Apparatus, system, and method for securely authorizing changes to a transaction restriction

1. An apparatus comprising:

[1] a computer readable storage medium storing a computer readable program;

[2] a processor executing the computer readable program, the computer readable program comprising:

[3] an authentication module receiving a first authentication from a user of the payment instrument at an authorized computer that the user designates as authorized to validate authentications for a payment instrument distinct from the authorized computer, electronically transacting payments with a payment server, and comprising a transaction restriction for the payment instrument;

[4] a security module residing on the authorized computer and securely storing encryption keys, wherein a first encryption key is a hash of the first authentication, a second encryption key is shared by the security module and the payment server and is required to change the transaction restriction for payment instrument, and the payment server authorizes payments by the payment instrument at a point-of-sale station distinct from the authorized computer and changes the transaction restriction of the payment instrument;

[5] the authentication module receiving a second authentication from the user only at the authorized computer; and

[6] the security module validating the second authentication with the first encryption key, and authorizing a change to the transaction restriction by the payment server by communicating the second encryption key to the payment server if the second authentication is valid and the security module communicates the second encryption key through the authorized computer.

2. The apparatus of claim 1 , further comprising a modification module changing the transaction restriction using the second encryption key.

3. The apparatus of claim 1 , wherein the authentication module comprises a fingerprint authentication module, the first authentication is a first fingerprint authentication, and the second authentication is a second fingerprint authentication.

4. The apparatus of claim 1 , wherein the security module comprises a Trusted Platform Module.

5. The apparatus of claim 1 , wherein the payment instrument is a radio frequency identification (RFID) tag.

6. The apparatus of claim 1 , wherein the payment instrument is a credit card.

7. The apparatus of claim 1 , wherein the transaction restriction limits payments to a specified amount during a specified time period.

8. The apparatus of claim 1 , wherein the transaction restriction limits payments to a specified payee.

9. A computer useable medium storing a computer readable program that when executed on a computer causes the computer to:

securely store encryption keys in a security module of an authorized computer that a user designates as authorized to validate authentications for a payment instrument distinct from the authorized computer that electronically transacts payments with a payment server and comprises a transaction restriction for the payment instrument, wherein a first encryption key is a hash of a first authentication of the user, a second encryption key is shared by the security module and the payment server and is required to change the transaction restriction for payment instrument, and the payment server authorizes payments by the payment instrument at a point-of-sale station distinct from the authorized computer and changes the transaction restriction of the payment instrument;

receive a second authentication from the user only at the authorized computer;

validate the second authentication with the first encryption key; and

authorize a change to the transaction restriction by the payment server by communicating the second encryption key to the payment server if the second authentication is valid and the security module communicates the second encryption key through the authorized computer.

10. The computer useable medium of claim 9 , wherein the computer readable code further causes the authorized computer to change the transaction restriction using the second encryption key.

11. The computer useable medium of claim 9 , wherein the first authentication is a first fingerprint authentication, the second authentication is a second fingerprint authentication, and each fingerprint authentication is received from a fingerprint authentication module.

12. The computer useable medium of claim 9 , wherein the security module comprises a Trusted Platform Module.

13. The computer useable medium of claim 9 , wherein the payment instrument is a RFID tag.

14. The computer useable medium of claim 9 , wherein the transaction restriction limits payments to a specified amount during a specified time period.

15. The computer useable medium of claim 9 , wherein the transaction restriction limits payments to a specified payee.

16. A system comprising:

a payment instrument electronically transacting payments with a payment server for a user and comprising a transaction restriction for the payment instrument;

the payment server authorizing payments by the payment instrument at a point-of-sale station distinct from an authorized computer and changing the transaction restriction of the payment instrument;

the authorized computer designated by the user as authorized to validate authentications for the payment instrument, distinct from the payment instrument, and comprising:

an authentication module receiving a first authentication from the user;

a security module securely storing encryption keys, wherein a first encryption key is a hash of the first authentication and a second encryption key is shared by the security module and the payment server and is required to change the transaction restriction for payment instrument;

the authentication module receiving a second authentication from the user only at the authorized computer;

the security module validating the second authentication with the first encryption key, and authorizing a change to the transaction restriction by the payment server by communicating the second encryption key to the payment server if the second authentication is valid and the security module communicates the second encryption key through the authorized computer; and

the payment server further comprising a modification module changing the transaction restriction using the second encryption key.

17. The system of claim 16 , wherein the authentication module comprises a fingerprint authentication module, the first authentication is a first fingerprint authentication, and the second authentication is a second fingerprint authentication.

18. The system of claim 16 , wherein the security module comprises a Trusted Platform Module.

19. The system of claim 16 , wherein the payment instrument is a Smart Card® electronic card.

20. A method for securely authorizing changes to a transaction restriction, the method comprising:

securely storing, by use of a processor, encryption keys in a security module of an authorized computer that a user designates as authorized to validate authentications for a payment instrument distinct from the authorized computer that electronically transacts payments with a payment server and comprises a transaction restriction for the payment instrument, wherein a first encryption key is a hash of a first authentication of the user, a second encryption key is shared by the security module and the payment server and is required to change the transaction restriction for payment instrument, and the payment server authorizes payments by the payment instrument at a point-of-sale station distinct from the authorized computer and changes the transaction restriction of the payment instrument;

receiving a second authentication from the user only at the authorized computer;

validating the second authentication with the first encryption key;

authorizing a change to the transaction restriction by the payment server by communicating the second encryption key to the payment server if the second authentication is valid and the security module communicates the second encryption key through the authorized computer; and

changing the transaction restriction using the second encryption key.