# US 2008/0307231 A1 · Secure Handling of Stored-Value Data Objects > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2008/0307231 A1 - Document ID: US20080307231A1 - Status: Published application - Kind: A1 - Application number: 12/195,485 - Filed: 2008-08-21 - Published: 2008-12-11 - Earliest claimed: 2001-11-13 - Assignees: Ericsson Inc. - Inventors: Santanu Dutta; Nils Rydbeck - Web page: https://patentgrep.com/patent/US20080307231A1 ## CPC - G06Q 20/327: {Short range or proximity payments by means of M-devices} - G06Q 20/045: {using payment protocols involving tickets} - G06Q 20/12: specially adapted for electronic shopping systems - G06Q 20/363: {with the personal data of a user} - G06Q 20/367: {involving electronic purses or money safes} - G06Q 20/3672: {initialising or reloading thereof} - G06Q 20/3674: {involving authentication} - G06Q 20/3676: {Balancing accounts} - G06Q 20/3678: {e-cash details, e.g. blinded, divisible or detecting double spending} - G07B 15/00: Arrangements or apparatus for collecting fares, tolls or entrance fees at one or more control points (handling coins or valuable papers, e.g. banknotes, G07D; apparatus for vending or hiring articles or services activated by coins, credit cards, paper currency or the like G07F7/00, G07F17/00) - G07F 7/0866: {by active credit-cards adapted therefor (G07F7/1008 takes precedence)} - G07F 7/1016: {Devices or methods for securing the PIN and other transaction-data, e.g. by encryption (arrangements for secret communication, see H04L9/00)} - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR - G07B: TICKET-ISSUING APPARATUS; FARE-REGISTERING APPARATUS; FRANKING APPARATUS - G07F: COIN-FREED OR LIKE APPARATUS (coin sorting G07D3/00; coin testing G07D5/00; {handling coins or paper currencies apart from payment activated apparatus G07D; payment architectures, schemes or protocols G06Q20/00}) ## Abstract An approach to managing stored-value data objects, such as electronic tickets, comprises secure systems and procedures for ticket issuing, storage, and redemption. With these systems and procedures in place, stored-value data objects may be securely transferred to remote systems, such as a user's personal electronic device, for subsequent secure redemption, thus allowing the user to gain access to the desired goods or service upon redeeming the data object. Techniques provide secure delivery of the requested data object to the requesting device, and provide secure redemption and disposal of the data object. Ticket issuing systems may be Internet-accessible systems, and users may purchase and redeem tickets using mobile terminals or other devices adapted for wireless communication. Standardized WPKI and Internet access procedures may be employed in ticket issuance and redemption. Techniques further provide temporary and rapid verification data objects useful where rapid ticket verification is essential, such as mass transit systems. ## Claims ### Claim 1 A system to securely manage stored-value data objects, the system comprising: an issuing system to issue a stored-value data object to a user device, wherein the issuing system signs the stored-value data object and encrypts the stored-value data object using a first public key associated with the user device; a security element comprising a portion of the user device to decrypt and securely store the stored-value data object received at the user device from the issuing system; and a redeeming system to redeem the stored-value data object by receiving the stored-value data object from the user device; wherein the security element encrypts the stored-value data object with a second public key associated with the redeeming system; and wherein the redeeming system decrypts the stored-value data object and verifies that the stored-value data object was signed by the issuing system. ### Claim 2 (depends on 1) The system of claim 1, wherein the security element comprises at least one processor and associated memory. ### Claim 3 (depends on 2) The system of claim 2, wherein the security element further comprises a tamper-resistant element for housing the at least one processor and associated memory. ### Claim 4 (depends on 2) The system of claim 2, wherein the associated memory comprises a memory device providing non-volatile storage for a first private key corresponding to the first public key used by the issuing system to encrypt the stored-value data object. ### Claim 5 (depends on 2) The system of claim 2, wherein the security element comprises an integrated module forming part of the user device. ### Claim 6 (depends on 2) The system of claim 2, wherein the security element comprises a removably connected module. ### Claim 7 (depends on 6) The system of claim 6, wherein the removably connected module comprises a smart card. ### Claim 8 (depends on 1) The system of claim 1, wherein the user device comprises a computing device having wireless communication capabilities, such that the user device wirelessly communicates with the issuing and redeeming systems in receiving and redeeming stored-value data objects. ### Claim 9 (depends on 9) The system of claim 9, wherein the computing device comprises at least a first wireless interface to communicate with the issuing and redeeming systems. ### Claim 10 (depends on 9) The system of claim 9, wherein the at least one wireless interface comprises first and second wireless interfaces to communicate with the issuing and redeeming systems, respectively. ### Claim 11 (depends on 10) The system of claim 10, wherein the first wireless communication interface is a cellular communication interface enabling the computing device to communicate with a wireless communication network. ### Claim 12 (depends on 11) The system of claim 11, wherein the computing device comprises an access terminal. ### Claim 13 (depends on 10) The system of claim 10, wherein the second wireless interface comprises a Bluetooth wireless interface. ### Claim 14 (depends on 10) The system of claim 10, wherein the second wireless interface comprises an infrared wireless interface. ### Claim 15 (depends on 1) The system of claim 1, wherein the issuing system comprises an Internet-accessible issuing system. ### Claim 16 (depends on 15) The system of claim 15, wherein the user device comprises at least a first wireless communication interface to communicate with a wireless communication network having Internet access. ### Claim 17 (depends on 16) The system of claim 16, wherein the user device comprises a WAP-enabled access terminal, and further wherein the Internet-accessible issuing system comprises a WAP-enabled server. ### Claim 18 (depends on 1) The system of claim 1, wherein the issuing system comprises: a communication interface to receive stored-value data object requests and issue stored-value data objects; a processing system to sign and encrypt stored-value data objects; and memory to store an issuing system private key used in signing stored-value data objects. ### Claim 19 (depends on 1) The system of claim 1, wherein the redeeming system comprises: a communication interface to receive redemption requests and stored-value data objects from user devices; a processing system to decrypt and verify stored-value data objects received from user devices; and memory to store a redeeming system private key used in decrypting the received stored-value data objects. ### Claim 20 (depends on 1) The system of claim 1 further comprising a second redeeming system to verify a multi-use stored-value data object returned to the user device from the first redeeming system responsive to the user device redeeming the stored-value data object received from the ticket issuing system. ### Claim 21 (depends on 1) The system of claim 1 further comprising a rapid verification system to redeem a rapid verification token (RVT) generated by the security element in the user device, and wherein the redeeming system returns a seed value to the user device responsive to the user device redeeming the stored-value data object at the redeeming system, the said seed value determining at least one pseudo-random element of the said RVT. ### Claim 22 A method of securely managing the issuance and redemption of stored-value data objects, the method comprising: issuing a stored-value data object from an issuing system to a user device, wherein the issuing system encrypts the stored-value data object using a first public key associated with the user device and the user device decrypts the stored-value data object using a private key known to the user device; transferring a generated value and a second public key from a redeeming system to the user device responsive to a redemption request; receiving the generated value and stored-value data object from the user device at the redeeming system, wherein the stored-value data object and the generated value are encrypted by the user device using the second public key; and validating the stored-value data object and generated value at the redeeming system after decrypting the stored-value data object and generated value using a private key known to the redeeming system. ### Claim 23 (depends on 22) The method of claim 22 further comprising decrypting and storing the stored-value data object received from the issuing system at the user device in a security element comprising a portion of the user device. ### Claim 24 (depends on 23) The method of claim 23 further comprising using the security element to encrypt the generated value received from the redeeming system and the stored-value data object held by the security element with the second public key received from the redeeming system. ### Claim 25 (depends on 24) The method of claim 24 further comprising operating the security element according to pre-defined input and output functions such that the security element functions as a trusted agent of the issuing and redeeming systems. ### Claim 26 (depends on 23) The method of claim 23 further comprising erasing the stored-value data object from the security element responsive to the user device sending the stored-value data object to the redeeming system. ### Claim 27 (depends on 22) The method of claim 22, wherein validating the generated value and the stored-value data object returned from the user device to the redeeming system comprises verifying that the generated value returned from the user device matches the generated value sent from the redeeming system to the user device. ### Claim 28 (depends on 22) The method of claim 22, wherein validating the generated value and the stored-value data object returned from the user device to the redeeming system comprises verifying that the stored-value data object is signed by the issuing system. ### Claim 29 (depends on 28) The method of claim 28, wherein verifying that the stored-valued data object is signed by the issuing system comprises validating a digital signature using a second private key at the redeeming system, and wherein the second private key is associated with the issuing system. ### Claim 30 (depends on 28) The method of claim 28, wherein verifying that the stored-valued data object is signed by the issuing system comprises validating a digital signature using a second private key at the redeeming system, and wherein the second private key is associated with another redeeming system. ### Claim 31 (depends on 22) The method of claim 22 further comprising generating the generated value as a nonce. ### Claim 32 (depends on 22) The method of claim 22 further comprising configuring the issuing system as a WAP-enabled server, which is also capable of generating and responding to special ticketing MIME types, allowing the user device to request and receive the stored-value data object in accordance with WAP procedures complemented with the said MIME types. ### Claim 33 (depends on 22) The method of claim 22, wherein the issuing system is remote from the user device, and further comprising communication between the user device and the issuing system via a wireless communication network. ### Claim 34 (depends on 22) The method of claim 22, wherein the redeeming system is local with respect to the user device, and further comprising communicating between the user device and redeeming system via local wireless signaling. ### Claim 35 (depends on 22) The method of claim 22 further comprising returning a modified stored-value data object from the redeeming system to the user device if the stored-value data object being redeemed by the user device is a multi-use stored-value data object. ### Claim 36 (depends on 35) The method of claim 35 further comprising modifying the multi-use stored-value data object received at the redeeming system from the user device by signing the multi-use stored-value data object using a redeeming system private key. ### Claim 37 (depends on 35) The method of claim 35 further comprising modifying the multi-use stored-value data object received at the redeeming system from the user device by setting a redemption counter value in the multi-use stored-value data object, wherein the redemption counter value comprises a portion of the data comprising the stored-value data object. ### Claim 38 (depends on 22) The method of claim 22 further comprising returning a seed value to the user device if the generated value and stored-value data object received from the user device are validated. ### Claim 39 (depends on 38) The method of claim 38 further comprising: receiving a verification sequence including a first pseudorandom element at a rapid verification system; validating the verification sequence by determining whether the first pseudorandom element matches a second pseudorandom element generated by the verification system using the same seed value; and wherein the user device generates the first pseudorandom element using the seed value received from the redeeming system. ### Claim 40 (depends on 38) The method of claim 38 further comprising verifying by a human operator at a rapid verification point a verification image generated by the user device, wherein the verification image is dependent on the seed value returned to the user device by the redeeming system. ### Claim 41 (depends on 40) The method of claim 40, wherein verifying the verification image by a human operator comprises the human operator comparing the verification image displayed by the user device with a reference image displayed by a rapid verification system. ### Claim 42 (depends on 22) The method of claim 22, wherein the stored-value data object comprises an electronic ticket. ### Claim 43 A method of securely managing stored-value data objects, the method comprising: receiving an issuance request for a stored-value data object at an issuing system, wherein the issuing system has access to a first public key associated with a user device originating the issuance request; encrypting the stored-value data object at the issuing system using the first public key; transmitting the encrypted stored-value data object from the issuing system for receipt at the user device, wherein the user device comprises a security element adapted to decrypt the stored-value data object using a first private key corresponding to the first public key, and then to securely store the stored-value data object; receiving a redemption request from the user device at a redeeming system; sending a second public key from the redeeming system to the user device responsive to the redemption request; receiving the stored-value data object encrypted using the second public key from the user device at the redeeming system; decrypting the stored-value data object at the redeeming system using a second private key corresponding to the second public key; and redeeming the stored-value data object at the redeeming system if the stored-value data object is valid. ### Claim 44 (depends on 43) The method of claim 43 further comprising receiving the first public key as part of the issuance request originated by the user device. ### Claim 45 (depends on 44) The method of claim 44 further comprising receiving the first public key as part of a user certificate from the user device. ### Claim 46 (depends on 45) The method of claim 45 further comprising retaining the private key associated with the first public key in the security element of the user device. ### Claim 47 (depends on 43) The method of claim 43 further comprising configuring the issuing system as a Wireless Application Protocol (WAP) server, such that remote wireless communication devices may request stored-value data objects from the WAP server. ### Claim 48 (depends on 47) The method of claim 47 further comprising receiving the issuance request and issuing the stored-value data object at the WAP server in accordance with Wireless Application Protocol Public Key Infrastructure (WPKI) definitions. ### Claim 49 (depends on 43) The method of claim 43 further comprising communicating between the redeeming system and the user device using wireless signaling. ### Claim 50 (depends on 43) The method of claim 43 further comprising sending a nonce from the redeeming system to the user device. ### Claim 51 (depends on 50) The method of claim 50, wherein the security element in the user device uses both the nonce and the second public key to encrypt the stored-value data object transferred to the redeeming system, the method further comprising decrypting the stored-value data object received from the user device at the redeeming system in accordance with the second private key and the nonce. ### Claim 52 (depends on 43) The method of claim 43 further comprising receiving the first public key at the redeeming system. ### Claim 53 (depends on 52) The method of claim 52 further comprising returning a redeemed stored-value data object encrypted using the first public key to the user device from the redeeming system. ### Claim 54 (depends on 53) The method of claim 53 further comprising exchanging the redeemed stored-value data object for a temporary stored-value data object that may be subsequently validated on a temporary basis. ### Claim 55 (depends on 54) The method of claim 54 further comprising defining the temporary basis as a defined number of allowable validation attempts. ### Claim 56 (depends on 55) The method of claim 55 further comprising defining the temporary basis as a defined time period during which subsequent validation is permitted. ### Claim 57 (depends on 56) The method of claim 56 further comprising returning a seed value, encrypted using the first public key associated with the user device, from the redeeming system to the user device. ### Claim 58 (depends on 57) The method of claim 57 further comprising verifying the temporary stored-value data object, based on the seed value, during a subsequent redemption attempt by the user device. ### Claim 59 (depends on 58) The method of claim 58, wherein verifying the temporary stored-value data object, based on the seed value, during a subsequent redemption attempt by the user device comprises verifying a pseudorandom number sequence returned from the user device based on the seed value and a redemption-system time-of-day value. ### Claim 60 (depends on 59) The method of claim 59, wherein the user device generates the pseudorandom sequence using the seed value and a user-device time-of-day value, the method further comprising synchronizing the redemption-system time-of-day value to a reference time associated with the user-device time-of-day value. ### Claim 61 (depends on 59) The method of claim 59 further comprising verifying the pseudorandom sequence returned from the user device by comparing the returned pseudorandom sequence to possible sequences generated by a like pseudorandom sequence generator over a defined time window referenced to the redemption-system time-of-day value. ### Claim 62 (depends on 54) The method of claim 54 further comprising verifying the temporary stored-value data object at a second redeeming system using a reduced-security redemption protocol as compared to the initial verification of the stored-value data object at the first redeeming system.