# US 8,788,828 B2 · Non-transferable anonymous digital receipts

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,788,828 B2
- Document ID: US8788828B2
- Status: Granted
- Kind: B2
- Application number: 13/612,263
- Filed: 2012-09-12
- Published: 2013-01-03
- Granted: 2014-07-22
- Earliest claimed: 2001-04-23
- Assignees: International Business Machines Corporation
- Applicants: Elsie van Herrewegen; Jan Camenisch
- Inventors: Elsie van Herrewegen; Jan Camenisch
- Web page: https://patentgrep.com/patent/US8788828B2

## CPC

- H04L 9/3247: {involving digital signatures}
- G06Q 20/047: {using payment protocols involving electronic receipts}
- H04L 2209/42: Anonymization, e.g. involving pseudonyms
- H04L 2209/56: Financial cryptography, e.g. electronic payment or e-cash
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR

## Abstract

A system and method for verifying ownership of an electronic receipt in a communication system providing a public key infrastructure, the verification arising out of a series of messages being sent and received between a first party and a verifying party, the method comprising the steps of receiving a proof message from the first party, the proof message being derived from at least a first public key based on a secret owned by the first party and wherein the secret is associated with at least the secret of a further public key of the first party and an electronic receipt that has been issued by electronically signing a request message with a second public key, determining whether or not the proof message was derived from the second public key.

## Claims

### Claim 1

A method for verifying ownership of an electronic receipt by a validating party (B) in a communication system providing a public key infrastructure, the verification arising out of a series of messages being sent and received between a first party (U), a second party (A), and a certificate authority (A), said method comprising:
receiving, at the certificate authority (A) a request message (RM) from the first party (U), the request message (RM) comprising a transaction request (TR) and a public key (PU) based on a secret (SU) owned by the first party (U), and wherein the secret (SU) is associated with at least a further secret (SU) of a further public key (PU) of the first party (U),
electronically signing, by said certificate authority (A), at least part of the request message (RM) with a public key (PA) assigned to said the certificate authority (A) for issuance as said electronic receipt (LU) to said first party (U);
said method further comprising:
subsequently receiving, at said second party (A), an encryption (E2) of the secret (SU) of a user's public key (PU) under the further public key (PU);
publishing, by said second party (A), said encryption (E2) to establish a link between the further secret (SU) of the further public key (PU) and the secret (SU) of the public key (PU), wherein:
E2=encPu(SU); and
receiving at said validation party (B) a proof message (PM) from said first party (U), said PM derived from said further public key (PU) based on the further secret (SU) owned by the user U, said further secret (SU) being associated via said encryption (E2) to said further public key (PU), said proof message (PM) being further derived from an electronic receipt (LU) previously issued by second party (A) signing said RM with a public key PA of said second party;
said second validating party (B) receiving said encryption (E2) and publishing said encryption E2; and
validating by the validating party (B) user ownership of said electronic receipt (LU) and (LU) and said encryption (E2) by verifying a cryptographic proof of the existence of values PU, SU, LU, PU, SU, LU such that the value PU is a first public key derived from the value SU and the value LU is a signature with respect to the public key PA on at least the value (PU), and the value PU is the public key derived from the value SU and the value LU is a signature with respect to the public key PA on at least the value PU and the encryption E2 is the encryption of the value SU under the value PU.

### Claim 2 (depends on 1)

The method according to claim 1, further comprising:
receiving, at said second party (A), a further public key (PUE) and a first encryption (E1) of a secret (SUE) of the further public key (PUE) under the public key (Pa), wherein E1=encPu (SUE).

### Claim 3 (depends on 2)

The method according to claim 2, further comprising: verifying a first cryptographic proof whether or not the secret (SUE) of the further public key (PUE) is encrypted in the first encryption (E1) under the first public key (PU).

### Claim 4 (depends on 1)

The method according to claim 1, further comprising: verifying a further cryptographic proof of the existence of a first, second, and a third value (PU, SU, LU) such that a first value (PU) is a public key derived from the second value (SU) and a third value (LU) is a signature with respect to a second public key (PA) on at least the first value (PU).

### Claim 5

A system for verifying ownership of an electronic receipt by a validating party (B) in a communication system providing a public key infrastructure, the verification arising out of a series of messages being sent and received between a first party (U), a second party (A), and a certificate authority (A), the system comprising:
a memory storage device;
a processor device in communication with said memory storage device at a first computer system configured to perform a method to:
receive, at the certificate authority (A) a request message (RM) from the first party (U), the request message (RM) comprising a transaction request (TR) and a public key (PU) based on a secret (SU) owned by the first party (U), and wherein the secret (SU) is associated with at least a further secret (SU) of a further public key (PU) of the first party (U),
electronically sign, by said certificate authority (A), at least part of the request message (RM) with a public key (PA) assigned to said the certificate authority (A) for issuance as said electronic receipt (LU) to said first party (U);
said method further comprising:
subsequently receive, at said second party (A), an encryption (E2) of the secret (SU) of a user's public key (PU) under the further public key (PU);
publish, by said second party (A), said encryption (E2) to establish a link between the further secret (SU) of the further public key (PU) and the secret (SU) of the public key (PU), wherein:
E2=encpu(S); and
receive at said validation party (B) a proof message (PM) from said first party (U), said PM derived from said further public key (PU) based on the further secret (SU) owned by the user U, said further secret (SU) being associated via said encryption (E2) to said further public key (PU), said proof message (PM) being further derived from an electronic receipt (LU) previously issued by second party (A) signing said RM with a public key PA of said second party;
said second validating party (B) receiving said encryption (E2) and publishing said encryption E2; and
a processor device in communication with a memory storage device at a second computer system configured to perform a method to:
validate by the validating party (B) user ownership of said electronic receipt (LU) and (LU) and said encryption (E2) by verifying a cryptographic proof of the existence of values PU, SU, LU, PU, SU, LU such that the value PU is a first public key derived from the value SU and the value LU is a signature with respect to the public key PA on at least the value (PU), and the value PU is the public key derived from the value SU and the value LU is a signature with respect to the public key EA on at least the value PU and the encryption E2 is the encryption of the value SU under the value PU.

### Claim 6 (depends on 5)

The system according to claim 5, wherein said second party (A) further receives a further public key (PUE) and a first encryption (E1) of a secret (SUE) of the further public key (PUE) under the public key (PU), wherein E1=encPu (SUE).

### Claim 7 (depends on 6)

The system according to claim 6, wherein said processor device is configured to further verify a first cryptographic proof whether or not the secret (SUE) of the further public key (PUE) is encrypted in the first encryption (E1) under the first public key (PU).

### Claim 8 (depends on 5)

The system according to claim 5, wherein said processor device is configured to further verify a further cryptographic proof of the existence of a first, second, and a third value (PU, SU, LU) such that a first value (PU) is a public key derived from the second value (SU) and a third value (LU) is a signature with respect to a second public key (PA) on at least the first value (PU).

### Claim 9

An article of manufacture comprising:
a computer usable medium, said medium not a propagating signal, said medium having computer readable program code tangibly embodied therein to execute at least one machine instruction in a processing unit for verifying ownership of an electronic receipt by a validating party (B) in a communication system providing a public key infrastructure, the verification arising out of a series of messages being sent and received between a first party (U), a second party (A), and a certificate authority (A) wherein:
a certificate authority (A) receives a request message (RM) from the first party (U), the request message (RM) comprising a transaction request (TR) and a public key (PU) based on a secret (SU) owned by the first party (U), and wherein the secret (SU) is associated with at least a further secret (SU) of a further public key (PU) of the first party (U),
the certificate authority (A) electronically signs at least part of the request message (RM) with a public key (PA) assigned to said the certificate authority (A) for issuance as said electronic receipt (LU) to said first party (U); and wherein
a second party (A) subsequently receives an encryption (E2) of the secret (SU) of a user's public key (PU) under the further public key (PU), the second party (A) publishing said encryption (E2) to establish a link between the further secret (SU) of the further public key (PU) and the secret (SU) of the public key (PU), wherein:
E2=encpu(SU); and
wherein at the processing unit, when running, said computer readable program code causing the processing unit to perform a method to:
receive at said validation party (B) a proof message (PM) from said first party (U), said PM derived from said further public key (PU) based on the further secret (SU) owned by the user U, said further secret (SU) being associated via said encryption (E2) to said further public key (PU), said proof message (PM) being further derived from an electronic receipt (LU) previously issued by second party (A) signing said RM with a public key PA of said second party;
said second validating party (B) receiving said encryption (E2) and publishing said encryption E2; and
validate by the validating party (B) user ownership of said electronic receipt (LU) and (LU) and said encryption (E2) by verifying a cryptographic proof of the existence of values PU, SU, LU, PU, SU, LU such that the value PU is a first public key derived from the value SU and the value LU is a signature with respect to the public key PA on at least the value (PU), and the value PU is the public key derived from the value SU and the value LU is a signature with respect to the public key PA on at least the value PU and the encryption E2 is the encryption of the value SU under the value PU.

### Claim 10 (depends on 9)

The article of manufacture according to claim 9, wherein said second party (A) further receives a further public key (PUE) and a first encryption (E1) of a secret (SUE) of the further public key (PUE) under the public key (PU), wherein E1=encPu (SUE).

### Claim 11 (depends on 10)

The article of manufacture according to claim 10, wherein the verifying includes verifying a first cryptographic proof whether or not the secret (SUE) of the further public key (PUE) is encrypted in the first encryption (E1) under the first public key (PU).

### Claim 12 (depends on 9)

The article of manufacture according to claim 9, wherein the verifying includes verifying a further cryptographic proof of the existence of a first, second, and a third value (PU, SU, LU) such that a first value (PU) is a public key derived from the second value (SU) and a third value (LU) is a signature with respect to a second public key (PA) on at least the first value (PU).