Patent EA-004693-B1 (EA)
Title: Secure file transfer method and system
Inventor: KEECH WINSTON DONALD
IPC: G06F21/62
Filed: 2001-11-28
Abstract: 1. A method of transferring a data file having a file name from a fast computer operated by a first user to a second computer operated by a second user, under control of a third computer, comprising the steps of: i) is the first computer, the fast user selecting a data file for and establishing a communications link with the third computer, ii) verifying an identity of the first user to the third computer by way of verification communications between the first and third computers; iii) in the first computer, wrapping or encrypting the data ale within an executable file adapted to unwrap or decrypt the data file only upon activation by a unique key code, and then transmitting the executable file containing the wrapped or encrypted data file directly to the second computer together with first user identification information and the file name of the data file; iv) transmitting the file name of the data file from the first computer to the third computer, together with first user identification information and the unique key code; v) in the second computer, upon receipt of the executable file containing the wrapped or encrypted data file and upon attempted access thereto by the second user, establishing a communications link with the third computer; vi) verifying an identity of the second user to the third computer by way of verification communications between the second and third computers; vii) upon successful verification of the identity of the second user, transmitting the file name of the data file from the second computer to the third computer with a request for the unique key code; and viii) transmitting the unique key code from the third computer to the second computer so as to cause the executable file to unwrap or decrypt the data file and to allow access thereto in the second computer by the second user. 2. A method according to claim 1, wherein the identity of the first user is verified in step ii) above by way of the first user applying a first user mask code to a pseudo-random security string in the first computer so as to generate a first user volatile identification code, the first user transmitting the first user volatile identification code to the third computer and the third computer comparing the first user volatile identification code with a first check volatile identification code obtained by applying the first user mask code to the pseudo-random string in the third computer, identity verification taking place when the first user volatile identification code and the first check volatile identification codes are found to match each other. 3. A method according to claim 1 or 2, wherein the identity of the second user is verified in step vi) above by way of the second user applying a second user mask code to a pseudo-random security string to the second computer so as to generate a second user volatile identification code, the second user transmitting the second user volatile identification code to the third computer and the third computer comparing the second user volatile identification code with a second check volatile identification code obtained by applying the second user mask code to the pseudo-random string in the third computer, identity verification taking place when the second user volatile identification code and the second check volatile identification codes are found to match each other. 4. A method according to claim 3 depending from claim 2, wherein the first user mask code arid the second user mask code are applied to the same pseudo-random security string. 5. A method according to claim 4, wherein the pseudo-random string is generated by the third computer and transmitted firstly to the first computer and then from the first computer to the second computer. 6. A method according to claim 4, wherein the pseudo-random string is generated by the third computer and transmitted firstly to the first computer and then from the third computer to the second computer. 7. A method according to claim 3, wherein the first user mask code and the second user mask code are applied to different pseudo-random security strings. 8. A method according to any preceding claim, wherein the identity of the first or second user is verified, respectively, through said first or second computer by way of a secure user code entry interface for entry of a user mask code by way of the computer and a display; wherein: i) said secure user code entry interface contains at least one octave display for entry of at least one digit of said user mask code by the uses; wherein sand active display illuminates or highlights at least orate display digit within said active display and said user enters said at least one digit of said user mask code by a response through an input device at a response time when said at least one display digit which corresponds with said at least one digit of said user mask code is illuminated or highlighted is said active display; and ii) a random ram on time is added to said response time to extend said at least one active display. 9. A method according to claim 2 or claim 3 or any claim depending therefrom, wherein: i) the pseudo-random string comprises a first linear array of characters, each character having a given numerical position in the first array (first, second, third etc.); ii) the mask code comprises a second linear array of numbers, each number having a given numerical position in the second away (first, second, third etc.); and iii) the volatile identification code is generated by applying the mask cede to the pseudo-random string so as sequentially to select numerical positions in the first array on the basis of the numbers in the second array, taken in positional order, and to return the characters thereby selected from the first array in sequence so as to form a third linear array, this third linear away foaming the volatile identification code. 10. A method according to any preceding claim, wherein the third computer maintains a record of transactions between the first, second and third computers so as to permit an audit trail to be established. 11. A method according to claim 2 or claim 3 or any claim depending therefrom, wherein the first and/or second user volatile identification code. are stored as digital signatures in the third computer in combination with the associated pseudorandom security string. 12. A method of transferring a data file to a first computer from a second computer, the method comprising the steps of: i) establishing a communications link between the first and second computers; ii) selecting, by way of the first computer, a data file for transfer from the second computer, iii) in the second computer, wrapping or encrypting the data file within an executable file adapted to unwrap or decrypt the data file only upon activation by a unique key code, and then transmitting the executable file containing the wrapped or encrypted data file to the fast computer; iv) verifying an identity of a user of the fast computer to the second computer by way of the first user applying a first user mask code to a pseudo-random security string in the fast computer so as to generate a first user volatile identification code; the first user transmitting the first user volatile identification code to the second computer and the second computer comparing the first user volatile identification code with a first check volatile identification code obtained by applying the first user mask code to the pseudo-random string in the second computer, identity verification taking place when the first user volatile identification code and the first check volatile identification codes are found to match each other, v) upon successful verification of the user of the first computer, transmitting the unique key code to the first computer. 13. A method according to claim 12, wherein the identity of the fast user is verified through said first computer by way of a secure user code entry interface for entry of a user mask code by way of the computer and a display; wherein: i) said secure user code entry interface contains at least one active display for entry of at least one digit of said user mask code by the user; wherein said active display illuminates or highlights at least one display digit within said active display and said user enters said at least one digit of said user mask code by a response through an input device at a response time when said at least one display digit which corresponds with said at least one digit of said user mask code is illuminated or highlighted in said active display, and ii) a random nm on time is added to said response time to extend said at least one active display. 14. A method according to claim 12 or claim 13, wherein: i) the pseudo-random sizing comprises a first linear array of characters, each character having a given numerical position in the first array (first, second, third etc.); ii) the mask code comprises a second linear array of numbers, each number having a given numerical position in the second array (first, second, third etc.); and iii) the volatile identification code is generated by applying the mask code to the pseudo-random string so as sequentially to select numerical positions in the first array on the basis of the numbers in the second array, taken in positional order, and to return the characters thereby selected from the first array is sequence so as to form a third linear array, this third linear array forming the volatile identification code. 15. A method of transferring a data file to a first computer having a first telecommunications address from a second computer having a second telecommunications address, comprising the steps of: i) transmitting a request for the data fife from the first computer to the second computer, the request including data identifying the data file and the first telecommunications address; ii) in the second computer, wrapping or encrypting the data file within an executable file adapted to unwrap or d