Using smartcards to enable probabilistic transaction on an untrusted device

Abstract

The present method permits a user to conduct remote transactions without a network while using an untrusted computing device, such as a hand-held personal digital assistant or a laptop computer. The computing device is augmented with a smartcard reader, and the user obtains a smartcard and connects it to the device. This design can be used by an untrusted user to perform financial transactions, such as placing bets on the outcome of a probabilistic computation. Protocols are presented for adding (purchasing) or removing (selling) value on the smartcard, again without requiring a network connection. Using the instant protocols, neither the user nor the entity issuing the smartcards can benefit from cheating.

Claims

What is claimed is:

1. A cryptographic module for enabling remote transactions with an untrusted apparatus, the cryptographic module comprising:

means for interfacing to an external untrusted apparatus;

means for storing numbers;

means for generating random numbers;

a processor, connected to the interface means, storage means, and generating means, for executing program instructions, the program instructions causing the processor to perform the steps of:

generating a first random number transmitting the first random number to the untrusted apparatus after the apparatus has generated a second random number;

receiving the second random number from the untrusted apparatus, wherein the first and second random numbers are used by the untrusted apparatus to calculate a third random number to enable probabilistic transactions and wherein the first random number is not transmitted until a commitment number is received which is calculated from knowledge of the second random number.

2. The apparatus of claim 1 wherein the commitment number is calculated based on a first salt random number generated by the cryptographic module, a second salt random number generated by the untrusted apparatus, and the second random number.

3. An apparatus for enabling remote transactions with a cryptographic module, the apparatus comprising:

means for interfacing to a cryptographic module;

means for storing numbers;

means for generating random numbers;

a processor, connected to the interface means, storage means, and generating means, for executing program instructions, the program instructions causing the processor to perform the steps of:

generating a first random number

receiving a second random number generated by a cryptographic module; and

calculating a third random number based on the first random number and the second random number which are used to enable probabilistic transactions and wherein the second random number is not received until a commitment number is calculated based on the first random number and transmitted to the cryptographic module.

4. The apparatus of claim 3 wherein the commitment number is calculated based on a first salt random number generated by the cryptographic module, a second salt random number generated by the apparatus, and the first random number.

Description

FIELD OF THE INVENTION

The present invention relates to electronic transactions and, more particularly, to systems for conducting electronic transactions with a cryptographic module.

BACKGROUND OF THE INVENTION

When users have access to a communication network, then applications for conducting electronic commerce transactions such as banking, shopping, and gambling can be implemented securely in a straightforward manner. This is because the resources that need protection, namely money, can be secured by cryptographic means in the network. There are many protocols for conducting secure transactions on the Internet, such as the Secure Sockets Layer (SSL) which permits electronic commerce by providing an encryption layer between the application/browser layer and the Internet's TCP/IP layer. (See Kipp E. B. Hickman and Taher Elgamal, The SSL Protocol, Internet draft draft-hickman-netscape-ssl-01.txt, 1995). Secure protocols are already implemented on many mobile devices. Hall et al. have presented protocols for remote electronic gambling for online users. (See Chris Hall and Bruce Schneier, "Remote Electronic Gambling," 13.sup.th Annual Computer Security Applications Conference, pages 227-30, December 1997).

There are, however, many occasions when a user is in possession of a small computing device, but is not in communication with the network. There is currently a proliferation of lightweight handheld devices, such as the 3Com Palm Pilot, Windows CE devices, and even laptops that weight under three pounds. Many of these devices are so portable that people can carry them in their pockets and use them at all times--while in a vehicle travelling, while in a public place, standing in line at a grocery store, sitting at a doctor's office, etc. In such scenarios, it is difficult to allow the user to perform financial transactions because interaction with servers is difficult or not possible. Moreover, it is assumed that the user has full access to the device, so secrets (such as cryptographic keys) cannot be safely stored on it. Accordingly, the prior art does not enable a user to securely conduct electronic transactions on an untrusted remote electronic device.

SUMMARY OF THE INVENTION

The present invention permits a user to conduct remote transactions without a network while using an untrusted computing device, such as a hand-held personal digital assistant or a laptop computer. The computing device is augmented with a smartcard reader, and the user obtains a smartcard and connects it to the device. This design can be used by an untrusted user to perform financial transactions, such as placing bets on the outcome of a probabilistic computation. Protocols are presented for adding (purchasing) or removing (selling) value on the smartcard, again without requiring a network connection. Using the instant protocols, neither the user nor the entity issuing the smartcards can benefit from cheating.

The protocols described below have numerous advantages over the prior art and satisfy the following security requirements, particularly as applied to gambling applications: (1) only the issuer of the smartcards is able to add or subtract money from the smartcard without participating in any particular transaction; (2) the issuer must refund the amount on the smartcard whenever the user wishes; (3) once a user commits an amount to a transaction or places a bet on a game, she cannot prevent the loss of that amount if she loses; (4) the user can detect a fraudulent transaction such as when she wins a game but is not credited for her bet; (5) the issuer must publicize the algorithms and probabilities that are actually used by the smartcard (e.g. the house must announce the rules for each game and it must be impossible for the smartcard to weigh the probability further in favor of the house); (6) the issuer can set limits on transactions on the smartcard (e.g. placing limits on bets); and (7) the user cannot risk more than the amount on the smartcard in any transaction. Thus, with respect to gambling, the user can play probabilistic games with assurance that if she wins, she will actually win the money in the bet, and the house knows that users will not be able to cheat. In addition, the user is guaranteed that the odds of winning published by the smartcard are accurate.

These and other advantages of the invention will be apparent to those of ordinary skill in the art by reference to the following detailed description and the accompanying drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is an illustrative representation of the major functional components of a portable cryptographic module and its interaction with a remote computing device.

FIGS. 2, 5, and 6 illustrate security protocols that may be used to implement the principles of the present invention.

FIG. 3 illustrates a possible mapping between integers and the values of a deck of cards.

FIG. 4 illustrates an example vector for use with the above protocols.

DETAILED DESCRIPTION

FIG. 1 illustrates in block diagram format a system designed in accordance with the principles of the present invention. The block diagram of FIG. 1 shows two main components, namely a portable cryptographic module such as a smartcard 20 and a remote computing device 30. The design of the device/smartcard combination in FIG. 1 permits a user to conduct a remote transaction--such as gambling--with the entity that issued the smartcard 20 (hereinafter referred to as the "house"). The user is in possession of the remote computing device 30 and purchases smartcards 20 from the house with value stored on them. The house not only issues smartcards with value on them in exchange for money, it is also responsible for redemption of money on smartcards. It is assumed that there is, associated with the house, a public/private cyptographic key pair whose public component is well-known.

The smartcard 20 includes a microprocessor 21, an erasable electronic programmable read-only memory (EEPROM) 25, and an interface 22 to a card reader, which, for example, typically comprises an analog interface chip, an inductive coil of a transformer for power, and several capacitive plates, which are not shown in FIG. 1. All smartcard components are preferably laminated beneath the smartcard surface such that no external contacts are accessible to intruders. It is assumed that monetary value can be stored on the card (e.g. several thousand dollars worth) such that reading or modifying the value is more costly to the attacker than the benefit that could be derived from such an attack. The microprocessor typically has a central processing unit and internal memory units (not shown) that store the firmware for an operating system. The internal memory units of microprocessor 21 store protocols for smartcard 20 to receive and transmit data, security and application control software, and memory management programs. Operating under the control of the firmware, microprocessor 21 executes instructions to format data that is transferred to the remote transaction device 30 via the card reader/writer interface. The microprocessor 21 also interprets programmed instructions received from the remote transaction device 30 through the card reader/writer interface, as described in further detail below.

It is advantageous for the smartcard to have a serial number, imprinted visibly on the outside, and that information be placed in the smartcard's secure memory at its manufacture time that depends on both the card and the particular entity issuing the smartcard. For example, the secure memory can store a signature from the house on the card's serial number which can be utilized in connection with the security protocols discussed more fully below. The smartcard 20 advantageously has a means for generating random numbers. This can be achieved either in hardware (e.g., using a noisy diode or a low-accuracy clock) or in software/firmware (e.g., using a built-in seed and a cryptographic pseudo-random number generator). The latter would require some nonvolatile memory, where some state can be maintained over time. Ideally, some combination of these techniques can be used.

The remote computing device 30 is preferably a small portable device that is capable of computation. It can be a special-purpose device built for the instant applications or a standard portable device such as a personal digital assistant or a laptop computer. The only physical requirement is that the device needs to be able to communicate with the cryptographic module. In the present design, the remote computing device is augmented with the smartcard reader/writer interface 32, which analagously to interface 22 comprises an analog interface chip, an inductive coil of a transformer connected to a power supply, and several capacitive plates, again not shown in FIG. 1. In a preferred embodiment, the device 30 also includes a microprocessor 31, a display 38, and some form of data entry module 36. The device should also have a source of random numbers and some means such as EEPROM for storing a public cryptographic key of the house. Since the device is used to interface with the user, it preferably should have a graphical display. There are no security requirements associated with the design of the device, which can be "untrusted" to the house. As such, the device is an agent of the user. It is assumed that the user can trust the device to behave properly (in the extreme, the user can build her own device to ensure that). The functionality of the device can be fully specified so that different manufacturers can produce devices that interoperate.

The security protocols described below permit the user to gamble against the house with assurance that, if she wins, she will actually win the money in the bet and with the odds of winning known accurately beforehand. The house is likewise confident that users will not be able to cheat. It should be noted that although the security protocols and requirements are described in relation to the application of gambling, the present invention is not so limited and has application to other forms of transactions conducted remotely with the computing device.

Transaction Protocols

FIG. 2 illustrates the security protocols as applied to the simple game of "high-card." In the game of high-card, the user and the house are each dealt a card from the same deck and whoever has the highest card wins. The house wins in the case of a tie, and aces are always high. The following notation and abbreviations are used in the discussion:

    NOTATION/ABRREVIATION          DEFINITION
    A .fwdarw. B: Message          A is sending Message to B
    [text].sub.sc                  text is signed by the entity SC.
    A, B                           comma denotes concatenation of
                                   A and B
    SC                             smartcard
    D                              device
    MK                             master key
    SN                             serial number

• Inventors
  Aiello, William A.; Rubin, Aviel D.; Strauss, Martin J.;
• Assignee
  AT&T Corp. (New York, NY)
• Published
  Dec-17-2002
• Current US Classes:
  380/228
  705/67
  713/200
• Application #
  412354
• International Classes
  G06F 017/00
• Field of Search
  235/380 235/379 902/9 713/200 713/201 713/171 713/162 713/187 705/71 705/67 705/64 380/228 380/239 380/229 380/269 380/272 380/273
• Examiner
  Trammell; James P.
• US Patent References:
  5548648
  5563950
  5721777
  5781458
  5970143