Method and apparatus for securing an application using a measurement of a location dependent physical property of the environment

An apparatus for use in securing interaction between a user and a computer based application comprising:

• an electronic device adapted to provide a secured measurement of a location dependent physical property, the electronic device comprising:
• a sensor adapted to make a measurement of the location dependent physical property, wherein said location dependent physical property of said location does not encompass said location itself nor an IP address;
• a memory component adapted to store a secret value;
• and
• a data processing component adapted to generate an electronic signature over said measurement by cryptographically combining said measurement with a secret key comprised in or derived from said secret value;
• the electronic device further adapted to make said electronic signature available for verification.

A system for securing the interaction between a user and a computer based application comprising:

• an apparatus comprising:
• a sensor adapted to make a first measurement of a first location dependent physical property at a location of the apparatus;
• a memory component adapted to store a secret value;
• and
• a data processing component adapted to generate an electronic signature over said first measurement by cryptographically combining said first measurement with a secret key comprised in or derived from said secret value;
• and
• an authentication server adapted to:
• receive a second measurement value of a second location dependent physical property of a location from which the computer based application is being accessed by the user;
• receive said electronic signature over said first measurement value;
• verify said received electronic signature;
• use said received second measurement value and a result of said verification of said received electronic signature in a risk analysis to obtain an outcome;
• and
• decide on the basis of the outcome of said risk analysis whether or not to perform a certain action.

A method for securing interaction between a user and a remotely accessible application, the method comprising the steps of:

• at an access device used by the user to access the remotely accessible application, determining a first value for a first location dependent variable the access device comprising a sensor adapted to determine said first value of the first location dependent variable;
• at an authentication device that is physically different from the access device determining, independently from the access device, a second value for a second location dependent variable;
• said authentication device comprising a sensor adapted to determine said second value for said second location dependent variable;
• at the authentication device generating a dynamic credential or electronic signature using said second value for the second location dependent variable and a cryptographic secret key;
• said authentication device further comprising a memory component adapted to store said cryptographic secret key and a data processing component adapted to perform said generating a dynamic credential or electronic signature;
• at an authentication server receiving the generated dynamic credential or electronic signature and the first value of the first location dependent variable;
• and
• at the authentication server verifying whether the received first value of the first location dependent variable is consistent with the received dynamic credential or electronic signature.