Method and apparatus for information carrier authentication

A method of authenticating an information carrier by a particular device, the information carrier being electronic equipment having a non-volatile memory for storing signed authentication data, the information carrier comprising an at least formerly writeable part comprising stored information and a physical token, the physical token being arranged to supply a response upon receiving a challenge through interaction between the physical token and the challenge, the at least formerly writeable part comprising signed authentication data that was previously obtained by signing second authentication data with a secret device key of the particular device such that the information carrier is exclusively useable by the particular device, the second authentication data comprising information derived from a detected response of the physical token, the method comprising acts of:

• applying a first challenge represented by challenge data to the physical token resulting in a first response, the physical token supplying the first response upon receiving the first challenge, and
• detecting the first response of the physical token resulting in a detected first response data,
• forming a first authentication data based on information derived from the detected first response data, by reading a first helper data from the writeable part of the information carrier, and applying a delta contracting function on the detected first response data using the first helper data,
• reading the signed authentication data from the at least formerly writeable part of the information carrier,
• deriving the second authentication data from the signed authentication data with the deriving depending on the signing used to enable the information carrier for authentication by the particular device, and
• authenticating the information carrier by verifying that the first authentication data matches the second authentication data,
• wherein the information used in forming the first authentication data comprises both the challenge data as well as the information derived from the detected first response data.

An apparatus for enabling an information carrier for authentication by a particular device, the information carrier being electronic equipment having a non-volatile memory for storing signed authentication data, the information carrier comprising a writeable part and a physical token, the physical token being arranged to supply a response upon receiving a challenge through interaction between the physical token and the challenge, the apparatus comprising:

• a challenge means arranged to apply a first challenge represented by challenge data to the physical token resulting in a first response, the physical token supplying the first response upon receiving the first challenge, and
• a detection means arranged to detect the first response of the physical token resulting in a detected first response data,
• an authentication data generation means arranged to form a first authentication data based on information derived from the detected first response data, forming the first authentication data further comprising generating a first helper data for use in a delta contracting function during authentication of the information carrier,
• a signing means arranged to sign the first authentication data using a secret device key of the particular device to configure the information carrier for exclusive use by the particular device, and
• a writing means arranged to write the signed authentication data and the first helper data in the writeable part of the information carrier, wherein the information used in forming the first authentication data comprises both the challenge data as well as the information derived from the detected first response data.

An apparatus for authenticating an information carrier, the information carrier being electronic equipment having a non-volatile memory for storing signed authentication data, the information carrier comprising an at least formerly writeable part comprising stored information, and a physical token, the physical token being arranged to supply a response upon receiving a challenge through interaction between the physical token and the challenge, the at least formerly writeable part comprising signed authentication data that was previously obtained by signing second authentication data with a secret device key of the particular device such that the information carrier is exclusively useable by the particular device, the second authentication data comprising information derived from a detected response of the physical token, the apparatus comprising:

• a challenge means arranged to apply a first challenge represented by challenge data to the physical token resulting in a first response, the physical token supplying the first response upon receiving the first challenge, and
• a detection means arranged to detect the first response of the physical token resulting in a detected first response data,
• an authentication data generation means arranged to form a first authentication data based on information derived from the detected first response data, by reading a first helper data from the writeable part of the information carrier, and applying a delta contracting function on the detected first response data using the first helper data,
• a reading means arranged to read the signed authentication data from the at least formerly writeable part of the information carrier,
• a derivation means arranged to derive the second authentication data from the signed authentication data, the deriving depending on the signing used to enable the information carrier for authentication by the particular device, and
• an authentication means arranged to verify that the first authentication data matches the second authentication data, wherein the information used in forming the first authentication data comprises both the challenge data as well as the information derived from the detected first response data.

A non-transitory information carrier, the information carrier being electronic equipment having a non-volatile memory for storing signed authentication data, the information carrier comprising:

• an at least formerly writeable part comprising stored information and
• a physical token arranged to supply a response upon receiving a challenge through interaction between the physical token and the challenge, the information carrier being characterized in that it comprises in the writeable part a signed authentication data and first helper data generated according to a method of enabling an information carrier for authentication by a particular device, the method comprising acts of:
• applying a first challenge represented by challenge data to the physical token resulting in a first response, the physical token supplying the first response upon receiving the first challenge, and
• detecting the first response of the physical token resulting in a detected first response data,
• forming a first authentication data based on information derived from the detected first response data, forming the first authentication data further comprising generating a first helper data for use in a delta contracting function during authentication of the information carrier,
• signing the first authentication data using a secret device key of the particular device to configure the information carrier for exclusive use by the particular device, and
• writing the signed authentication data and the first helper data in the writeable part of the information carrier,
• wherein the information used in forming the first authentication data comprises both the challenge data as well as the information derived from the detected first response data.

A computer program product comprising a non-transitory computer readable medium for performing a method of enabling an information carrier for authentication by a particular device when said program product is executed on a computer, the information carrier being electronic equipment having a non-volatile memory for storing signed authentication data, the information carrier comprising a writeable part and a physical token, the physical token being arranged to supply a response upon receiving a challenge through interaction between the physical token and the challenge, the method comprising acts of:

• applying a first challenge represented by challenge data to the physical token resulting in a first response, the physical token supplying the first response upon receiving the first challenge, and
• detecting the first response of the physical token resulting in a detected first response data,
• forming a first authentication data based on information derived from the detected first response data, forming the first authentication data further comprising generating a first helper data for use in a delta contracting function during authentication of the information carrier,
• signing the first authentication data using a secret device key of the particular device to configure the information carrier for exclusive use by the particular device, and
• writing the signed authentication data and the first helper data in the writeable part of the information carrier,
• wherein the information used in forming the first authentication data comprises both the challenge data as well as the information derived from the detected first response data.

A method of enabling authentication of an information carrier by a particular device, the information carrier being electronic equipment having a non-volatile memory for storing signed authentication data, the information carrier comprising a writeable part and a physical token, the physical token being arranged to supply a response upon receiving a challenge through interaction between the physical token and the challenge, the method comprising acts of:

• applying a first challenge represented by challenge data to the physical token resulting in a first response, the physical token supplying the first response upon receiving the first challenge, and
• detecting the first response of the physical token resulting in a detected first response data,
• forming a first authentication data based on information derived from the detected first response data, forming the first authentication data further comprising generating a first helper data for use in a delta contracting function during authentication of the information carrier,
• signing the first authentication data using a secret device key of the particular device to configure the information carrier for exclusive use by the particular device, and
• writing the signed authentication data and the first helper data in the writeable part of the information carrier,
• wherein the information used in forming the first authentication data comprises both the challenge data as well as the information derived from the detected first response data.

A method of authenticating an information carrier by a particular device, the information carrier being electronic equipment having a non-volatile memory for storing signed authentication data, the information carrier comprising an at least formerly writeable part comprising stored information and a physical token, the physical token being arranged to supply a response upon receiving a challenge through interaction between the physical token and the challenge, the method comprising acts of:

• applying a first challenge represented by challenge data to the physical token resulting in a first response, the physical token supplying the first response upon receiving the first challenge, and
• detecting the first response of the physical token resulting in a detected first response data,
• forming a first authentication data based on information derived from the detected first response data, by reading a first helper data from the writeable part of the information carrier, and applying a delta contracting function on the detected first response data using the first helper data,
• reading a signed authentication data from the at least formerly writeable part of the information carrier, the signed authentication data being derived from a secret device key of the particular device such that the information carrier is exclusively useable by the particular device,
• deriving a second authentication data from the signed authentication data with the deriving depending on the signing used to enable the information carrier for authentication by the particular device, and
• authenticating the information carrier by verifying that the first authentication data matches the second authentication data,
• wherein the information used in forming the first authentication data comprises both the challenge data as well as the information derived from the detected first response data.

An apparatus for enabling authentication of an information carrier by a particular device, the information carrier being electronic equipment having a non-volatile memory for storing signed authentication data, the information carrier comprising a writeable part and a physical token, the physical token being arranged to supply a response upon receiving a challenge through interaction between the physical token and the challenge, the apparatus comprising:

• a challenge means arranged to apply a first challenge represented by challenge data to the physical token resulting in a first response, the physical token supplying the first response upon receiving the first challenge, and
• a detection means arranged to detect the first response of the physical token resulting in a detected first response data,
• an authentication data generation means arranged to form a first authentication data based on information derived from the detected first response data, forming the first authentication data further comprising generating a first helper data for use in a delta contracting function during authentication of the information carrier,
• a signing means arranged to sign the first authentication data using a secret device key of the particular device to configure the information carrier for exclusive use by the particular device, and
• a writing means arranged to write the signed authentication data and the first helper data in the writeable part of the information carrier, wherein the information used in forming the first authentication data comprises both the challenge data as well as the information derived from the detected first response data.

An apparatus for authenticating an information carrier, the information carrier being electronic equipment having a non-volatile memory for storing signed authentication data, the information carrier comprising an at least formerly writeable part comprising stored information, and a physical token, the physical token being arranged to supply a response upon receiving a challenge through interaction between the physical token and the challenge, the apparatus comprising:

• a challenge means arranged to apply a first challenge represented by challenge data to the physical token resulting in a first response, the physical token supplying the first response upon receiving the first challenge, and
• a detection means arranged to detect the first response of the physical token resulting in a detected first response data,
• an authentication data generation means arranged to form a first authentication data based on information derived from the detected first response data, by reading a first helper data from the writeable part of the information carrier, and applying a delta contracting function on the detected first response data using the first helper data,
• a reading means arranged to read a signed authentication data from the at least formerly writeable part of the information carrier, the signed authentication data being derived from a secret device key of the particular device such that the information carrier is exclusively useable by the particular device,
• a derivation means arranged to derive a second authentication data from the signed authentication data, the deriving depending on the signing used to enable the information carrier for authentication by the particular device, and
• an authentication means arranged to verify that the first authentication data matches the second authentication data, wherein the information used in forming the first authentication data comprises both the challenge data as well as the information derived from the detected first response data.

A non-transitory information carrier, the information carrier being electronic equipment having a non-volatile memory for storing signed authentication data, the information carrier comprising:

• an at least formerly writeable part comprising stored information and
• a physical token arranged to supply a response upon receiving a challenge through interaction between the physical token and the challenge, the information carrier being characterized in that it comprises in the writeable part a signed authentication data and first helper data generated according to a method of enabling an information carrier for authentication by a particular device, the method comprising acts of:
• applying a first challenge represented by challenge data to the physical token resulting in a first response, the physical token supplying the first response upon receiving the first challenge, and
• detecting the first response of the physical token resulting in a detected first response data,
• forming a first authentication data based on information derived from the detected first response data, forming the first authentication data further comprising generating a first helper data for use in a delta contracting function during authentication of the information carrier,
• signing the first authentication data using a secret device key of the particular device to configure the information carrier for exclusive use by the particular device, and
• writing the signed authentication data and the first helper data in the writeable part of the information carrier,
• wherein the information used in forming the first authentication data comprises both the challenge data as well as the information derived from the detected first response data.

A computer program product comprising a non-transitory computer readable medium for performing a method of enabling an information carrier for authentication by a particular device when said program product is executed on a computer, the information carrier being electronic equipment having a non-volatile memory for storing signed authentication data, the information carrier comprising a writeable part and a physical token, the physical token being arranged to supply a response upon receiving a challenge through interaction between the physical token and the challenge, the method comprising acts of:

• applying a first challenge represented by challenge data to the physical token resulting in a first response, the physical token supplying the first response upon receiving the first challenge, and
• detecting the first response of the physical token resulting in a detected first response data,
• forming a first authentication data based on information derived from the detected first response data, forming the first authentication data further comprising generating a first helper data for use in a delta contracting function during authentication of the information carrier,
• signing the first authentication data using a secret device key of the particular device to configure the information carrier for exclusive use by the particular device, and
• writing the signed authentication data and the first helper data in the writeable part of the information carrier,
• wherein the information used in forming the first authentication data comprises both the challenge data as well as the information derived from the detected first response data.