METHOD OF TRANSFERRING ACCESS RIGHTS TO A SERVICE FROM ONE DEVICE TO ANOTHER

• US 20130290191A1
• Filed: 04/24/2013
• Published: 10/31/2013
• Est. Priority Date: 04/24/2012
• Status: Abandoned Application

• Current Assignee: IDEMIA France (Advent International Corporation)
• Original Assignee: Oberthur Technologies SA
• Inventors: Dottax, Emmanuelle, Dischamp, Paul
• Application Number:
  US13/869,347
• Publication Number:
  US 20130290191A1
• Time in Patent Office: Days
• US Class Current: 705/51
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06Q 10/02 Reservations, e.g. for tickets, services or events
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838

Abstract

A method of transfer transferring a right to access a service from a device (2) of a lender (P) to a device (25) of a borrower (E), the method comprising:

• • holding an access right to a service;
  • obtaining authentication data associated with the borrower (E) or the borrower'"'"'s device (25);
  • duplicating said at least one access right (D1-D2);
  • using a cryptographic key associated with the device (2) of the lender (P) to calculate a cryptogram containing authentication data and duplicated rights; and
  • sending the cryptogram to the device (25) of the borrower (E).

Correspondingly, the invention also provides a method of controlling access to such a service by a service provider, and also a method of managing a transfer of such access rights from the device (2) of the lender (P) to the service provider.

Claims

1. A transfer method for transferring a right to access a service to a device of a borrower, the method being performed by a device of a lender, comprising:

holding at least one access right to access a service enabling the lender'"'"'s device to access the service in accordance with said at least one access right;

obtaining authentication data associated with the borrower or with the borrower'"'"'s device;

duplicating said at least one access right;

using a cryptographic key associated with the lender'"'"'s device to calculate a cryptogram from a message containing the authentication data and said at least one duplicated access right; and

sending the cryptogram to the borrower'"'"'s device in order to transfer the duplicated access right thereto.

2. A transfer method according to claim 1, wherein the cryptogram is sent via an NFC, Bluetooth®

, or Zigbee short-range point-to-point communications connection.

3. A transfer method according to claim 1, further including selecting an identifier of the borrower'"'"'s device wherein the authentication data is obtained from the selected identifier and corresponds to a public cryptographic key associated with the borrower'"'"'s device.

4. A transfer method according to claim 1, wherein the authentication data is an identity code received from the borrower'"'"'s device.

5. A transfer method according to claim 1, further including selecting an identifier of the borrower'"'"'s device, wherein the authentication data is obtained from the selected identifier and corresponds to a biometric signature of the borrower.

6. A transfer method according to claim 1, wherein the cryptographic key associated with the lender'"'"'s device is a secret cryptographic key.

7. A computer program including instructions for executing steps of a transfer method according to claim 1 when said program is executed by a computer.

8. A computer readable recording medium having recorded thereon a computer program including instructions for executing steps of a transfer method according to claim 1.

15. A method of managing a transfer of at least one access right giving access to a service, the method comprising:

transferring at least one access right to a service to a device of a borrower, the method being performed by a device of a lender in accordance with claim 1;

transferring said at least one access right from the device of the borrower to an access provider; and

the access provider controlling access of the borrower to the service in accordance with claim 9.

9. A control method for controlling access to a service, the method being performed by a service provider, comprising:

receiving a first cryptogram from a device of a borrower, the first cryptogram being calculated on the basis of a first cryptographic key associated with a device of a lender, said first cryptogram comprising first authentication data associated with the borrower or with the borrower'"'"'s device together with at least one access right transferred by the lender'"'"'s device to give access to a service;

authenticating the first cryptogram using a second cryptographic key matching said first key in order to verify that said first cryptogram does indeed come from the lender'"'"'s device;

authenticating the borrower or the borrower'"'"'s device by receiving second authentication data of the borrower or of the borrower'"'"'s device and verifying the authenticity of the borrower'"'"'s device from the first authentication data extracted from said first cryptogram and from the received second authentication data; and

deciding to allow the borrower access to the service in compliance with said at least one transferred access right if, and only if, said authentication steps take place successfully.

10. A control method according to claim 9, wherein the first cryptogram from the borrower'"'"'s device and the second authentication data are received via a short-range point-to-point communications connection complying with the ISO14443, Bluetooth®

, or Zigbee standard.

11. A control method according to claim 9, wherein the first key associated with the lender'"'"'s device is a secret cryptographic key and the second key is a public cryptographic key matching said secret key.

12. A control method according to claim 9, wherein the second authentication data is a second cryptogram coming from the borrower'"'"'s device, and wherein verification of the authenticity of the borrower'"'"'s device comprises verifying the received second cryptogram using the first authentication data as extracted from the received first cryptogram, said first authentication data being a public cryptographic key that is associated with the borrower'"'"'s device.

13. A control method according to claim 9, wherein the first authentication data extracted from the first cryptogram is a first identity code and the received second authentication data is a second identity code, and wherein verification of the authenticity of the borrower'"'"'s device comprises comparing the first and second identity codes.

14. A control method according to claim 9, wherein the first authentication data extracted from the received first cryptogram is a first biometric signature, and the received second authentication data is a second biometric signature, and wherein the authenticity of the borrower'"'"'s device is verified by comparing the first and second biometric signatures.