US6938156B2
Expired / Lapsed
US
⏱️ 0.0 years remaining
ABDS system and verification status for authenticating entity access
Assignee: First Data Corp
•
Filing: 2003-01-31
•
Granted: 2005-08-30
•
Expires: 2023-01-31
Abstract
Abstract A system in which a requesting entity seeking access to a controlled resource is authenticated by an access authentication component includes the requesting entity initially opening a security account with the access authentication component, the access authentication component establishing and maintaining a record including information pertaining to the account and being retrievable based on a unique identifier for the requesting entity, and associating a public key of a public-private key pair with record; the requesting entity originating an electronic message and generating a digital signature using a provide key of the key pair, and sending the digitally signed electronic message to the access authentication component with the unique identifier; authenticating the electronic message using the public key associated with the record identified by the unique identifier; and upon successful authentication, authenticating access to the controlled resource. A digitally signed verification status is included with the electronic message.
Inventors
- 👤 Henry Lynn Wheeler
- 👤 Anne M. Wheeler
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-09 14:19
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/04; H04L63/0428; G; G06; G06F; G06F21/00; G06F21/30; G06F21/31; G06F21/32; G06Q; G06Q20/00; G06Q20/02; G06Q20/04; G06Q20/08; G06Q20/085; G06Q20/0855; G06Q20/12; G06Q20/30; G06Q20/34; G06Q20/341; G06Q20/355; G06Q20/3558; G06Q20/36; G06Q20/367; G06Q20/3674; G06Q20/3676; G06Q20/38; G06Q20/382; G06Q20/3821; G06Q20/3823; G06Q20/3825; G06Q20/3829; G06Q20/385; G06Q20/388; G06Q20/40; G06Q20/401; G06Q20/4014; G06Q20/40145; G06Q20/403; G06Q20/409; G06Q20/4097; G06Q20/40975; G06Q50/00; G06Q50/10; G06Q50/18; G06Q50/188; G07; G07F; G07F7/00; G07F7/08; G07F7/0873; G07F7/088; G07F7/0886; G07F7/10; G07F7/1008; G07F7/1016; H04L63/0442; H04L63/06; H04L63/062; H04L63/08; H04L63/0823; H04L63/083; H04L63/12; H04L9/00; H04L9/32; H04L9/321; H04L9/3247; G06F2221/00; G06F2221/21; G06F2221/2113; H04L2209/00; H04L2209/42; H04L2209/56
Claims Analysis
Total Claims: 44
Claim 1
Independent Claim
336 words
A system for authenticating a requesting entity for access to a controlled resource, comprising: (a) a device possessed by the requesting entity, the device maintaining securely therein pre-stored verification data of the requesting entity, the device configured to generate, upon receipt of suspect verification data input into the device, a verification status indicator based on a comparison of the suspect verification data with the pre-stored verification data of the requesting entity, the device also maintaining securely therein a private key of a public-private key pair and adapted to generate a digital signature of a message using the private key, the digitally-signed message comprising: (i) a unique identifier, (ii) a request by the requesting entity for access to the controlled resource, and (iii) the verification status indicator generated by the device; (b) an access authentication component having authority to allow or deny the request for access to the controlled resource, the access authentication component separate from the device but in electronic communication over a communications medium with the device for receipt of the digitally-signed message; and (c) a database accessible by the access authentication component, the database containing predetermined authorization rights of the requesting entity and the public key of the public-private key pair but not containing the private key or the verification data of the requesting entity, wherein the unique identifier is associated with the public key in the database prior to receipt of the digitally-signed message and wherein the public key is accessible from the database based on the unique identifier; wherein, in response to receipt of the digitally-signed message, the access authentication component verifies that the message was digitally-signed using the private key maintained within the device by decrypting the digital signature using the public key obtained from the database, and if the digitally-signed message verifies, the access authentication component authenticates the requesting entity for access to the controlled resource as a function of (i) the verification status indicator obtained from the digitally-signed message and (ii) the predetermined authorization rights of the requesting entity.
Claim 2
Independent Claim
336 words
A system for authenticating a requesting entity for access to a controlled resource, comprising: (a) a device possessed by the requesting entity, the device maintaining securely therein pre-stored verification data of the requesting entity, the device configured to generate, upon receipt of suspect verification data input into the device, a verification status indicator based on a comparison of the suspect verification data with the pre-stored verification data of the requesting entity, the device also maintaining securely therein a private key of a public-private key pair and adapted to generate a digital signature of a message using the private key, the digitally-signed message comprising: (i) a unique identifier, (ii) a request by the requesting entity for access to the controlled resource, and (iii) the verification status indicator generated by the device; (b) an access authentication component having authority to allow or deny the request for access to the controlled resource, the access authentication component separate from the device but in electronic communication over a communications medium with the device for receipt of the digitally-signed message; and (c) a database accessible by the access authentication component, the database containing predetermined authorization rights of the requesting entity and the public key of the public-private key pair but not containing the private key or the verification data of the requesting entity, wherein the unique identifier is associated with the public key in the database prior to receipt of the digitally-signed message and wherein the public key is accessible from the database based on the unique identifier; wherein, in response to receipt of the digitally-signed message, the access authentication component verifies that the message was digitally-signed using the private key maintained within the device by decrypting the digital signature using the public key obtained from the database, and if the digitally-signed message verifies, the access authentication component authenticates the requesting entity for access to the controlled resource as a function of (i) the verification status indicator obtained from the digitally-signed message and (ii) the predetermined authorization rights of the requesting entity.
Claim 3
Dependent Claim
13 words
The system of claim 1 wherein the message is originated by the device.
Claim 4
Dependent Claim
18 words
The system of claim 1 wherein the message is input into the device by a message generating component.
Claim 5
Dependent Claim
23 words
The system of claim 1 wherein the message and digital signature of the message are communicated by the device to the authentication component.
Claim 6
Dependent Claim
29 words
The system of claim 1 wherein the message and digital signature of the message are communicated from the device to the access authentication component by an electronic communication component.
Claim 7
Dependent Claim
15 words
The system of claim 1 wherein the request for access is inferred from the message.
Claim 8
Dependent Claim
18 words
The system of claim 1 wherein the request for access is explicitly stated as part of the message.
Claim 9
Dependent Claim
28 words
The system of claim 1 wherein the verification status indicator indicates that no suspect verification data has been input into the device within a predetermined period of time.
Claim 10
Dependent Claim
35 words
The system of claim 1 wherein the verification status indicator indicates that there was a successful comparison of the suspect verification data with the verification data of the requesting entity previously stored in the device.
Claim 11
Dependent Claim
25 words
The system of claim 1 wherein the verification status indicator indicates that said indicator was included in a previously digitally-signed message generated by the device.
Claim 12
Dependent Claim
35 words
The system of claim 1 wherein the verification status indicator indicates that there was an unsuccessful comparison of the suspect verification data with the verification data of the requesting entity previously stored in the device.
Claim 13
Dependent Claim
33 words
The system of claim 1 wherein the verification status indicator indicates the degree of comparison of the suspect verification data with the verification data of the requesting entity previously stored in the device.
Claim 14
Dependent Claim
19 words
The system of claim 1 wherein the suspect verification data is input into the device by the requesting entity.
Claim 15
Dependent Claim
15 words
The system of claim 1 wherein the verification data is a secret, PIN, or password.
Claim 16
Dependent Claim
16 words
The system of claim 1 wherein the verification data is biometric data of the requesting entity.
Claim 17
Dependent Claim
21 words
The system of claim 1 wherein the verification data of the requesting entity is not determinable from the verification status indicator.
Claim 18
Dependent Claim
23 words
The system of claim 1 wherein the type of suspect verification data input into the device is determinable from the verification status indicator.
Claim 19
Independent Claim
319 words
A system for providing a requesting entity with access to a controlled resource, comprising: (a) a device possessed by the requesting entity, the device maintaining securely therein pre-stored verification data of the requesting entity, the device configured to generate a verification status indicator based on a comparison of the suspect verification data input into the device with the pre-stored verification data of the requesting entity, the device also maintaining securely therein a private key of a public-private key pair and adapted to generate digital signatures of a message using the private key, the digitally-signed message comprising: (i) a unique identifier, (ii) a request by the requesting entity for access to the controlled resource, and (iii) the verification status indicator generated by the device; (b) an access authentication component having authority to allow or deny the request for access to the controlled resource, the access authentication component maintaining in a database a security account of the requesting entity, the security account including information accessible by the access authentication component based on the unique identifier, the information including the public key of the public-private key pair and predetermined authorization of the requesting entity to access the controlled resource; and (c) a transmitter component in electronic communication of a communication medium with the device and with the access authentication component, the transmitter component configured to transmit the digitally-signed message from the device to the access authentication component; wherein, in response to receipt of the digitally-signed message, the access authentication component verifies that the message was digitally-signed using the private key by decrypting the digital signature using the public key obtained from the database, such verification not requiring a digital certificate and, upon successful verification of the message, the access authentication component grants the requesting entity with access to the controlled resource as a function of the verification status indicator obtained from the digitally-signed message and the predetermined authorization of the requesting entity.
Claim 20
Independent Claim
319 words
A system for providing a requesting entity with access to a controlled resource, comprising: (a) a device possessed by the requesting entity, the device maintaining securely therein pre-stored verification data of the requesting entity, the device configured to generate a verification status indicator based on a comparison of the suspect verification data input into the device with the pre-stored verification data of the requesting entity, the device also maintaining securely therein a private key of a public-private key pair and adapted to generate digital signatures of a message using the private key, the digitally-signed message comprising: (i) a unique identifier, (ii) a request by the requesting entity for access to the controlled resource, and (iii) the verification status indicator generated by the device; (b) an access authentication component having authority to allow or deny the request for access to the controlled resource, the access authentication component maintaining in a database a security account of the requesting entity, the security account including information accessible by the access authentication component based on the unique identifier, the information including the public key of the public-private key pair and predetermined authorization of the requesting entity to access the controlled resource; and (c) a transmitter component in electronic communication of a communication medium with the device and with the access authentication component, the transmitter component configured to transmit the digitally-signed message from the device to the access authentication component; wherein, in response to receipt of the digitally-signed message, the access authentication component verifies that the message was digitally-signed using the private key by decrypting the digital signature using the public key obtained from the database, such verification not requiring a digital certificate and, upon successful verification of the message, the access authentication component grants the requesting entity with access to the controlled resource as a function of the verification status indicator obtained from the digitally-signed message and the predetermined authorization of the requesting entity.
Claim 21
Dependent Claim
15 words
The system of claim 18 wherein the transmitter component provides the message to the device.
Claim 22
Dependent Claim
21 words
The system of claim 18 wherein the access authentication component does not reside in and is not part of the device.
Claim 23
Dependent Claim
39 words
The system of claim 18 wherein the requesting entity is required to input further suspect verification data into the device to generate a new verification status indicator required before the requesting entity is granted access to the controlled resource.
Claim 24
Dependent Claim
52 words
The system of claim 18 wherein the requesting entity already has access to the controlled resources and wherein the requesting entity is required to input further suspect verification data into the device to generate a new verification status indicator required for the requesting entity to have continued access to the controlled resource.
Claim 25
Dependent Claim
13 words
The system of claim 18 wherein the controlled resource is a computer system.
Claim 26
Dependent Claim
13 words
The system of claim 18 wherein the controlled resource is a physical space.
Claim 27
Dependent Claim
13 words
The system of claim 18 wherein the controlled resource is a data record.
Claim 28
Dependent Claim
19 words
The system of claim 18 wherein the suspect verification data is input into the device by the requesting entity.
Claim 29
Independent Claim
389 words
A system for authenticating a requesting entity for access to a controlled resource, wherein, prior to a request for access to the controlled resource, the requesting entity is provided with a secure device, verification data of the requesting entity is input into and stored securely within the secure device, a private key of a public-private key pair is stored securely within the secure device, the public key of the public-private key is stored in a database of an access authentication component having authority to allow or deny the request for access to the controlled resource, a unique identifier is associated with the public key such that the public key is retrievable from the database by the access authentication component based on the unique identifier, and authorization rights of the requesting entity to access the controlled resource are assigned to the requesting entity, the system further comprising: (a) the secure device which receives suspect verification data, generates a verification status indicator based on a comparison of the suspect verification data with the pre-stored verification data of the requesting entity, and digitally signs a message that includes: (i) the unique identifier, (ii) the request by the requesting entity for access to the controlled resource, and (iii) the verification status indicator; (b) a data transmission component in electronic communication with the secure device and in electronic communication over a communications medium with the access authentication component, the data transmission component receives the digital signature of the message from the device and transmits the message and digital signature of the message to the access authentication component; (c) upon receipt of the message and digital signature of the message, the access authentication component retrieves the public key from the database based on the unique identifier obtained from the message and verifies that the message was digitally-signed using the private key maintained within the device by decrypting the digital signature with the public key; and (d) upon successful verification of the message and without need of a digital certificate to attest to the validity of the private key or to attest to the integrity of the secure device, the access authentication component grants the requesting entity with access to the controlled resource solely as a function of the verification status indicator obtained from the digitally-signed message and the pre-assigned authorization rights of the requesting entity.
Claim 30
Independent Claim
389 words
A system for authenticating a requesting entity for access to a controlled resource, wherein, prior to a request for access to the controlled resource, the requesting entity is provided with a secure device, verification data of the requesting entity is input into and stored securely within the secure device, a private key of a public-private key pair is stored securely within the secure device, the public key of the public-private key is stored in a database of an access authentication component having authority to allow or deny the request for access to the controlled resource, a unique identifier is associated with the public key such that the public key is retrievable from the database by the access authentication component based on the unique identifier, and authorization rights of the requesting entity to access the controlled resource are assigned to the requesting entity, the system further comprising: (a) the secure device which receives suspect verification data, generates a verification status indicator based on a comparison of the suspect verification data with the pre-stored verification data of the requesting entity, and digitally signs a message that includes: (i) the unique identifier, (ii) the request by the requesting entity for access to the controlled resource, and (iii) the verification status indicator; (b) a data transmission component in electronic communication with the secure device and in electronic communication over a communications medium with the access authentication component, the data transmission component receives the digital signature of the message from the device and transmits the message and digital signature of the message to the access authentication component; (c) upon receipt of the message and digital signature of the message, the access authentication component retrieves the public key from the database based on the unique identifier obtained from the message and verifies that the message was digitally-signed using the private key maintained within the device by decrypting the digital signature with the public key; and (d) upon successful verification of the message and without need of a digital certificate to attest to the validity of the private key or to attest to the integrity of the secure device, the access authentication component grants the requesting entity with access to the controlled resource solely as a function of the verification status indicator obtained from the digitally-signed message and the pre-assigned authorization rights of the requesting entity.
Claim 31
Independent Claim
356 words
A system for authenticating a requesting entity for continued access to a controlled resource, wherein the requesting entity already has been granted access to and is currently accessing the controlled resource, wherein an access authentication component has authority to allow or deny the continued access to the controlled resource, wherein the access authentication component has access to a database in which, prior to an original grant of access to the controlled resource for the requesting entity, a unique identifier has been associated with a public key of a public-private key pair and wherein the public key is accessible from the database based on the unique identifier, comprising: (a) the access authentication component maintains business rules regarding continued access to the controlled resource, and wherein the access authentication component sends a confirmation request to the requesting entity in accordance with the business rules; (b) a device possessed by the requesting entity and maintaining securely therein pre-stored verification data of the requesting entity, the device configured to generate a verification status indicator based on a comparison of suspect verification data input into the device with the pre-stored verification data of the requesting entity, the device also maintaining securely therein the private key of the public-private key pair and adapted to generate digital signatures using the private key, wherein, in response to the confirmation request, the requesting entity inputs suspect verification data into the device and wherein, in response to the input of suspect verification data, the device (i) generates the verification status indicator, (ii) includes the verification status indicator in a message, and (iii) digitally-signs the message using the private key; and wherein the digitally-signed message is provided to the access authentication component; (c) in response to receipt of the digitally-signed message, the access authentication component verifies that the message was digitally-signed using the private key maintained within the device by decrypting the digital signature using the public key obtained from the database; and (d) if the digitally-signed message verifies, the access authentication component authenticates the requesting entity for continued access to the controlled resource as a function of the verification status indicator obtained from the digitally-signed message.
Claim 32
Independent Claim
356 words
A system for authenticating a requesting entity for continued access to a controlled resource, wherein the requesting entity already has been granted access to and is currently accessing the controlled resource, wherein an access authentication component has authority to allow or deny the continued access to the controlled resource, wherein the access authentication component has access to a database in which, prior to an original grant of access to the controlled resource for the requesting entity, a unique identifier has been associated with a public key of a public-private key pair and wherein the public key is accessible from the database based on the unique identifier, comprising: (a) the access authentication component maintains business rules regarding continued access to the controlled resource, and wherein the access authentication component sends a confirmation request to the requesting entity in accordance with the business rules; (b) a device possessed by the requesting entity and maintaining securely therein pre-stored verification data of the requesting entity, the device configured to generate a verification status indicator based on a comparison of suspect verification data input into the device with the pre-stored verification data of the requesting entity, the device also maintaining securely therein the private key of the public-private key pair and adapted to generate digital signatures using the private key, wherein, in response to the confirmation request, the requesting entity inputs suspect verification data into the device and wherein, in response to the input of suspect verification data, the device (i) generates the verification status indicator, (ii) includes the verification status indicator in a message, and (iii) digitally-signs the message using the private key; and wherein the digitally-signed message is provided to the access authentication component; (c) in response to receipt of the digitally-signed message, the access authentication component verifies that the message was digitally-signed using the private key maintained within the device by decrypting the digital signature using the public key obtained from the database; and (d) if the digitally-signed message verifies, the access authentication component authenticates the requesting entity for continued access to the controlled resource as a function of the verification status indicator obtained from the digitally-signed message.
Claim 33
Dependent Claim
12 words
The system of claim 28 wherein the message includes the confirmation request.
Claim 34
Dependent Claim
19 words
The system of claim 29 wherein the confirmation request is provided to the device by an electronic communication component.
Claim 35
Dependent Claim
21 words
The system of claim 28 wherein the access authentication component does not reside in and is not part of the device.
Claim 36
Dependent Claim
18 words
The system of claim 28 wherein the digitally-signed message is communicated by the device to the authentication component.
Claim 37
Dependent Claim
24 words
The system of claim 28 wherein the digitally-signed message is communicated from the device to the access authentication component by an electronic communication component.
Claim 38
Dependent Claim
28 words
The system of claim 28 wherein the verification status indicator indicates that no suspect verification data has been input into the device within a predetermined period of time.
Claim 39
Dependent Claim
35 words
The system of claim 28 wherein the verification status indicator indicates that there was a successful comparison of the suspect verification data with the verification data of the requesting entity previously stored in the device.
Claim 40
Dependent Claim
25 words
The system of claim 28 wherein the verification status indicator indicates that said indicator was included in a previous digitally-signed message generated by the device.
Claim 41
Dependent Claim
35 words
The system of claim 28 wherein the verification status indicator indicates that there was an unsuccessful comparison of the suspect verification data with the verification data of the requesting entity previously stored in the device.
Claim 42
Dependent Claim
33 words
The system of claim 28 wherein the verification status indicator indicates the degree of comparison of the suspect verification data with the verification data of the requesting entity previously stored in the device.
Claim 43
Dependent Claim
15 words
The system of claim 28 wherein the verification data is a secret, PIN, or password.
Claim 44
Dependent Claim
16 words
The system of claim 28 wherein the verification data is biometric data of the requesting entity.
References Cited (Backward Citations)
US3962539A
Cited
US4200770A
Cited
US4218582A
Cited
US4405829A
Cited
US4408203A
Cited
US4424414A
Cited
US4825050A
Cited
US4823388A
Cited
US4734564A
Cited
US5018196A
Cited
US4885788A
Cited
US5097504A
Cited
US4748668A
Cited
US4797920A
Cited
US4850017A
Cited
US5140634A
Cited
US4868877A
Cited
US5225978A
Cited
US5029208A
Cited
US5455865A
Cited
US5214703A
Cited
US5231668A
Cited
US5453601A
Cited
US5502766A
Cited
US5534855A
Cited
US5422953A
Cited
US5677953A
Cited
US5625690A
Cited
US5623637A
Cited
US6205437B1
Cited
US5724424A
Cited
US6009177A
Cited
US5787172A
Cited
US5509071A
Cited
US5563946A
Cited
US5963648A
Cited
US5557518A
Cited
US6134325A
Cited
US5796840A
Cited
US5539828A
Cited
US5586036A
Cited
US5878142A
Cited
US5659616A
Cited
US5694471A
Cited
US5606609A
Cited
US5715314A
Cited
US5636280A
Cited
US6044154A
Cited
US20010000535A1
Cited
US5604801A
Cited
US5619574A
Cited
US5812666A
Cited
US5590197A
Cited
US5677955A
Cited
US5910989A
Cited
US5577120A
Cited
US5745886A
Cited
US5708780A
Cited
US6000522A
Cited
US5790677A
Cited
US5778072A
Cited
US5615266A
Cited
US5809144A
Cited
US5721779A
Cited
US5671279A
Cited
US5949881A
Cited
US5671285A
Cited
US5943423A
Cited
US5870475A
Cited
US5751813A
Cited
US5848161A
Cited
US5781723A
Cited
US5862327A
Cited
US6253027B1
Cited
US6324525B1
Cited
US6373950B1
Cited
US5825884A
Cited
US6023509A
Cited
US5956404A
Cited
US6029150A
Cited
US6279112B1
Cited
US6047051A
Cited
US5903882A
Cited
US6285991B1
Cited
US6021202A
Cited
US5887131A
Cited
US6104815A
Cited
US6105012A
Cited
US6282522B1
Cited
US6202151B1
Cited
US6565000B2
Cited
US6240091B1
Cited
US5910988A
Cited
US6243812B1
Cited
US6161180A
Cited
US6213391B1
Cited
US6000832A
Cited
US5883810A
Cited
US6061794A
Cited
US5970147A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2008-08-29 | 2009-02-28 | 2009-08-30 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2012-08-29 | 2013-02-28 | 2013-08-30 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2016-08-29 | 2017-02-28 | 2017-08-30 | $7700.00 | Window Closed / Lapsed |