Back to results
US 10,706,416 B2Granted
System and method of generating and validating encapsulated cryptographic tokens based on multiple digital signatures
AssigneeInstitutional Cash Distributors Technology, LLC
InventorMark A. Heyner
Life of this patent
Estimating the term…
Abstract
Functional data for use in one or more digital transactions are secured by using an encapsulated security token (EST). In certain embodiments, the EST is created by encapsulating digital data including the functional data using at least two cryptographic systems of two parties. The encapsulation and subsequent de-encapsulation can utilize cryptographic systems of the parties that involve a private key for signing and decryption and a public key for encryption and signature verification. If constructed carefully over a series of rigorous events, the resulting EST can be practically impossible to counterfeit. In addition, a propagation of rights can be tracked for auditing and rights can be easily terminated or modified.
Claims34
A method of authenticating electronic credentials using an encapsulated cryptographic token associated with multiple digital signatures, the method comprising the steps of:
- (a) generating, with a cryptographic computer system, an encapsulated cryptographic token associated with multiple digital signatures by:
- providing a private key and a public key of an originator, wherein the private key and the public key of the originator are cryptographically associated such that data encrypted with the public key of the originator can be decrypted with the private key of the originator and data signed with the private key of the originator can be validated with the public key of the originator;
- providing a private key and a public key of a first propagatee, wherein the private key and the public key of the first propagatee are cryptographically associated such that data encrypted with the public key of the first propagatee can be decrypted with the private key of the first propagatee and data signed with the private key of the first propagatee can be validated with the public key of the first propagatee;
- generating a first cryptographic token by digitally signing the combination of:
- (1) credential data of the originator and (2) identity data of the first propagatee with the cryptographic computer system using the private key of the originator, wherein the first cryptographic token is tagged with the public key of the originator;
- generating a second cryptographic token that encapsulates the first cryptographic token by digitally signing the combination of:
- (1) the first cryptographic token and (2) identity data of a second propagatee with the cryptographic computer system using the private key of the first propagatee, wherein the second cryptographic token is tagged with the public key of the first propagatee;
- (b) validating authenticity of an entity attempting to use the credential data of the originator with the second cryptographic token by:
- receiving identity data of the entity attempting to use the second cryptographic token;
- validating, with the cryptographic computer system, whether the first propagatee signed the second cryptographic token using the public key of the first propagatee;
- validating, with the cryptographic computer system, the identity data of the entity attempting to use the second cryptographic token by comparing the identity data of the entity attempting to use the second cryptographic token with the identity of the second propagatee in the second cryptographic token to determine whether there is a match;
- validating, with the cryptographic computer system, whether the originator signed the first cryptographic token encapsulated in the second cryptographic token using the public key of the originator;
- validating, with the cryptographic computer system, the identity data of the first propagatee by comparing the public key of the first propagatee with the identity of the first propagatee in the first cryptographic token to determine whether there is a match;
- responsive to validating authenticity of the entity attempting to use the credentials of the originator with the second cryptographic token, allowing usage of credential data of the originator;
- and
- responsive to determining the entity attempting to use the credentials of the originator with the second cryptographic token is not authentic, denying usage of the credential data of the originator.
13 more elements
A method of automating electronic fund transfer using an encapsulated cryptographic token associated with multiple digital signatures, the method comprising the steps of:
- (a) receiving, at a computer system on a network, a fund transfer request from an entity attempting to transfer funds, the fund transfer request comprising:
- (1) identity data of the entity attempting to transfer funds;
- (2) an encapsulated cryptographic token;
- (3) a proposed source account from which funds are to be removed;
- and (4) a proposed destination account to which funds are to be transferred, wherein the encapsulated cryptographic token comprises:
- (1) a first level cryptographic token comprising the combination of:
- (a) identifying data of an authorized source financial account of a first entity;
- (b) identity data of the first entity;
- and (c) identity data of a financial institution that administers the first entity's authorized source financial account digitally signed with a private key associated with the financial institution, wherein the first level cryptographic token is tagged with a public key associated with the financial institution;
- (2) a second level cryptographic token comprising the combination of:
- (a) the first level cryptographic token;
- (b) identity data of a second entity;
- (c) identity data of an authorized destination financial account digitally signed with a private key associated with the first entity, wherein the second level cryptographic token is tagged with a public key associated with the first entity;
- and
- (b) validating, by the computer system, authenticity of the fund transfer request by:
- (1) validating whether the first entity signed the second level cryptographic token using the public key of the first entity;
- (2) validating the identity data of the entity attempting to transfer funds by comparing the identity data of the entity attempting to transfer funds with the identity data of the second entity in the second level cryptographic token to verify there is a match;
- (3) validating the proposed destination account by comparing the identity data of the authorized destination account in the second level cryptographic token with the proposed destination account to verify there is a match;
- (4) validating whether the financial institution signed the first level cryptographic token using the public key of the financial institution;
- (5) validating the identity data of the first entity by comparing the public key of the first entity with the identity data of the first entity in the first level cryptographic token to verify there is a match;
- and
- (6) validating the proposed source account by comparing the identity data of the authorized source account in the first level cryptographic token with the proposed source account to verify there is a match;
- (c) responsive to validating authenticity of the fund transfer request in each of the validating steps (1)-(6), forwarding the electronic fund transfer request to the financial institution to transfer funds from the authorized source account to the authorized destination account;
- and
- (d) responsive to failing one or more of the validating steps (1)-(6), denying the fund transfer request.
22 more elements
Dependencies are inferred from the claim text.