US5721781A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Authentication system and method for smart card transactions
Assignee: Microsoft Technology Licensing LLC
•
Filing: 1995-09-13
•
Granted: 1998-02-24
•
Expires: 2015-09-13
Abstract
Abstract An authentication system includes a portable information device, such as a smart card, that is configured to store and process multiple different applications. The smart card is assigned its own digital certificate which contains a digital signature from a trusted certifying authority and a unique public key. Each of the applications stored on the smart card is also assigned an associated certificate having the digital signature of the certifying authority. The system further includes a terminal that is capable of accessing the smart card. The terminal has at least one compatible application which operates in conjunction with an application on the smart card. The terminal is assigned its own certificate which also contains the digital signature from the trusted certifying authority and a unique public key. Similarly, the application on the terminal is given an associated digital certificate. During a transactional session, the smart card and terminal exchange their certificates to authenticate one another. Thereafter, a smart card application is selected and the related certificates for both the smart card application and the terminal application are exchanged between the smart card and terminal to authenticate the applications. Additionally, the cardholder enters a unique PIN into the terminal. The PIN is passed to the smart card for use in authenticating the cardholder. The three-tiered authentication system promotes security in smart card transactions.
Inventors
- 👤 Vinay Deo
- 👤 Robert B. Seidensticker
- 👤 Daniel R. Simon
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-02 01:24
CPC Classifications
G; G06; G06Q; G06Q20/00; G06Q20/30; G06Q20/34; G06Q20/341; G06Q20/357; G06Q20/3576; G06Q20/36; G06Q20/367; G06Q20/3674; G06Q20/38; G06Q20/40; G06Q20/409; G06Q20/4097; G07; G07F; G07F7/00; G07F7/08; G07F7/0806; G07F7/0813; G07F7/082; G07F7/10; G07F7/1008; H; H04; H04L; H04L9/00; H04L9/32; H04L9/3234; H04L9/3263; H04L2209/00; H04L2209/56
Claims Analysis
Total Claims: 26
Claim 1
Independent Claim
149 words
A method for authenticating a transaction between a portable information device and a terminal, the portable information device storing a device-related certificate unique to the device and the terminal storing a terminal-related certificate unique to the terminal which includes information regarding a type of terminal, the method comprising the following steps: exchanging the device-related and terminal-related certificates between the portable information device and the terminal during a transaction; authenticating the portable information device and the terminal to each other using the exchanged device-related and terminal-related certificates; determining, at the portable information device, a security level for the terminal based on the terminal type information contained in the terminal-related certificate received from the terminal, the security level having an associated value limit for a value of the transaction conducted during the transactional session; and restricting the value of the transaction to the value limit associated with the determined security level.
Claim 2
Independent Claim
149 words
A method for authenticating a transaction between a portable information device and a terminal, the portable information device storing a device-related certificate unique to the device and the terminal storing a terminal-related certificate unique to the terminal which includes information regarding a type of terminal, the method comprising the following steps: exchanging the device-related and terminal-related certificates between the portable information device and the terminal during a transaction; authenticating the portable information device and the terminal to each other using the exchanged device-related and terminal-related certificates; determining, at the portable information device, a security level for the terminal based on the terminal type information contained in the terminal-related certificate received from the terminal, the security level having an associated value limit for a value of the transaction conducted during the transactional session; and restricting the value of the transaction to the value limit associated with the determined security level.
Claim 3
Dependent Claim
27 words
A method as recited in claim 1 and further comprising the additional step of encrypting communication between the portable information device and the terminal during the transaction.
Claim 4
Dependent Claim
59 words
A method as recited in claim 1, wherein the portable information device is associated with a user who has a unique PIN, and further comprising the following additional steps: receiving the PIN at the terminal during the transaction; passing the PIN from the terminal to the portable information device; and authenticating the the user at the portable information device.
Claim 5
Independent Claim
393 words
A method for conducting a transaction between a smart card and multiple various types of terminals that are each capable of accessing the smart card during the transaction, each terminal having at least one resident application stored thereon, the method comprising the following steps: storing multiple applications on the smart card, the applications being compatible target applications which operate in conjunction with a corresponding said resident application stored on each of the various terminals; establishing multiple security levels for corresponding types of terminals, the security levels having associated value limits for limiting a value of any transaction conducted on the corresponding terminal type; assigning a card-related certificate to the smart card, the card-related certificate having a digital signature of a certified authority and a public key unique to the smart card for use in data encryption; assigning terminal-related certificates to the various types of terminal, each terminal-related certificate having the digital signature of the certified authority and a public key unique to the terminal for use in data encryption, said each terminal-related certificate also having information regarding the type of terminal; assigning an application-related certificate to each application stored on the smart card and to the resident applications at the terminals, each application-related certificate having the digital signature of the certified authority and a public key unique to that application; commencing a transactional session between the smart card and a particular one of the terminals; exchanging the device-related and terminal-related certificates between the smart card and the particular terminal; authenticating the smart card and the particular terminal to each other using the exchanged device-related and terminal-related certificates; determining the security level for particular terminal, at the smart card, using the terminal type information contained in the terminal-related certificate received from the particular terminal; selecting a target application from among the multiple applications stored on the smart card that is compatible with the resident application stored at the particular terminal; exchanging, between the smart card and the particular terminal, the application-related certificates assigned to the selected target application stored on the smart card and the resident application stored at the particular terminal; authenticating the target and resident applications using their exchanged application-related certificates; conducting the transaction after the target application has been authenticated; and restricting the value of the transaction to the value limit associated with the security level determined for the particular terminal.
Claim 6
Independent Claim
393 words
A method for conducting a transaction between a smart card and multiple various types of terminals that are each capable of accessing the smart card during the transaction, each terminal having at least one resident application stored thereon, the method comprising the following steps: storing multiple applications on the smart card, the applications being compatible target applications which operate in conjunction with a corresponding said resident application stored on each of the various terminals; establishing multiple security levels for corresponding types of terminals, the security levels having associated value limits for limiting a value of any transaction conducted on the corresponding terminal type; assigning a card-related certificate to the smart card, the card-related certificate having a digital signature of a certified authority and a public key unique to the smart card for use in data encryption; assigning terminal-related certificates to the various types of terminal, each terminal-related certificate having the digital signature of the certified authority and a public key unique to the terminal for use in data encryption, said each terminal-related certificate also having information regarding the type of terminal; assigning an application-related certificate to each application stored on the smart card and to the resident applications at the terminals, each application-related certificate having the digital signature of the certified authority and a public key unique to that application; commencing a transactional session between the smart card and a particular one of the terminals; exchanging the device-related and terminal-related certificates between the smart card and the particular terminal; authenticating the smart card and the particular terminal to each other using the exchanged device-related and terminal-related certificates; determining the security level for particular terminal, at the smart card, using the terminal type information contained in the terminal-related certificate received from the particular terminal; selecting a target application from among the multiple applications stored on the smart card that is compatible with the resident application stored at the particular terminal; exchanging, between the smart card and the particular terminal, the application-related certificates assigned to the selected target application stored on the smart card and the resident application stored at the particular terminal; authenticating the target and resident applications using their exchanged application-related certificates; conducting the transaction after the target application has been authenticated; and restricting the value of the transaction to the value limit associated with the security level determined for the particular terminal.
Claim 7
Dependent Claim
18 words
A method according to claim 4 and further comprising associating monetary value limits with the different security levels.
Claim 8
Dependent Claim
58 words
A method as recited in claim 4 and further comprising the following additional steps: associating the smart card with a cardholder; assigning a unique PIN to the cardholder; inputting the PIN to the particular terminal during the transactional session; passing the PIN from the particular terminal to the smart card; and authenticating the cardholder at the smart card.
Claim 9
Dependent Claim
153 words
A method as recited in claim 6 wherein the multiple various terminals are off-line and on-line types of terminals, the method further comprising the following additional steps: establishing a first security level that is associated with an off-line terminal that has an unexpired terminal-related certificate; establishing a second security level that is associated with an on-line terminal that has an unexpired terminal-related certificate, the second security level being of higher security than the first security level; establishing a third security level that is associated with an off-line terminal that has an unexpired terminal-related certificate and requires the PIN from the cardholder, the third security level being of higher security than the second security level; and establishing a fourth security level that is associated with an on-line terminal that has an unexpired terminal-related certificate and requires the PIN from the cardholder, the fourth security level being of higher security than the third security level.
Claim 10
Dependent Claim
24 words
A method as recited in claim 7 and further comprising associating monotonically increasing monetary value limits with the first through fourth security levels, respectively.
Claim 11
Dependent Claim
36 words
A method as recited in claim 4 and further comprising the additional step of encrypting the application-related certificates before exchanging them using the public keys from the device-related and terminal-related certificates that have already been exchanged.
Claim 12
Independent Claim
120 words
A system comprising: a portable information device having a microprocessor capable of processing multiple applications, the portable information device having an associated device-related certificate; multiple terminals of various types capable of accessing the portable information device, the terminals having associated security levels wherein the security levels have associated value limits for a value of a transaction, each terminal having an associated terminal-related certificate which contains information pertaining to the terminal type; means for exchanging the device-related and terminal-related certificates between a particular terminal and the portable information device; and the portable information device having means for determining the security level for a particular terminal based upon the terminal type information contained in a terminal-related certificate associated with the particular terminal.
Claim 13
Independent Claim
120 words
A system comprising: a portable information device having a microprocessor capable of processing multiple applications, the portable information device having an associated device-related certificate; multiple terminals of various types capable of accessing the portable information device, the terminals having associated security levels wherein the security levels have associated value limits for a value of a transaction, each terminal having an associated terminal-related certificate which contains information pertaining to the terminal type; means for exchanging the device-related and terminal-related certificates between a particular terminal and the portable information device; and the portable information device having means for determining the security level for a particular terminal based upon the terminal type information contained in a terminal-related certificate associated with the particular terminal.
Claim 14
Dependent Claim
16 words
A system as recited in claim 10 wherein the portable information device comprises a smart card.
Claim 15
Dependent Claim
18 words
A system as recited in claim 10 wherein the portable information device comprises a portable personal digital assistant.
Claim 16
Dependent Claim
16 words
A system as recited in claim 10 wherein the portable information device comprises an electronic watch.
Claim 17
Dependent Claim
20 words
A system as recited in claim 10 wherein the portable information device has a file system for managing multiple files.
Claim 18
Dependent Claim
51 words
A system as recited in claim 10 and further comprising an input mechanism at the terminal to enable a cardholder to enter a PIN, the terminal transferring the PIN to the portable information device so that the authentication means can verify the authenticity of the cardholder to the portable information device.
Claim 19
Dependent Claim
86 words
A portable information device for use in transactions with a terminal, the portable information device comprising: a memory for storing at least one application; a processor programmed to: (1) receive a terminal-related certificate from the terminal, the terminal-related certificate containing information pertaining to the type of terminal; (2) authenticate the terminal using the received terminal-related certificate; (3) analyze the terminal type from the information contained in the terminal-related certificate: and (4) limit any transaction to a selected monetary amount based upon the the type of terminal.
Claim 20
Dependent Claim
86 words
A portable information device for use in transactions with a terminal, the portable information device comprising: a memory for storing at least one application; a processor programmed to: (1) receive a terminal-related certificate from the terminal, the terminal-related certificate containing information pertaining to the type of terminal; (2) authenticate the terminal using the received terminal-related certificate; (3) analyze the terminal type from the information contained in the terminal-related certificate: and (4) limit any transaction to a selected monetary amount based upon the the type of terminal.
Claim 21
Dependent Claim
29 words
A portable information device as recited in claim 16 wherein the processor is programmed to encrypt communication output to the terminal and to decrypt communication received from the terminal.
Claim 22
Dependent Claim
41 words
A portable information device as recited in claim 16 wherein the memory stores a PIN of an associated user, the processor is further programmed to receive a PIN from the terminal and to authenticate the user based upon the received PIN.
Claim 23
Dependent Claim
29 words
A portable information device as recited in claim 16 wherein the memory stores multiple applications and one of the applications comprises a file system capable of managing multiple files.
Claim 24
Dependent Claim
25 words
Computer-readable media resident at the portable information device and the terminal having computer-executable instructions for performing the steps in the method recited in claim 1.
Claim 25
Dependent Claim
75 words
In a system involving a transaction between a portable information device and a terminal, a computer-readable media provided at the portable information device having computer-executable instructions for performing the following steps: receiving a certificate from the terminal, the certificate containing information pertaining to a type of terminal; analyzing the terminal type from the information contained in the certificate; and limiting any transaction with the terminal to a selected value based upon the type of terminal.
Claim 26
Dependent Claim
75 words
In a system involving a transaction between a portable information device and a terminal, a computer-readable media provided at the portable information device having computer-executable instructions for performing the following steps: receiving a certificate from the terminal, the certificate containing information pertaining to a type of terminal; analyzing the terminal type from the information contained in the certificate; and limiting any transaction with the terminal to a selected value based upon the type of terminal.
References Cited (Backward Citations)
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2001-02-23 | 2001-08-25 | 2002-02-24 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2005-02-23 | 2005-08-25 | 2006-02-24 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2009-02-23 | 2009-08-25 | 2010-02-24 | $7700.00 | Window Closed / Lapsed |