US6038551A
Expired / Lapsed
US
⏱️ 0.0 years remaining
System and method for configuring and managing resources on a multi-purpose integrated circuit card using a personal computer
Assignee: Microsoft Technology Licensing LLC
•
Filing: 1996-03-11
•
Granted: 2000-03-14
•
Expires: 2016-03-11
Abstract
Abstract A computerized system offers a uniform platform for conducting electronic transactions in multiple different environments. The system includes a portable, multi-purpose, integrated circuit (IC) card and complimentary computer software which enables access and management of resources maintained on the IC card. The software runs on a user's personal computer, empowering the user to initialize the IC card, configure the card with the resources that the user wants to maintain on the card, and to manage those resources. The software enables the user to generate private/public key pairs and establish or change passcodes for access to the card resources. The IC card itself provides the electronic vehicle for securely transporting the user's private keys and certificates without exposing them in plaintext form. The IC card is designed with enough processing capabilities to perform rudimentary cryptographic functions so that the private keys may be employed for signing or encryption without ever being released from the card.
Inventors
- 👤 Doug Barlow
- 👤 Blair Dillaway
- 👤 Barbara Fox
- 👤 Terry Lipscomb
- 👤 Terrence Spies
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-28 23:07
CPC Classifications
G; G07; G07F; G07F7/00; G07F7/08; G07F7/10; G07F7/1008; G06; G06Q; G06Q20/00; G06Q20/08; G06Q20/10; G06Q20/105; G06Q20/30; G06Q20/34; G06Q20/341; G06Q20/355; G06Q20/3552; G06Q20/357; G06Q20/3576; G06Q20/35765; G06Q20/36; G06Q20/367; G06Q20/3672; G06Q20/38; G06Q20/40
Claims Analysis
Total Claims: 61
Claim 1
Independent Claim
119 words
A system for supporting at least one computer-implemented application to access and manage a multi-purpose integrated circuit (IC) card, the system comprising: a multi-purpose integrated circuit (IC) card having a plurality of resources for different uses; a card reader which interfaces with the IC card to transfer information to and from the IC card; a computers coupled to the card reader, to implement at least one application to enable a user to access and manage select resources of the plurality of resources of the IC card; and an application-independent application interface executing on the computer to implement services utilized by the computer-implemented application to facilitate user access to certain of the plurality of resources provided by the IC card.
Claim 2
Independent Claim
119 words
A system for supporting at least one computer-implemented application to access and manage a multi-purpose integrated circuit (IC) card, the system comprising: a multi-purpose integrated circuit (IC) card having a plurality of resources for different uses; a card reader which interfaces with the IC card to transfer information to and from the IC card; a computers coupled to the card reader, to implement at least one application to enable a user to access and manage select resources of the plurality of resources of the IC card; and an application-independent application interface executing on the computer to implement services utilized by the computer-implemented application to facilitate user access to certain of the plurality of resources provided by the IC card.
Claim 3
Dependent Claim
24 words
A system as recited in claim 1, wherein the application-independent application interface supports configuration services which permit a user to reconfigure the IC card.
Claim 4
Dependent Claim
29 words
A system as recited in claim 1, wherein the application-independent application interface supports resource management services which permit a user to manage the resources provided by the IC card.
Claim 5
Dependent Claim
47 words
A system as recited in claim 1, further comprising: an operating system executing on the computer, the application being run on the operating system; and the application-independent application interface is implemented as a service layer for the operating system and is securely integrated with the operating system.
Claim 6
Dependent Claim
15 words
A system as recited in claim 1, wherein the IC card is a smart card.
Claim 7
Dependent Claim
43 words
A system as recited in claim 1, wherein: the IC card has a memory to store at least one asset indicative of value; and the application-independent application interface is configured to retrieve the asset from the IC card for use by the application.
Claim 8
Dependent Claim
38 words
A system as recited in claim 1, wherein the IC card comprises: a memory to store at least one cryptographic key; and a processor configured to perform a cryptographic function using the cryptographic key stored in the memory.
Claim 9
Dependent Claim
33 words
A system as recited in claim 1, wherein the IC card comprises: a memory to store at least one certificate; and a processor configured to supply the certificate to the application-independent application interface.
Claim 10
Dependent Claim
142 words
A system as recited in claim 1, wherein: the IC card has a memory to store at least one cryptographic key and a processor to provide cryptographic functionality using the cryptographic key; the application requests a cryptographic function involving use of the cryptographic key stored on the IC card; and the application-independent application interface comprises: a cryptographic application program interface (CAPI) to interface with the application and handle the application's request for the cryptographic function; and a cryptography service provider (CSP) independent from, but dynamically accessible by, the CAPI, the CSP providing the cryptographic function requested by the application, the CSP managing access to the IC card for use of the cryptographic key in support of the cryptographic function while protecting the cryptographic key stored on the IC card to prevent exposure of the cryptographic key to the CAPI and the application.
Claim 11
Dependent Claim
72 words
A system as recited in claim 9, wherein the processor of the IC card is configured to perform a cryptographic function selected from a group of cryptographic functions comprising (1) encryption using the cryptographic key, (2) decryption using the cryptographic key, (3) digital signing using the cryptographic key, (4) verifying authentication of a digital signature using the cryptographic key, (5) generation of the cryptographic key, and (6) destruction of the cryptographic key.
Claim 12
Dependent Claim
94 words
A system as recited in claim 1, wherein the application-independent application interface is configured to support at least one request made by the application for a particular resource provided by the IC card, said at least one request being selected from a group of requests comprising (1) initializing the IC card to an initial state, (2) retrieving characteristics of the IC card, (3) retrieving an identification of the IC card, (4) logging into the IC card, (5) logging out of the IC card, and (6) changing a passcode for access to the IC card.
Claim 13
Dependent Claim
98 words
A system as recited in claim 1, wherein the application-independent application interface is configured to support at least one request made by the application for a particular resource provided by the IC card, said at least one request being selected from a group of requests comprising (1) generating a cryptographic key for the IC card, (2) retrieving a public cryptographic key from the IC card, (3) adding a certificate or other data resource to the IC card, (4) retrieving a certificate or other data resource from the IC card, and (5) deleting a certificate from the IC card.
Claim 14
Dependent Claim
76 words
A system as recited in claim 1, wherein the application-independent application interface is configured to support at least one request made by the application for a particular resource provided by the IC card, said at least one request being selected from a group of requests comprising (1) signing data supplied by the application, (2) encrypting data supplied by the application, (3) decrypting data supplied by the application, and (4) verifying a signature supplied by the application.
Claim 15
Dependent Claim
63 words
A system as recited in claim 1, wherein: the application requests digital signing of data; the application-independent application interface hashes the data to produce a hash and passes the hash to the IC card; and the IC card digitally signs the hash using a cryptographic signing key and returns the signed hash to the application-independent application interface without exposing the cryptographic signing key.
Claim 16
Dependent Claim
54 words
A system as recited in claim 1, wherein: the application requests verification of a digital signature; the application-independent application interface passes the digital signature to the IC card; and the IC card verifies the digital signature using a cryptographic key and informs the application-independent application interface as to whether the digital signature is authentic.
Claim 17
Dependent Claim
54 words
A system as recited in claim 1, wherein: the application requests encryption of data; the application interface passes at least a portion of the data to the IC card; and the IC card encrypts the data passed from the application interface using an encryption key and returns the encrypted data to the application interface.
Claim 18
Dependent Claim
46 words
A system as recited in claim 1, wherein: the application requests decryption of encrypted data; the application interface passes the encrypted data to the IC card; and the IC card decrypts the encrypted data using a decryption key and returns decrypted data to the application interface.
Claim 19
Dependent Claim
160 words
A computer-implemented application program interface to interface an application executing on a computer operating system with a program executing on an integrated circuit (IC) card, the IC card being coupled to communicate with a computer on which the operating system is running, the application program interface comprising: a cryptographic services module which implements cryptographic functionality for the application, the cryptographic services module using cryptographic resources maintained on the IC card so that when the application requests a cryptographic function, the cryptographic services module communicates with the IC card to have the IC card support the cryptographic function without exposing the cryptographic resources maintained thereon; and a card management services module which implements administration functionality for the application for managing resources maintained on the IC card so that when the application requests that an administrative task be performed on the IC card, the card management services module communicates with the IC card to perform the administrative task requested by the application.
Claim 20
Dependent Claim
160 words
A computer-implemented application program interface to interface an application executing on a computer operating system with a program executing on an integrated circuit (IC) card, the IC card being coupled to communicate with a computer on which the operating system is running, the application program interface comprising: a cryptographic services module which implements cryptographic functionality for the application, the cryptographic services module using cryptographic resources maintained on the IC card so that when the application requests a cryptographic function, the cryptographic services module communicates with the IC card to have the IC card support the cryptographic function without exposing the cryptographic resources maintained thereon; and a card management services module which implements administration functionality for the application for managing resources maintained on the IC card so that when the application requests that an administrative task be performed on the IC card, the card management services module communicates with the IC card to perform the administrative task requested by the application.
Claim 21
Dependent Claim
26 words
A computer-implemented application program interface as recited in claim 18, wherein the cryptographic function is selected from a group comprising encryption, decryption, digital signing, and verification.
Claim 22
Dependent Claim
53 words
A computer-implemented application program interface as recited in claim 18, wherein the administrative task is selected from a group comprising initialization of the IC card, cryptographic key generation, passcode configuration, management of cryptographic keys on the IC card, management of certificates on the IC card, and management of assets on the IC card.
Claim 23
Dependent Claim
93 words
A computer-implemented application program interface as recited in claim 18, wherein the cryptographic services module comprises: a cryptographic application program interface (CAPI) to interface with the application and handle the application's request for the cryptographic function; and a cryptography service provider (CSP) independent from, but dynamically accessible by, the CAPI, the CSP performing the cryptographic function requested by the application by accessing the IC card for support of the cryptographic function while protecting the cryptographic resources on the IC card to prevent exposure of the cryptographic resources to the CAPI and the application.
Claim 24
Dependent Claim
87 words
A computer-implemented application program interface as recited in claim 18, wherein at least one of the service modules is configured to support at least one request made by the application which is selected from a group of requests comprising (1) initializing the IC card to an initial state, (2) retrieving characteristics of the IC card, (3) retrieving an identification of the IC card, (4) logging into the IC card, (5) logging out of the IC card, and (6) changing a passcode for access to the IC card.
Claim 25
Dependent Claim
91 words
A computer-implemented application program interface as recited in claim 18, wherein at least one of the service modules is configured to support at least one request made by the application which is selected from a group of requests comprising (1) generating a cryptographic key for the IC card, (2) retrieving a public cryptographic key from the IC card, (3) adding a certificate or other data resource to the IC card, (4) retrieving a certificate or other data resource from the IC card, and (5) deleting a certificate from the IC card.
Claim 26
Dependent Claim
69 words
A computer-implemented application program interface as recited in claim 18, wherein at least one of the service modules is configured to support at least one request made by the application which is selected from a group of requests comprising (1) signing data supplied by the application, (2) encrypting data supplied by the application, (3) decrypting data supplied by the application, and (4) verifying a signature supplied by the application.
Claim 27
Dependent Claim
15 words
A computer readable memory comprising a computer-implemented application program interface as recited in claim 18.
Claim 28
Dependent Claim
66 words
A computer to configure and manage a plurality of resources of an integrated circuit (IC) card, the computer comprising: a processor; a display; and a card manager user interface (UI) executing on the processor, the card manager UI presenting at least one graphical dialog screen on the display which enables a user to reconfigure the IC card and to manage the resources on the IC card.
Claim 29
Dependent Claim
66 words
A computer to configure and manage a plurality of resources of an integrated circuit (IC) card, the computer comprising: a processor; a display; and a card manager user interface (UI) executing on the processor, the card manager UI presenting at least one graphical dialog screen on the display which enables a user to reconfigure the IC card and to manage the resources on the IC card.
Claim 30
Dependent Claim
20 words
A computer as recited in claim 26, wherein the card manager UI has icons representing resources on the IC card.
Claim 31
Dependent Claim
30 words
A computer as recited in claim 27, wherein the card manager UI enables a user to add and delete resources by manipulating the icons presented on the graphical dialog screen.
Claim 32
Dependent Claim
58 words
A computer as recited in claim 26, wherein: the card manager UI presents a resource list of available resources that can be placed on the IC card; and the card manager UI enables the user to add resources from the resource list to the IC card and to remove resources from the IC card to the resource list.
Claim 33
Dependent Claim
86 words
A configuration system enabling a user to configure an integrated circuit (IC) card after manufacture of the IC card, the IC card having a processor and programmable memory, the configuration system comprising: a computer having a card reader to interface with the IC card; and a card management application interface executing on the computer to enable the user to access the IC card and add, delete and otherwise configure the resources of the IC card stored within the programmable memory with data selected by a user.
Claim 34
Dependent Claim
86 words
A configuration system enabling a user to configure an integrated circuit (IC) card after manufacture of the IC card, the IC card having a processor and programmable memory, the configuration system comprising: a computer having a card reader to interface with the IC card; and a card management application interface executing on the computer to enable the user to access the IC card and add, delete and otherwise configure the resources of the IC card stored within the programmable memory with data selected by a user.
Claim 35
Dependent Claim
24 words
A configuration system as recited in claim 30, wherein the card management application interface permits a user to manage resources on the IC card.
Claim 36
Dependent Claim
31 words
A configuration system as recited in claim 30, fuirther comprising a graphical user interface executing on the computer to present graphical representations of resources that are available on the IC card.
Claim 37
Dependent Claim
100 words
An integrated circuit (IC) card comprising: a processor; a data I/O port controlled by the processor to receive and output data; a data memory coupled to the processor, the data memory being partitioned into a public storage and a private storage; the processor being configured to access the private storage of the data memory only following receipt and verification of an externally supplied passcode from the data I/O port; and the processor being configured to access the public storage and output contents stored in the public storage to the data I/O port without requiring receipt and verification of the passcode.
Claim 38
Dependent Claim
100 words
An integrated circuit (IC) card comprising: a processor; a data I/O port controlled by the processor to receive and output data; a data memory coupled to the processor, the data memory being partitioned into a public storage and a private storage; the processor being configured to access the private storage of the data memory only following receipt and verification of an externally supplied passcode from the data I/O port; and the processor being configured to access the public storage and output contents stored in the public storage to the data I/O port without requiring receipt and verification of the passcode.
Claim 39
Dependent Claim
20 words
An integrated circuit (IC) card as recited in claim 33, wherein the private storage stores at least one cryptographic key.
Claim 40
Dependent Claim
21 words
An integrated circuit (IC) card as recited in claim 33, wherein the private storage stores at least one public key certificate.
Claim 41
Dependent Claim
28 words
An integrated circuit (IC) card as recited in claim 33, wherein the private storage includes a permanent memory location to permanently store at least one private cryptographic key.
Claim 42
Dependent Claim
21 words
An integrated circuit (IC) card as recited in claim 33, wherein the private storage stores electronic assets indicative of commercial value.
Claim 43
Dependent Claim
31 words
An integrated circuit (IC) card as recited in claim 33, wherein the IC card is uniquely assigned to a user, and the public storage stores non-confidential information pertaining to the user.
Claim 44
Independent Claim
95 words
A method to provide cryptographic function support to a requesting application, the method comprising the following steps: storing at least one cryptographic key on a portable integrated circuit (IC) card; supplying a request for a cryptographic function from the application to an application-independent application interface; establishing data communication between the application-independent application interface and the IC card; and performing the cryptographic function requested by the application cooperatively between the application-independent application interface and the IC card using the cryptographic key stored on the IC card and without exposing the cryptographic key from the IC card.
Claim 45
Independent Claim
95 words
A method to provide cryptographic function support to a requesting application, the method comprising the following steps: storing at least one cryptographic key on a portable integrated circuit (IC) card; supplying a request for a cryptographic function from the application to an application-independent application interface; establishing data communication between the application-independent application interface and the IC card; and performing the cryptographic function requested by the application cooperatively between the application-independent application interface and the IC card using the cryptographic key stored on the IC card and without exposing the cryptographic key from the IC card.
Claim 46
Dependent Claim
27 words
A method as recited in claim 39, wherein the performing step comprises the cryptographic function is selected from a group comprising encryption, decryption, digital signing, and verification.
Claim 47
Dependent Claim
75 words
A method as recited in claim 39, wherein the performing step comprises digitally signing data according to the following steps: hashing the data at the aplication-independent application interface to produce a hash; passing the hash from the application-independent application interface to the IC card; digitally signing the hash using a cryptographic signing key; and passing the signed hash from the IC card back to the application independent application interface without exposing the cryptographic signing key.
Claim 48
Dependent Claim
56 words
A method as recited in claim 39, wherein the performing step comprises verifying a digital signature according to the following steps: passing the digital signature form the application-independent application interface to the IC card; verifying the digital signature using the cryptographic key; and informing the application-independent application interface as to whether the digital signature is authentic.
Claim 49
Dependent Claim
68 words
A method as recited in claim 39, wherein the performing step comprises encrypting data according to the following steps: passing at least a portion of the data from the application-independent application interface to the IC card; encrypting, at the IC card, the data passed from the application-independent application interface using the cryptographic key; and passing the encrypted data from the IC card back to the application-independent application interface.
Claim 50
Dependent Claim
69 words
A method as recited in claim 39, wherein the performing step comprises decrypting data according to the following steps: passing at least a portion of encrypted data from the application-independent application interface to the IC card; decrypting, at the IC card, the encrypted data passed from the application-independent application interface using the cryptographic key; and passing the decrypted data from the IC card back to the application-independent application interface.
Claim 51
Dependent Claim
24 words
A method as recited in claim 39, further comprising verifying the authenticity of the application-independent application interface amd the OC card to each other.
Claim 52
Dependent Claim
88 words
A method as recited in claim 39, further comprising: supplying the request for a cryptographic function from the application to a cryptographic application program interface (CAPI); selecting a cryptography service provider (CSP) to perform the requested cryptographic function; establishing data communication between the CAPI and the CSP; establishing data communication between the CSP and the IC card; and performing the cryptographic function cooperatively between the CSP and the IC card using the cryptographic key stored on the IC card without exposing the cryptographic key from the IC card.
Claim 53
Dependent Claim
17 words
A method as recited in claim 46, further comprising: verifying authenticity of the CSP to the CAPI.
Claim 54
Dependent Claim
21 words
A method as recited in claim 46, further comprising: verifying authenticity of the CSP and the IC card to each other.
Claim 55
Independent Claim
101 words
A method for personalizing contents on an integrated circuit (IC) card from a computer according to a user's preferences, the method comprising the following steps: interfacing the IC card to the computer with an application-independent application interface executing on the computer; presenting a user interface on the computer to the user as part of the execution of the application interface; initializing the IC card using the user interface; configuring the IC card, using the user interface, to include cryptographic resources and non-cryptographic resources; and managing the cryptographic and non-cryptographic resources that are maintained on the IC card using the user interface.
Claim 56
Independent Claim
101 words
A method for personalizing contents on an integrated circuit (IC) card from a computer according to a user's preferences, the method comprising the following steps: interfacing the IC card to the computer with an application-independent application interface executing on the computer; presenting a user interface on the computer to the user as part of the execution of the application interface; initializing the IC card using the user interface; configuring the IC card, using the user interface, to include cryptographic resources and non-cryptographic resources; and managing the cryptographic and non-cryptographic resources that are maintained on the IC card using the user interface.
Claim 57
Dependent Claim
22 words
A method as recited in claim 49, wherein the managing step comprises adding resources to, and removing resources from, the IC card.
Claim 58
Dependent Claim
61 words
A method as recited in claim 49, further comprising the following steps: partitioning a memory on the IC card into a private storage and a public storage; and the configuring step comprises storing some of the resources in the private storage and some of the resources in the public storage, and establishing a passcode for use in accessing the private storage.
Claim 59
Independent Claim
303 words
A method for conducting secure electronic transactions comprising the following steps: configuring, at a first computing site, a portable multi-purpose integrated circuit (IC) card with resources that enable the IC card to be used for multiple purposes, the resources including a cryptographic key and a certificate which can be used for at least one of the multiple purposes; transporting the multi-purpose IC card from the first computing site to a second computing site; interfacing the multi-purpose IC card with an application interface executing at the second computing site, the application interface supporting an application which is executing at the second computing site to process data for a designated purpose, the application requiring transformation of at least a portion of the data according to a cryptographic function, the application having a certificate; exchanging certificates between the application and the IC card to verify authenticity to each other; establishing data communication between the application and the IC card through the application interface; supplying a request for the cryptographic function from the application to the application interface; performing the cryptographic function cooperatively between the application interface and the IC card using the cryptographic key stored on the IC card without exposing the cryptographic key from the IC card; transporting the IC card from the second computing site to a third computing site; interfacing the IC card with an application interface executing at the third computing site, the application interface at the third computing site supporting an application which is executing at the third computing site and requires access to a non-cryptographic resource on the IC card for another designated purpose; establishing data communication between the application and the IC card through the application interface; making a request from the application for the non-cryptographic resource on the IC card; and fulfilling the request for the non-cryptographic resource.
Claim 60
Independent Claim
303 words
A method for conducting secure electronic transactions comprising the following steps: configuring, at a first computing site, a portable multi-purpose integrated circuit (IC) card with resources that enable the IC card to be used for multiple purposes, the resources including a cryptographic key and a certificate which can be used for at least one of the multiple purposes; transporting the multi-purpose IC card from the first computing site to a second computing site; interfacing the multi-purpose IC card with an application interface executing at the second computing site, the application interface supporting an application which is executing at the second computing site to process data for a designated purpose, the application requiring transformation of at least a portion of the data according to a cryptographic function, the application having a certificate; exchanging certificates between the application and the IC card to verify authenticity to each other; establishing data communication between the application and the IC card through the application interface; supplying a request for the cryptographic function from the application to the application interface; performing the cryptographic function cooperatively between the application interface and the IC card using the cryptographic key stored on the IC card without exposing the cryptographic key from the IC card; transporting the IC card from the second computing site to a third computing site; interfacing the IC card with an application interface executing at the third computing site, the application interface at the third computing site supporting an application which is executing at the third computing site and requires access to a non-cryptographic resource on the IC card for another designated purpose; establishing data communication between the application and the IC card through the application interface; making a request from the application for the non-cryptographic resource on the IC card; and fulfilling the request for the non-cryptographic resource.
Claim 61
Dependent Claim
45 words
A method as recited in claim 52 wherein the application at the third computing site requests access to an asset maintained on the IC card and the fulfilling step comprises supplying the asset from the IC card to the application at the third computing site.
References Cited (Backward Citations)
US5778067A
Cited
US5036461A
Cited
US5745571A
Cited
US5644750A
Cited
US5577121A
Cited
US5590038A
Cited
US5748737A
Cited
US5689565A
Cited
US5844218A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2003-03-14 | 2003-09-13 | 2004-03-14 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2007-03-14 | 2007-09-13 | 2008-03-14 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2011-03-14 | 2011-09-13 | 2012-03-14 | $7700.00 | Window Closed / Lapsed |