Method and apparatus for generating one-time password on hand-held mobile device

• US 20060136739A1
• Filed: 12/18/2004
• Published: 06/22/2006
• Est. Priority Date: 12/18/2004
• Status: Abandoned Application

• Current Assignee: Chaing Chen, Christian Brock
• Original Assignee: Chaing Chen, Christian Brock
• Inventors: Chen, Chaing, Brock, Christian
• Application Number:
  US11/015,839
• Publication Number:
  US 20060136739A1
• Time in Patent Office: Days
• US Class Current: 713/184
• CPC Class Codes: G06Q 20/322 Aspects of commerce using mobile devices [M-devices]
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/425 using two different networks, one for transaction and one for security confirmation
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 63/067 using one-time keys cryptographic mechanisms or cryptographic arrangements for generation of one-time passwords H04L9/0863
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 9/0841 involving Diffie-Hellman or related key agreement protocols
• CPC Class Codes: H04L 9/12 Transmitting and receiving encryption devices synchronised or initially set up in a particular manner
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04M 1/66 with means for preventing unauthorised or fraudulent calling verifying user identity or authority in secret or secure digital communications H04L9/32
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/61 Time-dependent

Abstract

According to the invention, a system and an apparatus to use the One-Touch button on a mobile hand-held device to generate one time passwords (OTP) are disclosed. Components of this system comprise: a mobile hand-held device, a built-in One-Touch button on the mobile device, a Global Authentication Server, and an OTP Generation engine installed and ran on the mobile device. The mobile device user only needs to push the One-Touch button and an OTP is generated. The OTP is generated on the mobile device by the OTP generation engine after a secure key exchange process is performed between the remote Global Authentication Server and the mobile device. The mobile device is registered to use online web services that recognize the OTP through the Global Authentication Service. Online web services require that the user enter a combination of the user'"'"'s known password and OTP for identity assurance. As a result of this invention, users will quickly adopt the two-factor authentication method as a central means to identify themselves.

Claims

1. A method and apparatus to generate one time passwords using a One-Touch button approach, comprising:

(a) Mobile hand-held device means to serve as a platform to generate a one-time password (OTP),

(b) Global Authentication Server means to serve as a portal for providing global authentication service,

(c) One-Touch button means on the said mobile hand-held device means to serve as an access point for user to generate OTP,

(d) OTP generation means that runs on the said mobile hand-held device means to serve as the OTP generation engine to generate OTP.

2. The method and apparatus of claim 1 wherein said One-Touch button means contain means to activate and execute the said OTP generation means to produce OTP.

3. The method and apparatus of claim 1 wherein said mobile hand-held device means contain means to be incorporated in a mobile cell phones, PDAs and Smart phones.

4. The method and apparatus of claim 1 wherein said OTP generation means contains means to securely communicate with the said Global Authentication Server means for key exchange and subsequently for the key generation and displaying on the said mobile hand-held device.

5. The method and apparatus of claim 1 wherein said One-Touch button generates OTP after the button is pushed by the user when there is a demand for having a OTP for purposes containing authentication and identity assurance.

6. The method and apparatus of claim 1 wherein said One-Touch OTP generation means together with said Global Authentication Server means comprise an infrastructure to provide a Global Authentication Service for users to authenticate themselves to means contain means of web banking, Automated Teller Machines, financial transactions, or any business activity that requires authentication.

7. The method and apparatus of claim 1 wherein said Global Authentication Server offers Global Authentication Service means over means containing the Internet, Intranet, Wireless Network, phone, and other communication means.

8. The method and apparatus of claim 1 wherein said OTP generation means dynamically and independently computes non-static shared secret information that is the foundation to provide strong authentication.

9. The method and apparatus of claim 1 wherein said OTP generation means comprise means to generate OTP when there is no wireless connection. Under this situation, the OTP is generated by means which is a function of the current time and the non-static shared secret information which is generated and store at the hand-held device when there is a wireless connection.