Certificate Status Service that is configurable, directed, and able to retrieve status from any approved Certification Authority (CA) is disclosed. The CSS may be used by a Trusted Custodial Utility (TCU) and comparable systems or applications whose roles are validating the right of an individual to perform a requisite action, the authenticity of submitted electronic information objects, and the status of authentication certificates used in digital signature verification and user authentication processes. The validity check on authentication certificates is performed by querying an issuing CA. Traditionally, to create a trusted Public Key Infrastructure (PKI) needed to validate certificates, complex relationships are formed by cross- certification among CAs or by use of PKI bridges. The PKI and CA interoperability problem is addressed from a different point of view, with a focus on establishing a trust environment suitable for the creation, execution, maintenance, transfer, retrieval and destruction of electronic original information objects that may also be transferable records (ownership may change hands). A TCU is concerned only with a known set of 'approved CAs' although they may support a multitude of business environments, and within that set of CAs, only with those certificates that are associated with TCU user accounts. Building PKI/CA trusted relationships is not required as the CSS achieves a trusted environment by querying only approved CAs and maintaining caches of valid certificates' status.

System and method for electronic transmission, storage and retrieval of authenticated documents

A system and method for effectuating Electronic Funds Transfer credit messages (see Fig. 12) is disclosed. The main structural components of the system include a Payment Portal Processor (Web Broker), an Internet Pay Anyone (IPA) Account (1202), a Virtual Private Lockbox (VPL) and an Account Reporter, the existing EFT networks, and a cash card for accessing a VPL or IP account. The Web Broker is a software application that provides a secure portal for accessing the user's Demand Deposit Account (DDA) or an IPA account and can be combined with the functionality of a traditional digital Wallet. Consumers use a Web Broker enhanced Wallet to fund their account, shop on the web, pay bills, store electronic receipts and transaction history, and check their recent Web Broker enhanced Wallet activity. The IPA is a special purpose account with limited functionality for making electronic payments in the form of EFT credit messages. The VPL is a limited function receive only account for receiving electronic payments through the EFT. The Account Reporter is a portal to view transaction history and the balance in IPA and VPL accounts, and provide online, real-time transaction reports and reconcile accounts receivable/purchase records against incoming EFT payment records. A physical card can be associated with either an IPA or VPL account in order to provide PIN debit capability.

Method and system for processing internet payments

The method and system of the invention provide a variety of techniques for using a selected alias and a selected personal identification entry (PIE) in conjunction with use of a transaction card, such as a credit card, debit card or stored value card, for example. A suitable number or other identification parameter is selected by the account-holder as an alias. The account-holder is then required to choose a PIE for security purposes. The alias is linked to the account-holder's credit card number via a database. When the account-holder enters into a transaction with a merchant, the physical card need not be present. The account-holder simply provides his or her alias and then the PIE. This can be done at any point of sale such as a store, catalog telephone order, or over the Internet. The alias and PIE are entered and authorization is returned from the credit card company.

System for providing cardless payment

Systems and methods for providing user logon and state-less authentication are described in a distributed processing environment. Upon an attempted access by a user to an online resource, transaction, or record, a logon component asks the user to supply a logon ID and a password. The logon component verifies the provided information, and upon successful identification, a security context is constructed from information relevant to the user. The security context is sent to the user and is presented to the system each time the user attempts to invoke a new resource, such as a program object, transaction, record, or certified printer avoiding the need for repeated logon processing.

Systems and methods for state-less authentication

A system, apparatus, method, and machine readable medium are described for performing advanced authentication techniques and associated applications. For example, one embodiment of a method comprises: receiving a policy identifying a set of acceptable authentication capabilities; determining a set of client authentication capabilities; and filtering the set of acceptable authentication capabilities based on the determined set of client authentication capabilities to arrive at a filtered set of one or more authentication capabilities for authenticating a user of the client.

Advanced authentication techniques and applications

A single sign-on (SSO) mechanism to enable a given user to access a target application on a target resource in a distributed computer enterprise One or more configuration directives each identifying a given logon process and any associated methods required to access the target application on the target resource are stored in a preferably global-accessible database (CIM) For each of a set of users, a preferably global-accessible database (PKM) stores user-specific and application-specific information enabling the user to access and logon to one or more target resources During a particular session, a logon coordinator (LC) mechanism coordinates given user information with the configuration directive to enable the given user to perform a given action with respect to the target application without specifying the given logon process and the application-specific information

Coordinating user target logons in a single sign-on (SSO) environment

A method, instructions and system is provided for establishing and enforcing change password policy in a single sign on environment. In response to receiving a change instruction identifying a first single sign-on password, the first single sign-on password is changed to create a second single sign-on password. Then a target password is retrieved. The target password is modified in a user selected manner to match the second single sign-on password to create a modified target password. The modified target password is stored. In response to a request from a user requesting access to an application, the modified target password is retrieved and the modified target password is provided to the requested application.

Paul A. Kallfelz

Papers

Coordinating user target logons in a single sign-on (SSO) environment

Incorporating password change policy into a single sign-on environment