Method and apparatus for a token

• US 20070198848A1
• Filed: 02/22/2006
• Published: 08/23/2007
• Est. Priority Date: 02/22/2006
• Status: Active Grant

• Current Assignee: HID Global Corporation (Assa Abloy AB)
• Original Assignee: Digital Persona Inc (Assa Abloy AB)
• Inventors: Bjorn, Vance
• Granted Patent: US 8,245,052 B2
• Time in Patent Office: Days
• US Class Current: 713/186
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G07C 2009/00365 in combination with a wake-up circuit
• CPC Class Codes: G07C 2009/00388 code verification carried out according to the challenge/response method
• CPC Class Codes: G07C 2009/00412 the transmitted data signal being encrypted
• CPC Class Codes: G07C 9/00309 operated with bidirectional data transmission between data carrier and locks
• CPC Class Codes: G07C 9/00563 using personal physical data of the operator, e.g. finger prints, retinal images, voicepatterns
• CPC Class Codes: G07C 9/28 the pass enabling tracking or indicating presence

Abstract

A method and apparatus of using a token comprises receiving an indication of a presence of a nearby short-range terminal and waking up the token in response to receiving the indication. The method further comprises performing authentication between the token and the terminal, without requiring a user to directly interact with the token.

Claims

1. A token comprising:

a low power receiver to receive an indication indicating a presence of a nearby short-range terminal;

a wake-up logic to wake up the token in response to receiving the ping;

an identity verifier to perform authentication between the token and the terminal, without requiring a user to physically touch the token.

2. The token of claim 1 implemented as a key fob.

3. The token of claim 1, further comprising:

a secure session creator to set up a secure communications channel between the wireless token and the short-range terminal.

4. The token of claim 1, further comprising:

a transceiver to send a pseudonym and a certified public key to the terminal; and

a secure session creator to establish a secure communications channel between the wireless token and the terminal using the certified public key.

5. The token of claim 1, further comprising:

a transceiver to receive a biometric template from the terminal, through a secure communications channel; and

the identity verifier to determine if the biometric template matches a biometric template of the owner of the wireless token.

6. The token of claim 5, wherein the biometric template of the owner of the wireless token is stored in secure memory on the wireless token.

7. The token of claim 5, further comprising:

the transceiver further to send authentication results to the terminal, to permit the user access, as provided by the terminal.

8. The token of claim 1, further comprising:

the transceiver to receive periodic maintenance pings after authentication; and

the transceiver further to respond to the periodic pings verifying the continued proximity of the wireless token to the terminal.

9. The token of claim 1, further comprising:

insecure pseudonyms released to a terminal in response to a request, when a secure session has been established; and

secure pseudonyms released to the terminal in response to a request only after biometric authentication of the user.

10. The token of claim 1, further comprising:

public pseudonyms released to any terminal in response to a request, when a secure session has been established; and

private pseudonyms released only to the terminal that initially established the private pseudonyms.

11. The token of claim 1, further comprising a timer to put the wireless token back to sleep after an authentication process has been completed.

12. The token of claim 11, further comprising:

an always-on portion of the wireless token, which remains awake after the wireless token has been put to sleep, to continue monitoring for pings, the always-on portion of the wireless token including the low power receiver.

13. The token of claim 1, wherein the token communicates with the terminal using wireless frequencies.

14. The token of claim 1, wherein the token communicates with the terminal using human skin conductance.

15. A terminal to permit use of a wireless token for authentication, the terminal comprising:

a ping generator to generate periodic pings;

a transceiver to receive a connection request from a wireless token, which received the ping;

a secure session logic to establish a secure session with the wireless token; and

access control logic to provide access to a limited access system, in response to receiving authentication information from the wireless token.

16. The terminal of claim 15, further comprising:

a biometric sensor to receive biometric data from a user, for authentication;

a minutia extraction logic to extract a biometric template from the biometric data; and

the transceiver to send the biometric template via the secure session to the wireless token for authentication of the user by the wireless token.

17. The terminal of claim 15, further comprising:

a pseudonym verifier to verify that a pseudonym received from the user is in an access database.

18. The terminal of claim 17, further comprising:

additional data requested by the access control logic, if additional data is needed to provide access.

19. The terminal of claim 15, further comprising:

a continued access verifier to periodically send out a maintenance ping after a user has been provided access to a limited access system, to verify that the user remains in proximity to the limited access system.

20. The terminal of claim 15, further comprising:

a random number generator used to generate random numbers for an initial connection between the terminal and the wireless token, such that only a current ping is available for response.

21. The terminal of claim 15, wherein the limited access system may include one or more of the following:

a building, a room, a computer system, an airport security terminal, a vehicle, or an automated teller or similar financial transaction system.

22. A method of using a wireless token comprising:

receiving a ping indicating a presence of a nearby short-range terminal;

waking up the wireless token in response to receiving the ping; and

performing authentication between the wireless token and the terminal, without requiring a user to interact with the wireless token.

23. The method of claim 22, wherein the wireless token is implemented on a key fob.

24. The method of claim 22, further comprising:

setting up a secure communications channel between the wireless token and the short-range terminal.

25. The method of claim 22, wherein performing authentication comprises:

sending a pseudonym and a certified public key to the terminal; and

establishing a secure communications channel between the wireless token and the terminal using the certified public key.

26. The method of claim 25, further comprising:

receiving a biometric template from the terminal, through the secure communications channel; and

determining if the biometric template is the biometric template of the owner of the wireless token.

27. The method of claim 26, further comprising:

sending the authentication results to the terminal, to permit the user access, as provided by the terminal.

28. The method of claim 27, further comprising:

continuing to receive periodic pings to verify continued proximity of the wireless token to the terminal; and

responding to the periodic pings verifying the continued proximity of the wireless token.