
• Field of Search: 713/170, 713/176, 713/180, 713/182
• US Class Current: 713/170
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2211/008 Public Key, Asymmetric Key, Asymmetric Encryption
• CPC Class Codes: G06F 2221/2151 Time stamp
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/12 specially adapted for electronic shopping systems
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32

Abstract

A trusted third-party authentication protocol that facilitates secure commercial transactions over computer networks between a merchant and a user. The method and system of the present invention generally involves three entities: 1) a guarantor, which acts as a trusted arbitrator, 2) a merchant, and 3) a consumer or user. In one embodiment, the guarantor authenticates users and provides authentication documents back to the user for use in transactions with merchants. The authentication document generated by the guarantor can be used as a means to validate a user'"'"'s identity and/or to provide authorization/validation of a specific transaction.

Claims

1. A method for providing secure guaranteed transactions over a computer network, said transactions conducted between a user and a recipient merchant, said method comprising the steps of

a) authenticating a user;

b) receiving a recipient merchant request;

c) generating an authentication document, if said user is authentic;

d) adding a digital signature to said authentication document; and

e) transmitting said authentication document and a URL link comprising a recipient merchant site address to said user, whereby the user can access said recipient merchant site by activating said URL link.

6. The method of claim 1, wherein said merchant has at least one encryption key, further comprising the step of

f) encrypting said authentication document with the encryption key of said merchant before performing said transmitting step (e).

7. The method of claim 6 wherein said encryption key is a shared encryption key between a guarantor and said merchant.

8. The method of claim 6 wherein said encryption key is a public key of said merchant.

9. The method of claim 1 or 2 wherein said authentication document includes payment information corresponding to said user.

10. The method of claim 9 wherein said authentication document further includes a guarantee number and a time stamp.

11. The method of claim 9 wherein said authentication document further includes a guarantee number and a time limit.

12. The method of claim 1, or wherein said authentication document is signed with a private key of said guarantor.

13. The method of claim 1, or wherein said digital signature in step (d) is created with a secret key of said guarantor using a key-dependent one way hash-function, and wherein said recipient merchant possesses said secret key.

14. The method of claim 1, or wherein said digital signature in step (d) is generated with a private key of said guarantor using an asymmetric algorithm.

15. The method of claim 1, or wherein said adding step (d) comprises the steps of

(dl) hashing said authentication document;

(d2) creating a digital signature by applying a public-key algorithm to said hashed authentication document using a private key of said guarantor; and

(d3) adding said digital signature to said authentication document.

2. A method for providing secure guaranteed transactions over a computer network, said transactions conducted between a user and a recipient merchant, said merchant having at least one public encryption key and a corresponding private key, said method comprising the steps of

(a) authenticating a user;

(b) receiving a recipient merchant request;

(c) generating an authentication document, if said user is authentic;

(d) adding a digital signature to said authentication document,

(e) encrypting said authentication document with the public key of said recipient merchant; and

(f) transmitting said encrypted authentication document to said user,

wherein said transmitting step (f) further comprises the steps of packaging said encrypted authentication document as an open cookie; and

transmitting said open cookie to said user.

3. An apparatus for providing secure guaranteed transactions over a computer network, said transactions conducted between a user and a recipient merchant, said user authenticated by a guarantor, said apparatus comprising:

a database, said database containing a list user accounts and passwords, or encrypted representations thereof, corresponding to said user accounts; and

a server operably coupled to said database, said server comprising;

means for authenticating a user and receiving a recipient merchant request;

means for generating an authentication document;

means for adding a digital signature to said authentication document,

means for generating a URL link comprising a recipient merchant site address; and

means for transmitting said encrypted authentication document and said URL link to said user.

17. The apparatus of claim 3 wherein said merchant having at least one public encryption key, further comprising means for encrypting said authentication document with the public key of said recipient merchant.

18. The apparatus of claim 3 or 17 wherein said transmitting means further comprises means for packaging said authentication document as an open cookie.

4. A method for providing secure guaranteed transactions over a computer network, said transactions conducted between a user and a recipient merchant, said merchant having at least one public encryption key, said user authenticated by a guarantor, said method comprising the steps of

a) receiving an authentication document from a user, said authentication document encrypted with a public encryption key of said recipient merchant and including a digital signature;

b) decrypting said authentication document with the corresponding private key of said recipient merchant;

c) authenticating said digital signature; and

d) processing the user'"'"'s request, if said digital signature is authentic and said authentication document is valid,

wherein said authentication document is packaged as an open cookie and wherein said receiving step (a) comprises uploading said open cookie.

19. The method of claim 4 wherein said authentication document includes payment information, wherein said user request is a purchase request, and wherein said processing step (d) further comprises using said payment information in said authentication document to complete a transaction.

20. The method of claim 4 wherein said recipient merchant request includes a merchant transaction identifier;

and wherein said authentication document generated in step (c) includes said merchant transaction identifier.

21. The method of claim 20 wherein said recipient merchant request originates from a merchant as a redirect message transmitted to said user.

5. A method for providing secure guaranteed transactions over a computer network, said transactions conducted between a user and a recipient merchant, said method comprising the steps of

a) authenticating a user;

b) receiving a recipient merchant request, said recipient merchant request including a merchant transaction identifier;

c) generating an authentication document including said merchant transaction identifier, if said user is authentic;

d) adding a digital signature to said authentication document; and

e) transmitting said authentication document to said user,

wherein said recipient merchant request originates from a merchant as a redirect message transmitted to said user.

16. The method of claim wherein said public key and said private key are shared by at least two recipient merchants.