Securing Access To An Application Service Based On A Proximity Token

• US 20080046734A1
• Filed: 08/08/2007
• Published: 02/21/2008
• Est. Priority Date: 06/05/2003
• Status: Active Grant

• Current Assignee: SAP SE
• Original Assignee: SAP AG (SAP SE)
• Inventors: Kilian-Kehr, Roger
• Granted Patent: US 7,865,731 B2
• Time in Patent Office: Days
• US Class Current: 713/172
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G07C 9/22 in combination with an identity check of the pass holder
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/30 Security of mobile devices; Security of mobile applications
• CPC Class Codes: H04W 12/64 using geofenced areas
• CPC Class Codes: H04W 88/02 Terminal devices

Abstract

A system for providing secured access to an application service includes a security token that couples to the application service. The security token performs a first element of a cryptographic technique, such as, for example, encryption or decryption. A. proximity token is provided that is associated with the security token. The proximity token performs a second element of the cryptographic technique to validate a communication between the application service and the security token. The proximity token is operable to validate the communication only when the proximity token is located within a predetermined validation distance from the security token or the application service. The security token may perform the first element of the cryptographic technique to verify that the proximity token has validated the communication between the application service and the security token. The system may be configured to provide secured access to the application service when the proximity token validates the communication and to prevent secured access to the application service when the proximity token does not validate the communication.

Claims

1. A computer-implemented method comprising:

receiving an instruction at an application service;

generating a command at the application service based upon the instruction;

automatically communicating the command from the application service to a proximity token, via a wireless connection;

transforming the command at the proximity token using a first cryptographic technique;

automatically communicating the transformed command from the proximity token to the application service;

automatically communicating the transformed command from the application service to a security token;

recovering the command from the transformed command at the security token using a second cryptographic technique;

executing the recovered command, recovered from the transformed comment, at the security token to produce a result; and

automatically communicating the result from the security token to the application service.

2. The computer-implemented method of claim 1, wherein transforming the command at the proximity token using the first cryptographic technique further comprises digitally signing the command at the proximity token.

3. The computer-implemented method of claim 1, wherein transforming the command at the proximity token using the first cryptographic technique further comprises encrypting the command at the proximity token.

4. The computer-implemented method of claim 1, wherein transforming the command at the proximity token using the first cryptographic technique further comprises applying a hashing algorithm to the command at the proximity token.

5. The computer-implemented method of claim 1, wherein recovering the command from the transformed command at the security token using the second cryptographic technique further comprises recovering the command using a cryptographic key shared by the proximity token, or a public key of the proximity token.

6. The computer-implemented method of claim 1, wherein the application service is a mobile telephone, a personal digital assistant, a pen-based computer, a notebook computer, a desktop computer, a workstation, an automated teller machine, a security system, a web browser, an enterprise client, a subscriber identity module toolkit browser, an email client, a synchronization client, an electronic purse or wallet, an instant messaging client, a business productivity application, an operating system, or an operating system kernel.

7. The computer-implemented method of claim 1, wherein the command is communicated to the proximity token via a short message service (SMS) communication, a wireless application protocol (WAP) communication, a transport connection protocol (TCP) communication, an Internet protocol (IP) communication, a World Wide Web (WWW) communication, a local area network (LAN) communication, a wireless LAN (WLAN) communication, a wide area network (WAN) communication, a public switched telephone network (PTSN) communication, an integrated services digital network (ISDN) communication, a digital subscriber line (DSL) communication, an advanced mobile telephone service (AMPS) communication, a global system for mobile communications (GSM) communication, a general packet radio service (GPRS) communication, a code division multiple access (CDMA) communication, a wideband CDMA (WCDMA) communication, a universal mobile telecommunications system (UTMS) communication, a radio communication, a cable communication, or a satellite communication.

8. The computer-implemented method of claim 1, further comprising storing a secret cryptographic key within the security token.

9. The computer-implemented method of claim 1, wherein the transformed command is communicated from the proximity token to the application service if the proximity token is within a predetermined distance from the application service.

10. The computer-implemented method of claim 1, wherein the transformed command is communicated from the proximity token to the application service if the command is received from the application service above a predetermined power.

11. The computer-implemented method of claim 1, wherein the first and second cryptographic techniques are the same cryptographic techniques.

22. The computer-implemented method of claim 1, wherein the first, second, third, and/or fourth cryptographic techniques are the same cryptographic techniques.

12. A computer-implemented method comprising:

receiving an instruction at an application service;

generating a command at the application service based upon the instruction;

automatically communicating the command to a security token;

executing the command, communicated from the application service, at the security token to produce a result;

modifying the result at the security token using a first cryptographic technique;

automatically communicating the modified result from the security token to a proximity token, via a wireless connection;

transforming the modified result at the proximity token using a second cryptographic technique;

automatically communicating the transformed result from the proximity token to the security token;

recovering the modified result from the transformed result at the security token based upon a third cryptographic technique;

recovering the result from the recovered modified result at the security token based upon a fourth cryptographic technique; and

automatically communicating the recovered result from the security token to the application service.

13. The computer-implemented method of claim 12, wherein modifying the result at the security token using the first cryptographic technique further comprises digitally signing the command at the security token.

14. The computer-implemented method of claim 12, wherein modifying the result at the security token using the first cryptographic technique further comprises encrypting the command at the security token.

15. The computer-implemented method of claim 12, wherein modifying the result at the security token using, the first cryptographic technique further comprises applying a hashing algorithm to the command at the proximity token.

16. The computer-implemented method of claim 12, wherein recovering the modified result from the transformed result at the security token using the third cryptographic technique further comprises recovering the command using a cryptographic key shared by the security token, or a public key of the security token.

17. The computer-implemented method of claim 12, wherein the application service is a mobile telephone, a personal digital assistant, a pen-based computer, a notebook computer, a desktop computer, a workstation, an automated teller machine, a security system, a web browser, an enterprise client, a subscriber identity module toolkit browser, an email client, a synchronization client, an electronic purse or wallet, an instant messaging client, a business productivity application, an operating system, or an operating system kernel.

18. The computer-implemented method of claim 12, wherein the command is communicated to the proximity token via a short message service (SMS) communication, a wireless application protocol (WAP) communication, a transport connection protocol (TCP) communication, an Internet protocol (IP) communication, a World Wide Web (WWW) communication, a local area network (LAN) communication, a wireless LAN (WLAN) communication, a wide area network (WAN) communication, a public switched telephone network (PTSN) communication, an integrated services digital network (ISDN) communication, a digital subscriber line (DSL) communication, an advanced mobile telephone service (AMPS) communication, a global system for mobile communications (GSM) communication, a general packet radio service (GPRS) communication, a code division multiple access (CDMA) communication, a wideband CDMA (WCDMA) communication, a universal mobile telecommunications system (UTMS) communication, a radio communication, a cable communication, or a satellite communication.

19. The computer-implemented method of claim 12, further comprising storing a secret cryptographic key within the security token.

20. The computer-implemented method of claim 12, wherein the transformed result is communicated from the proximity token to the security token if the proximity token is within a predetermined distance from the security token.

21. The computer-implemented method of claim 12, wherein the transformed result is communicated from the proximity token to the security token if the command is received from the security token above a predetermined power.

23. A system comprising:

an application service, the application service;

receiving an instruction,

generating a command based upon the instruction,

automatically communicating the command,

receiving a transformer and command, and

automatically communicating the transformed command;

a proximity token, the proximity token;

receiving the command from the application service, via a wireless connection,

transforming the command using a first cryptographic technique, and

automatically communicating the transformed command to the application service; and

a security token, the security token;

receiving the transformed command from the application service,

recovering the command from the transformed command using a second cryptographic technique,

executing the recovered command, recovered from the transformed command, to produce a result, and

automatically communicating the result to the application service.

24. A system comprising:

an application service, the application service;

receiving an instruction,

generating a command based upon the instruction, and

automatically communicating the command;

a security token, the security token;

receiving the command from the application service,

executing the command, received from the application service, to produce a result,

modifying the result using a first cryptographic technique,

automatically communicating the modified result,

receiving a transformed result,

recovering the modified result from the transformed result based upon a third cryptographic technique,

recovering the result from the recovered modified result based upon a fourth cryptographic technique, and

automatically communicating the recovered result to the application service; and

a proximity token, the proximity token;

receiving the modified result from the security token, via a wireless connection,

transforming the modified result using a second cryptographic technique, and

automatically communicating the transformed result to the security token.

25. A computer program product, tangibly embodied in a machine-readable medium, the computer program product comprising instructions that, when read by a machine, cause a data processing apparatus to:

receive an instruction at an application service;

generate a command at the application service based upon the instruction;

automatically communicate the command from the application service to a proximity token, via a wireless connection;

transform the command at the proximity token using a first cryptographic technique;

automatically communicate the transformed command from the proximity token to the application service;

automatically communicate the transformed command from the application service to a security token;

recover the command from the transformed command at the security token using a second cryptographic technique;

execute the recovered command, recovered from the transformed comment, at the security token to produce a result; and

automatically communicate the result from the security token to the application service.

26. A computer program product, tangibly embodied in a machine-readable medium, the computer program product comprising instructions that, when read by a machine, case a data processing apparatus to:

receive an instruction at an application service;

generate a command at the application service based upon the instruction;

automatically communicate the command to a security token;

execute the command, communicated from the application service, at the security token to produce a result;

modify the result at the security token using a first cryptographic technique;

automatically communicate the modified result from the security token to a proximity token, via a wireless connection;

transform the modified result at the proximity token using a second cryptographic technique;

automatically communicate the transformed result from the proximity token to the security token;

recover the modified result from the transformed result at the security token based upon a third cryptographic technique;

recover the result from the recovered modified result at the security token based upon a fourth cryptographic technique; and

automatically communicate the recovered result from the security token to the application service.

27. A computer-implemented method comprising receiving validated result data at an application service if a secure execution function that produces result data is performed at a security token on command data communicated from the application service, and if a data validation function is performed at a proximity token on the command data or the result data, the proximity token performing the data validation function if the proximity token is within a predetermined distance of the application service.

28. A device comprising means for receiving validated result data at an application service if a secure execution function that produces result data is performed at a security token on command data communicated from the application service, and if a data validation function is performed at a proximity token on the command data or the result data, the proximity token performing the data validation function if the proximity token is within a predetermined distance of the application service.