The present invention relates generally to apparatus and methods for providing the secure transfer of data. More particularly, this invention relates to apparatus and methods for securely transferring information over an electronic network where the identities of the participants can be verified by each of the participants in the transaction.
The use of electronic networks to convey information among networked users has undergone an enormous amount of growth in recent years. The ability to transfer data using computer applications, such as, for example, electronic mail (“e-mail”) and file transfer protocol (“FTP”) programs, has become increasingly important in personal, and especially, business communications. Electronic communication services have become invaluable to individual and business concerns.
E-mail is a well-known means of communication for individuals and businesses with access to computers and Internet connections. When a user establishes an account with an e-mail service provider, e.g., America Online™ or Hotmail™, the user is assigned a unique e-mail address, e.g., someone@inter.net. Another individual can send a message to the user by entering the user's e-mail address along with the message and sending it via the Internet. E-mail can provide almost instant message delivery among individuals and businesses over vast distances for very little or no cost.
Despite the advantages of e-mail, there are drawbacks. E-mail messages are insecure, and can be intercepted en route by unknown third parties. Individuals and businesses who communicate electronically need to know that their messages are private, and that they can rely on the address to correctly identify the sender and/or recipient.
FTP allows a user to transfer files between two computers, generally connected via a network. If a system has FTP and is connected to a network, a user can access files available on connected computer systems. FTP allows for the easy transfer of large numbers of files, for instant access to files, and file sharing by many individuals over vast distances.
Despite the advantages of FTP, there are drawbacks. It may be difficult to keep files to be transferred secure and to control the flow of the electronic files. Individuals and businesses who use FTP for file sharing need to know that their files are kept private and that they can correctly identify the requestor and source of the file.
In addition to e-mail and FTP programs, other types of data transfer are employed in business communications. For example, buying and selling goods online, electronic finds transfer, online advertising, and accessing business information resources, is known as electronic commerce (E-commerce). E-commerce can improve the efficiency of current business processes and provide opportunities to widen existing customer bases. As the number of Internet users continues to expand, E-commerce has the potential to be the source of all extraordinary amount of revenue growth. In order to realize this potential, a variety of communication services and features will be required for E-commerce, which traditionally have been available in physical communication channels.
The United States Postal Service (USPS), an independent establishment of the executive branch of the U.S. government, provides many E-commerce features through a variety of document and package delivery services. The USPS is widely recognized as a secure and reliable means for sending and receiving packages and mail used for both personal and business transactions. Packages and mail sent via the USPS are time-stamped with an official postmark, which provides the recipient with proof of the time the item was sent. Additionally, once a package or mail item is placed with the USPS, the item is no longer in the sender's control, and thus cannot be recalled. Furthermore, packages and mail sent through the USPS are protected from third-party tampering by Federal laws.
In contrast, electronic communication services and E-commerce services currently do not provide these features. Additional security enhancements, such as authenticating the identities of the parties involved in a transaction and/or providing assurance to the recipient that a received message has not been altered, may also be required for these services to reach their full potential.
To ensure the vitality and growth of electronic communication services and E-commerce services, individuals and businesses need a secure way to communicate and conduct business electronically. Without trustworthy channels of communication, many potential participants in electronic communication and E-commerce may be unwilling to send sensitive information electronically.
In light of the foregoing, it is desirable to provide systems and methods for electronic communication services and E-commerce services providing a level of security which meets or exceeds the current level offered by the existing physical package and mail delivery services. In addition, it is also desirable to provide a system for communicating electronically that provides a secure and reliable way to conduct transactions electronically.
In accordance with the purpose of the present invention, as embodied and broadly described herein, the invention provides systems and methods for securely transferring information over an electronic network wherein the identities of the participants can be mutually verifiable.
An embodiment of the invention provides a method for processing a secure electronic transaction over a network from a sender to a receiver, which includes the process of generating a first unique representation of information included in the transaction, encrypting the information with a first encryption layer, and forming an encryption packet which includes the first encryption layer. The encryption packet is then transmitted over a network and then received the by a receiver. The authenticity of the encryption packet is verified and a receipt is generated using the information included in the encryption packet. The receipt is then transmitted to an electronic postmark server which verifies the authenticity of the receipt. A postmarked receipt is then created by the electronic postmark server and a copy is sent to the sender and/or the receiver.
It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the invention, as claimed.
The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate several embodiments of the invention and together with the description, serve to explain the principles of the invention.
Reference will now be made to the present embodiments consistent with the invention, examples of which are illustrated in the accompanying drawings. Wherever possible, the same reference numbers will be used throughout the drawings to refer to the same or like parts.
The described system and methods relate to a secure electronic transaction service that allows a user to send information over a network from sender to receiver in such a way that both parties have assurance that the information transmitted cannot be compromised during transit and that the identities of each participant in the transaction are mutually known.
Digital certificates can be received from the U.S. Postal Service (USPS) through a networked processing system. An Internet Customer Registration System is described in U.S. patent application Ser. No. 09/809,328, entitled “Methods and Systems for Establishing an Electronic Account for a Customer,” which is incorporated by reference in its entirety herein. When the user first receives a digital certificate they can choose to download it through a specific computer for storage in a token device such as a floppy, a zip drive, a smart card, or any other type of recordable media.
A digital certificate is a data structure used to verify the identity of an individual, and typically include a public/private key pair and a certificate number, which is some kind of reference to the certificate used by the CA which issued the certificate. The public key may be universally published, while the private key is typically be kept secure and private. A document is digitally signed by appending to the document a function of the private key in the form of a data string. The digital signature is the function of the private key. When a user receives a digitally signed document, the user uses the public key to decrypt the digital signature. After decrypting the digital signature, the user will be presented with a certificate number and the name of a CA verifying the signature. At this point the user can ask the CA to verify the certificate number. The CA will return the name associated with the certificate number and the name of the owner of that certificate. The digital signature could be added to the file by appending it to the file, placing it somewhere within the file, or other know processes in the art described in Chapter 11 of the Handbook of Applied Cryptography by Alfred J. Menezes. Just the certificate number and CA information could be attached to a document. After receiving the certificate number, the user receiving the document could perform a check with the CA on the identity of the owner of the certificate and the validity of the certificate.
The information itself is then encrypted in a first encryption layer 302. The encrypted information 302 and the unique representation 306 are then combined together. At this stage, a second encryption layer could optionally be added. This second encryption layer would be used if the sender desired an extended level of security at the expense of additional computations. Any encryption methods may be used, such as, for example, triple des, which is an industry-accepted standard.
After the initial encryption, in this implementation, first encryption layer 302 and the digitally signed unique representation 306 are then together digitally signed. This second signature process may use either the same sender's digital signature 303 or a different signature 304 to create an encryption packet 305. If the signature 303 or 304 originates from the USPS, encryption packet 305 could be afforded Federal legal protection currently afforded to the physical mail process conducted by the USPS.
Next, sender 10 transmits encryption packet 305 to receiver 20 (310). Receiver 20 sends digital signature 303 or 304 to CA server 40 for verification of the validity of the sender's digital signature 303 or 304 (330). A verification authority, like CA server 40, verifies the legitimacy of the identity of the digital signature user and validity of their digital certificate. The verification authority then sends the receiver an indication of the status of user of the digital signature. If verified, CA server 40 then sends back verification that user of digital signature 303 or 304 is valid and has not been revoked (335). If not verified, CA server 40 sends back a message indicating the user of digital signature 303 or 304 is not valid.
After verification of digital signature is received, receiver 20 digitally signs the unique representation 306 with the receiver's digital signature 313 creating a receipt, 316. Receiver 20 transmits receipt 316 to EPM server 50. After receiving receipt 316, EPM server 50 sends digital signature 313 to CA server 40 for verification of the validity of the user of digital signature 313. In another embodiment, EPM server may also verify the sender's digital signature 303. Once receiver's digital signature 313 is verified, EPM server 50 creates a postmarked receipt 346 of the transaction. Postmarked receipt 346 comprises a unique representation of receipt 316 and contains, among other information, a date and time stamp which uniquely identifies the transaction, all of which are digitally signed. EPM server 50 then sends a copy of postmarked receipt 346 to both sender 10 and receiver 20. Once postmarked receipt 346 is received by receiver 20, first encryption layer 302 can be removed and information 301 can be viewed by receiver 20, with assurance that the transaction has been documented and is secure. The decryption of first encryption layer 302 can take place either before or after receiving verification from CA server 40.
A hash of the information is then taken (stage 510). A first encryption layer is then applied to the information (stage 515) using a public key of the receiver. Next, the encrypted information and hash are signed creating an encryption packet (stage 520). The encryption package is then sent over the network to a receiver (stage 525).
Once at the receiver, the sender's digital signature is verified with the CA server to confirm the digital signature is valid (stage 530). If valid, the receiver digitally signs the hash creating a receipt (stage 535). The receiver the sends the receipt to the EPM server for electronic postmarking (stage 540). Once at the EPM server, the receiver's digital signature is verified with the CA server to confirm the digital signature is valid (stage 545). The EPM server then generates a postmarked receipt containing the hash of the receipt and other postmark data which is signed by the EPM server (stage 550) The EPM server then sends the postmarked receipt to both the sender and the receiver (stage 555).
Other embodiments of the invention will be apparent to those skilled in the art from consideration of the specification and practice of the invention disclosed herein. It is intended that the specification and examples be considered as exemplary only, with a true scope and spirit of the invention being indicated by the following claims.
This application claims the benefit of a provisional application entitled “Systems and Methods for Secure Data Transfer,” filed Aug. 18, 2000 and assigned Ser. No. 60/226,082. The contents of the above application is relied upon and expressly incorporated herein by reference.
Number | Date | Country | |
---|---|---|---|
60226082 | Aug 2000 | US |
Number | Date | Country | |
---|---|---|---|
Parent | 15013682 | Feb 2016 | US |
Child | 15494990 | US | |
Parent | 10344720 | Feb 2003 | US |
Child | 15013682 | US |