Secure pin transmission
AssigneeMicrosoft Corporation
InventorsMiki Mullor, Dan Sledz
Life of this patent
Estimating the term…
Abstract
A secure channel is established between a processor and a smart card such that authentication can be achieved without transmitting a Personal Identification Number (PIN) to or from the smart card in the clear. A session ticket indicative of the PIN is generated, and the session ticket is securely negotiated between the computer and the smart card instead of the PIN. Also, a trusted path is established between a user and the operating system of the processor for allowing the user to enter a PIN. A trusted computing base is established in the processor for receiving the PIN from the user and performing operations associated therewith.
Claims20
An authentication method comprising:
- receiving a personal identification number;
- requesting a ticket;
- receiving an encrypted ticket responsive to the request, wherein the encrypted ticket is indicative of a ticket encrypted utilizing a personal identification number stored in a device;
- generating a first key, utilizing the received personal identification number;
- decrypting the received encrypted ticket, utilizing the first key;
- providing the decrypted ticket for authentication.
A method in accordance 7, wherein:
- the first key is generated utilizing a hash of the received personal identification number;
- and
- the second key is generated utilizing a hash of the personal identification number stored in a device.
A authentication system comprising:
- an input/output portion configured to:
- receive a personal identification number;
- provide a request for a ticket from a device;
- and
- provide to the device, a decrypted ticket for authentication;
- and
- a processor portion configured to:
- in response to providing the request for a ticket, receive an encrypted ticket from the device, wherein the encrypted ticket was encrypted utilizing a personal identification number stored in the device;
- generate a first key, utilizing the received personal identification number;
- and
- generating the decrypted ticket by decrypting the received encrypted ticket, utilizing the first key.
A system in accordance 15, wherein:
- the first key is generated utilizing a hash of the received personal identification number;
- and
- the second key is generated utilizing a hash of the personal identification number stored in a device.
A computer-readable medium having stored thereon computer-executable instructions for establishing a trusted computing base and performing, within the trusted computing base the steps of:
- requesting a ticket;
- receiving an encrypted ticket responsive to the request, wherein the encrypted ticket is indicative of a ticket encrypted utilizing a personal identification number stored in a device;
- generating a first key, utilizing the received personal identification number;
- decrypting the received encrypted ticket, utilizing the first key;
- providing the decrypted ticket for authentication.
A computer-readable medium in accordance 19, wherein:
- the first key is generated utilizing a hash of the received personal identification number;
- and
- the second key is generated utilizing a hash of the personal identification number stored in a device.
Dependencies are inferred from the claim text.