US 2011/0258452 A1Published application

Remote authentication and transaction signatures

AssigneeVasco Data Security, Inc.

InventorsFrank Coulier, Frank Hoornaert, Frederik Mennes

Life of this patent

Estimating the term…

Loading patent…

Abstract

The invention provides a method, apparatus, computer readable medium and signal which allows the usage of devices containing PKI private keys such as PKI-enabled smart cards or USB sticks to authenticate users and to sign transactions. The authenticity of the user and/or the message is verified. Furthermore the operation (authentication and/or signing) occurs without the need for an application to have some kind of a direct or indirect digital connection with the device containing the private key. In addition the operation occurs without the need for the PKI-enabled device containing the private key (e.g. a PKI smart card or USB stick) to either support symmetric cryptographic operations or to have been personalized with some secret or confidential data element that can be read by a suitable reader.

A method for securing an application comprising the steps of:

registering data representing a private key for at least one user having a PKI device storing said private key;
said registering comprising
receiving a representation of a Private Key Code generated by a reader device operating in conjunction with said PKI device where said generation of said Private Key Code by said reader device occurs by said reader device generating and sending a challenge to said PKI device, and instructing said PKI device to perform an asymmetric cryptographic operation on said challenge with said private key, and said reader device receiving from said PKI device a result of said asymmetric cryptographic operation, and deriving from said received result said Private Key Code;
deriving from said representation of said Private Key Code a Private Key Related Value,
storing said Private Key Related Value linked to said user;
receiving from said at least one user at least one dynamic credential that has been generated by a reader device in conjunction with said PKI device and where said generation by said reader device of said dynamic credential comprises obtaining and sending said challenge to said PKI device, instructing said PKI device to perform an asymmetric cryptographic operation on said challenge with said private key, receiving from said PKI device a result of said asymmetric cryptographic operation, deriving from said received result a first Private Key Related Input Parameter, deriving said dynamic credential by cryptographically combining said derived first Private Key Related Input Parameter with at least one dynamic input variable;
verifying the received dynamic credentials comprising the steps of:
retrieving said stored Private Key Related Value linked to said user, and
deriving from said retrieved Private Key Related Value a second Private Key Related Input Parameter,
calculating a reference value by cryptographically combining said derived second Private Key Related Input Parameter with a value for at least one dynamic input variable, and
comparing said calculated reference value with said received dynamic credential;
and
protecting access to said application in dependence on the outcome of said verifying.

10 more elements

Facts

Application

13/086,182Filed 13 Apr 2011

Priority

31 May 2007

Published

20 Oct 2011

Term ends

Not estimatedThe source records don’t support an estimate.

Classification13 codes

H04L 9/3228
Using a predetermined code, e.g. password, passphrase or PIN: one-time or temporary data, i.e. information which is sent for every authentication…
G06F 21/31
Authentication, i.e. establishing the identity or authorisation of security principals: user authentication
G06F 21/34
User authentication: involving the use of external additional devices, e.g. dongles or smart cards
G06Q 20/3823
Insuring higher security of transaction: combining multiple encryption tools for a transaction

Abstract

Claims30