US20050198536A1 - Digital credential usage reporting - Google Patents
Digital credential usage reporting Download PDFInfo
- Publication number
- US20050198536A1 US20050198536A1 US11/122,893 US12289305A US2005198536A1 US 20050198536 A1 US20050198536 A1 US 20050198536A1 US 12289305 A US12289305 A US 12289305A US 2005198536 A1 US2005198536 A1 US 2005198536A1
- Authority
- US
- United States
- Prior art keywords
- transaction
- digital
- digital credential
- credential
- activity
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Abandoned
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q10/00—Administration; Management
- G06Q10/10—Office automation; Time management
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/08—Payment architectures
- G06Q20/20—Point-of-sale [POS] network systems
- G06Q20/206—Point-of-sale [POS] network systems comprising security or operator identification provisions, e.g. password entry
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
- G06Q20/3821—Electronic credentials
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q30/00—Commerce
- G06Q30/02—Marketing; Price estimation or determination; Fundraising
Definitions
- Cryptography provides the basis for a number of privacy and authentication mechanisms used in computer-based systems.
- One such mechanism is a digital signature, which is often used to authenticate the sender of an electronic message.
- the sender To create a digital signature, the sender first creates a private signature key and a corresponding public verification key. To sign a message or other document, the sender performs a computation that takes as input the message and the private signature key and produces as output a digital signature for that message.
- a receiver performs a computation that takes as input the message, the digital signature for that message, and the public verification key, and produces as output either “signature verified” or “signature failed to verify.”
- the receiver In order to facilitate the authentication of a digitally signed document, the receiver must be assured that the public verification key that is used to verify the signature is indeed the public verification key belonging to the sender of the message. Typically, the receiver will obtain a digital certificate, which contains the identity of the sender, the public verification key of the sender, and other information. Typically, this digital certificate is digitally signed by a certification authority. Other mechanisms are also used for establishing the correspondence between an identity and a public verification key such as an entry in a database.
- FIG. 1 is a block diagram illustrating one example of a system that monitors the usage of digital credentials.
- FIG. 2 is a flow chart illustrating one example of a process for monitoring the usage of digital credentials.
- FIG. 3 is an example activity log.
- FIG. 4 is a block diagram illustrating a computer suitable for implementing embodiments of the invention.
- a user's “digital credential”, as used herein, refers to the security mechanisms associated with the user's identity.
- a user's digital credential can include one or more digital signature keys relating to one or more digital certificates.
- a user's digital credential can be any other suitable cryptographic security mechanism, such as a mechanism for use in a proprietary cryptographic scheme.
- Validating a user's digital credential can include one or more tasks. Examples include verifying that the user's digital signature is valid using the public key in the user's digital certificate and validating the digital certificate, which can include several additional tasks such as using a key of the certification authority to validate that the digital signature on the digital certificate is valid, verifying that the digital certificate has not been revoked or suspended, and validating the key of the certification authority.
- FIG. 1 is a block diagram illustrating one example of a system 2 that tracks the usage of digital credentials, generates activity reports, and identifies potential fraudulent activities or other misuse. As explained in detail below, system 2 allows timely detection of fraudulent activity or general misuse of digital credentials.
- Web browser 12 such as Internet ExplorerTM from MicrosoftTM Corporation of Redmond, Wash., executes in an operating environment provided by computing device 4 A and allows an owner of digital credential 16 to remotely access online services 6 via network 28 .
- online services 6 represent web-based venues that support secure electronic transactions.
- online services 6 can be web-based retailers of consumer products such as books, movies, software, toys, games and the like.
- online services 6 can be business-to-business web sites such as online marketplaces for medical and other supplies. Other examples include online banking institutions, brokerage firms, and health care services.
- authorized delegates of the user use web browsers (not shown) executing on computing devices 4 B through 4 M to access online services 6 and conduct secure transactions using a digital credential that has been authorized by the user to act on behalf of the user for specified uses.
- Computing devices 4 represents general purpose computing systems suitable for interacting with network 28 .
- a suitable computing device 4 is a personal computer.
- each computing device 4 can be a laptop computer, a handheld computer, a personal digital assistant (PDA), such as a PalmTM organizer from Palm Inc. of Santa Clara, Calif., or even a network-enabled cellular telephone.
- Network 28 represents any communication network, such as a packet-based digital network like the Internet.
- Credential service provider (CSP) 8 provides a central service by which a user can manage his or her digital credentials. More specifically, CSP 8 allows a user to request a digital credential, revoke a digital credential and define one or more delegates that are authorized to use their own digital credential to act in behalf of the user for specified functions.
- the user directs web browser 12 to CSP 8 , generates a private signature key and a public verification key, and requests a digital certificate.
- the user submits the public verification key and a variety of information, such as name and address, that is validated during the application process.
- CSP 8 submits the information to credential issuing service (CIS) 22 that, as a certificate authority, issues a corresponding digital credential 16 , including a digital certificate and signature key, and records the owner information in owner database 24 . In this fashion, the user becomes the “owner” of his or her digital credential 16 . After CIS 22 issues digital credential 16 the owner can access CSP 8 and designate one or more authorized delegates.
- CIS credential issuing service
- the owner uses digital credential 16 to securely access online services 6 , present digitally signed documents and otherwise conduct secure transactions.
- web browser 12 establishes a secure communication link with a web server at one of the online services 6 using a secure communications protocol, such as the Secure Socket Layer (SSL). When accessed, the web server issues a “challenge” to web browser 12 . Web browser 12 responds by signing the challenge with his private signature key and communicating digital credential 16 and the signed challenge to online service 6 .
- web browser 12 uses his private signature key to digitally sign a document presented to online server 6 , such as when the owner or delegate is submitting a confidential medical diagnosis or a prescription request to a web-based health care service.
- Online services 6 can opt to validate digital credential 16 directly, such as by verifying the digital signatures using the public key and by checking a local database to verify the association between the public key and the user. However, online services 6 can also communicate the digital credential 16 to credential verification service 10 (CVS) for verification. In one configuration, online services 6 validate transactions of low monetary value locally and use CVS 10 to validate high value transactions.
- CVS credential verification service 10
- CVS 10 To validate a digital credential 16 , CVS 10 receives the digital credential, such as the digital signature and the digital certificate, from online services 6 and interacts with CIS 22 . CVS 10 accesses CIS 22 to obtain the public key for CIS 22 , as a certificate authority, and verifies the digital signature. Next, CVS 20 accesses CIS 22 to determine whether digital credential 16 has been revoked, as indicated by certificate repository 26 . CVS 20 stores the result of the verification, whether successful or not, in activity log 20 .
- the digital credential such as the digital signature and the digital certificate
- CSP 8 allows the user to generate a number of digital signature keys associated with his identity and assign a “friendly name” to each key. For example, the user may assign names such as: Office Key, Home Key, Portable Key. As described below, this allows the user to more readily track usage of the digital signature keys.
- CVS 10 can automatically send an activity report to web browser 12 , which can display the activity report to the user. In this fashion the user can readily identify whether the digital signature key is being misused.
- CSP 8 can access CSP 8 and request an activity report that details any usage of digital signature key.
- CSP 8 communicates the request directly to CVS 10 .
- CVS 10 examines activity log 20 , extracts the relevant activity information, formulates a report and communicates the report to CSP 8 .
- CSP 8 electronically presents the report to the user via network 22 .
- the owner or delegate can also configure CSP 8 to periodically generate the report and electronically mail the report to the user. Alternatively, CSP 8 can mail a physical copy of the report to the user.
- fraud detection module 18 of CVS 10 applies fraud detection techniques to activity log 20 in order to automatically identify misuse. As described in detail below, fraud detection module 18 analyzes activity log 20 to identify any unusual patterns that may indicate misuse.
- FIG. 2 is a flow chart illustrating a process 30 further illustrating how system 2 monitors the usage of digital signature keys and identifies potential fraudulent activities or general misuse.
- Each online service 6 processes secure transactions by communicating digital credential 16 to CVS 10 for verification ( 32 ).
- CVS 10 cooperates with CIS 22 to verify digital credential 16 including determining whether digital credential 16 is revoked.
- online services validate the digital credential and communicate transaction information to CVS 10 .
- CVS 10 stores the result of each verification in activity log 26 ( 34 ).
- CVS 10 stores relevant transaction information such as a date and time of the transaction, the online service 6 that is involved in the transaction, the type of transaction, the device used to access the online service 6 , such as a laptop computer, cell phone or a PDA, the value of the transaction, and location and position information, such as an IP address or a name of computing device 4 .
- CVS 10 In order to facilitate the timely identification of misuse of digital credential 16 , CVS 10 generates activity reports that detail the information stored in activity log 20 ( 26 ). As discussed above, CVS 10 generates the activity reports in a variety of ways and at a variety of times. For example, CVS 10 can automatically generate an activity report when handling each verification request, thereby frequently providing the information to the user. In addition, CVS 10 can periodically generate activity reports or upon request by the owner.
- CVS 10 also tailors each activity report to the requestor such that the owner of digital credential 16 can view all activity, including any activity by the delegates. An individual delegate, however, can only view activity reports that list his or her activity.
- Fraud detection module 18 of CVS 10 analyzes activity log 20 to identify any unusual patterns in order to identify fraudulent activities. For example, a significant increase in the number or the size of the transactions can indicate misuse. A change in the types of transactions can indicate misuse. In addition, any indication that digital signature key 16 is suddenly being used from a different computing device, such as a change from a frequently used internet protocol (IP) address to a previously unused IP address, can also indicate misuse.
- IP internet protocol
- CVS 10 communicates an activity report to the owner alerting him or her of the activity. In this manner, the owner can readily determine whether any fraudulent activity or general misuse has indeed occurred and the extent of the activity.
- the owner can access CSP 8 and revoke digital credential 16 .
- the owner can revoke the associated digital certificate.
- the owner can create a new private signature key and a new public verification key and sign this public verification key with the old private signature key.
- System 2 can issue a new digital certificate for this new verification key.
- CSP 8 communicates the revocation to CIS 22 , which updates the status of digital credential 16 in certificate repository 26 , thereby causing any future verifications by CVS 10 of the digital credential to fail.
- the owner can immediately stop the fraudulent activity.
- the activity report can be provided to an authorized operator of CSP 8 of CVS 10 .
- an activity report detailing activity at a specific online service 6 can be generated and provided to an authorized operator at the online service.
- system 2 helps detect unauthorized use of the digital signature key in the event digital signature key is misappropriated.
- These features are especially advantages to professional services such as the healthcare profession.
- a healthcare professional accessing a healthcare oriented online service and requesting access to healthcare information or seeking to submit a prescriptions or diagnosis.
- the online service communicates transaction information describing the access request and the medical professional's digital credential to the central credential verification service.
- the healthcare oriented service Upon receiving a verification result from the credential verification service, the healthcare oriented service provides access to the medical records. Subsequently, the healthcare oriented service receives an activity report from the credential verification service and provides the report to healthcare professional.
- FIG. 3 is an example activity report 30 generated by CVS 10 .
- Activity report 30 lists the activities logged in activity log 20 , broken down by owner and delegate.
- the example activity report 40 lists the date and time, the online service involved in the transaction, the name of the computing device 4 used by the user to originate the transaction, the value of the transaction, the type of the transaction, and the authentication result.
- FIG. 4 illustrates a programmable computing system (system) 100 that provides an operating environment suitable for use as a computing device 4 or as a server within CSP 8 , CVS 10 or CIS 22 .
- the system 100 includes a processor 112 that represents any suitable microprocessor such as the PENTIUM® family of microprocessors manufactured by the Intel Corporation of Santa Clara, Calif. Other examples include the MIPS® family of microprocessors, the POWERPC® family of microprocessors from both the Motorola Corporation and the IBM Corporation, the PRECISION ARCHITECTURE® family of microprocessors from the Hewlett-Packard Company, the SPARC® family of microprocessors from the Sun Microsystems Corporation, or the ALPHA® family of microprocessors from the Compaq Computer Corporation.
- system 100 represents any server, personal computer, laptop or a hand-held PC, a personal digital assistant (PDA) or a network-enabled cellular phone.
- PDA personal digital assistant
- System 100 includes system memory 113 , including read only memory (ROM) 114 and random access memory (RAM) 115 , which is connected to the processor 112 by a system data/address bus 116 .
- Input/output bus 118 is connected to the data/address bus 116 via bus controller 119 .
- input/output bus 118 is implemented as a standard Peripheral Component Interconnect (PCI) bus.
- PCI Peripheral Component Interconnect
- the bus controller 119 examines all signals from the processor 112 to route the signals to the appropriate bus. Signals between the processor 112 and the system memory 113 are merely passed through the bus controller 119 . However, signals from the processor 112 intended for devices other than system memory 113 are routed onto the input/output bus 118 .
- Various devices are connected to the input/output bus 118 including hard disk drive 120 , floppy drive 121 that is used to read floppy disk 151 , and optical drive 122 , such as a CD-ROM drive that is used to read an optical disk 152 .
- the video display 124 or other kind of display device is connected to the input/output bus 118 via a video adapter 125 .
- System 100 Users enter commands and information into the system 100 by using a keyboard 140 and/or pointing device, such as a mouse 142 , which are connected to bus 118 via input/output ports 128 .
- pointing devices include track pads, track balls, joysticks, data gloves, head trackers, and other devices suitable for positioning a cursor on the video display 124 .
- System 100 also includes a modem 129 that is typically used to communicate over wide area networks (not shown), such as the Internet using either a wired or wireless connection.
- Software applications 136 and data are typically stored via one of the memory storage devices, which may include the hard disk 120 , floppy disk 151 , CD-ROM 152 and are copied to RAM 115 for execution. In one embodiment, however, software applications 136 are stored in ROM 114 and are copied to RAM 115 for execution or are executed directly from ROM 114 .
- the operating system 135 executes software applications 136 and carries out instructions issued by the user.
- the Basic Input/Output System (BIOS) 117 for the system 100 is a set of basic executable routines that have conventionally helped to transfer information between the computing resources within the system 100 .
- Operating system 135 or other software applications 136 use these low-level service routines.
- system 100 includes a registry (not shown) that is a system database that holds configuration information for system 100 .
Abstract
An credential verification service (CVS) authenticates digital credentials, such as, digital certificates, at the request of online service providers. The CVS stores the authentication results and transaction information in a central activity log. The transaction information can include a size of the transaction, the online service requesting the authentication, an internet protocol (IP) address of a computing device originating the transaction and the goods or services involved in the transaction. The CVS generates an activity report from the activity log that lists the authentication results and the transaction information. A fraud detection module within the CVS analyzes the activity log to identify any unusual patterns in order to identify fraudulent activities or general misuse of the digital credential.
Description
- Priority is claimed from U.S. provisional patent application Ser. No. 60/199,220, filed Apr. 24, 2000, and from U.S. patent application Ser. No. 09/608,402, filed Jun. 30, 2000, the contents of both of which are incorporated herein by reference.
- Cryptography provides the basis for a number of privacy and authentication mechanisms used in computer-based systems. One such mechanism is a digital signature, which is often used to authenticate the sender of an electronic message. To create a digital signature, the sender first creates a private signature key and a corresponding public verification key. To sign a message or other document, the sender performs a computation that takes as input the message and the private signature key and produces as output a digital signature for that message. To verify a digital signature, a receiver performs a computation that takes as input the message, the digital signature for that message, and the public verification key, and produces as output either “signature verified” or “signature failed to verify.”
- In order to facilitate the authentication of a digitally signed document, the receiver must be assured that the public verification key that is used to verify the signature is indeed the public verification key belonging to the sender of the message. Typically, the receiver will obtain a digital certificate, which contains the identity of the sender, the public verification key of the sender, and other information. Typically, this digital certificate is digitally signed by a certification authority. Other mechanisms are also used for establishing the correspondence between an identity and a public verification key such as an entry in a database.
-
FIG. 1 is a block diagram illustrating one example of a system that monitors the usage of digital credentials. -
FIG. 2 is a flow chart illustrating one example of a process for monitoring the usage of digital credentials. -
FIG. 3 is an example activity log. -
FIG. 4 is a block diagram illustrating a computer suitable for implementing embodiments of the invention. - A user's “digital credential”, as used herein, refers to the security mechanisms associated with the user's identity. For example, a user's digital credential can include one or more digital signature keys relating to one or more digital certificates. In addition, a user's digital credential can be any other suitable cryptographic security mechanism, such as a mechanism for use in a proprietary cryptographic scheme.
- Validating a user's digital credential, therefore, can include one or more tasks. Examples include verifying that the user's digital signature is valid using the public key in the user's digital certificate and validating the digital certificate, which can include several additional tasks such as using a key of the certification authority to validate that the digital signature on the digital certificate is valid, verifying that the digital certificate has not been revoked or suspended, and validating the key of the certification authority.
-
FIG. 1 is a block diagram illustrating one example of asystem 2 that tracks the usage of digital credentials, generates activity reports, and identifies potential fraudulent activities or other misuse. As explained in detail below,system 2 allows timely detection of fraudulent activity or general misuse of digital credentials. -
Web browser 12, such as Internet Explorer™ from Microsoft™ Corporation of Redmond, Wash., executes in an operating environment provided bycomputing device 4A and allows an owner ofdigital credential 16 to remotely access online services 6 vianetwork 28. Generally, online services 6 represent web-based venues that support secure electronic transactions. For example, online services 6 can be web-based retailers of consumer products such as books, movies, software, toys, games and the like. Alternatively, online services 6 can be business-to-business web sites such as online marketplaces for medical and other supplies. Other examples include online banking institutions, brokerage firms, and health care services. Similarly, authorized delegates of the user use web browsers (not shown) executing oncomputing devices 4B through 4M to access online services 6 and conduct secure transactions using a digital credential that has been authorized by the user to act on behalf of the user for specified uses. - Computing devices 4 represents general purpose computing systems suitable for interacting with
network 28. One example of a suitable computing device 4 is a personal computer. In addition, each computing device 4 can be a laptop computer, a handheld computer, a personal digital assistant (PDA), such as a Palm™ organizer from Palm Inc. of Santa Clara, Calif., or even a network-enabled cellular telephone. Network 28 represents any communication network, such as a packet-based digital network like the Internet. - Credential service provider (CSP) 8 provides a central service by which a user can manage his or her digital credentials. More specifically, CSP 8 allows a user to request a digital credential, revoke a digital credential and define one or more delegates that are authorized to use their own digital credential to act in behalf of the user for specified functions.
- In order to obtain
digital credential 16, the user directsweb browser 12 to CSP 8, generates a private signature key and a public verification key, and requests a digital certificate. The user submits the public verification key and a variety of information, such as name and address, that is validated during the application process. - CSP 8 submits the information to credential issuing service (CIS) 22 that, as a certificate authority, issues a corresponding
digital credential 16, including a digital certificate and signature key, and records the owner information inowner database 24. In this fashion, the user becomes the “owner” of his or herdigital credential 16. After CIS 22 issuesdigital credential 16 the owner can access CSP 8 and designate one or more authorized delegates. - The owner uses
digital credential 16 to securely access online services 6, present digitally signed documents and otherwise conduct secure transactions. In one configuration,web browser 12 establishes a secure communication link with a web server at one of the online services 6 using a secure communications protocol, such as the Secure Socket Layer (SSL). When accessed, the web server issues a “challenge” toweb browser 12.Web browser 12 responds by signing the challenge with his private signature key and communicatingdigital credential 16 and the signed challenge to online service 6. In another configuration,web browser 12 uses his private signature key to digitally sign a document presented to online server 6, such as when the owner or delegate is submitting a confidential medical diagnosis or a prescription request to a web-based health care service. - Online services 6 can opt to validate
digital credential 16 directly, such as by verifying the digital signatures using the public key and by checking a local database to verify the association between the public key and the user. However, online services 6 can also communicate thedigital credential 16 to credential verification service 10 (CVS) for verification. In one configuration, online services 6 validate transactions of low monetary value locally and useCVS 10 to validate high value transactions. - To validate a
digital credential 16, CVS 10 receives the digital credential, such as the digital signature and the digital certificate, from online services 6 and interacts with CIS 22. CVS 10 accessesCIS 22 to obtain the public key forCIS 22, as a certificate authority, and verifies the digital signature. Next, CVS 20accesses CIS 22 to determine whetherdigital credential 16 has been revoked, as indicated bycertificate repository 26. CVS 20 stores the result of the verification, whether successful or not, in activity log 20. - In one configuration, CSP 8 allows the user to generate a number of digital signature keys associated with his identity and assign a “friendly name” to each key. For example, the user may assign names such as: Office Key, Home Key, Portable Key. As described below, this allows the user to more readily track usage of the digital signature keys.
-
System 2 incorporates many features that allow an owner or delegate to detect unauthorized use of the digital signature key in the event digital signature key is misappropriated or otherwise misused. For example, when verifying digital signature during each secure transaction, CVS 10 can automatically send an activity report toweb browser 12, which can display the activity report to the user. In this fashion the user can readily identify whether the digital signature key is being misused. - In addition, the owner or delegate can access
CSP 8 and request an activity report that details any usage of digital signature key. Upon receiving such a request, CSP 8 communicates the request directly toCVS 10.CVS 10 examinesactivity log 20, extracts the relevant activity information, formulates a report and communicates the report toCSP 8. CSP 8 electronically presents the report to the user vianetwork 22. The owner or delegate can also configureCSP 8 to periodically generate the report and electronically mail the report to the user. Alternatively,CSP 8 can mail a physical copy of the report to the user. - In addition to the above-described techniques by which an owner or delegate can detect misuse of digital credential,
fraud detection module 18 ofCVS 10 applies fraud detection techniques toactivity log 20 in order to automatically identify misuse. As described in detail below,fraud detection module 18 analyzesactivity log 20 to identify any unusual patterns that may indicate misuse. -
FIG. 2 is a flow chart illustrating aprocess 30 further illustrating howsystem 2 monitors the usage of digital signature keys and identifies potential fraudulent activities or general misuse. Each online service 6 processes secure transactions by communicatingdigital credential 16 toCVS 10 for verification (32). As described above,CVS 10 cooperates withCIS 22 to verifydigital credential 16 including determining whetherdigital credential 16 is revoked. In one configuration, however, online services validate the digital credential and communicate transaction information toCVS 10. -
CVS 10 stores the result of each verification in activity log 26 (34). In addition,CVS 10 stores relevant transaction information such as a date and time of the transaction, the online service 6 that is involved in the transaction, the type of transaction, the device used to access the online service 6, such as a laptop computer, cell phone or a PDA, the value of the transaction, and location and position information, such as an IP address or a name of computing device 4. - In order to facilitate the timely identification of misuse of
digital credential 16,CVS 10 generates activity reports that detail the information stored in activity log 20 (26). As discussed above,CVS 10 generates the activity reports in a variety of ways and at a variety of times. For example,CVS 10 can automatically generate an activity report when handling each verification request, thereby frequently providing the information to the user. In addition,CVS 10 can periodically generate activity reports or upon request by the owner. -
CVS 10 also tailors each activity report to the requestor such that the owner ofdigital credential 16 can view all activity, including any activity by the delegates. An individual delegate, however, can only view activity reports that list his or her activity. -
Fraud detection module 18 ofCVS 10 analyzesactivity log 20 to identify any unusual patterns in order to identify fraudulent activities. For example, a significant increase in the number or the size of the transactions can indicate misuse. A change in the types of transactions can indicate misuse. In addition, any indication thatdigital signature key 16 is suddenly being used from a different computing device, such as a change from a frequently used internet protocol (IP) address to a previously unused IP address, can also indicate misuse. Upon detecting potential misuse,CVS 10 communicates an activity report to the owner alerting him or her of the activity. In this manner, the owner can readily determine whether any fraudulent activity or general misuse has indeed occurred and the extent of the activity. - If the owner determines that unauthorized activities have indeed occurred, the owner can access
CSP 8 and revokedigital credential 16. For example, the owner can revoke the associated digital certificate. Alternatively, the owner can create a new private signature key and a new public verification key and sign this public verification key with the old private signature key.System 2 can issue a new digital certificate for this new verification key.CSP 8 communicates the revocation toCIS 22, which updates the status ofdigital credential 16 incertificate repository 26, thereby causing any future verifications byCVS 10 of the digital credential to fail. Thus, the owner can immediately stop the fraudulent activity. - In addition, the activity report can be provided to an authorized operator of
CSP 8 ofCVS 10. Furthermore, an activity report detailing activity at a specific online service 6 can be generated and provided to an authorized operator at the online service. - It this manner,
system 2 helps detect unauthorized use of the digital signature key in the event digital signature key is misappropriated. These features are especially advantages to professional services such as the healthcare profession. To further illustrate these benefits, consider a healthcare professional accessing a healthcare oriented online service and requesting access to healthcare information or seeking to submit a prescriptions or diagnosis. The online service communicates transaction information describing the access request and the medical professional's digital credential to the central credential verification service. Upon receiving a verification result from the credential verification service, the healthcare oriented service provides access to the medical records. Subsequently, the healthcare oriented service receives an activity report from the credential verification service and provides the report to healthcare professional. -
FIG. 3 is anexample activity report 30 generated byCVS 10.Activity report 30 lists the activities logged inactivity log 20, broken down by owner and delegate. For each authentication request, theexample activity report 40 lists the date and time, the online service involved in the transaction, the name of the computing device 4 used by the user to originate the transaction, the value of the transaction, the type of the transaction, and the authentication result. -
FIG. 4 illustrates a programmable computing system (system) 100 that provides an operating environment suitable for use as a computing device 4 or as a server withinCSP 8,CVS 10 orCIS 22. Thesystem 100 includes aprocessor 112 that represents any suitable microprocessor such as the PENTIUM® family of microprocessors manufactured by the Intel Corporation of Santa Clara, Calif. Other examples include the MIPS® family of microprocessors, the POWERPC® family of microprocessors from both the Motorola Corporation and the IBM Corporation, the PRECISION ARCHITECTURE® family of microprocessors from the Hewlett-Packard Company, the SPARC® family of microprocessors from the Sun Microsystems Corporation, or the ALPHA® family of microprocessors from the Compaq Computer Corporation. In various configurations,system 100 represents any server, personal computer, laptop or a hand-held PC, a personal digital assistant (PDA) or a network-enabled cellular phone. -
System 100 includessystem memory 113, including read only memory (ROM) 114 and random access memory (RAM) 115, which is connected to theprocessor 112 by a system data/address bus 116. Input/output bus 118 is connected to the data/address bus 116 viabus controller 119. In one embodiment, input/output bus 118 is implemented as a standard Peripheral Component Interconnect (PCI) bus. Thebus controller 119 examines all signals from theprocessor 112 to route the signals to the appropriate bus. Signals between theprocessor 112 and thesystem memory 113 are merely passed through thebus controller 119. However, signals from theprocessor 112 intended for devices other thansystem memory 113 are routed onto the input/output bus 118. - Various devices are connected to the input/
output bus 118 includinghard disk drive 120,floppy drive 121 that is used to readfloppy disk 151, andoptical drive 122, such as a CD-ROM drive that is used to read anoptical disk 152. Thevideo display 124 or other kind of display device is connected to the input/output bus 118 via avideo adapter 125. - Users enter commands and information into the
system 100 by using akeyboard 140 and/or pointing device, such as amouse 142, which are connected tobus 118 via input/output ports 128. Other types of pointing devices (not shown) include track pads, track balls, joysticks, data gloves, head trackers, and other devices suitable for positioning a cursor on thevideo display 124.System 100 also includes amodem 129 that is typically used to communicate over wide area networks (not shown), such as the Internet using either a wired or wireless connection. -
Software applications 136 and data are typically stored via one of the memory storage devices, which may include thehard disk 120,floppy disk 151, CD-ROM 152 and are copied to RAM 115 for execution. In one embodiment, however,software applications 136 are stored inROM 114 and are copied to RAM 115 for execution or are executed directly fromROM 114. - In general, the
operating system 135 executessoftware applications 136 and carries out instructions issued by the user. The Basic Input/Output System (BIOS) 117 for thesystem 100 is a set of basic executable routines that have conventionally helped to transfer information between the computing resources within thesystem 100.Operating system 135 orother software applications 136 use these low-level service routines. In oneembodiment system 100 includes a registry (not shown) that is a system database that holds configuration information forsystem 100. - The invention has been described in reference to a variety of embodiments. These and other embodiments are within the scope of the following claims.
Claims (39)
1. A method comprising:
receiving a request to verify a use of a digital credential by a user of a digital credential, the digital credential being a digital security mechanism associated with a user's identity, the use occurring at a first of a plurality of different services where the digital credential can be used;
verifying the use of the digital credential in response to receipt of the request to verify;
sending a result of the verification to the first service;
storing the result of the verification in an activity log in a central service that communicates with each of said plurality of different services; and
allowing specified users to access said result.
2. The method of claim 1 further including storing transaction information in the activity log.
3. The method of claim 2 , wherein the transaction information includes at least one of a message that was signed using a digital signature key of the digital credential, a value of a transaction, an online service, an internet protocol (IP) address, a date of the transaction and a time of the transaction.
4. The method of claim 1 further including generating an activity report from the activity log, wherein the activity report lists the stored verification results.
5. The method of claim 4 further including associating a name to a digital signature key of the digital credential, wherein the activity report lists the name of the digital signature key.
6. The method of claim 4 , wherein generating the activity report includes generating the activity report upon request by an owner of the digital credential.
7. The method of claim 4 , wherein generating the activity report includes generating the activity report each time the digital credential is verified.
8. The method of claim 4 , wherein generating the activity report includes generating a report periodically.
9. The method of claim 1 further including analyzing the activity log to detect misuse of the digital credential.
10. The method of claim 6 , wherein generating the activity report includes listing activity for a plurality of digital signature keys associated with the owner.
11. The method of claim 1 further comprising:
authorizing one or more delegates to use a delegated digital credential to act on behalf of the owner of the digital credential for specified functions, wherein verifying the use of the digital credential includes determining whether the delegated digital credential was authorized for the specific use.
12. The method of claim 4 , wherein generating an activity report includes generating activity reports of the delegates of the user and wherein said allowing comprises allowing said user to view all reports, but allowing each said delegate to view only their own activity report, and not allowing each said delegate to view reports for other delegates.
13. An article comprising a computer-readable medium having computer-executable instructions stored thereon for causing a computer to:
receive a request to verify a use of a digital credential by a user of a digital credential at any of a plurality of different services where the digital credential can be used, the digital credential being a digital security mechanism associated with a user's identity;
verify the use of the digital credential in response to receipt of the request to verify from a first service of the plurality of different services;
send a result of the verification to the first service;
store a result of the verification in an activity log in a central service that communicates with each of said plurality of different services; and
allow specified users to access said result.
14. The article of claim 13 , wherein the computer-executable instructions cause the computer to store transaction information in activity log.
15. The article of claim 14 , wherein,the transaction information includes at least one of a message that was signed using a digital signature key of the digital credential, a transaction value, an online service processing the transaction, an internet protocol (IP) address of a computing device originating the transaction, the date of the transaction and the time of the transaction.
16. The article of claim 13 , wherein the computer-executable instructions cause the computer to generate an activity report from the activity log, wherein the activity report lists the stored verification results.
17. The article of claim 16 , wherein the computer-executable instructions cause the computer to associate a name to a digital signature key of the digital credential, wherein the activity report lists the name of the digital signature key.
18. The article of claim 16 , wherein the computer-executable instructions cause the computer to generate the activity report upon receiving a request by an owner of the digital credential and wherein said allowing comprises allowing said user to view all reports, but allowing each said delegate to view only their own activity report, and not allowing each said delegate to view reports for other delegates.
19. The article of claim 13 , wherein the computer-executable instructions cause the computer to analyze the activity log to detect misuse of the digital credential.
20. The article of claim 17 , wherein the computer-executable instructions cause the computer to list in the activity report activity for a plurality of digital signature keys associated with the owner according to the name of the digital signature key.
21. The article of claim 20 , wherein the computer-executable instructions cause the computer to authorize one or more delegates to use a delegated digital credential to act on behalf of the owner of the digital credential for specified functions and determine whether the delegated digital credential was authorized for the specific use.
22. The article of claim 21 , wherein the computer-executable instructions cause the computer to generate activity reports of the delegates.
23. A system comprising:
a server to receive requests to verify digital credentials by a user of a digital credential at any of a plurality of different services where the digital credential can be used, to verify the use of the digital credential in response to receipt of requests, and to send results from the verifications to the services;
an activity log coupled to the server to store the results from the verifications in a central service that communicates with each of said plurality of different services; and
a communication part to allow specified users to access said results.
24. The system of claim 23 , wherein the activity log is configured to store transaction information for each authentication result.
25. The system of claim 24 , wherein the transaction information includes at least one of a digitally signed message, a date of the transaction, a value of the transaction, an online service requesting the authentication, an internet protocol (IP) address, a value of the transaction, and a time of the transaction.
26. The system of claim 23 , and further comprising an owner database to store information of an owner of the digital credential and owner-approved delegates and wherein said communication element allows said owner to view all reports, but allows each said delegate to view only their own report, and not reports for other delegates.
27. An article comprising a computer-readable medium having data structures stored thereon comprising:
a first data field to store a result from an verification of a digital credential by a user of a digital credential at any of a plurality of different services where the digital credential can be used;
a plurality of data fields to store transaction information relating to each verification result in a central service that communicates with each of said plurality of different services; and
a data access structure, allowing specified users to access said results.
28. The article of claim 27 , wherein the plurality of data fields store at least one of a digitally signed message, a date of the transaction, a time of the transaction, a value of the transaction, an online service, an internet protocol (IP) address of a computing device originating the transaction, and goods or services involved in the transaction.
29. The article of claim 27 , wherein the data structures further include a plurality of data fields to store owner and delegate information.
30. A method comprising:
storing use information for a digital credential of a plurality of delegates who are delegated to use said digital credential by an owner, the digital credential being a digital security mechanism associated with the owner's identity;
processing the use information for each of said plurality of delegates to detect misuse; and
generating an alert to the owner based on the detection of misuse.
31. The method of claim 30 , wherein generating an alert includes generating an activity report based on the use information.
32. The method of claim 30 , wherein generating an alert includes alerting a credential service provider.
33. The method of claim 30 , wherein the use information includes transaction information and wherein the method further comprises allowing said owner to view all reports, but allowing each said delegate to view only their own activity report, and not allowing each said delegate to view reports for other delegates
34. The method of claim 30 , wherein the use information includes verification information for the digital credential.
35. The method of claim 33 , wherein the transaction information includes at least one of a message that was signed, a transaction value, an online service, an internet protocol (IP) address, a value of the transaction, a date of the transaction and a the time of the transaction.
36. A method comprising:
receiving a request from a medical professional to access medical information at a remote service, wherein the request includes a digital credential for the medical professional, the digital credential being a digital security mechanism associated with the medical professional's identity;
communicating transaction information describing the access request and the digital credential to a credential verification service;
receiving a verification result from the credential verification service;
providing the medical professional access to the medical information based on the verification result; and
receiving an activity report from the credential verification service, wherein the activity report lists the transaction information, the digital credential and the transaction result.
37. The method of claim 36 , wherein the transaction information includes at least an access type, a date of the transaction and a time of the transaction.
38. The method of claim 36 , further wherein the digital credential was provided by a credential issuing service and a credential service provider.
39. The method of claim 36 , and further including:
receiving a request to access the activity report from an owner of the digital credential; and
providing the owner access to the activity report.
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US11/122,893 US20050198536A1 (en) | 2000-04-24 | 2005-05-04 | Digital credential usage reporting |
Applications Claiming Priority (3)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US19922000P | 2000-04-24 | 2000-04-24 | |
US09/608,402 US6965881B1 (en) | 2000-04-24 | 2000-06-30 | Digital credential usage reporting |
US11/122,893 US20050198536A1 (en) | 2000-04-24 | 2005-05-04 | Digital credential usage reporting |
Related Parent Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US09/608,402 Division US6965881B1 (en) | 2000-04-24 | 2000-06-30 | Digital credential usage reporting |
Publications (1)
Publication Number | Publication Date |
---|---|
US20050198536A1 true US20050198536A1 (en) | 2005-09-08 |
Family
ID=34915301
Family Applications (2)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US09/608,402 Expired - Fee Related US6965881B1 (en) | 2000-04-24 | 2000-06-30 | Digital credential usage reporting |
US11/122,893 Abandoned US20050198536A1 (en) | 2000-04-24 | 2005-05-04 | Digital credential usage reporting |
Family Applications Before (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US09/608,402 Expired - Fee Related US6965881B1 (en) | 2000-04-24 | 2000-06-30 | Digital credential usage reporting |
Country Status (1)
Country | Link |
---|---|
US (2) | US6965881B1 (en) |
Cited By (7)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20020083014A1 (en) * | 2000-06-30 | 2002-06-27 | Brickell Ernie F. | Delegating digital credentials |
US20060282662A1 (en) * | 2005-06-13 | 2006-12-14 | Iamsecureonline, Inc. | Proxy authentication network |
FR2907941A1 (en) * | 2006-10-26 | 2008-05-02 | Jean Luc Leleu | Hypertext link selection validating method for e.g. Internet, involves validating selection of hypertext link by user as legitimate to establish connection of user to web site in case of success of verification of integrity of certificate |
US7457950B1 (en) | 2000-09-29 | 2008-11-25 | Intel Corporation | Managed authentication service |
US20120246483A1 (en) * | 2011-03-25 | 2012-09-27 | Netanel Raisch | Authentication System With Time Attributes |
US20140283054A1 (en) * | 2013-03-14 | 2014-09-18 | Microsoft Corporation | Automatic Fraudulent Digital Certificate Detection |
US20140362819A1 (en) * | 2010-11-02 | 2014-12-11 | Qualcomm Incorporated | Protocols for enabling mode 1 and mode 2 devices in tv white space networks |
Families Citing this family (57)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6965881B1 (en) * | 2000-04-24 | 2005-11-15 | Intel Corporation | Digital credential usage reporting |
US7117529B1 (en) * | 2001-10-22 | 2006-10-03 | Intuit, Inc. | Identification and authentication management |
US7484097B2 (en) * | 2002-04-04 | 2009-01-27 | Symantec Corporation | Method and system for communicating data to and from network security devices |
US9400589B1 (en) | 2002-05-30 | 2016-07-26 | Consumerinfo.Com, Inc. | Circular rotational interface for display of consumer credit information |
US9710852B1 (en) | 2002-05-30 | 2017-07-18 | Consumerinfo.Com, Inc. | Credit report timeline user interface |
US20050114713A1 (en) * | 2003-11-25 | 2005-05-26 | Shawn Beckman | Automated subscription and purchasing service for a data computing device |
US7543740B2 (en) * | 2004-09-17 | 2009-06-09 | Digital Envoy, Inc. | Fraud analyst smart cookie |
US7497374B2 (en) * | 2004-09-17 | 2009-03-03 | Digital Envoy, Inc. | Fraud risk advisor |
US7881255B1 (en) * | 2004-09-29 | 2011-02-01 | Google Inc. | Systems and methods for relating network traffic using traffic-based signatures |
US20080115209A1 (en) * | 2006-11-10 | 2008-05-15 | Fargo Electronics, Inc. | Credential substrate processing authorization |
WO2008147918A2 (en) | 2007-05-25 | 2008-12-04 | Experian Information Solutions, Inc. | System and method for automated detection of never-pay data sets |
US9990674B1 (en) | 2007-12-14 | 2018-06-05 | Consumerinfo.Com, Inc. | Card registry systems and methods |
US8127986B1 (en) | 2007-12-14 | 2012-03-06 | Consumerinfo.Com, Inc. | Card registry systems and methods |
US8312033B1 (en) | 2008-06-26 | 2012-11-13 | Experian Marketing Solutions, Inc. | Systems and methods for providing an integrated identifier |
US9256904B1 (en) | 2008-08-14 | 2016-02-09 | Experian Information Solutions, Inc. | Multi-bureau credit file freeze and unfreeze |
US8060424B2 (en) | 2008-11-05 | 2011-11-15 | Consumerinfo.Com, Inc. | On-line method and system for monitoring and reporting unused available credit |
US9449195B2 (en) * | 2009-01-23 | 2016-09-20 | Avow Networks Incorporated | Method and apparatus to perform online credential reporting |
US9652802B1 (en) | 2010-03-24 | 2017-05-16 | Consumerinfo.Com, Inc. | Indirect monitoring and reporting of a user's credit data |
US9147042B1 (en) | 2010-11-22 | 2015-09-29 | Experian Information Solutions, Inc. | Systems and methods for data verification |
EP2676197B1 (en) | 2011-02-18 | 2018-11-28 | CSidentity Corporation | System and methods for identifying compromised personally identifiable information on the internet |
US9665854B1 (en) | 2011-06-16 | 2017-05-30 | Consumerinfo.Com, Inc. | Authentication alerts |
US9483606B1 (en) | 2011-07-08 | 2016-11-01 | Consumerinfo.Com, Inc. | Lifescore |
US9106691B1 (en) | 2011-09-16 | 2015-08-11 | Consumerinfo.Com, Inc. | Systems and methods of identity protection and management |
US8738516B1 (en) | 2011-10-13 | 2014-05-27 | Consumerinfo.Com, Inc. | Debt services candidate locator |
US11030562B1 (en) | 2011-10-31 | 2021-06-08 | Consumerinfo.Com, Inc. | Pre-data breach monitoring |
US9853959B1 (en) | 2012-05-07 | 2017-12-26 | Consumerinfo.Com, Inc. | Storage and maintenance of personal data |
US9654541B1 (en) | 2012-11-12 | 2017-05-16 | Consumerinfo.Com, Inc. | Aggregating user web browsing data |
US9916621B1 (en) | 2012-11-30 | 2018-03-13 | Consumerinfo.Com, Inc. | Presentation of credit score factors |
US10255598B1 (en) | 2012-12-06 | 2019-04-09 | Consumerinfo.Com, Inc. | Credit card account data extraction |
US8812387B1 (en) | 2013-03-14 | 2014-08-19 | Csidentity Corporation | System and method for identifying related credit inquiries |
US9406085B1 (en) | 2013-03-14 | 2016-08-02 | Consumerinfo.Com, Inc. | System and methods for credit dispute processing, resolution, and reporting |
US10102570B1 (en) | 2013-03-14 | 2018-10-16 | Consumerinfo.Com, Inc. | Account vulnerability alerts |
US9870589B1 (en) | 2013-03-14 | 2018-01-16 | Consumerinfo.Com, Inc. | Credit utilization tracking and reporting |
US10664936B2 (en) | 2013-03-15 | 2020-05-26 | Csidentity Corporation | Authentication systems and methods for on-demand products |
US9633322B1 (en) | 2013-03-15 | 2017-04-25 | Consumerinfo.Com, Inc. | Adjustment of knowledge-based authentication |
US10685398B1 (en) | 2013-04-23 | 2020-06-16 | Consumerinfo.Com, Inc. | Presenting credit score information |
US9721147B1 (en) | 2013-05-23 | 2017-08-01 | Consumerinfo.Com, Inc. | Digital identity |
US9443268B1 (en) | 2013-08-16 | 2016-09-13 | Consumerinfo.Com, Inc. | Bill payment and reporting |
US10325314B1 (en) | 2013-11-15 | 2019-06-18 | Consumerinfo.Com, Inc. | Payment reporting systems |
US9477737B1 (en) | 2013-11-20 | 2016-10-25 | Consumerinfo.Com, Inc. | Systems and user interfaces for dynamic access of multiple remote databases and synchronization of data based on user rules |
USD760256S1 (en) | 2014-03-25 | 2016-06-28 | Consumerinfo.Com, Inc. | Display screen or portion thereof with graphical user interface |
USD759689S1 (en) | 2014-03-25 | 2016-06-21 | Consumerinfo.Com, Inc. | Display screen or portion thereof with graphical user interface |
USD759690S1 (en) | 2014-03-25 | 2016-06-21 | Consumerinfo.Com, Inc. | Display screen or portion thereof with graphical user interface |
US9892457B1 (en) | 2014-04-16 | 2018-02-13 | Consumerinfo.Com, Inc. | Providing credit data in search results |
US10373240B1 (en) | 2014-04-25 | 2019-08-06 | Csidentity Corporation | Systems, methods and computer-program products for eligibility verification |
US10339527B1 (en) | 2014-10-31 | 2019-07-02 | Experian Information Solutions, Inc. | System and architecture for electronic fraud detection |
US11151468B1 (en) | 2015-07-02 | 2021-10-19 | Experian Information Solutions, Inc. | Behavior analysis using distributed representations of event data |
US10699028B1 (en) | 2017-09-28 | 2020-06-30 | Csidentity Corporation | Identity security architecture systems and methods |
US10896472B1 (en) | 2017-11-14 | 2021-01-19 | Csidentity Corporation | Security and identity verification system and architecture |
US10911234B2 (en) | 2018-06-22 | 2021-02-02 | Experian Information Solutions, Inc. | System and method for a token gateway environment |
US11017076B2 (en) | 2018-08-08 | 2021-05-25 | Microsoft Technology Licensing, Llc | Enhancing security using anomaly detection |
US11265324B2 (en) | 2018-09-05 | 2022-03-01 | Consumerinfo.Com, Inc. | User permissions for access to secure data at third-party |
US11315179B1 (en) | 2018-11-16 | 2022-04-26 | Consumerinfo.Com, Inc. | Methods and apparatuses for customized card recommendations |
US11238656B1 (en) | 2019-02-22 | 2022-02-01 | Consumerinfo.Com, Inc. | System and method for an augmented reality experience via an artificial intelligence bot |
US11941065B1 (en) | 2019-09-13 | 2024-03-26 | Experian Information Solutions, Inc. | Single identifier platform for storing entity data |
US11350174B1 (en) | 2020-08-21 | 2022-05-31 | At&T Intellectual Property I, L.P. | Method and apparatus to monitor account credential sharing in communication services |
US11963089B1 (en) | 2021-10-01 | 2024-04-16 | Warner Media, Llc | Method and apparatus to profile account credential sharing |
Citations (42)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5052040A (en) * | 1990-05-25 | 1991-09-24 | Micronyx, Inc. | Multiple user stored data cryptographic labeling system and method |
US5224163A (en) * | 1990-09-28 | 1993-06-29 | Digital Equipment Corporation | Method for delegating authorization from one entity to another through the use of session encryption keys |
US5485519A (en) * | 1991-06-07 | 1996-01-16 | Security Dynamics Technologies, Inc. | Enhanced security for a secure token code |
US5530438A (en) * | 1995-01-09 | 1996-06-25 | Motorola, Inc. | Method of providing an alert of a financial transaction |
US5627886A (en) * | 1994-09-22 | 1997-05-06 | Electronic Data Systems Corporation | System and method for detecting fraudulent network usage patterns using real-time network monitoring |
US5659616A (en) * | 1994-07-19 | 1997-08-19 | Certco, Llc | Method for securely using digital signatures in a commercial cryptographic system |
US5692181A (en) * | 1995-10-12 | 1997-11-25 | Ncr Corporation | System and method for generating reports from a computer database |
US5809144A (en) * | 1995-08-24 | 1998-09-15 | Carnegie Mellon University | Method and apparatus for purchasing and delivering digital goods over a network |
US5845070A (en) * | 1996-12-18 | 1998-12-01 | Auric Web Systems, Inc. | Security system for internet provider transaction |
US5872844A (en) * | 1996-11-18 | 1999-02-16 | Microsoft Corporation | System and method for detecting fraudulent expenditure of transferable electronic assets |
US5878138A (en) * | 1996-02-12 | 1999-03-02 | Microsoft Corporation | System and method for detecting fraudulent expenditure of electronic assets |
US5953710A (en) * | 1996-10-09 | 1999-09-14 | Fleming; Stephen S. | Children's credit or debit card system |
US5963915A (en) * | 1996-02-21 | 1999-10-05 | Infoseek Corporation | Secure, convenient and efficient system and method of performing trans-internet purchase transactions |
US5978780A (en) * | 1997-11-21 | 1999-11-02 | Craig Michael Watson | Integrated bill consolidation, payment aggregation, and settlement system |
US5983208A (en) * | 1996-06-17 | 1999-11-09 | Verifone, Inc. | System, method and article of manufacture for handling transaction results in a gateway payment architecture utilizing a multichannel, extensible, flexible architecture |
US6021202A (en) * | 1996-12-20 | 2000-02-01 | Financial Services Technology Consortium | Method and system for processing electronic documents |
US6047270A (en) * | 1996-08-08 | 2000-04-04 | Joao; Raymond Anthony | Apparatus and method for providing account security |
US6105027A (en) * | 1997-03-10 | 2000-08-15 | Internet Dynamics, Inc. | Techniques for eliminating redundant access checking by access filters |
US6105010A (en) * | 1997-05-09 | 2000-08-15 | Gte Service Corporation | Biometric certifying authorities |
US6111506A (en) * | 1996-10-15 | 2000-08-29 | Iris Corporation Berhad | Method of making an improved security identification document including contactless communication insert unit |
US6119230A (en) * | 1997-10-01 | 2000-09-12 | Novell, Inc. | Distributed dynamic security capabilities |
US6275941B1 (en) * | 1997-03-28 | 2001-08-14 | Hiatchi, Ltd. | Security management method for network system |
US20010037388A1 (en) * | 2000-03-31 | 2001-11-01 | International Business Machines Corporation | Method and apparatus for communicating with network from comunication terminal |
US6353886B1 (en) * | 1998-02-04 | 2002-03-05 | Alcatel Canada Inc. | Method and system for secure network policy implementation |
US20020083014A1 (en) * | 2000-06-30 | 2002-06-27 | Brickell Ernie F. | Delegating digital credentials |
US6418467B1 (en) * | 1997-11-20 | 2002-07-09 | Xacct Technologies, Ltd. | Network accounting and billing system and method |
US6442526B1 (en) * | 1995-09-06 | 2002-08-27 | The Sabre Group, Inc. | System for corporate travel planning and management |
US20020120573A1 (en) * | 1998-11-03 | 2002-08-29 | Mccormick Douglas | Secure extranet operation with open access for qualified medical professional |
US6510513B1 (en) * | 1999-01-13 | 2003-01-21 | Microsoft Corporation | Security services and policy enforcement for electronic data |
US6515110B1 (en) * | 1991-11-25 | 2003-02-04 | Enzon, Inc. | Multivalent antigen-binding proteins |
US20030086594A1 (en) * | 2001-12-04 | 2003-05-08 | Gross Raymond L. | Providing identity and security information |
US6601192B1 (en) * | 1999-08-31 | 2003-07-29 | Accenture Llp | Assertion component in environment services patterns |
US6675153B1 (en) * | 1999-07-06 | 2004-01-06 | Zix Corporation | Transaction authorization system |
US6775382B1 (en) * | 1997-06-30 | 2004-08-10 | Sun Microsystems, Inc. | Method and apparatus for recovering encryption session keys |
US6775782B1 (en) * | 1999-03-31 | 2004-08-10 | International Business Machines Corporation | System and method for suspending and resuming digital certificates in a certificate-based user authentication application system |
US6931545B1 (en) * | 2000-08-28 | 2005-08-16 | Contentguard Holdings, Inc. | Systems and methods for integrity certification and verification of content consumption environments |
US6934838B1 (en) * | 1998-06-01 | 2005-08-23 | Entrust Technologies Ltd. | Method and apparatus for a service provider to provide secure services to a user |
US20050198356A1 (en) * | 2000-03-14 | 2005-09-08 | Jeffrey Delaney | Application program interface for message routing and management system |
US6965881B1 (en) * | 2000-04-24 | 2005-11-15 | Intel Corporation | Digital credential usage reporting |
US7013286B1 (en) * | 1999-12-30 | 2006-03-14 | International Business Machines Corporation | Generation, distribution, storage, redemption, validation and clearing of electronic coupons |
US7062471B1 (en) * | 1999-06-07 | 2006-06-13 | Nippon Telegraph And Telephone Corporation | Electronic rights information processing system, method and apparatus for carrying out same and recorded medium for program carrying out the method |
US7106843B1 (en) * | 1994-04-19 | 2006-09-12 | T-Netix, Inc. | Computer-based method and apparatus for controlling, monitoring, recording and reporting telephone access |
Family Cites Families (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
DE848338C (en) * | 1949-04-23 | 1952-09-04 | Schloemann Ag | Push-off and stacking device for blanks |
EP0786728B1 (en) * | 1995-07-11 | 2011-02-09 | Hitachi, Ltd. | Service offering system |
-
2000
- 2000-06-30 US US09/608,402 patent/US6965881B1/en not_active Expired - Fee Related
-
2005
- 2005-05-04 US US11/122,893 patent/US20050198536A1/en not_active Abandoned
Patent Citations (42)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5052040A (en) * | 1990-05-25 | 1991-09-24 | Micronyx, Inc. | Multiple user stored data cryptographic labeling system and method |
US5224163A (en) * | 1990-09-28 | 1993-06-29 | Digital Equipment Corporation | Method for delegating authorization from one entity to another through the use of session encryption keys |
US5485519A (en) * | 1991-06-07 | 1996-01-16 | Security Dynamics Technologies, Inc. | Enhanced security for a secure token code |
US6515110B1 (en) * | 1991-11-25 | 2003-02-04 | Enzon, Inc. | Multivalent antigen-binding proteins |
US7106843B1 (en) * | 1994-04-19 | 2006-09-12 | T-Netix, Inc. | Computer-based method and apparatus for controlling, monitoring, recording and reporting telephone access |
US5659616A (en) * | 1994-07-19 | 1997-08-19 | Certco, Llc | Method for securely using digital signatures in a commercial cryptographic system |
US5627886A (en) * | 1994-09-22 | 1997-05-06 | Electronic Data Systems Corporation | System and method for detecting fraudulent network usage patterns using real-time network monitoring |
US5530438A (en) * | 1995-01-09 | 1996-06-25 | Motorola, Inc. | Method of providing an alert of a financial transaction |
US5809144A (en) * | 1995-08-24 | 1998-09-15 | Carnegie Mellon University | Method and apparatus for purchasing and delivering digital goods over a network |
US6442526B1 (en) * | 1995-09-06 | 2002-08-27 | The Sabre Group, Inc. | System for corporate travel planning and management |
US5692181A (en) * | 1995-10-12 | 1997-11-25 | Ncr Corporation | System and method for generating reports from a computer database |
US5878138A (en) * | 1996-02-12 | 1999-03-02 | Microsoft Corporation | System and method for detecting fraudulent expenditure of electronic assets |
US5963915A (en) * | 1996-02-21 | 1999-10-05 | Infoseek Corporation | Secure, convenient and efficient system and method of performing trans-internet purchase transactions |
US5983208A (en) * | 1996-06-17 | 1999-11-09 | Verifone, Inc. | System, method and article of manufacture for handling transaction results in a gateway payment architecture utilizing a multichannel, extensible, flexible architecture |
US6047270A (en) * | 1996-08-08 | 2000-04-04 | Joao; Raymond Anthony | Apparatus and method for providing account security |
US5953710A (en) * | 1996-10-09 | 1999-09-14 | Fleming; Stephen S. | Children's credit or debit card system |
US6111506A (en) * | 1996-10-15 | 2000-08-29 | Iris Corporation Berhad | Method of making an improved security identification document including contactless communication insert unit |
US5872844A (en) * | 1996-11-18 | 1999-02-16 | Microsoft Corporation | System and method for detecting fraudulent expenditure of transferable electronic assets |
US5845070A (en) * | 1996-12-18 | 1998-12-01 | Auric Web Systems, Inc. | Security system for internet provider transaction |
US6021202A (en) * | 1996-12-20 | 2000-02-01 | Financial Services Technology Consortium | Method and system for processing electronic documents |
US6105027A (en) * | 1997-03-10 | 2000-08-15 | Internet Dynamics, Inc. | Techniques for eliminating redundant access checking by access filters |
US6275941B1 (en) * | 1997-03-28 | 2001-08-14 | Hiatchi, Ltd. | Security management method for network system |
US6105010A (en) * | 1997-05-09 | 2000-08-15 | Gte Service Corporation | Biometric certifying authorities |
US6775382B1 (en) * | 1997-06-30 | 2004-08-10 | Sun Microsystems, Inc. | Method and apparatus for recovering encryption session keys |
US6119230A (en) * | 1997-10-01 | 2000-09-12 | Novell, Inc. | Distributed dynamic security capabilities |
US6418467B1 (en) * | 1997-11-20 | 2002-07-09 | Xacct Technologies, Ltd. | Network accounting and billing system and method |
US5978780A (en) * | 1997-11-21 | 1999-11-02 | Craig Michael Watson | Integrated bill consolidation, payment aggregation, and settlement system |
US6353886B1 (en) * | 1998-02-04 | 2002-03-05 | Alcatel Canada Inc. | Method and system for secure network policy implementation |
US6934838B1 (en) * | 1998-06-01 | 2005-08-23 | Entrust Technologies Ltd. | Method and apparatus for a service provider to provide secure services to a user |
US20020120573A1 (en) * | 1998-11-03 | 2002-08-29 | Mccormick Douglas | Secure extranet operation with open access for qualified medical professional |
US6510513B1 (en) * | 1999-01-13 | 2003-01-21 | Microsoft Corporation | Security services and policy enforcement for electronic data |
US6775782B1 (en) * | 1999-03-31 | 2004-08-10 | International Business Machines Corporation | System and method for suspending and resuming digital certificates in a certificate-based user authentication application system |
US7062471B1 (en) * | 1999-06-07 | 2006-06-13 | Nippon Telegraph And Telephone Corporation | Electronic rights information processing system, method and apparatus for carrying out same and recorded medium for program carrying out the method |
US6675153B1 (en) * | 1999-07-06 | 2004-01-06 | Zix Corporation | Transaction authorization system |
US6601192B1 (en) * | 1999-08-31 | 2003-07-29 | Accenture Llp | Assertion component in environment services patterns |
US7013286B1 (en) * | 1999-12-30 | 2006-03-14 | International Business Machines Corporation | Generation, distribution, storage, redemption, validation and clearing of electronic coupons |
US20050198356A1 (en) * | 2000-03-14 | 2005-09-08 | Jeffrey Delaney | Application program interface for message routing and management system |
US20010037388A1 (en) * | 2000-03-31 | 2001-11-01 | International Business Machines Corporation | Method and apparatus for communicating with network from comunication terminal |
US6965881B1 (en) * | 2000-04-24 | 2005-11-15 | Intel Corporation | Digital credential usage reporting |
US20020083014A1 (en) * | 2000-06-30 | 2002-06-27 | Brickell Ernie F. | Delegating digital credentials |
US6931545B1 (en) * | 2000-08-28 | 2005-08-16 | Contentguard Holdings, Inc. | Systems and methods for integrity certification and verification of content consumption environments |
US20030086594A1 (en) * | 2001-12-04 | 2003-05-08 | Gross Raymond L. | Providing identity and security information |
Cited By (15)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20020083014A1 (en) * | 2000-06-30 | 2002-06-27 | Brickell Ernie F. | Delegating digital credentials |
US7395246B2 (en) | 2000-06-30 | 2008-07-01 | Intel Corporation | Delegating digital credentials |
US7457950B1 (en) | 2000-09-29 | 2008-11-25 | Intel Corporation | Managed authentication service |
US20060282662A1 (en) * | 2005-06-13 | 2006-12-14 | Iamsecureonline, Inc. | Proxy authentication network |
US8856891B2 (en) | 2005-06-13 | 2014-10-07 | Iamsecuronline, Inc. | Proxy authentication network |
US8028329B2 (en) * | 2005-06-13 | 2011-09-27 | Iamsecureonline, Inc. | Proxy authentication network |
WO2008056063A2 (en) * | 2006-10-26 | 2008-05-15 | Jean-Luc Leleu | Method and system for validating the selection of a hyperlink in a web page |
WO2008056063A3 (en) * | 2006-10-26 | 2008-09-12 | Jean-Luc Leleu | Method and system for validating the selection of a hyperlink in a web page |
FR2907941A1 (en) * | 2006-10-26 | 2008-05-02 | Jean Luc Leleu | Hypertext link selection validating method for e.g. Internet, involves validating selection of hypertext link by user as legitimate to establish connection of user to web site in case of success of verification of integrity of certificate |
US20140362819A1 (en) * | 2010-11-02 | 2014-12-11 | Qualcomm Incorporated | Protocols for enabling mode 1 and mode 2 devices in tv white space networks |
US9686791B2 (en) * | 2010-11-02 | 2017-06-20 | Qualcomm Incorporated | Protocols for enabling mode 1 and mode 2 devices in TV white space networks |
US10051626B2 (en) | 2010-11-02 | 2018-08-14 | Qualcomm Incorporated | Protocols for enabling mode 1 and mode 2 devices in TV white space networks |
US20120246483A1 (en) * | 2011-03-25 | 2012-09-27 | Netanel Raisch | Authentication System With Time Attributes |
US20140283054A1 (en) * | 2013-03-14 | 2014-09-18 | Microsoft Corporation | Automatic Fraudulent Digital Certificate Detection |
US8966659B2 (en) * | 2013-03-14 | 2015-02-24 | Microsoft Technology Licensing, Llc | Automatic fraudulent digital certificate detection |
Also Published As
Publication number | Publication date |
---|---|
US6965881B1 (en) | 2005-11-15 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US6965881B1 (en) | Digital credential usage reporting | |
US7395246B2 (en) | Delegating digital credentials | |
US7457950B1 (en) | Managed authentication service | |
EP3460693B1 (en) | Methods and apparatus for implementing identity and asset sharing management | |
US20230245019A1 (en) | Use of identity and access management for service provisioning | |
EP3460692A1 (en) | Identity management for implementing vehicle access and operation management | |
US7788700B1 (en) | Enterprise security system | |
CA2561906C (en) | System, method and program for user authentication, and recording medium on which the program is recorded | |
JP3871300B2 (en) | A method for job-based authorization between companies | |
US7512782B2 (en) | Method and system for using a web service license | |
EP3510746A1 (en) | Architecture for access management | |
US20010034836A1 (en) | System for secure certification of network | |
US20030074315A1 (en) | System and apparatus for remotely printing certified documents | |
US10762501B2 (en) | System and method for partner key management | |
US7509498B2 (en) | Digital signature validation | |
CN101663670A (en) | Request-specific authentication for accessing web service resources | |
JP5720831B2 (en) | Personal information management apparatus, service providing apparatus, program, personal information management method, verification method, and personal information verification system for preventing falsification of personal information and denial of distribution of personal information | |
WO2001082190A1 (en) | Multi-tiered identity verification authority for e-commerce | |
JP2003150735A (en) | Digital certificate system | |
JP2001175599A (en) | Authentication system | |
EP1574978A1 (en) | Personal information control system, mediation system, and terminal unit | |
KR20100006811A (en) | Contraction authenticating system using certification of contractor in mobile configuration and contractor authenticating method thereof | |
JP2004362189A (en) | User information circulation system | |
JP2004297333A (en) | Digital certificate accreditation system, digital certificate accreditation server, pki token, digital certificate accreditation method and program | |
JP5818635B2 (en) | Login authentication system and method |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AS | Assignment |
Owner name: INTEL CORPORATION, CALIFORNIA Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:BRICKELL, ERNIE F.;DEKLOTZ, WESLEY;REEL/FRAME:016670/0390 Effective date: 20001020 |
|
STCB | Information on status: application discontinuation |
Free format text: ABANDONED -- FAILURE TO RESPOND TO AN OFFICE ACTION |