Modifying message data and generating random number digital signature within computer chip

Abstract

A method of generating a digital signature within a computer chip includes receiving data representing a message, and generating a digital signature for the message by modifying the message data with additional data, calculating a hash value of the modified message, and encrypting the hash value using a private key of a public-private key pair. The additional data includes data prestored within content searchable memory of the computer chip and a verification status of the computer chip. The verification status is identified out of a plurality of predefined verification statuses as a function of verification data input into the computer chip and data prestored within the computer chip. An identified verification status is used by one entity in determining risk regarding an electronic communication from another entity, especially where the electronic communication comprises a request and a digital signature generated by the computer chip.

Description

I. CROSS-REFERENCE TO RELATED APPLICATIONS[0001] This patent application claims priority in the United States under 35 U.S.C. 119, and under the Paris Convention worldwide, to the benefit of the filing date of Wheeler et al. U.S. provisional patent application serial No. 60 / 223,076, which was filed on Aug. 4, 2000, and which is incorporated herein by reference. This application also incorporates herein by reference each of four international patent applications and two U.S. patent application to Anne and Lynn Wheeler filed concurrently herewith on Aug. 6, 2001, in the U.S. Patent & Trademark Office and bearing serial number PCT / US______ / ______(entitled "Person-Centric Account-Based Digital Signature System") and serial number 09 / _______,_______ (entitled "Account-Based Digital Signature (ABDS) System"); serial number PCT / US_______ / _______(entitled "Entity Authentication in Electronic Communications by Providing Verification Status of Device"); serial number PCT / US______ / ______(enti...

AI Technical Summary

Benefits of technology

0065] Random numbers are utilized in may computer applications, such as in security protocols like secure socket layer (SSL) protocol and pretty good privacy (PGP) for the creation of session keys. Yet another feature of the present invention includes the generation of a digital signature using a digital signature algorithm, with the resulting digital signature being used in such an application as a random number.

0066] The device of the methods of the present invention preferably is a personal device of the sender of the EC. The device also preferably includes a device interface such as, for example, an alphanumeric keypad, an electrical contact, a touch screen display, a standard electronic interface with a computer bus, or an antenna. The device interface also may comprise a port the device, such as a wireless communic

Problems solved by technology

A fraudulent use of a private key to generate a digital signature of an EC currently cannot be detected through the above-described Message Authentication and Factor A Entity Authentication procedures.

The digital signature system therefore is susceptible to fraud if a private key of a device is stolen, either by discovery of the private key therein and subsequent copying and use in another device capable of generating digital signatures, or by physical theft of the device containing the private key.

While Factor B Entity Authentication and Factor C Entity Authentication both reduce the risk of a fraudulent use of a device to generate a digital signature for a message, both also include significant drawbacks.

This paradigm also exposes the Secret or biometric value itself to a greater risk of theft.

First, the transmission of the Secret or biometric value for verification carries with it the risk of interception and discovery during transit.

Second, the Secret or biometric value must be safeguarded by the recipient, thereby exposing the Secret to theft from the recipient.

This is especially significant in the corporate context where a rogue employee may steal the safeguarded Secret or biometric value (insider fraud historically has been the greatest risk).

The potential damages also are extensive when the Secret or biometric value is stolen under this paradigm.

Since it is difficult for an individual to remember multiple Secrets for multiple recipients, it is common for the same Secret to be used by an individual with different recipients.

The theft of the Secret from one credit card company puts all of the other credit card accounts at jeopardy, at least until the Secret is changed.

In the case of the theft of a biometric value, the damages are even more severe, as a person's biometric characteristic cannot be changed and, once lost, potentially compromises any future entity authentication therewith.

A drawback to this alternative paradigm, however, is that because the device remains inoperable until the correct Secret or biometric value of the user is entered, the recipient is unable to monitor repeated attempts to guess the Secret or biometric value.

Under this alternative paradigm, a recipient is unable to determine whether a particular EC sent during such a time period includes a fraudulently generated digital signature, as the device may have been stolen after being enabled but before its deactivation.

Yet another drawback is that this alternative paradigm does not particularly accommodate the use of the device to send ECs to different recipients when a biometric value is prestored and maintained within--and Factor C Entity Authentication is performed by--the device.

Images