SYSTEM AND METHOD FOR ENCRYPTION

• US 20160134424A1
• Filed: 06/06/2014
• Published: 05/12/2016
• Est. Priority Date: 06/12/2013
• Status: Active Grant

• Current Assignee: Cryptomathic Ltd
• Original Assignee: Cryptomathic Ltd
• Inventors: Forget, Guillaume, Pedersen, Torben Pryds, Landrock, Peter
• Granted Patent: US 9,705,681 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/42 using separate channels for security data
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 9/06 the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
• CPC Class Codes: H04L 9/3215 using a plurality of channels network architectures or network communication protocols using different networks H04L63/18
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

A method and system for generating a signature for a user are described. The system comprises a signature server, an initial transaction device for a user and a validation device for a user. The initial transaction device is configured to display a first message M and send a request to the signature server to create a signature for said first message M. The signature server is configured to generate a validation challenge using a second message M′ which is based on said first message M′ and a first secret shared between said user and said signature server and send said validation challenge to the validation device. The validation device is configured to regenerate said second message M′ using said first shared secret, display said second message M′, receive user confirmation that the displayed second message M′ corresponds to said first message M, generate a validation code confirming the request to create a signature; and send said validation code to said signature server. Thereafter, said signature server generates the sig nature for the user for the first message M.

Claims

1. A method of generating a signature on behalf of a user having a first and second user device, the method comprising:

receiving a request from said first user device to create a signature for a first message M;

generating a validation challenge using a second message M′

which is based on the first message M and a first secret shared with said user;

sending said validation challenge to said user to enable said user device to regenerate said second message M′

;

receiving a validation code from said second user device, said validation code confirming the request to create a signature; and

generating the signature for the user for the first message M.

2. The method of claim 1, wherein said second message M′

is identical to said first message M.

3. The method of claim 1, wherein said validation challenge is generated by encrypting said second message M′

using said first shared secret.

4. The method of claim 1, further comprising reformatting the validation challenge as a barcode which is readable by the second user device and sending the reformatted validation challenge to the user.

5. The method of claim 1, further comprising verifying the validation code prior to generating the signature.

6. The method of claim 5, wherein the validation code is verified using a second shared secret.

7. The method of claim 6, wherein the second shared secret is different to the first shared secret.

8. The method of claim 1, further comprising preregistering with the second user device to obtain the first shared secret and/or second shared secret.

9. A method of validating a signature request for a first message M from a signature creation device, the method comprising:

receiving a validation challenge from the signature creation device, the validation challenge having been created using a second message M′

which is based on the first message M and a first secret shared between said signature creation device and said user;

generating the second message M′

from the validation challenge using the first shared secret;

displaying the second message M′

to the user;

receiving confirmation that the second message M′

as displayed corresponds to the first message M;

generating a validation code confirming the request to create the signature; and

outputting the validation code.

10. The method of claim 9, wherein said second message M′

is identical to said first message M.

11. The method of claim 9, wherein said second message M′

is generated by decrypting said validation challenge using said first shared secret.

12. The method of claim 9, comprising generating said validation code using a second secret shared with the signature creation device.

13. The method of claim 12, comprising generating said validation code using encryption with the second secret being a symmetric key.

14. The method of claim 9, comprising receiving the validation challenge from an authentication and validation device.

15. The method of claim 14, comprising outputting the validation code to the authentication and validation device.

16. The method of claim 9, comprising receiving the validation challenge from a signature creation device.

17. A method of generating a signature on behalf of a user, the method comprising:

displaying a first message M on a first user device;

sending a request from said first user device to a signature server to create a signature for said first message M;

creating a second message M′

which is based on the first message M;

generating a validation challenge using said second message M′ and

a first secret shared between said user and said signature server;

sending said validation challenge to a second user device;

regenerating said second message M′

on said second user device using said first shared secret;

displaying said second message M′

on said second user device;

receiving user confirmation that the displayed second message M′

corresponds to said first message M;

generating a validation code confirming the request to create a signature;

sending said validation code from said second user device to said signature server; and

generating the signature for the user for the first message M.

18. The method of claim 17, further comprising verifying the validation code prior to generating the signature.

19. (canceled)

20. A signature server for creating a signature on behalf of a user, the user having a first and second user device, the server being configured to:

receive a request from said first user device to create a signature for a first message M;

generate a validation challenge using a second message M′

which is based on the first message M and a first secret shared with said user;

send said validation challenge to said user to enable said second user device to regenerate said second message M′

;

receive a validation code from said second user device, said validation code confirming the request to create a signature; and

generate the signature for the user for the first message M.

21. The signature server according to claim 20, comprising a signature creation device to generate the signature for the user.

22. The signature server according to claim 21, wherein the signature creation device is local to the user.

23. The signature server according to claim 21, wherein the signature creation device generates the validation challenge.

24. The signature server according to claim 23, wherein the signature creation device and the second user device both store the first shared secret.

25. The signature server according to claim 20, comprising an authentication and validation server to generate the validation challenge.

26. The signature server according to claim 25, wherein the authentication and validation server and the second user device both store the first shared secret.

27. The signature server according to claim 25, wherein the authentication and validation server is remote from the user.

28. A validation device for a user to validate a signature request for a first message M, the validation device being configured to:

receive a validation challenge from a signature creation device, the validation challenge having been created using a second message M′

which is based on the first message M and a first secret shared between said signature creation device and said validation device;

generate the second message M′

from the validation challenge using the first shared secret;

display the second message M′

to the user;

receive user confirmation that the second message M′

corresponds to the first message M;

generate a validation code confirming the request to create the signature; and

output the validation code.

29. The validation device of claim 28, wherein said second message M′

is identical to said first message M.

30. The validation device of claim 28, wherein said second message M′

is generated by decrypting said validation challenge using said first shared secret.

31. The validation device of claim 28, wherein the validation device is configured to generate said validation code using a second secret which is shared with the signature creation device and which is stored on the validation device.

32. The validation device of claim 31, wherein the validation device is configured to generate said validation code using cryptographic methods with the second secret being a symmetric key.

33. The validation device of claim 28, wherein the validation device is configured to receive the validation challenge from an authentication and validation device.

34. The validation device of claim 33, wherein the validation device is configured to output the validation code to the authentication and validation device.

35. The validation device of claim 28, wherein the validation device is configured to receive the validation challenge from a signature creation device.

36. (canceled)

37. A system comprising a signature server, an initial transaction device for a user and a validation device for a user, the initial transaction device being configured to:

display a first message M; and

send a request to the signature server to create a signature for said first message M;

the signature server being configured to;

generate a validation challenge using a second message M′

which is based on said first message M and a first secret shared between said user and said signature server; and

send said validation challenge to the validation device;

the validation device being configured to;

regenerate said second message M′

using said first shared secret;

display said second message M′

;

receive user confirmation that the displayed second message M′

corresponds to said first message M;

generate a validation code confirming the request to create a signature; and

send said validation code to said signature server;

whereby said signature server generates the signature for the user for the first message M.