System, method and apparatus for electronic authentication

• US 20050193198A1
• Filed: 01/27/2005
• Published: 09/01/2005
• Est. Priority Date: 01/27/2004
• Status: Abandoned Application

• Current Assignee: Livo Technologies SA
• Original Assignee: Livo Technologies SA
• Inventors: Livowsky, Jean-Michel
• Application Number:
  US11/050,827
• Publication Number:
  US 20050193198A1
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 2221/2131 Lost password, e.g. recovery of lost or forgotten passwords
• CPC Class Codes: H04L 2209/42 Anonymization, e.g. involving pseudonyms
• CPC Class Codes: H04L 2209/463 Electronic voting
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/3066 involving algebraic varieties, e.g. elliptic or hyper-elliptic curves
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions

Abstract

A system, method and apparatus for on-line authentication of a user. The system may include an authentication device, such as a portable authentication token, in communication with an authentication server or system of a trusted party. In one aspect, authentication is based on an authentication curve or data derived from it, the authentication curve being mapped from points that are based on a combination of unique data stored or obtained by the authentication device and provided to the authentication server, and on information stored or obtained at the authentication server. In one embodiment, authentication is based at least in part on biometric data of a user to be authenticated.

Claims

1. A method for authenticating a user, comprising:

receiving, at an authentication server, identification data from an authentication device;

generating random data at the authentication server;

combining the random data and the identification data to map at least two data points; and

determining a geometric curve that includes the at least two data points;

wherein an authentication decision is based on one or more characteristics of the geometric curve.

2. The method of claim 1, wherein the geometric curve is based on P data points, and wherein the authentication decision is based on the coefficients of a polynomial equation of degree D that describes the geometric curve.

3. The method of claim 1, further comprising:

storing a backup data point;

wherein when at least one item of information on which at least one of the at least two data points are based is lost, the at least one item of information can be recovered using the backup data point and a characteristic of the geometric curve.

4. The method of claim 3, wherein the at least one item of information is a user'"'"'s PIN.

5. A system for user authentication on a computer system, said user operating an authentication device communicating with said computer system via at least one communication link, said authentication device comprising at least a memory means, a main processor means to process information contained in said memory means and a communication interface to send and receive information to and from said computer system through said communication link, said computer system comprising at least a memory means, a processor means to process information contained in said memory means and a communication interface to send and receive information to and from said authentication device through said communication link, characterized in that it uses the method according to any of the preceding claims.

6. A method for reaching a positive or negative determination of authentication in response to a request by an unknown user, comprising:

reaching a positive determination of authentication only when;

data received from the unknown user are combined with data stored to determine a curve, the curve having a unique mathematical property; and

the unique mathematical property matches a stored mathematical property associated with a known user;

wherein the unique mathematical property is permanently associated with the known user; and

wherein the curve having the unique mathematical property cannot be calculated from the data stored alone.

7. The method of claim 6, wherein the data received from the unknown user are combined with data stored to determine coefficients of a polynomial curve.

8. The method of claim 6, wherein the unique mathematical property represents a unique authentication number.

9. The method of claim 6, wherein the known user can retrieve previously-stored secret data only when the positive determination of authentication has been reached.