Method and system for personal identification

Claim 1

A method for enabling an authorized user of a personal identification card to effect a transaction using a transaction terminal, comprising the steps of: generating a first data string having a portion thereof which is derived from a physical characteristic of the authorized user and need not be retained secret; mapping the first data string using a predetermined function F to generate a second data string Q having a length substantially less than the length of the first data string; digitally signing the second data string with a private key of a public-key cryptosystem pair to generate a signature corresponding to the second data string, the public-key cryptosystem pair also having a public key M; encoding the first data string and the signature to generate an encoded first data string/signature; storing the encoded first data string/signature on the personal identification card; receiving the personal identification card at the transaction terminal; decoding the encoded first data string/signature on the received personal identification card to generate the first data string and a received signature; mapping the first data string with the predetermined function F to generate the second data string; digitally verifying, using the public key M of the public-key cryptosystem pair, whether the received signature can be generated from the second data string; if the received signature can be generated from the second data string using the public key, generating an indication that the received signature is valid; generating a representation from the first data string; and displaying the representation and the indication on a display of the transaction terminal to enable an operator thereof to verify that the user is authorized to effect a transaction using the personal identification card.

Claim 2

A method for enabling an authorized user of a personal identification card to effect a transaction using a transaction terminal, comprising the steps of: generating a first data string having a portion thereof which is derived from a physical characteristic of the authorized user and need not be retained secret; mapping the first data string using a predetermined function F to generate a second data string Q having a length substantially less than the length of the first data string; digitally signing the second data string with a private key of a public-key cryptosystem pair to generate a signature corresponding to the second data string, the public-key cryptosystem pair also having a public key M; encoding the first data string and the signature to generate an encoded first data string/signature; storing the encoded first data string/signature on the personal identification card; receiving the personal identification card at the transaction terminal; decoding the encoded first data string/signature on the received personal identification card to generate the first data string and a received signature; mapping the first data string with the predetermined function F to generate the second data string; digitally verifying, using the public key M of the public-key cryptosystem pair, whether the received signature can be generated from the second data string; if the received signature can be generated from the second data string using the public key, generating an indication that the received signature is valid; generating a representation from the first data string; and displaying the representation and the indication on a display of the transaction terminal to enable an operator thereof to verify that the user is authorized to effect a transaction using the personal identification card.

Claim 13

A method for issuing a personal identification card for an authorized user of the personal identification card, comprising the steps of: generating a pictorial representation of a physical characteristic of the authorized user; processing the pictorial representation to generate a first data string; mapping the first data string with a predetermined one-way function to generate a second data string Q having a length substantially less than the length of the first data string; digitally signing the second data string Q with a private key of a first public-key cryptosystem pair to generate a first signature, where P 1 and P 2 are secret prime numbers and the first public-key cryptosystem pair also includes a public key M which is equal to a product of P 1 multiplied by P 2 ; encoding the first data string and the first signature with an error-correcting code to generate an encoded first data string/signature; and storing the encoded first data string/signature on the personal identification card.

Claim 14

A method for issuing a personal identification card for an authorized user of the personal identification card, comprising the steps of: generating a pictorial representation of a physical characteristic of the authorized user; processing the pictorial representation to generate a first data string; mapping the first data string with a predetermined one-way function to generate a second data string Q having a length substantially less than the length of the first data string; digitally signing the second data string Q with a private key of a first public-key cryptosystem pair to generate a first signature, where P 1 and P 2 are secret prime numbers and the first public-key cryptosystem pair also includes a public key M which is equal to a product of P 1 multiplied by P 2 ; encoding the first data string and the first signature with an error-correcting code to generate an encoded first data string/signature; and storing the encoded first data string/signature on the personal identification card.

Claim 21

A system for issuing authorized personal identification cards and for preventing unauthorized use thereof, comprising: issuing terminal means for issuing a plurality of personal identification cards, each of said cards having stored therein a first data string with a portion thereof derived from a physical characteristic of an authorized user of the card, each of said cards also having stored therein a signature derived from a second data string using a private key of a public-key cryptosystem pair, the public-key cryptosystem pair also having a public key, the second data string being derived from the first data string using a predetermined one-way function and having a length substantially less than the length of the first data string; and transaction terminal means including at least one transaction terminal for receiving a personal identification card offered to effect a transaction using the transaction terminal, the personal identification card having the first data string and a received signature stored therein, wherein the transaction terminal comprises means, using the public key of the public-key cryptosystem pair, for verifying that the received signature can be generated from the first data string, means responsive to the verifying means for generating a representation from the first data string, and means for displaying the representation and an indication of whether the received signature can be generated from the first data string to enable an operator of the transaction terminal to verify that the user of the offered personal identification card is authorized to effect a transaction.

Claim 22

A system for issuing authorized personal identification cards and for preventing unauthorized use thereof, comprising: issuing terminal means for issuing a plurality of personal identification cards, each of said cards having stored therein a first data string with a portion thereof derived from a physical characteristic of an authorized user of the card, each of said cards also having stored therein a signature derived from a second data string using a private key of a public-key cryptosystem pair, the public-key cryptosystem pair also having a public key, the second data string being derived from the first data string using a predetermined one-way function and having a length substantially less than the length of the first data string; and transaction terminal means including at least one transaction terminal for receiving a personal identification card offered to effect a transaction using the transaction terminal, the personal identification card having the first data string and a received signature stored therein, wherein the transaction terminal comprises means, using the public key of the public-key cryptosystem pair, for verifying that the received signature can be generated from the first data string, means responsive to the verifying means for generating a representation from the first data string, and means for displaying the representation and an indication of whether the received signature can be generated from the first data string to enable an operator of the transaction terminal to verify that the user of the offered personal identification card is authorized to effect a transaction.

Claim 24

A system for allowing authorizing users of personal identification cards to effect transactions via at least one transaction terminal comprising a plurality of said cards each having stored therein a signature which is the digital signature of a second data string, the second data string being derived from a first data string derived from a physical characteristic associated with a respective user, the second data string derived from the first data string using a predetermined one-way function and having a length substantially less than the length of the first data string, the signature stored in each of said cards having been derived with the same private key of a public-key cryptosystem pair also having a public key; and at least one transaction terminal having means for controlling (1) the retrieval of the first data string and the signature stored in the inserted card, (2) the digital verification of the signature with the use of the public key of the public-key cryptosystem pair, (3) the generation of a pictorial representation from the first data string, and (4) the effecting of a transaction only if the signature is verified and the pictorial representation matches the user.

Claim 25

A system for allowing authorizing users of personal identification cards to effect transactions via at least one transaction terminal comprising a plurality of said cards each having stored therein a signature which is the digital signature of a second data string, the second data string being derived from a first data string derived from a physical characteristic associated with a respective user, the second data string derived from the first data string using a predetermined one-way function and having a length substantially less than the length of the first data string, the signature stored in each of said cards having been derived with the same private key of a public-key cryptosystem pair also having a public key; and at least one transaction terminal having means for controlling (1) the retrieval of the first data string and the signature stored in the inserted card, (2) the digital verification of the signature with the use of the public key of the public-key cryptosystem pair, (3) the generation of a pictorial representation from the first data string, and (4) the effecting of a transaction only if the signature is verified and the pictorial representation matches the user.

Claim 30

A method for personal identification, comprising the steps of: generating a first data string having a portion thereof which is derived from a physical characteristic of a user and need not be retained secret; mapping the first data string using a predetermined function to generate a second data string; digitally signing the second data string with a private key of a public-key cryptosystem pair to generate a signature corresponding to the second data string, the public-key cryptosystem pair also including a public key; encoding the first data string and the signature to generate an encoded first data string/signature; transmitting the encoded first data string/signature over a communications channel; receiving the encoded first data string/signature at a transaction terminal; decoding the received encoded first data string/signature to generate the first data string and a received signature; mapping the first data string with the predetermined function to generate the second data string; digitally verifying, using the public key of the public-key cryptosystem pair, whether the received signature can be generated from the second data string; if the received signature can be generated from the second data string using the public key, generating an indication that the received signature is valid; generating a representation from the first data string; and displaying the representation and the indication on a display of the transaction terminal to enable an operator thereof to verify that the user is authorized to effect a transaction.

Claim 31

A method for personal identification, comprising the steps of: generating a first data string having a portion thereof which is derived from a physical characteristic of a user and need not be retained secret; mapping the first data string using a predetermined function to generate a second data string; digitally signing the second data string with a private key of a public-key cryptosystem pair to generate a signature corresponding to the second data string, the public-key cryptosystem pair also including a public key; encoding the first data string and the signature to generate an encoded first data string/signature; transmitting the encoded first data string/signature over a communications channel; receiving the encoded first data string/signature at a transaction terminal; decoding the received encoded first data string/signature to generate the first data string and a received signature; mapping the first data string with the predetermined function to generate the second data string; digitally verifying, using the public key of the public-key cryptosystem pair, whether the received signature can be generated from the second data string; if the received signature can be generated from the second data string using the public key, generating an indication that the received signature is valid; generating a representation from the first data string; and displaying the representation and the indication on a display of the transaction terminal to enable an operator thereof to verify that the user is authorized to effect a transaction.

Claim 32

A method for enabling an authorized user of a personal identification card to effect a transaction using a transaction terminal, comprising the steps of: generating a first data string having a portion thereof which is derived from a physical characteristic of the authorized user and need not be retained secret; digitally signing the first data string with a private key of a public-key cryptosystem pair to generate a signature corresponding to the first data string, the public-key cryptosystem pair also having a public key M; storing the first data string and the signature on the personal identification card; receiving the personal identification card at the transaction terminal; digitally verifying, using the public key M of the public-key cryptosystem pair, whether the signature on the personal identification card received at the transaction terminal can be generated from the first data string; if the signature can be generated from the first data string using the public key, generating an indication that the signature is valid; generating a representation from the first data string; and displaying the representation and the indication on a display of the transaction terminal to enable an operator thereof to verify that the user is authorized to effect a transaction using the personal identification card.

Claim 33

A method for enabling an authorized user of a personal identification card to effect a transaction using a transaction terminal, comprising the steps of: generating a first data string having a portion thereof which is derived from a physical characteristic of the authorized user and need not be retained secret; digitally signing the first data string with a private key of a public-key cryptosystem pair to generate a signature corresponding to the first data string, the public-key cryptosystem pair also having a public key M; storing the first data string and the signature on the personal identification card; receiving the personal identification card at the transaction terminal; digitally verifying, using the public key M of the public-key cryptosystem pair, whether the signature on the personal identification card received at the transaction terminal can be generated from the first data string; if the signature can be generated from the first data string using the public key, generating an indication that the signature is valid; generating a representation from the first data string; and displaying the representation and the indication on a display of the transaction terminal to enable an operator thereof to verify that the user is authorized to effect a transaction using the personal identification card.

Claim 34

A method for enabling an authorized user of a personal identification card to effect a transaction using a transaction terminal, the personal identification card having stored therein a first data string having a portion thereof which is derived from a physical characteristic of the authorized user and need not be retained secret, and a signature of the first data string derived from a private key of a public-key cryptosystem pair, the public-key cryptosystem pair also having a public key M, comprising the steps of: receiving the personal identification card at the transaction terminal; digitally verifying, using the public key M of the public-key cryptosystem pair, whether the signature on the personal identification card received at the transaction terminal an be generated from the first data string; if the signature can be generated from the first data string using the public key, generating an indication that the signature is valid; generating a representation from the first data string; and displaying the representation and the indication on a display of the transaction terminal to enable an operator thereof to verify that the user is authorized to effect a transaction using the personal identification card.

Claim 35

A method for enabling an authorized user of a personal identification card to effect a transaction using a transaction terminal, the personal identification card having stored therein a first data string having a portion thereof which is derived from a physical characteristic of the authorized user and need not be retained secret, and a signature of the first data string derived from a private key of a public-key cryptosystem pair, the public-key cryptosystem pair also having a public key M, comprising the steps of: receiving the personal identification card at the transaction terminal; digitally verifying, using the public key M of the public-key cryptosystem pair, whether the signature on the personal identification card received at the transaction terminal an be generated from the first data string; if the signature can be generated from the first data string using the public key, generating an indication that the signature is valid; generating a representation from the first data string; and displaying the representation and the indication on a display of the transaction terminal to enable an operator thereof to verify that the user is authorized to effect a transaction using the personal identification card.