US 8,145,899 B2Granted

Creation of user digital certificate for portable consumer payment device

AssigneeVisa International Service Association

InventorTerence V. Trench

Life of this patent

Estimating the term…

Loading patent…

Abstract

A method for creating a digital certificate for a user issued by a reliant party, where the reliant party relies on an established cryptographic infrastructure by a registration or certificate authority is described. The registration authority, typically a large financial or credit institution, has already performed the initial overhead steps necessary for a digital authentication system using a chip card. These steps include minting and distributing the chip card, establishing that the key pair and card are given to the right person, and creating the certificate library. The reliant party leverages this cryptographic infrastructure to issue its own digital certificate and certificate chain to a user already having a chip card from the registration authority. Consequently, a user can have additional digital certificates issued to him without having his chip card modified in any way. All additional digital certificates created for a user are stored at a user-specific memory are in a remote certificate library.

Claims20

Dependent claims

A method comprising:

encrypting, to create an encrypted data set by using an issuer private key, a user public key and a set of attributes;
storing, on a portable consumer payment device useable by a user to make purchase from a merchant, a user private key and an address of a certificate library server;
and
storing a digital certificate at a user-allocated memory segment of the certificate library server, wherein the digital certificate contains the user public key, the set of attributes, the encrypted data set, and an issuing-party identifier;
and
storing, in the user-allotted memory segment of the certificate library server, a certificate chain created from the digital certificate, wherein the certificate library server stores a plurality of the certificate chains of other said users, and the certificate library server includes:
a plurality of the user-allocated memory segments each being accessible by an address contained in one said portable consumer payment device of one said user;
a plurality of the certificate chains issued to the one said user, wherein the plurality of the certificate chains are included in one of the user-allocated memory segments and wherein each said certificate chain is issued to the one said user by an issuer;
an issuer identifier associated with each said certificate chain that identifies the issuer on whose behalf the digital certificate is provided in the certificate library server;
a user first cryptographic key included in each said certificate chain, said user first cryptographic key having a corresponding user second cryptographic key being stored in the one said portable consumer payment device of the one said user;
a set of user attributes included in each said certificate chain providing information regarding the relationship between the one said user and the issuer associated with the digital certificate chain;
and
a trusted root certificate for each said certificate chain, with the corresponding trusted root differing from other trusted certificate roots stored at the corresponding user-allocated memory segment.

10 more elements

An apparatus comprising:

means for generating:
a user private key for a user;
and
a user public key for the user;
means for creating an encrypted data set using:
an issuer private key;
and
a set of attributes containing data pertaining to the user;
means for creating a digital certificate containing the user public key, the set of attributes, the encrypted data set, and an issuing-party identifier;
means for storing the digital certificate at a user-allocated memory segment of a certificate library server;
means for storing, on a portable consumer payment device of the user, the user private key and an address of the certificate library server;
means for creating a certificate chain using the digital certificate;
and
means for storing the certificate chain in the user-allotted memory segment of the certificate library server, wherein the certificate library server stores a plurality of the certificate chains of other said users, and the certificate library server includes:
a plurality of the user-allocated memory segments each being accessible by an address contained in one said portable consumer payment device of one said user;
a plurality of the certificate chains issued to the one said user, wherein the plurality of the certificate chains are included in one of the user-allocated memory segments and wherein each said certificate chain is issued to the one said user by an issuer;
an issuer identifier associated with each said certificate chain that identifies the issuer on whose behalf the digital certificate is provided in the certificate library server;
a user first cryptographic key included in each said certificate chain, said user first cryptographic key having a corresponding user second cryptographic key being stored in the one said portable consumer payment device of the one said user;
a set of user attributes included in each said certificate chain providing information regarding the relationship between the one said user and the issuer associated with the digital certificate chain;
and
a trusted root certificate for each said certificate chain, with the corresponding trusted root differing from other trusted certificate roots stored at the corresponding user-allocated memory segment.

18 more elements

A method comprising:

generating a user private key and a user public key;
obtaining a set of attributes containing data pertaining to a user;
encrypting a combination of the user public key and the set of attributes using an issuer private key to create an encrypted data set;
creating a digital certificate containing the user public key, the set of attributes, the encrypted data set, and an issuing-party identifier;
storing the digital certificate at a user-allocated memory segment of a certificate library server;
storing the user private key and an address of the certificate library server on a portable consumer payment device that includes:
memory for storing:
the user private key;
the address of the certificate library server;
and
one or more application each including instructions;
a processor for executing the instructions of the applications in the memory;
and
a communicator portion for the portable consumer payment device to communicate with a card reader, wherein the processor executes instructions for one said application such that the portable consumer payment device:
receives an unencrypted text string corresponding to a challenge from a reliant party;
and
produces an encrypted text string by signing the challenge using with the user private key, wherein the encrypted text string can be communicated to the reliant party via being read by the card reader through the communicator portion;
creating a certificate chain using the digital certificate;
and
storing the certificate chain in the user-allotted memory segment of the certificate library server, wherein the certificate library server stores a plurality of the certificate chains of other said users, and the certificate library server includes:
a plurality of the user-allocated memory segments each being accessible by an address contained in one said portable consumer payment device of one said user;
a plurality of the certificate chains issued to the one said user, wherein the plurality of the certificate chains are included in one of the user-allocated memory segments and wherein each said certificate chain is issued to the one said user by an issuer;
an issuer identifier associated with each said certificate chain that identifies the issuer on whose behalf the digital certificate is provided in the certificate library server;
a user first cryptographic key included in each said certificate chain, said user first cryptographic key having a corresponding user second cryptographic key being stored in the one said portable consumer payment device of the one said user;
a set of user attributes included in each said certificate chain providing information regarding the relationship between the one said user and the issuer associated with the digital certificate chain;
and
a trusted root certificate for each said certificate chain, with the corresponding trusted root differing from other trusted certificate roots stored at the corresponding user-allocated memory segment.

24 more elements

Dependencies are inferred from the claim text.

Facts

Application: 12/471,357Filed 23 May 2009 · continuation
Priority: 27 Oct 1999
Published: US 2009/0235070 A117 Sep 2009
Granted: 27 Mar 2012
Term ends: Not estimatedThe source records don’t support an estimate.

Classification17 codes

H04L 63/0435
Wherein the data content is protected, e.g. by encrypting or encapsulating the payload: wherein the sending and receiving network entities apply…
G06Q 20/02
Payment architectures, schemes or protocols: involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
G06Q 20/341
Using cards, e.g. integrated circuit [IC] cards or magnetic cards: active cards, i.e. cards including their own processing means, e.g. including…
G06Q 20/355
Using cards, e.g. integrated circuit [IC] cards or magnetic cards: personalisation of cards for use

Family

Application60/161,706Us provisional application · filed 27 Oct 1999
Application09/590,438Parent of this continuation · filed 9 Jun 2000
Application11/044,882Parent of this continuation · filed 27 Jan 2005
US 7,539,861 B2Parent of this continuation · filed 26 May 2009
US 2009/0235070 A1Pre-grant publication · published 17 Sep 2009
US 2005/0154877 A1Published application
US 8,145,899 B2This patent

From the US filing history. Foreign family members aren’t listed.