ICC reader
AssigneeThales Dis France SAS
InventorsFrédéric Faven, Jean-François Schuh
Life of this patent
Estimating the term…
Abstract
The present disclosure provides an ICC reader including a microcontroller configured to exchange data with an insertable ICC while the insertable ICC is inserted and powered, and with an end-user entity, an ICC connector configured to allow the exchange of data between the microcontroller and the inserted ICC, and an end-user entity interface connector configured to allow the exchange of data between the microcontroller and an end-user entity, wherein the ICC reader further includes an activatable 2-position built-in switch defining two states: a first state wherein the exchange of data between the microcontroller and the inserted ICC is allowed, and a second state wherein the exchange of data between the microcontroller and the inserted ICC is interrupted emulating an ICC withdrawal.
Claims15
An Integrated Chip Card, ICC, reader comprising:
- a microcontroller, provides a hardware-based user-presence confirmation compliant with FIDO2 authentication requirements, configured to exchange data with an insertable ICC while the insertable ICC is inserted and powered, and with an end-user entity, an ICC connector configured to allow the exchange of data between the microcontroller and the inserted ICC, and
- an end-user entity interface connector configured to allow the exchange of data between the microcontroller and an end-user entity,
- wherein the ICC reader further comprises an activatable, user-operable, 2-position built-in switch defining two states:
- a first state wherein the exchange of data between the microcontroller and the inserted ICC is allowed, and
- a second state wherein the exchange of data between the microcontroller and the inserted ICC is interrupted emulating an ICC withdrawal.
Method for registering an end-user account with an online service, the method comprising:
- providing an authentication token;
- receiving, by an end-user entity being configured to communicate with a relying party providing the online service, the credentials of the end-user account;
- connecting the authentication token to an end-user entity though the end-user entity interface;
- shifting the activatable 2-position built-in switch of the connected authentication token at least from the second state to the first state;
- generating, by the authentication token, a cryptographic key pair unique for the authentication token, the online service and the end-user account to be registered;
- sending, by the authentication token to the relying party through the end-user entity, the public key;
- registering, by the relying party, the end-user account by storing the end-user account associated with the public key.
Method for authenticating an end-user account already registered with an online service, the method comprising:
- providing an authentication token;
- receiving, by an end-user entity being configured to communicate with a relying party providing the on line service, the credentials of the end-user account;
- connecting the authentication token to an end-user entity though the end-user entity interface;
- creating a challenge response by shifting the activatable 2-position built-in switch of the connected authentication token at least from the second state to the first state;
- retrieving, by the authentication token, the private key associated with the online service and the registered end-user account,
- signing, by the authentication token, the challenge response;
- sending, by the authentication token to the relying party through the end-user entity, the signed challenge response;
- and
- verifying, by the relying party, the signed challenge response with the public key stored and, if both matches, authenticating the end-user account.
Dependencies are inferred from the claim text.