Preventing identity theft
Determining whether to remotely authorize an action on behalf of a requester includes having the requester provide a privacy token, remotely obtaining data from the privacy token, and authorizing the action if the data from the privacy token verifies that the requester is authorized to take the action. The action may include issuing a credit card for the requester. The privacy token may be a smart card. The data may be digitally signed. Determining whether to remotely authorize an action on behalf of a requester may also include authorizing the action if the requester had previously indicated a desire not to require presentation of the privacy token. The action may be authorized only if the data from the privacy token verifies the identity of the requester.
1 . A method of determining whether to remotely authorize an action on behalf of a requester, comprising:
having the requester provide a privacy token;
remotely obtaining data from the privacy token; and
authorizing the action if the data from the privacy token verifies that the requester is authorized to take the action.
2 . A method, according to claim 1 , wherein the action includes issuing a credit card for the requester.
3 . A method, according to claim 1 , wherein the privacy token is a smart card.
4 . A method, according to claim 1 , wherein the data is digitally signed.
5 . A method, according to claim 1 , further comprising:
authorizing the action if the requester had previously indicated a desire not to require presentation of the privacy token.
6 . A method, according to claim 1 , wherein the action is authorized only if the data from the privacy token verifies that the requester is authorized to take the action.
7 . A method, according to claim 1 , wherein the data provided in the privacy token is encrypted to inhibit directly ascertaining identifying information about the requester.
8 . A method, according to claim 7 , wherein the data is encrypted using a one-way hash function.
9 . A method, according to claim 8 , further comprising:
applying the one-way hash function to identifying information about the requester and comparing the result thereof with the data provided in the privacy token.
10 . A method, according to claim 1 , wherein the requester provides the privacy token in response to obtaining a particular credit score for the requester.
11 . A computer readable medium having computer executable instructions for performing the steps recited in claim 1 .
12 . A privacy token, comprising:
an electronic identifier that stores data;
a data communicator coupled to the electronic identifier; and
data, provided on the electronic identifier, that binds the privacy token to a holder thereof, wherein the data is authenticated by an authority that is trusted by a provider of service to the holder.
13 . A privacy token, according to claim 12 , wherein the data is digitally signed by the authority.
14 . A privacy token, according to claim 12 , wherein the data provided in the privacy token is encrypted using a one-way hash function to inhibit directly ascertaining identifying information about the requester.
15 . A method of administering privacy tokens that have data that binds each of the privacy tokens to a holder thereof using authenticated data, the method comprising:
receiving, from a token issuing authority, authenticated information indicating that a particular privacy token has been issued; and
providing a transaction authority with authenticated information indicating that the particular privacy token has been issued by the token issuing authority, wherein the transaction authority authorizes use of the privacy token in response to receiving the second authenticated information.
16 . A method, according to claim 15 , wherein the authenticated information received from the token issuing authority is different from the authenticated information provided to the transaction authority.
17 . A method, according to claim 15 , wherein the authenticated information received from the token issuing authority is the same as the authenticated information provided to the transaction authority.
18 . A method, according to claim 15 , wherein an authority granting agency communicates information indicating particular token issuing privileges of the token issuing authority.
19 . A method, according to claim 18 , wherein the authenticated information provided to the transaction authority depends, at least in part, on information provided by the authority granting agency.
20 . A computer readable medium having computer executable instructions for performing the steps recited in claim 15.