Central key authority database in an ABDS system

• US 7,096,354 B2
• Filed: 02/01/2003
• Issued: 08/22/2006
• Est. Priority Date: 08/04/2000
• Status: Expired due to Term

• Current Assignee: First Data Corporation (Fiserv Incorporated)
• Original Assignee: First Data Corporation (Fiserv Incorporated)
• Inventors: Wheeler, Lynn Henry, Wheeler, Anne M.
• Primary Examiner(s): Zand, Kambiz
• Application Number:
  US10/248,622
• Publication Number:
  US 20030097573A1
• Time in Patent Office: 1,298 Days
• Field of Search: 713/155, 713/156, 713/157, 713/176, 713/167, 380/284, 705/64, 705/71
• US Class Current: 713/155
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/12 specially adapted for electronic shopping systems
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/3823 combining multiple encryption tools for a transaction
• CPC Class Codes: G06Q 20/3825 Use of electronic signatures
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/388 using mutual authentication without cards, e.g. challenge-response
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G06Q 20/403 Solvency checks
• CPC Class Codes: G06Q 20/40975 using encryption therefor
• CPC Class Codes: G07F 7/0886 the card reader being portable for interacting with a POS or ECR in realizing a payment transaction
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: G07F 7/1016 Devices or methods for securing the PIN and other transaction-data, e.g. by encryption arrangements for secret communication, see H04L9/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32

Abstract

Managing a database of a central key authority for a plurality of account holders, each account holder having at least one account associated with a public key of a public-private key pair of that account holder, includes maintaining for each account holder a record of information pertaining to the accounts of that account holder associated with the public keys of the account holder. The information pertaining to the accounts of an account holder includes (a) a public key of a user device that generates digital signatures, and (b) third-party account identifiers each of which identifies to a third-party an account of the user that is maintained with the third-party and that has been associated with the user'"'"'s public key by the third-party.

Claims

1. A method of managing a central repository database by a Central Key Authority on behalf of a plurality of account holders and a plurality of account authorities, comprising the steps of:

(i) maintaining in the central repository database a list of the plurality of account holders and a list of the plurality of account authorities;

(ii) associating in the central depository database, for each respective account holder;

(a) a record of information pertaining to at least one account of the respective account holder, said at least one account being maintained with a respective one of the account authorities, with

(b) a public key of a public-private key pair of the respective account holder; and

(iii) acting on the information from the central depository database upon authorized request;

wherein the at least one account of the respective account holder is already associated with the public key of the respective account holder in an account database of the respective account authority, and wherein the private key of the public-private key pair of the respective account holder is used to originate digital signatures.

2. The method of claim 1, wherein the respective account holder has a plurality of public keys, each such public key being associated with one or more accounts of the respective account holder.

3. The method of claim 1, wherein the respective account holder has a plurality of accounts and wherein each of the accounts is associated with the public key of the respective account holder.

4. The method of claim 3 further comprising maintaining a list of the plurality of accounts of the respective account holder.

5. The method of claim 1, wherein the information includes the identity of the respective account authority.

6. The method of claim 1, wherein the information includes a unique identifier used by the respective account authority to identify said at least one account in the account database of the respective account authority.

7. The method of claim 1, wherein the information includes attributes of said at least one account.

8. The method of claim 1, wherein the information includes personal information of the respective account holder.

9. The method of claim 1, wherein the information includes data regarding a device of the respective account holder, said device containing the private key of the public-private key pair of the respective account holder.

10. The method of claim 9, wherein the data regarding the device includes security features of the device.

11. The method of claim 9, wherein the data regarding the device is obtained from a manufacturer of the device.

12. The method of claim 9, wherein the data regarding the device is obtained from a distributor of the device.

13. The method of claim 1, wherein the information pertaining to at least one account of the respective account holder is obtained from the respective account authority.

14. The method of claim 1, wherein the step of acting on the information comprises notifying the respective account authority that the private key corresponding with the public key associated with the at least one account of the respective account holder has been lost, stolen, or compromised.

15. The method of claim 14, wherein, before notifying the respective account authority, the Central Key Authority determines that the private key has been lost, stolen, or compromised.

16. The method of claim 14, wherein, before notifying the respective account authority, the Central Key Authority is notified that the private key has been lost, stolen, or compromised.

17. The method of claim 14, wherein the step of acting on the information further comprises providing the respective account authority with a new public key of the respective account holder.

18. The method of claim 1, wherein the step of acting on the information comprises providing at least the public key of the respective account holder to another one of the account authorities with which the respective account holders desires to establish a new account.

19. The method of claim 18, wherein no personal information regarding the respective account holder is provided to the another one of the account authorities.

20. The method of claim 1, wherein the information includes an account number.

21. The method of claim 1, wherein the information includes the name of the respective account holder.

22. The method of claim 1, wherein the information includes the address of the respective account holder.

23. The method of claim 1, wherein the information includes the social security number of the respective account holder.

24. The method of claim 1, wherein the information includes the tax identification number of the respective account holder.

25. A method of maintaining a Central Key Authority (CKA) computer database on behalf of a plurality of account holders and account authorities, each respective account holder having a user device, the CKA computer database being maintained by a Central Key Authority and wherein the CKA computer database is not contained in any of the user devices, comprising the steps of:

for each respective account holder;

(a) storing in the CKA database a public key of a public-private key pair, wherein the user device of the respective account holder generates digital signatures using a private key of the public-private key pair, wherein the private key is maintained securely within the respective user device; and

(b) associating in the CKA database at least one record of information pertaining to at least one account of the respective account holder, the at least one account being maintained with a respective one of the account authorities, wherein the respective account authority is distinct and separate from the CKA and wherein the public key of the user device has been previously associated with the at least one account of the respective account holder by the respective account authority.

26. The method of claim 25, wherein the respective account holder has a plurality of public keys, each such public key being associated with one or more accounts of the respective account holder, and wherein each corresponding private key is maintained within the respective user device.

27. The method of claim 25, wherein the respective account holder has a plurality of public keys, each such public key being associated with one or more accounts of the respective account holder, and wherein each corresponding private key is maintained within a plurality of respective user devices of the respective account holder.

28. The method of claim 25, wherein the respective account holder has a plurality of accounts and wherein each of the accounts is associated with the public key of the respective account holder.

29. The method of claim 28 further comprising maintaining a list of the plurality of accounts of the respective account holder.

30. The method of claim 25, wherein the information includes the identity of the respective account authority.

31. The method of claim 25, wherein the information includes a unique identifier used by the respective account authority to identify said at least one account maintained by the respective account authority.

32. The method of claim 25, wherein the information includes attributes of said at least one account.

33. The method of claim 25, wherein the information includes personal information of the respective account holder.

34. The method of claim 25, further comprising storing in the CKA database data regarding the user device of the respective account holder, the data including security features or manufacturing history of the user device.

35. The method of claim 34, wherein the data regarding the user device is obtained from a manufacturer of the user device.

36. The method of claim 34, wherein the data regarding the user device is obtained from a distributor of the user device.

37. The method of claim 25, wherein the information pertaining to at least one account of the respective account holder is obtained from the respective account authority.

38. The method of claim 25, further comprising the step of notifying the respective account authority that the private key of the respective user device has been lost, stolen, or compromised.

39. The method of claim 38, wherein, before notifying the respective account authority, the Central Key Authority determines that the private key has been lost, stolen, or compromised.

40. The method of claim 38, wherein, before notifying the respective account authority, the Central Key Authority is notified that the private key has been lost, stolen, or compromised.

41. The method of claim 25 further comprising providing the respective account authority with a new public key of the respective account holder.

42. The method of claim 41, wherein the new public key of the respective account holder corresponds with another private key maintained securely within the respective user device.

43. The method of claim 41, wherein the new public key of the respective account holder corresponds with another private key maintained in another user device of the respective account holder.