Personal Authentication Device and System for Securing Transactions on a Mobile Device

• US 20140282925A1
• Filed: 03/15/2013
• Published: 09/18/2014
• Est. Priority Date: 03/15/2013
• Status: Abandoned Application

• Current Assignee: Analog Devices, Inc.
• Original Assignee: Sypris Electronics, LLC (Sypris Solutions Incorporated)
• Inventors: Walsh, John J., Aldridge, Hal A.
• Application Number:
  US13/832,885
• Publication Number:
  US 20140282925A1
• Time in Patent Office: Days
• US Class Current: 726/5
• CPC Class Codes: G06F 21/43 wireless channels
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/645 using a third party
• CPC Class Codes: G09C 1/00 Apparatus or methods whereby a given sequence of signs, e.g. an intelligible text, is transformed into an unintelligible sequence of signs by transposing the signs or groups of signs or by replacing them by others according to a predetermined system cryptographic typewriters G09C3/00
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3278 using physically unclonable functions [PUF]

Abstract

A personal authentication device for use with a mobile device, comprising a secure processor, a crypto engine supporting certificate functions, a wireless communication module, a cryptographic engine, a memory, a hardware based identity, a policy engine, one or more security features; and an on-board main power battery. Also a system comprising the personal authentication device and a verification authority, and an associated method of authentication.

Claims

1. A personal authentication device for use with a mobile device, comprising:

a. a secure processor;

b. a crypto engine supporting certificate functions;

c. a wireless communication module;

d. a secure non-volatile memory;

e. a hardware fingerprint means that comprises a fingerprint device or a fingerprint circuit;

f. one or more security features; and

g. an on-board main power battery.

2. The device of claim 1, wherein the hardware fingerprint device or fingerprint circuit is a PUF.

3. The device of claim 1, wherein the one or more security features is of a class enabling the device to be associated with a FIPS 140-2 level 3 certification.

4. The device of claim 1, wherein the wireless communication module is Bluetooth or NFC.

5. The device of claim 1, wherein the wireless communication module is Bluetooth or NFC and the one or more security features is of a class enabling the device to be associated with a FIPS 140-2 level 3 certification.

6. The device of claim 1, wherein the wireless communication module is Bluetooth or NFC, and the one or more security features is of a class enabling the device to be associated with a FIPS 140-2 level 3 certification, and the hardware fingerprint device or fingerprint circuit is a PUF.

7. The device of claim 1, wherein the hardware fingerprint device or fingerprint circuit is a PUF and the one or more security features is of a class enabling the device to be associated with a FIPS 140-2 level 3 certification.

8. The device of claim 1, wherein the hardware fingerprint device or fingerprint circuit is a PUF and the wireless communication module is Bluetooth or NFC.

9. A system comprising one or more of the devices of claim 1, and one or more secure mobile devices that store certificates accessible for execution only by authorized applications in a securely separated partition that includes means for establishing secure data tunnels to an authorized account provider and to at least one of the devices of claim 1.

10. The device of claim 1, wherein the device is configured to directly or indirectly communicate information with the provider of an account that is associated with the device through binding to the identity of a specific human individual.

11. The device of claim 1, wherein the device is associated with a mobile device.

12. The device of claim 11, wherein the wireless communication module is configured to communicate with the mobile device.

13. The device of claim 11, wherein the wireless communication module is configured to directly or indirectly communicate with a mobile device, a verification authority, and an account provider.

14. The device of claim 1, wherein the memory stores one or more authentication certificates.

15. The device of claim 1, wherein the memory stores one or more authentication certificates and the hardware fingerprint device or fingerprint circuit is a PUF.

16. The device of claim 1, further comprising a secure boot module.

17. A system comprising one or more of the devices of claim 1, wherein the wireless communication module is configured to directly or indirectly communicate with a mobile device, a verification authority, and an account provider.

18. The system of claim 17, wherein the account provider is a bank.

19. The system of claim 17, wherein the account provider possesses health records.

20. The system of claim 17, wherein one or more individual humans are associated with the account provider through an account corresponding to the individual.

21. The device of claim 1, wherein the memory contains policy data obtained through interactions between the device and an account provider.

22. The device of claim 21, wherein the memory contains policy data associated with a secure enrollment of a user with an account provider.

23. The device of claim 1, wherein the secure processor includes a policy engine that is adapted to determine whether a transaction complies with policy data.

24. The device of claim 23, wherein the policy engine is further adapted to authorize transactions that comply with policy data.

25. The device of claim 15, wherein the certificate is a certificate traditionally used for identity processing.

26. The device of claim 15, wherein the device is adapted to utilize both the authentication certificates and the PUF in a manner that increases transactional security beyond what either means can provide alone.