# US 2021/0240813 A1 · Mutual Authentication of a User-Controllable Device or System Containing Sensitive or Confidential Data

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2021/0240813 A1
- Document ID: US20210240813A1
- Status: Published application
- Kind: A1
- Application number: 17/051,519
- Filed: 2019-04-30
- Published: 2021-08-05
- Earliest claimed: 2018-04-30
- Assignees: Ledger SAS
- Applicants: Ledger, SAS
- Inventors: Nicolas Bacca; Olivier Tomaz
- Web page: https://patentgrep.com/patent/US20210240813A1

## CPC

- G06F 21/44: Program or device authentication
- G06F 21/31: User authentication
- G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes}
- H04W 12/06: Authentication
- G06F 2221/031: Protect user input by software means
- G06F 2221/2103: Challenge-response
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

Method of mutual authentication of a controllable electronic device (DE) and of its user (USER) able to control it so that it procures him a service (DS), the device (DE) containing sensitive or confidential data (DA) and being arranged so as to—in an operational phase (OP) including a preliminary step of authentication of the user (UAP)—, execute an operation (SO) so as to procure the service (DS), including, furthermore, a prior phase of authentication of the device (SDAP), in which the authenticity of the device (DE) is verified, so that if on completion of the prior phase of authentication of the device (SDAP), the device (DE) is confirmed to be authentic, the user (USER) can execute the operational phase (OP), whilst if the device (DE) is not confirmed to be authentic, the user (USER) can prevent the execution of the operational phase (OP).

## Claims

### Claim 1

A method for the mutual authentication of a controllable functional electronic device (DE) and of its user (USER) comprising a preliminary device (DE) configuration phase (SDCP) defining the modalities for verifying its authenticity, the user (USER) then being able to control the device (DE) such that it provides him with a determined service (DS), the device (DE) containing sensitive or confidential data (DA) and being arranged so as—during an operational phase (OP) initiated by the user (USER) and including a preliminary user authentication step (UAP) by the device (DE)—to perform a specific operation (SO) appropriate to provide the service (DS), the method further comprising, before any operational phase (OP) is performed, a preliminary device authentication phase (SDAP) in which the authenticity of the device (ED) is verified, such that:
if, at the end of the preliminary device authentication phase (SDAP), the device (DE) is proven to be genuine, the user (USER) can perform the operational phase (OP),
if, at the end of the preliminary device authentication phase (SDAP), the device (ED) is not proven to be genuine, the user (USER) can prevent execution of the operational phase (OP), such that first the device (DE) and then the user (USER) are authenticated, and the operation and the service (DS) provided are secure.

### Claim 2 (depends on 1)

The method according to claim 1, wherein the preliminary device authentication phase (SDAP) is performed by the user (USER).

### Claim 3 (depends on 1)

The method according to claim 1, which includes several operational phases (OP) over time, in which a preliminary device authentication phase (SDAP) is performed before each operational phase (OP).

### Claim 4 (depends on 2)

The method according to claim 2, in which the preliminary device authentication phase (SDAP) performed by the user (USER), is based on a question/answer authentication process, by means of a device authentication secret (SDAS) which involves a preliminary question (PQ) from the user (USER) to the device (DE) and a preliminary answer (PA) to the preliminary question (PQ) from the device (DE) to the user (USER), the preliminary question (PQ) and the preliminary answer (PR) being secret so as to be known or accessible only to the sole genuine user (USER), such that the device (DE) is only genuine if, and only if, the user (USER) verifies that there is equivalence between the answer provided (ADS) by the device (DE) to the preliminary question (PQ), and the preliminary answer (PA).

### Claim 5 (depends on 1)

The method according to claim 1, wherein the preliminary configuration phase (SDCP) configures the device (ED) with the device authentication secret (SDAS).

### Claim 6 (depends on 5)

The method according to claim 5, in which the preliminary configuration phase (SDCP) of the device (DE) is performed by the user (USER).

### Claim 7 (depends on 5)

The method according to claim 5, such that the configuration of the device (DE) with the preliminary question (PQ) and the preliminary answer (PA) is done using a question from the (USER), through a question-to-answer generation process.

### Claim 8 (depends on 5)

The method according to claim 5, in which the preliminary device authentication phase (SDAP) is executed after the preliminary configuration phase (SDCP) has been executed, and under the condition that no other preliminary authentication phase (SDAP) or operational phase (OP) of the device has been executed in the meantime.

### Claim 9 (depends on 5)

The method according to claim 5, in which the preliminary device authentication phase (SDAP) is executed after the preliminary configuration phase (SDCP) has been executed, and under the condition that one or more other preliminary authentication phases (SDAP) or operational phases (OP) of the device have been executed in the meantime.

### Claim 10 (depends on 5)

The method according to claim 5, in which a preliminary configuration phase (SDCP) is necessarily and sufficiently combined with either a single preliminary device authentication phase (SDAP) or a pre-set plurality of successive preliminary device authentication phases (SDAP) or an unlimited number of successive preliminary device authentication phases (SDAP).

### Claim 11 (depends on 1)

The method according to claim 1, wherein the preliminary step for the authentication of the user (UAP) by the device (DE) is based on a user authentication secret (UAS) which is an operational answer (OA) from the user to the device (DE), which is secret so as to be known and accessible only to the sole genuine user (USER), such that the authenticity of the user (USER) is proven if, and only if, the device (DE) verifies that there is equivalence between the answer provided by the user (AU) and the operational answer (OA).

### Claim 12 (depends on 4)

The method according to claim 4, in which the preliminary question (PQ) and the operational answer (OA) are different.

### Claim 13 (depends on 1)

The method according to claim 1, which comprises a step in which sensitive or confidential data (DA) are deleted from the device (DE), this being executed automatically at the end of a pre-set number of executions of successive preliminary device authentication phases (SDAP) in which the device (DE) has not been proven to be genuine.

### Claim 14 (depends on 13)

The method according to claim 13, in which the step in which the sensitive or confidential data (DA) are deleted from the device (DE), also involves deletion of the preliminary question (PQ) and the preliminary answer (PA) when, at the end of a pre-set number of successive executions of preliminary device or system authentication phases SDAP, the user USER has failed to provide the preliminary question (PQ) corresponding to the preliminary answer (PA), such that the device ED or system ES will consider that the user is not the genuine user.

### Claim 15

A method of operation by a user (USER) of a functional electronic device (DE) controllable by the user (USER) in order to provide him with a determined service (DS), the device (DE) containing sensitive or confidential data (DA), in which—during an operational phase (OP) initiated by the user (USER) and including a preliminary user authentication step (UAP) by the device (DE)—the device (DE) performs a specific operation (SO) appropriate to provide the service (DS), the operating method further comprising, before any operational phase (OP) is performed, a preliminary device authentication phase (SDAP) in which the authenticity of the device (DE) is verified, such that:
if, at the end of the preliminary device authentication phase (SDAP), the device (DE) is proven to be genuine, the user (USER) can perform the operational phase (OP),
if, at the end of the preliminary device authentication phase (SDAP), the device (DE) is not proven to be genuine, the user (USER) can prevent execution of the operational phase (OP), such that first the device (DE) and then the user (USER) are authenticated, and the operation and the service (DS) provided are secure.

### Claim 16 (depends on 1)

A functional electronic device (DE), controllable by a user (USER) concerning a determined service (DS), containing sensitive or confidential data (DA), specially designed for the implementation of the mutual authentication method according to claim 1.

### Claim 17 (depends on 16)

The device (DE) according to claim 16, configured, after a preliminary configuration phase (SDCP), with the authentication secret of the device (SDAS), which is a preliminary question from the user (PQ) to device (DE), and preliminary answer (PA) to the preliminary question (PQ) from the device to the user (USER).

### Claim 18 (depends on 16)

The device (DE) according to claim 16, comprising the device authentication secret (SDAS) and the user authentication secret (UAS).

### Claim 19 (depends on 1)

A method for the mutual authentication of a functional electronic system (ES), controllable by a user (USER), regarding a determined service (DS), containing sensitive or confidential data (DA), comprising a plurality of electronic devices (DE) which are functionally associated with each other, arranged so as—during an operational phase (OP) initiated by the user (USER) and including a step in which the system (ES) authenticates the user (USER)—to perform a specific operation (SO) or series of operations (SO) appropriate for providing the service (DS), the method comprising, moreover, before any operational phases (OP) are performed, a preliminary system (ES) authentication phase in which the authenticity of all or some of the plurality of devices (DE) that the system (ES) comprises is verified, by implementing, for each verified device (DE), the authentication method according to claim 1.

### Claim 20 (depends on 19)

The method according to claim 19, with a plurality of electronic devices (DE) forming one or more functional chains with one or more upstream devices (DE) and one or more downstream devices (DE), in which:
if, at the end of the prior authentication phase of an upstream device (DE) in a chain of devices (DE), this device (DE) is proven to be genuine, the downstream device(s) (DE) in the same chain of devices (DE) are also authenticated,
if, at the end of the preliminary authentication phase of an upstream device (DE) in a chain of devices (DE), this device (DE) is not proven to be genuine, the downstream device(s) (DE) in the same chain of devices (DE) are not authenticated, the system (ES) being proven not to be genuine.

### Claim 21 (depends on 1)

The method of operation by a user (USER) of a functional electronic system (ES) controllable by the user (USER), such that it provides a determined service (DS), the system (ES) containing sensitive or confidential data (DA), comprising a plurality of electronic devices (DE) functionally associated with each other, in which—during an operational phase (OP) initiated by the user (USER) and including a preliminary user authentication step (UAP) performed by the system (ES)—the system (ES) performs a specific operation (SO) or series of operations (SO) appropriate to provide the service (DS), the operating method further comprising, before any operational phase (OP) is performed, a preliminary system authentication phase (SDAP) in which the authenticity of all or some of the plurality of devices (DE) that the system (ES) includes is verified, by implementing, for each verified device (DE), the authentication method according to claim 1, such that:
if, at the end of the preliminary system (ES) authentication phase the system (ES) is proven to be genuine, the user (USER) can perform the operational phase,
if, at the end of the preliminary system (ES) authentication phase the system (ES) is not proven to be genuine, the user (USER) can prevent execution of the operational phase (OP),
such that, first the system (ES) and then the user (USER) are authenticated, and that the operation (SO) performed and the service (DS) provided are secure.

### Claim 22

(canceled)