Method and system for personal identification using proofs of legitimacy
OwnerFrank T. Leighton, Silvio Micaliinventors
Life of this patent
Estimating the term…
Abstract
The method and system for the invention utilizes any of a number of "proofs of legitimacy" to generate and verify a personal identification card. A card is generated by computing a digital signature of a non-secret password. The password and the digital signature are then encoded and stored on a magnetic stripe or other memory device of the card. To effect a transaction, the digital signature on a received card must be shown to have been generated from the password on the received card. The password preferably includes a digitized photograph of the authorized cardholder which is capable of being displayed at the transaction terminal. This enables the operator of the terminal to verify the identity of the cardholder by visual inspection.
Claims17
A method for enabling an authorized user of a personal identification card to effect a transaction using a transaction terminal, comprising the steps of:
- generating a first data string having a portion thereof which is derived from a physical characteristic of the authorized user and need not be retained secret;
- digitally signing the first data string to generate a signature corresponding to the first data string;
- encoding the first data string and the signature using a predetermined encoding function to generate an encoded first data string/signature;
- storing the encoded first data string/signature on the personal identification card;
- receiving the personal identification card at the transaction terminal;
- decoding the encoded first data string/signature on the received personal identification card to generate the first data string and a received signature;
- digitally verifying whether the received signature can be generated from the first data string;
- if the received signature can be generated from the first data string, generating an indication that the signature is valid;
- generating a representation from the first data string;
- and
- displaying the representation and the indication on a display of the transaction terminal to enable an operator thereof to verify that the user is authorized to effect a transaction using the personal identification card.
A method for enabling an authorized user of a personal identification card to effect a transaction using a transaction terminal, the personal identification card having stored therein a first data string having a portion thereof which is derived from a physical characteristic of the authorized user and need not be retained secret, and a signature of the first data string, comprising the steps of:
- receiving the personal identification card at the transaction terminal;
- digitally verifying whether the signature on the personal identification card received at the transaction terminal can be generated from the first data string;
- if the signature can be generated from the first data string, generating an indication that the signature is valid;
- generating a representation from the first data string;
- and
- displaying the representation and the indication on a display of the transaction terminal to enable an operator thereof to verify that the user is authorized to effect a transaction using the personal identification card.
A method for enabling an authorized user of a personal identification card to effect a transaction using a transaction terminal, the personal identification card having a processor and a storage area, the storage area for storing a data string having a portion thereof which is derived from a physical characteristic of the authorized user and some other authorizing information, comprising the steps of:
- (a) receiving the personal identification card at the transaction terminal;
- (b) exchanging one or more messages between the personal identification card and the transaction terminal to enable the transaction terminal to verify whether the personal identification card contains the authorizing information;
- (c) if the transaction terminal verifies that the personal identification card contains the authorizing information, generating an indication that the authorizing information is valid;
- (d) generating a representation from the data string;
- and
- (e) displaying the representation and the indication on a display of the transaction terminal to enable an operator thereof to verify that the user is authorized to effect a transaction using the personal identification card.
A method for enabling an authorized user of a personal identification card to effect a transaction using a transaction terminal, the personal identification card having a processor and a storage area, the storage area for storing a data string Q, a value j equal to the one of the factors .+-.1 mod M and .+-.2 mod M that causes the product of j and Q modulo M to be a perfect square modulo M, and a signature z of the data string equal to the square root of the product, and where M equals a product of P.sub.1 multiplied by P.sub.2 and P.sub.1 and P.sub.2 are secret prime numbers, comprising the steps of:
- (a) receiving the personal identification card at the transaction terminal;
- (b) determining whether a predetermined number of legitimacy checks have been carried out on the personal identification card;
- (c) if the predetermined number of legitimacy checks have not been carried out, exchanging one or more messages between the personal identification card and the transaction terminal to enable the transaction terminal to verify whether the personal identification card contains the signature z;
- (d) if the transaction terminal verifies that the personal identification card contains the signature z, repeating step (b);
- (e) if the predetermined number of legitimacy checks have been carried out, generating an indication that the signature z is valid;
- (f) generation a representation from the data string;
- and
- (g) displaying the representation and the indication on a display of the transaction terminal to enable an operator thereof to verify that the user is authorized to effect a transaction using the personal identification card.
Dependencies are inferred from the claim text.