Sun Microsystems, Inc.

The Brodia Group

Mastercard International Incorporated

Theodore Charles Goldstein

Ronald Martinez

Efrem Lipkin

Paul H Rubin

Brian T Lewis

Jonathan J Gibbons

Michael S Bender

Michael J Jordan

Diana Neiman

Gary Herman

Jonathan B Ziegler

Michael J Day

Rinaldo Di Giorgio

A trusted third-party authentication protocol that facilitates secure commercial transactions over computer networks between a merchant and a user. The method and system of the present invention generally involves three entities: 1) a guarantor, which acts as a trusted arbitrator, 2) a merchant, and 3) a consumer or user. In one embodiment, the guarantor authenticates users and provides authentication documents back to the user for use in transactions with merchants. The authentication document generated by the guarantor can be used as a means to validate a user's identity and/or to provide authorization/validation of a specific transaction.

Method and system for secure guaranteed transactions over a computer network

An electronic vault includes an array of smart products for use in processing associated transactions. Because smart product transactions usually require that a value of currency always be stored on a particular smart product, the vault provides a collection of smart products storing digital currency values for use in processing a high volume of associated transactions.

Electronic vault for use in processing smart product transactions

A trusted agent server provides a networked application that assists a customer in managing their online commercial affairs. A user contacts the server using a network access device, such as a browser on a personal computer. The trusted agent client component augments the user's network access device to perform business transactions on behalf of the user. The user controls these transactions through the trusted agent server. A trusted agent service is a trusted agent client component application which operates in conjunction with the trusted agent server. The trusted agent service is an Internet-based mechanism that makes single-click buying available on any commercial Web site. The trusted agent also provides customers with access to personal and credit card information used during single-click transactions, smart receipts used for ongoing customer support, merchant and product preference settings, and direct response product offerings keyed to these preferences. Because this information is all stored on the trusted agent server, it is available to any device connected to the Internet. The trusted agent service is implemented by operating the trusted agent server.

Trusted agent for electronic commerce

A smart electronic receipt system that provides intelligent receipts, called Smart Receipts, that electronically document a transaction between two parties and maintains a persistent connection between the two parties following a successful online transaction. A Trusted Agent on the Buyer's client system creates an order record which is stored in a database on a Trusted Agent Server and starts the transaction process with the merchant. A Smart Receipt is delivered by a Smart Receipt Agent over a secure connection from the merchant to the Trusted Agent Server upon successful completion of a purchase and reflects the details of the transaction. It is stored in a secure database on the Trusted Agent Server and is made available to the Buyer (user) through a Trusted Agent located on his machine. The Trusted Agent Server compares the order record Limited Edition Digital Objects (LEDOs) stored in database with the Smart Receipt's LEDO to find the corresponding order record. The Smart Receipt provides the customer with detailed information about an online purchase in a standardized format. Hyperlinks embedded in the Smart Receipt enable the customer to access customer service and order status. The merchant may also embed addition-al services within the Smart Receipt, including special offers for future purchases. Offers provided in a Smart Receipt can be personalized to a user's preferences which are stored on the Trusted Agent Server. Each Smart Receipt is comprised of a chain of LEDOs with each LEDO object having a unique owner. A Smart Receipt is a dynamic entity and is continuously updated until the Buyer deletes it from the Trusted Agent Server.

Smart electronic receipt system

A system and methods are provided for storing and validating electronic tickets for multiple venues on a single smart card. In accordance with this present embodiment, an operating system of the smart card includes a Java Virtual Machine and an applet loader key. A shared applet, including a venue loader key, is validated with the applet loader key and is stored on the smart card. One or more venue applets are also stored on the smart card, each with a venue key corresponding to an associated venue. Each venue applet is validated by the applet loader key and the venue loader key. The shared applet is used by the venue applets to interface with ticket loaders and ticket validation devices. Tickets are purchased for events associated with the venue applets and are stored on the smart card in association with the related venue applets. Ticket signatures are authenticated with each venue applet's venue key. A ticket is cancelled after being tendered to gain admittance to an event.

Multi-venue ticketing using smart cards

The present invention provides a method and an apparatus for providing a first computer program module with the ability to access a service from a second computer program module. The method includes receiving the first computer program module--for example, at a third party computer system, and determining whether the first computer program module has been digitally signed by an authority having power to confer access for the service. If so, the method provides the first computer program module with access to the service. A variation on this embodiment includes verifying that the first computer program module includes a chain of certificates establishing a chain of authorization for the service. This verification process includes verifying that a first certificate in the chain is signed by an entity that is originally authorized to confer access for the service, and verifying that subsequent certificates in the chain are signed by entities that have been delegated authorization to confer access for the service. In a further variation on the above embodiment, the act of providing the first computer program module with access to the service, includes providing the first computer program module with a permit that allows the first computer program module to perform a restricted set of operations on the service.

Controlling access to services between modular applications

One embodiment of the present invention provides a method and an apparatus for controlling access to services in a protected memory system. The method makes use of a permit, which includes an access control mechanism that resides in a memory space that is protected from a user of the permit. The method includes receiving a request for a service through a permit, the permit comprising an object defined within an object-oriented programming system. In response to the request, the method activates an access control mechanism within the permit. This access control mechanism controls access to the service and resides in a memory space that is protected from a user of the permit, such that the access control mechanism is triggered by invoking a method on the permit. If the access is allowed, the method accesses the service by performing an invocation on a controlled object. This controlled object includes methods to perform the service, and is otherwise protected from the user of the permit. Another variation of the above embodiment includes receiving, at a permit issuing authority, a request for the permit from an entity (such as a person, a computer program or a computer process) requiring access to the service. If the request includes valid authorization information, a permit is issued to the entity. A further variation of the above embodiment includes creating a copy of the permit and transferring the copy to an entity requiring access to the service.

Permit for controlling access to services in protected memory systems

The present invention provides a system and process for making use of pre-existing data-structures which represent a computer program, in a way which has the advantages of shortening the time and cost required to create a new version of the computer program. The pre-existing data-structure is modified to produce a shadow data-structure which contains only shadows of those elements or nodes of the pre-existing data-structure required to perform the tasks of the new version of the computer program. The present invention includes processes to make the data-structure of the original program shadowable; processes to use data from the original program compilation process in compiling the new version of the program, including processes to create a shadow data-structure; and processes to use the new version of the computer program along with the shadow data-structure to create the desired execution. This new version of the computer program is typically a tool for checking or observing the original program's execution in some manner. Moreover, the system and processes disclosed provide mechanisms for a software manufacturer to create type-safe versions of a connected collection of objects which are dynamically extensible.

Method and apparatus for a type-safe framework for dynamically

A method and apparatus for generating a platform-standard object file containing machine-independent abstract code. Source code which defines a procedure is convened into abstract code which makes no assumptions about the platform on which the procedure will be executed. An abstract code platform-standard object file is generated based on the abstract code. The abstract code platform-standard object file includes a list of definitions of any global variables defined in the abstract code, a list of symbol references indicative of any external variables or external procedures referenced in the abstract code, a sequence of machine instructions for calling an execution routine when a client calls the procedure, and the abstract code which defines the procedure. The abstract code is preferably compressed before it is stored in the abstract code platform-standard object file. When a program including the abstract code platform-standard object file is executed, it is dynamically linked to the execution routine. When the procedure is called, the execution routine is invoked. The execution routine executes the procedure by interpreting the abstract code or generating machine-code responsive to the abstract code. The execution routine may be an execution control unit which selects between various execution techniques based on runtime factors, such as the frequency with which the procedure is called.

Growing community of inventors

Palo Alto, CA, United States of America

Theodore Charles Goldstein