US6950940B2
Expired / Lapsed
US
⏱️ 0.0 years remaining
ABDS method utilizing security information in authenticating entity access
Assignee: First Data Corp
•
Filing: 2003-01-31
•
Granted: 2005-09-27
•
Expires: 2023-01-31
Abstract
Abstract Authenticating an entity for access to a controlled resource by an access authentication component for the controlled resource includes the steps of: the requesting entity initially opening a security account with the access authentication component, with the access authentication component establishing and maintaining a record including information pertaining to the account and being retrievable based on a unique identifier for the requesting entity, and associating a public key of a public-private key pair with the record; the requesting entity originating an electronic message and generating a digital signature using a private key of the key pair, and sending the digitally signed electronic message to the access authentication component with the unique identifier; authenticating the electronic message using the public key associated with the record identified by the unique identifier; and upon successful authentication, authenticating access to the controlled resource. Security information is considered in authenticating the requesting entity.
Inventors
- 👤 Lynn Henry Wheeler
- 👤 Anne M. Wheeler
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-09 14:25
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/04; H04L63/0428; G; G06; G06F; G06F21/00; G06F21/30; G06F21/31; G06F21/32; G06Q; G06Q20/00; G06Q20/02; G06Q20/04; G06Q20/08; G06Q20/085; G06Q20/0855; G06Q20/12; G06Q20/30; G06Q20/34; G06Q20/341; G06Q20/355; G06Q20/3558; G06Q20/36; G06Q20/367; G06Q20/3674; G06Q20/3676; G06Q20/38; G06Q20/382; G06Q20/3821; G06Q20/3823; G06Q20/3825; G06Q20/3829; G06Q20/385; G06Q20/388; G06Q20/40; G06Q20/401; G06Q20/4014; G06Q20/40145; G06Q20/403; G06Q20/409; G06Q20/4097; G06Q20/40975; G06Q50/00; G06Q50/10; G06Q50/18; G06Q50/188; G07; G07F; G07F7/00; G07F7/08; G07F7/0873; G07F7/088; G07F7/0886; G07F7/10; G07F7/1008; G07F7/1016; H04L63/0442; H04L63/06; H04L63/062; H04L63/08; H04L63/0823; H04L63/083; H04L63/12; H04L9/00; H04L9/32; H04L9/321; H04L9/3247; G06F2221/00; G06F2221/21; G06F2221/2113; H04L2209/00; H04L2209/42; H04L2209/56
Claims Analysis
Total Claims: 26
Claim 1
Independent Claim
345 words
A method of providing a requesting entity with access to a controlled resource, the requesting entity communicating electronically over a communications medium with an access authentication component for the controlled resource, wherein the requesting entity possesses a secure device that maintains therein a private key of a public-private key pair and wherein the secure device is adapted to generate digital signatures using the private key, comprising the steps of: (a) providing the requesting entity with a security account maintained in a database of the access authentication component, information in the security account being retrievable by the access authentication component based on a unique identifier of the requesting entity, the information identifying the requesting entity's authority to access the controlled resource; (b) associating in the database the public key of the public-private key pair with the security account such that the public key is retrievable by the access authentication component based on the unique identifier; (c) associating a security profile of the secure device with the security account such that the security profile is retrievable by the access component based on the unique identifier, the security profile identifying security features of the secure device, the security features indicative of the relative security strength of the secure device as compared to the other devices capable of generating digital signatures; (d) wherein the access authentication component performs the steps of: (i) receiving the unique identifier of the requesting entity; (ii) receiving a message and a digital signature of the message; (iii) based on the unique identifier, obtaining the public key of the requesting entity and the security profile of the secure device; (iv) using the public key obtained from the database, decrypting the digital signature to verify that the digital signature was generated using the private key of the secure device; and, (e) if the digital signature verifies, granting the requesting entity with access to the controlled resource as a function of the information pertaining to the requesting entity's authority to access the controlled resource and as a function of the relative security strength of the secure device.
Claim 2
Independent Claim
345 words
A method of providing a requesting entity with access to a controlled resource, the requesting entity communicating electronically over a communications medium with an access authentication component for the controlled resource, wherein the requesting entity possesses a secure device that maintains therein a private key of a public-private key pair and wherein the secure device is adapted to generate digital signatures using the private key, comprising the steps of: (a) providing the requesting entity with a security account maintained in a database of the access authentication component, information in the security account being retrievable by the access authentication component based on a unique identifier of the requesting entity, the information identifying the requesting entity's authority to access the controlled resource; (b) associating in the database the public key of the public-private key pair with the security account such that the public key is retrievable by the access authentication component based on the unique identifier; (c) associating a security profile of the secure device with the security account such that the security profile is retrievable by the access component based on the unique identifier, the security profile identifying security features of the secure device, the security features indicative of the relative security strength of the secure device as compared to the other devices capable of generating digital signatures; (d) wherein the access authentication component performs the steps of: (i) receiving the unique identifier of the requesting entity; (ii) receiving a message and a digital signature of the message; (iii) based on the unique identifier, obtaining the public key of the requesting entity and the security profile of the secure device; (iv) using the public key obtained from the database, decrypting the digital signature to verify that the digital signature was generated using the private key of the secure device; and, (e) if the digital signature verifies, granting the requesting entity with access to the controlled resource as a function of the information pertaining to the requesting entity's authority to access the controlled resource and as a function of the relative security strength of the secure device.
Claim 3
Dependent Claim
23 words
The method of claim 1 wherein the relative security strength of the secure device is indicative of the uniqueness of the private key.
Claim 4
Dependent Claim
30 words
The method of claim 1 wherein the relative security strength of the secure device is indicative of a likelihood that the private key of the secure device has been compromised.
Claim 5
Dependent Claim
33 words
The method of claim 1 wherein access to the controlled resource is granted only if the security strength of the secure device exceeds a minimum threshold required for access to the controlled resource.
Claim 6
Dependent Claim
32 words
The method of claim 1 wherein the step of granting the requesting entity with access to the controlled resource further comprises generating an access authentication signal for use by the controlled resource.
Claim 7
Dependent Claim
12 words
The method of claim 1 wherein the message comprises the unique identifier.
Claim 8
Dependent Claim
16 words
The method of claim 1 wherein the message includes the security profile of the secure device.
Claim 9
Dependent Claim
39 words
The method of claim 1 wherein the step of decrypting the digital signature of the message using the public key further comprises generating a message digest of the message and comparing the message digest with the decrypted digital signature.
Claim 10
Dependent Claim
27 words
The method of claim 1 wherein a portion of the message is input into the secure device before the digital signature is generated by the secure device.
Claim 11
Dependent Claim
328 words
In a system for authenticating a requesting entity for access to a controlled resource in which access to the controlled resource is controlled by an access authentication component, wherein the requesting entity possesses a secure device that maintains therein a private key of a public-private key pair and wherein the access authentication component does not reside in and is not part of the secure device, a method comprising the steps of: (a) providing the requesting entity with a security account maintained in a database, information in the security account being retrievable by the access authentication component based on a unique identifier of the requesting entity; (b) associating the public key of the public-private key pair with the security account such that the public key is retrievable based on the unique identifier; (c) associating a security profile of the secure device with the security account such that the security profile is retrievable based on the unique identifier, the security profile identifying security features of the secure device; (c) generating a digital signature of a message using the private key of the secure device, the message comprising a request by the requesting entity for access to the controlled resource; (e) transmitting over a communications medium an electronic communication to the access authentication component, the electronic communication including the unique identifier of the requesting entity, the message, and the digital signature of the message; (f) wherein the access authentication component performs the steps of: (i) receiving the electronic communication; (ii) based on the unique identifier in the electronic communication, obtaining the public key of the requesting entity and the security profile of the secure device; (iii) using the public key obtained from the record, decrypting the digital signature to verify that the digital signature was generated using the private key of the secure device; and (iv) determining the relative likelihood that the digital signature was in fact generated by the secure device based on the security features of the secure device.
Claim 12
Dependent Claim
328 words
In a system for authenticating a requesting entity for access to a controlled resource in which access to the controlled resource is controlled by an access authentication component, wherein the requesting entity possesses a secure device that maintains therein a private key of a public-private key pair and wherein the access authentication component does not reside in and is not part of the secure device, a method comprising the steps of: (a) providing the requesting entity with a security account maintained in a database, information in the security account being retrievable by the access authentication component based on a unique identifier of the requesting entity; (b) associating the public key of the public-private key pair with the security account such that the public key is retrievable based on the unique identifier; (c) associating a security profile of the secure device with the security account such that the security profile is retrievable based on the unique identifier, the security profile identifying security features of the secure device; (c) generating a digital signature of a message using the private key of the secure device, the message comprising a request by the requesting entity for access to the controlled resource; (e) transmitting over a communications medium an electronic communication to the access authentication component, the electronic communication including the unique identifier of the requesting entity, the message, and the digital signature of the message; (f) wherein the access authentication component performs the steps of: (i) receiving the electronic communication; (ii) based on the unique identifier in the electronic communication, obtaining the public key of the requesting entity and the security profile of the secure device; (iii) using the public key obtained from the record, decrypting the digital signature to verify that the digital signature was generated using the private key of the secure device; and (iv) determining the relative likelihood that the digital signature was in fact generated by the secure device based on the security features of the secure device.
Claim 13
Dependent Claim
21 words
The method of claim 10 further comprising granting the requesting entity with access to the controlled resource based on said determination.
Claim 14
Dependent Claim
15 words
The method of claim 11 wherein the database is maintained by the access authentication component.
Claim 15
Dependent Claim
23 words
The method of claim 11 wherein the database is maintained by a third party other than the requesting entity and access authentication component.
Claim 16
Dependent Claim
43 words
The method of claim 11 wherein the controlled resource is a database of accounts and wherein the step of granting the requesting entity with access to the controlled resource includes enabling the requesting entity to view one of the accounts in the database.
Claim 17
Dependent Claim
23 words
The method of claim 10 further comprising the step of establishing an account with the controlled resource on behalf of the requesting entity.
Claim 18
Dependent Claim
18 words
The method of claim 15 wherein the message includes an instruction regarding the account of the controlled resource.
Claim 19
Independent Claim
302 words
A method of providing access to an entity requesting access to a controlled resource, the requesting entity communicating electronically over a communications medium with an access authentication component for the controlled resource, comprising the steps of: (a) providing the requesting entity with a security account maintained in a database accessible by the access authentication component, the security account having information that is retrievable based on a unique identifier, the information pertaining to the requesting entity's right to access the controlled resource, the information further including security features of a genuine device that generates digital signatures using a private key of a public-private key pair, wherein the genuine device does not reside in and is not part of the access authentication component; (b) associating the public key of the genuine device with the security account such that the public key is retrievable based on the unique identifier in the database; (c) thereafter, (i) receiving an electronic communication including the unique identifier, a message, and a digital signature of the message, the digital signature generated by a suspect device and the message comprising a request for access to the controlled resource; (ii) obtaining the public key associated with the unique identifier received; (iii) authenticating the message using the public key associated with the unique identifier; (iv) upon successful authentication, identifying the security features retrievable by the unique identifier as being the security features of the genuine device; and (v) granting the requesting entity with access to the controlled resource in response to the request as a function of the information pertaining to the requesting entity's right to access the controlled resource and as a function of the relative likelihood that the digital signature generated by the suspect device was actually generated by the genuine device based on the security features of the genuine device.
Claim 20
Independent Claim
302 words
A method of providing access to an entity requesting access to a controlled resource, the requesting entity communicating electronically over a communications medium with an access authentication component for the controlled resource, comprising the steps of: (a) providing the requesting entity with a security account maintained in a database accessible by the access authentication component, the security account having information that is retrievable based on a unique identifier, the information pertaining to the requesting entity's right to access the controlled resource, the information further including security features of a genuine device that generates digital signatures using a private key of a public-private key pair, wherein the genuine device does not reside in and is not part of the access authentication component; (b) associating the public key of the genuine device with the security account such that the public key is retrievable based on the unique identifier in the database; (c) thereafter, (i) receiving an electronic communication including the unique identifier, a message, and a digital signature of the message, the digital signature generated by a suspect device and the message comprising a request for access to the controlled resource; (ii) obtaining the public key associated with the unique identifier received; (iii) authenticating the message using the public key associated with the unique identifier; (iv) upon successful authentication, identifying the security features retrievable by the unique identifier as being the security features of the genuine device; and (v) granting the requesting entity with access to the controlled resource in response to the request as a function of the information pertaining to the requesting entity's right to access the controlled resource and as a function of the relative likelihood that the digital signature generated by the suspect device was actually generated by the genuine device based on the security features of the genuine device.
Claim 21
Dependent Claim
26 words
The method of claim 17 wherein the security features of the genuine device as indicative of the uniqueness of the private key in the genuine device.
Claim 22
Dependent Claim
25 words
The method of claim 17 wherein the security features are indicative of a likelihood that the private key of the genuine device has been compromised.
Claim 23
Dependent Claim
28 words
The method of claim 17 wherein access to the controlled resource is granted only if the security features of the genuine device exceed a minimum threshold of reliability.
Claim 24
Dependent Claim
15 words
The method of claim 17 wherein the database is maintained by the access authentication component.
Claim 25
Dependent Claim
23 words
The method of claim 17 wherein the data is maintained by a third party other than the requesting entity and access authentication component.
Claim 26
Dependent Claim
43 words
The method of claim 17 wherein the controlled resource is a database of accounts and wherein the step of granting the requesting entity with access to the controlled resource includes enabling the requesting entity to view one of the accounts in the database.
References Cited (Backward Citations)
US3962539A
Cited
US4200770A
Cited
US4218582A
Cited
US4405829A
Cited
US4408203A
Cited
US4424414A
Cited
US4825050A
Cited
US4823388A
Cited
US4734564A
Cited
US5018196A
Cited
US4798668A
Cited
US4885788A
Cited
US5097504A
Cited
US4748668A
Cited
US4850017A
Cited
US5140634A
Cited
US4868877A
Cited
US5225978A
Cited
US5029208A
Cited
US5455865A
Cited
US5214703A
Cited
US5231668A
Cited
US5453601A
Cited
US5502766A
Cited
US5534855A
Cited
US5422953A
Cited
US5677953A
Cited
US5625690A
Cited
US5623637A
Cited
US5724424A
Cited
US6205437B1
Cited
US6009177A
Cited
US5509071A
Cited
US5563946A
Cited
US5557518A
Cited
US5963648A
Cited
US6134325A
Cited
US5796840A
Cited
US5539828A
Cited
US5586036A
Cited
US5878142A
Cited
US5659616A
Cited
US5694471A
Cited
US5606609A
Cited
US5715314A
Cited
US5636280A
Cited
US6044154A
Cited
US20010000535A1
Cited
US5604801A
Cited
US5619574A
Cited
US5812666A
Cited
US5590197A
Cited
US5677955A
Cited
US5910989A
Cited
US5577120A
Cited
US5745886A
Cited
US5708780A
Cited
US6000522A
Cited
US5790677A
Cited
US5778072A
Cited
US5615266A
Cited
US5721779A
Cited
US5671279A
Cited
US5949881A
Cited
US5671285A
Cited
US5943423A
Cited
US5870475A
Cited
US5928298A
Cited
US5751813A
Cited
US5848161A
Cited
US5781723A
Cited
US5862327A
Cited
US6253027B1
Cited
US6324525B1
Cited
US6373950B1
Cited
US5825884A
Cited
US5956404A
Cited
US6023509A
Cited
US6029150A
Cited
US6279112B1
Cited
US6285991B1
Cited
US5903882A
Cited
US6021202A
Cited
US5887131A
Cited
US6104815A
Cited
US6105012A
Cited
US6282522B1
Cited
US6202151B1
Cited
US6565000B2
Cited
US6240091B1
Cited
US5910988A
Cited
US6161180A
Cited
US6243812B1
Cited
US6213391B1
Cited
US6000832A
Cited
US5883810A
Cited
US5970147A
Cited
US6061794A
Cited
US6111956A
Cited
US6061799A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2008-09-26 | 2009-03-28 | 2009-09-27 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2012-09-26 | 2013-03-28 | 2013-09-27 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2016-09-26 | 2017-03-28 | 2017-09-27 | $7700.00 | Window Closed / Lapsed |