Patent Application
20080137861
This invention relates to a method of producing a reproducable security code for user authentication, and for storing, signing and encryption/decryption of information by means of a programmable user device. The invention also relates to methods whereby the reproducable security code is utilized for various security purposes, and a corresponding programmable user device.
In many situations where service providers offer services and transfer of information to the general public through electronic media, there is a need for a mechanism that provides for verified identification of the individual receiving the service or exchanging information with the service provider. Traditional authentication schemes employ user name and password pairs to authenticate users. This simple method provides, however, minimal security. To achieve a higher degree of security it is increasingly common to use so-called two-factor authentication. Such two-factor authentication is based on a “something you know” component (such as a password) and a “something you have” component; one example being a bank payment card (that you have) and the corresponding PIN (Personal Identification Number) code (that you know).
If a password is to be sent across an open telecommunications or computer network it may easily be captured by others. Therefore, it is desirable to permit the use of so-called one-time passwords (dynamic passwords) in stead of fixed (static) passwords (such as PIN codes). For this purpose, many banks, for example, are using card-like semiconductor devices (also called security tokens), which compute and display a one-time passcode (i.e. a time-varying number) on a small screen. By entering this number into a system when attempting to authenticate (login), the person doing so proves that he is in possession of the device. One example of such a semiconductor device is disclosed in U.S. Pat. No. 4,599,489. To increase the security, the semiconductor device itself sometimes is protected by a PIN code which is required to “open” the device. If so, first the correct PIN must be entered before the correct passcode numbers are displayed.
One problem with semiconductor devices of this kind is the substantial costs of their acquisition and distribution. Another problem is that a person who is a registered user of several services, such as banking services from various institutions via Internet, for example, the use of each requiring a separate semiconductor device, will have to keep and handle a plurality of different devices. It would, in deed, be beneficial to the public if a plurality of service providers could make use of one and the same semiconductor device as a common or generic “multi-code calculator” for a plurality of services.
On the other hand, arrangements are known that permit the implementation of security measures in electronic equipment of various kinds. For example, software may be stored in a communication terminal to be used for a secure communications service between a user and a service provider. The software needed may be stored as independent computer programs in the terminal memory. In one and the same terminal, applications may be stored that originate from different service providers for a variety of purposes.
A person who wishes to make use of a computer program for a service, such as a secure communications service, normally must register the program with the service provider before he is allowed to run that program on a computer for secure communication with that service provider. Once a registered user, he may run that program on any computer, usually by entering his user name and password, possibly a one-time passcode provided by the card-like semiconductor device, for example, mentioned above. This procedure makes sure that the user is in possession of the correct user name and password, or in the latter case, the correct card-like semiconductor device and corresponding PIN (if required).
To avoid the problems arising from having a plurality of card-like devices dedicated to respective ones of a plurality of service providers, the present invention seeks to make use of existing and future electronic information technology devices, typically those having a communication capacity, for the purpose of secure identity verification.
To achieve this, the inventors think that in stead of tying the identity of a user to a card-like semiconductor device especially designed and dedicated for one single purpose, it would be less costly and much more flexible to tie the identity of the user to a piece of equipment already in his possession or being acquired primarily for another, more general purpose than that of identification verification.
One intention of the invention is to avoid the need for any modification or supplementation of the hardware configuration of existing user devices to be used in the system according to the invention. Hence, electronic user devices apt for the prescribed use should as a minimum be programmable and comprise at least one data input interface, data processing means, data storage means, and data output capacities. In addition, for the device to operate according to the invention, the data storage means must include a readable tamper-proof storage in which an equipment identifier uniquely identifying the individual device is stored.
To ease the information exchange with selected service providers the equipment should preferably offer the user a suitable communications functionality. Such a communication capacity may be inherent to the device or be added as a functional extension.
Hence, in principle, a variety of electronic user devices may be used for the implementation of the invention. Mobile telephones (cell phones) compliant with the GSM (Global System for Mobile Communications) technology are, however, considered to be particularly well suited for the purpose of the invention, since every GSM mobile telephone already bears a unique equipment identifier stored in tamper resistant memory, viz. an International Mobile Equipment Identity (IMEI), which is a 15-digit code primarily being used to identify an individual GSM mobile telephone to a GSM network or operator. The presence of the IMEI code in a GSM mobile telephone usually is mandatory for the telephone to be operable in the GSM network. Hence, removing or altering the IMEI code would render the mobile telephone inoperable for its main purpose, namely telecommunication.
In this connection, examples of using IMEI codes for checking the compatibility of, and for controlling the right of use/activation of a mobile station, respectively, are known from U.S. Pat. Nos. 6,164,547 and 5,956,633. In addition, from US Patent Application Publ. No.s 2003/0236981 and 2004/0030906, respectively, it is known to use the IMEI code as a key for encryption of individual SMS (Short Message Service) messages, and for authentication of such messages through a digital signature computed with the IMEI code as a key.
WO 01/31840 A1 is a further example of prior art, describing how a first one-time password can be generated in a mobile station on the basis of a personal identification number (PIN), a subscriber identifier (typically IMSI in a GSM network), a device identifier (typically IMEI in a GSM network) and time (hence, a time-varying passcode), and then be used at an authentication server to enable a telecommunication connection between the mobile station and a computer system. To carry out the identification procedure the authentication server uses the subscriber identifier (IMSI) received from the mobile station for searching a database for the PIN code and device identifier (IMEI) associated with that subscriber, and when retrieved, all three entities are combined with time to produce a second one-time password for comparison with the first one.
This approach enables authentication to one computer system or service provider, but can not be used by more than one service provider without compromising security. If used by more than one service provider, the approach requires that the same identifiers (PIN, IMEI and IMSI) are distributed to each computer system, thereby compromising the security for all involved parties. Further, this approach can only be used for authentication, but not for other security functions like signing, encryption and secure distribution, nor can it be used for local encryption and access control of sensitive information, such as private PKI (Public Key Infrastructure) keys, for example, stored in a mobile telephone.
The prior art identifying process described in WO 01/31840 A1 is a process hidden to the user requiring no user interaction and it only represents a weak authentication of the user at the authentication instant. In addition, all the identifiers needed in the process, including the user PIN, are stored in the mobile station as well as in the computer system at the respective service providers. The approach is also limited to use of time as the only source of variable input to the one-time password calculation, which further limits the flexibility of the method.
In JP Patent Publication No. 2003 410949 a system and method are disclosed that generate unique codes and display the codes on the mobile terminal of a user, e.g. in the form of a picture. The user uses the picture and a “user secret” to authenticate itself to a service provider or computer system for accessing a service, like a cash withdrawal or a payment service. Aside from requiring additional user interaction, the method has a weakness in that the code can unintentionally be disclosed from the display. This method does not make use of mobile terminal identifiers for generating the user authentication data. The mobile terminal is used only as a communications terminal and not as a robust possession factor (something you have) in a two-factor authentication.
In the context of the present invention, the IMEI code of a mobile telephone would be utilized as the unique equipment identifier required for the mobile telephone to operate according to the invention.
Security mechanisms that can be used to access several different service providers are often based on so called public key algorithms. In a PKI system, the private keys need to be securely stored, whereas the public keys may be published in directories or certificates signed by a Trusted Third Party. To make sure that the private keys can be used only under the user's sole control, it is common to have the keys stored in a hardware key container, such as a smart-card or SIM (Subscriber Identity Module) Card. The main problem with such systems is the cost of the manufacture and distribution of the hardware. The present invention is offering a much cheaper solution to this need for a tamper-resistant, user controlled key container.
One aspect of the present invention relates to a method of producing a reproducable security code for user authentication, and for storing, signing and encryption/decryption of information by means of a programmable user device comprising at least one data input interface, data processing means and data storage means including a readable tamper-proof storage in which an equipment identifier uniquely identifying the user device is prestored,
the method comprising the steps of:
The method of the invention generates data for two-factor user identification without the need to register, or store, the user personal code in any way.
In a preferred embodiment the method according to the invention further comprises the steps of, prior to the calculation internal to the user device of a security code:
By inputting a service provider code to the calculation of the security code, different security codes can be produced for each service provider, without the need of changing any of the other identifiers (user personal code and equipment identifier). The method of the invention enables a user to use the same device for two-factor user identification to more than one service provider without sharing sensitive data between service providers.
A special aspect of the invention relates to a method of authenticating the user of a user device, the user being registered in a customer file at a service provider with his/her user name and an associated security code obtained by a method according to the invention, the method comprising the steps of:
Another aspect of the invention relates to a method of securely storing information on a programmable user device comprising at least one data input interface, data processing means and data storage means including a readable tamper-proof storage in which an equipment identifier uniquely identifying the user device is prestored, the method comprising the steps of encrypting the information prior to storage and decrypting the information upon retrieval of the stored, encrypted information, whereby:
Still another aspect of the invention relates to a method of signing an information element to be exchanged between the user of a user device and a service provider, the user being registered in a customer file at the service provider with his/her user name and an associated security code obtained by a method according to the invention,
the method comprising the steps of:
In a special embodiment the “signature” may comprise a digital or electronic signature, or a message authentication code (MAC).
Yet another aspect of the invention relates to a method of securing an information element to be transferred from the user of a user device to a service provider, the user being registered in a customer file at a service provider with his/her user name and an associated security code obtained by a method according to the invention,
the method comprising the steps of:
A further aspect of the invention relates to a method of securing an information element to be transferred from a service provider to the user of a user device, the user being registered in a customer file at a service provider with his/her user name and an associated security code obtained by a method according to the invention,
the method comprising the steps of:
This method of securing information elements to be transferred from a service provider may be useful for sending messages, and for keeping information secret to others, as well as for sending digital content not to be copied (such as electronic tickets, or other digital content to be protected from illegal copying, music, video, software, etc.).
The invention also relates to a programmable user device comprising at least one data input interface, data processing means, data storage means including a readable tamper-proof storage in which an equipment identifier uniquely identifying the user device is prestored, the programmable user device being programmed to run a process according to any of the methods of the invention.
Preferably, the equipment identifier of the user device is a product serial number embedded in the device prior to delivery to a user, and in the case of a mobile telephone (cell phone), the equipment identifier may be an international mobile equipment identity (the IMEI code in the case of a GSM phone).
In general, the invention may allow a user device to serve as a common or generic “multi-code calculator” for a plurality of services from a plurality of service providers.
Further features of the user device and the method of producing a security code according to the present invention will appear from the following description of examples of embodiments thereof given by reference to the accompanying drawings, on which:
Referring to
The user device of the invention is programmable, i.e. it is capable of executing computer programs and applications read into its microprocessor's memory. To implement some embodiments of the invention the user device should also be capable of exchanging information with a service provider, by whom the user is registered as a customer or subscriber. Therefore, mobile telephones (cell phones) compliant with the GSM technology are considered to be particularly suitable for the purpose of the invention. It is, however, envisaged that other personal pieces of electronic equipment, such as portable computers (Laptops) and handheld information devices (PDA—Personal Digital Assistant), or indeed, stationary personal computers (PCs), and future mobile telephones, of course, may also be used when provided with an appropriate Equipment Identity (EI) in a manner similar to the GSM mobile telephones. Future pocket calculators or special purpose generic password generators may also be envisioned.
The software needed for the calculation of the security code may be permanently stored in the user device of the invention. It may, for example, be implemented in the device at the time of manufacture. To permit the use of an already existing device of the appropriate kind as indicated above, a special application may be supplied to the device at any instant in time via any type of data supply media, such as a floppy disk, optical compact disk (CD-ROM) and plug-in data storage means (memory stick or card). In cases where the device is furnished with a communications capacity, the application may be downloaded from a software vendor via a communications network of the device, to the device for direct execution and/or storage for later utilization.
According to the invention the security code calculation software is a general computer program containing no secrets at all. The program or application may be open to the public for utilization on any suitable user device. In principle, the application may be identical from one user device to the next, except for computer related differences due to the use of different operating systems, programming languages, compilators, and the like.
This feature of, in principle, free distribution of the security code calculation software, and the possibility of copying the software from one device to another without compromising security, is a major advantage of the present invention, especially compared to security arrangements requiring the presence of secrets in the user software itself.
The calculation carried out by the security code software is typically based on the use of one-way encryption algorithms (e.g. a hashing algorithm) to produce the security code and two-way encryption algorithms to encrypt/decrypt information elements, but encryption algorithms of various other kinds may be used. The encryption method used is not decisive to the implementation of the invention. The security code should, however, be sufficiently unique and it should not be possible to derive its input data elements from the code itself (i.e. one-way encryption). Another important feature of the security code calculation software is that it is designed to read the equipment identifier uniquely identifying the device in question each and every time a security code is to be used and that the calculated security code never is stored in the device.
Referring to
The security code thus obtained is based on two factors. Hence, regarded as a two-factor authentication scheme, the user personal code would constitute the “something you know” component while the equipment identifier is the “something you have” component. The security code represents a unique identification of the user and the user's device, but the original input identifiers (the user personal code and the equipment identifier) can not be re-calculated from the security code. The method according to the invention prevents the input identifiers from being exposed to any other party, and is also a method where there is no need for storing the user personal code in any way.
In principle, the user may freely select any suitable personal code to be entered for the production of a security code. The personal code may, of course, be a different one for different purposes. In the present case the security code is representative of both the user and the user device. The code may now be output via the data output capacities of the device, such as being displayed in the display window 5, or through the communications module 6 for sending to some external local or remote equipment, such as to communication equipment located at the site of a service provider.
Although not shown in
As an alternative to introducing the service provider code as a separate third code, some kind of indication of a specific service provider may be incorporated into the user personal code such that it becomes a two-part code, and there will be one different security code for each service provider.
The capability of the method of the invention of producing specific, or different, security codes for each service provider enables the user to use the same device for security services at more than one service provider without compromising security. No service providers need to share the same security code, and no service provider is able to recalculate the input identifiers.
With the development of biometric coding techniques the possibility is also envisaged that biometric data may be part of the security code according to the invention. Hence, biometric data representative of a user may constitute the user personal code alone or as an integral part thereof, thus moving from a “something you have” to a “something you are” situation. In such a case the user device needs to be furnished with or be connected to, appropriate input means to permit biometric particulars to be scanned from the user's attributes and supplied to the user device.
Typically each of the user personal code and the service provider code may comprise a sequence of alphabetic and/or numeric characters which is easy to remember and which, in the process, is converted into a sequence of binary coded data. The user and service provider codes may also, alone or in combination with other pieces of information, comprise a piece of information that is already converted into a sequence of binary coded data. Biometric data representative of a user is an example of such precoded binary data.
In any case the calculation of the security code may comprise a simple arithmetic operation, or a complex cryographic operation, or use of other kinds of enciphering techniques. The operation should, however, be such that none of the input data elements to the calculation are derivable from the code and/or from the knowledge of some of the input elements.
Referring now to
If the user chooses to use different personal codes for different purposes, he/she may choose one specific code, for example, for the purpose of secure storage locally of information elements.
In the example shown a “two-factor” security code is produced but a “three-factor” security code may equally well be used, particularly when the information element to be securely stored relates to a service provider.
Later, within the user device, information elements thus being encrypted prior to storage on the device, may be retrieved and decrypted prior to use by using the security code as decryption key. Such a process may, as illustrated in
In a preferred implementation, for security reasons the decrypted information element is always deleted after being used, leaving only encrypted information in the data storage means 3 of the device.
In a preferred embodiment the user device is furnished with a communications functionality permitting unilateral and/or bilateral data communication with a service provider through a wired or wireless communications network.
In such a case, if the service provider wishes to use an asymmetric, dual key crypto scheme, whereby information to be distributed to users is to be encrypted prior to transmission to a user, the information may, as illustrated in
In this case, the security code need not be stored at the site of the service provider. The public key may be specified by the user or be stored in advance at the site of the service provider, or be publicly available through a notice/bulletin board service.
Alternatively, in stead of using a dual key crypto scheme, the service provider may use the security code of the invention in connection with the distribution of secret information, provided arrangements are made for storage at the site of the service provider, of the security codes of the users of the provider's services. Such a process, whereby the information is encrypted prior to transmittal by using the security code as encryption key (step S1 in
In both cases, after being used, the decrypted information is preferably deleted for security reasons, leaving no trace thereof on the device (unless it is stored locally by using the security code as local encryption key, as illustrated in
In addition the security code may, in deed, be used as a basis for the verification of the identity of the user and the user device belonging to him/her.
In one embodiment of the invention the user device comprises a communications module 6 (see
If the one-time passwords are identical, the authentication result is positive, confirming that the user identified by user name is in possession of the electronic device and of a corresponding user personal code, otherwise, the authentication result is negative.
When the user device is equipped with a communications module, the present invention may also be used for message authentication by calculating a digital signature or MAC (Message Authentication Code) from a message, or from a digest thereof, to be communicated between the user device and a service provider, or other third party, the security code according to the invention being one of the components taking part in that calculation.
In another embodiment of the invention, where the user device does not include a communications module and, hence, no direct exchange of information with service providers via the user device itself is possible, or if it is not convenient to exchange all information through the device, the user may act as an “intermediary” between the user device and service provider. To communicate with the service provider the user may then use any communications means available, such as a personal computer connectable to the Internet, for example, the main issue being that the exchange of the user's indications to the service provider and the responses returned by the service provider to the user is accomplished in an acceptable manner, preferably in real time. The communication link or channel itself may, if required for security reasons, of course be scrambled or encrypted in any conventional way.
In principle, whether there is a technical arrangement for equipment-to-equipment communications present, or not, the authentication method of the invention may be similar to that illustrated in
The possibility is also envisaged, in stead of having a variable received from the service provider as part of a challenge therefrom (step S7 in
For many services offered to the public, generally the customer or user of such a service must register with the respective service provider to get access to the service(s) concerned (e.g. subscribe to the service). In the context of utilizing embodiments of the present invention for such services, this is also the case. Hence, as illustrated by step S1 in
One way for the user to obtain his/her security code is to carry out the steps of the method explained above in the section “Security Code Calculation” and illustrated in
In either case the exchange of information between user and service provider may be accomplished by any communications means available, such as by means of letters through the postal service, facsimile, or even through voice communication.
Although the present description of preferred embodiments is made on the basis of the invention being implemented in software, the invention may be realised by means of hardware components performing similar tasks as the software of the embodiments described.
| Number | Date | Country | Kind |
|---|---|---|---|
| 20050152 | Jan 2005 | NO | national |
| Filing Document | Filing Date | Country | Kind | 371c Date |
|---|---|---|---|---|
| PCT/NO06/00012 | 1/11/2006 | WO | 00 | 11/9/2007 |
