System for authenticating users and devices in on-line transaction networks

Patent 4317957 Issued on March 2, 1982. Estimated Expiration Date:

March 10, 2000. Estimated Expiration Date is calculated based on simple USPTO term provisions. It does not account for terminal disclaimers, term adjustments, failure to pay maintenance fees, or other factors which might affect the term of a patent.

Abstract Claims Description Full Text

Patent References

Transaction execution system with secure data storage and communications
Patent #: 3956615
Issued on: 05/11/1976
Inventor: Anderson , et al.

Personal authority verification system
Patent #: 3985998
Issued on: 10/12/1976
Inventor: Crafton

Security means for transaction terminal system
Patent #: 4025760
Issued on: 05/24/1977
Inventor: Trenkamp

Identity verification method and apparatus
Patent #: 4123747
Issued on: 10/31/1978
Inventor: Lancto , et al.

Personal identification system
Patent #: 4214230
Issued on: 07/22/1980
Inventor: Fak , et al.

Cryptographic architecture for use with a high security personal identification system
Patent #: 4223403
Issued on: 09/16/1980
Inventor: Konheim , et al.

Cryptographic file security for single domain networks
Patent #: 4238854
Issued on: 12/09/1980
Inventor: Ehrsam , et al.

Security system for electronic funds transfer system Patent #: 4259720
Issued on: 03/31/1981
Inventor: Campbell

Inventor

Sendrow, Marvin

Application

No. 06/129110 filed on 03/10/1980

US Classes:

705/71, Including key management235/379, Banking systems235/382, Permitting access380/281, Using master key (e.g., key-encrypting-key)380/45, Multiple key level705/43, Including Automatic Teller Machine (i.e., ATM)705/72, Verifying PIN713/185, Using record or token902/2, Protects transmitted data (e.g., encryption or decryption)902/5And to verify identity of user*

Examiners

Primary: Birmiel, Howard A.

Attorney, Agent or Firm

International Classes

G06Q 20/00 (20060101)
G07F 7/10 (20060101)

Abstract

A method for efficiently protecting transactions and providing authentication of users and devices in on-line systems that transfer funds electronically, dispense cash, or provide a good or permit a service to be utilized is provided. The transaction may be initiated by a magnetic-striped plastic card at an attended or unattended terminal (10, 11, 12) and requires the entry of a preassigned Personal Identification Number through a keyboard (20). The Personal Identification Number is encrypted (23) more than once at the terminal and other means are used in order to prevent the utilization of certain tapped-line data. The data required to validate and authorize the transaction is transmitted securely to a centralized computer (14) which accesses from its stored data base (15) the data that is required to decrypt and validate the transaction, including the encrypted Personal Identification Number corresponding to the received transaction data. A secret Terminal Master Key must be maintained securely at each terminal and may differ at each terminal. A list of such Terminal Master Keys and other secret data must be securely maintained at the centralized computer. Means for multiple-encryptions and decryptions in a predetermined way must also be maintained at each terminal and at the centralized computer. Means (34) are provided for securely returning a response to the terminal at which the transaction was initiated to authorize or reject the requested transaction. These functions are accomplished in a way that permits efficient utilization of data communications lines and reduces or eliminate perpetration of fraud by any of various means.