# US 2019/0173874 A1 · One-time-password generated on reader device using key read from personal security device > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0173874 A1 - Document ID: US20190173874A1 - Status: Published application - Kind: A1 - Application number: 16/188,503 - Filed: 2018-11-13 - Published: 2019-06-06 - Earliest claimed: 2013-07-08 - Assignees: Assa Abloy AB - Applicants: Assa Abloy AB - Inventors: Julian Eric Lovelock; Philip Hoyer - Web page: https://patentgrep.com/patent/US20190173874A1 ## CPC - H04L 63/0838: {using one-time-passwords} - G06F 21/34: involving the use of external additional devices, e.g. dongles or smart cards - G06F 21/35: communicating wirelessly - H04L 9/0863: {involving passwords or one-time passwords (network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067)} - H04L 9/3234: {involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853)} - H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)} - H04L 63/10: {for controlling access to devices or network resources} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract An authentication system is provided using one-time passwords (OTPs) for user authentication. An OTP key may be stored on a different device than the device on which the OTP is generated. In an embodiment, the system described herein enables a combined authentication system, including the two separate devices communicating over a non-contact interface, to provide advantageous security features compared to the use of a single device, such as a hardware OTP token. One device may be a personal security device and the other device may be a reader device coupled to a host device via which access is being controlled. ## Claims ### Claim 1 A method for access control using a personal security device (PSD) of a user, comprising: providing the PSD with a one-time-password (OTP) key; interfacing a reader device, coupled to a host device, with the PSD; authenticating the reader device to the PSD, wherein the OTP key is only readable from the PSD by the reader device when the reader device is authenticated and a secure channel is established between the PSD and a reader device; transferring the OTP key from the PSD to the reader device over the secure channel; generating an OTP at the reader device using the OTP key transferred to the reader device from the PSD; and passing the OTP from the reader device to the host device or a validation system connected to the host device for validation. ### Claim 2 (depends on 1) The method according to claim 1, further comprising: validating the OTP and granting access to the user. ### Claim 3 (depends on 1) The method according to claim 1, further comprising: clearing the OTP key from the reader device. ### Claim 4 (depends on 1) The method according to claim 1, further comprising at least one of: (i) sending counter data from the PSD to the reader device; (ii) sending counter data or incremented counter data from the reader device to the PSD after an access decision; or (iii) storing counter data on the reader device before or after an access decision. ### Claim 5 (depends on 1) The method according to claim 1, wherein the PSD is at least one of: a smart card, a token or a mobile phone. ### Claim 6 (depends on 1) The method according to claim 1, wherein the PSD is a secure memory storage card that has authentication capabilities and no exposed crypto functions beyond memory access authentication. ### Claim 7 (depends on 1) The method according to claim 1, wherein the OTP is generated at the reader device in a secure environment of the reader device. ### Claim 8 (depends on 1) The method according to claim 1, wherein the PSD is provided with the OTP key at at least one of: at a time of manufacture of the PSD or during a field revision of the PSD. ### Claim 9 (depends on 1) The method according to claim 1, wherein the interfacing of the reader device and the PSD is via a non-contact interface. ### Claim 10 A non-transitory computer readable medium storing software for access control using a personal security device (PSD) of a user, the software comprising: executable code that stores a one-time-password (OTP) key on the PSD; executable code that controls interfacing of a reader device, coupled to a host device, with the PSD; executable code that authenticates the reader device to the PSD, wherein the OTP key is only readable from the PSD by the reader device when the reader device is authenticated and a secure channel is established between the PSD and a reader device; executable code that transfers the OTP key from the PSD to the reader device over the secure channel; executable code that generates an OTP at the reader device using the OTP key transferred to the reader device from the PSD; and executable code that passes the OTP from the reader device to the host device or a validation system connected to the host device for validation. ### Claim 11 (depends on 10) The non-transitory computer readable medium according to claim 10, wherein the software further comprises: executable code that validates the OTP and grants access to the user. ### Claim 12 (depends on 10) The non-transitory computer readable medium according to claim 10, further comprising: executable code that clears the OTP key from the reader device. ### Claim 13 (depends on 10) The non-transitory computer readable medium according to claim 10, further comprising at least one of: (i) executable code that sends counter data from the PSD to the reader device; (ii) executable code that sends counter data or incremented counter data from the reader device to the PSD after an access decision; or (iii) executable code that stores counter data on the reader device before or after an access decision. ### Claim 14 (depends on 10) The non-transitory computer readable medium according to claim 10, wherein the PSD is at least one of: a smart card, a token or a mobile phone. ### Claim 15 (depends on 10) The non-transitory computer readable medium according to claim 10, wherein the PSD is a secure memory storage card that has authentication capabilities and no exposed crypto functions beyond memory access authentication. ### Claim 16 (depends on 10) The non-transitory computer readable medium according to claim 10, wherein the OTP is generated at the reader device in a secure environment of the reader device. ### Claim 17 (depends on 10) The non-transitory computer readable medium according to claim 10, wherein the PSD is provided with the OTP key at at least one of: a time of manufacture of the PSD or during a field revision of the PSD. ### Claim 18 (depends on 10) The non-transitory computer readable medium according to claim 10, wherein the interfacing of the reader device and the PSD is via a non-contact interface. ### Claim 19 A system for access control using a personal security device (PSD) of a user, comprising: the PSD; a non-contact field reader device coupled to a host device; and at least one processor that reads software stored on at least one computer readable medium, the software comprising: executable code that stores a one-time-password (OTP) key on the PSD; executable code that controls interfacing of a reader device, coupled to the host device, with the PSD; executable code that authenticates the reader device to the PSD, wherein the OTP key is only readable from the PSD by the reader device when the reader device is authenticated and a secure channel is established between the PSD and a reader device; executable code that transfers the OTP key from the PSD to the reader device over the secure channel; executable code that generates an OTP at the reader device using the OTP key transferred to the reader device from the PSD; and executable code that passes the OTP from the reader device to the host device or a validation system connected to the host device for validation. ### Claim 20 (depends on 19) The system according to claim 19, wherein the software further comprises at least one of: (i) executable code that validates the OTP and grants access to the user; (ii) executable code that clears the OTP key from the reader device; (iii) executable code that sends counter data from the PSD to the reader device; (iv) executable code that sends counter data or incremented counter data from the reader device to the PSD after an access decision; or (v) executable code that stores counter data on the reader device before or after an access decision.