Method and apparatus for personal identification

• US 5,168,520 A
• Filed: 03/18/1991
• Issued: 12/01/1992
• Est. Priority Date: 11/30/1984
• Status: Expired due to Term

• Current Assignee: EMC Corporation (Dell Technologies Inc.)
• Original Assignee: Security Dynamics Technologies, Inc. (Symphony Technology Group LLC)
• Inventors: Weiss, Kenneth P.
• Primary Examiner(s): Gregory, Bernarr E.
• Application Number:
  US07/670,705
• Time in Patent Office: 624 Days
• Field of Search: 380/3, 380/4, 380/23, 380/24, 380/25, 380/49, 380/50, 235/379, 235/380, 235/382, 340/825.31, 340/825.34
• US Class Current: 713/184
• CPC Class Codes: G06F 21/313 using a call-back technique via a telephone network
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06F 21/725 operating on a secure reference time value
• CPC Class Codes: G06F 2211/007 Encryption, En-/decode, En-/decipher, En-/decypher, Scramble, (De-)compress
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: G06F 7/582 Pseudo-random number generators
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/40975 using encryption therefor
• CPC Class Codes: G07C 9/215 the system having a variable access-code, e.g. varied as a function of time
• CPC Class Codes: G07C 9/33 by means of a password
• CPC Class Codes: G07F 7/10 together with a coded signal , e.g. in the form of personal identification information, like personal identification number [PIN] or biometric data
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: G07F 7/1016 Devices or methods for securing the PIN and other transaction-data, e.g. by encryption arrangements for secret communication, see H04L9/00

Abstract

A method and apparatus for providing improved security for a personal identification number (PIN) in a personal identification and verification system of the type wherein a time dependent nonpredictable code is generated at a device in the possession of the individual, which code is unique to the individual and this code is communicated to, and compared with a nonpredictable code generated at a central verification computer. In this system, the PIN is mixed with the nonpredictable code before transmission of these values to the central verification computer. A nonsecret code is previously transmitted to the central verification computer and is used to retrieve the PIN and the appropriate nonpredictable code for the user. These values are used to strip the PIN from the transmitted nonpredictable code and the stripped PIN and remaining nonpredictable code are compared with the corresponding retrieved values in order to determine verification.

Claims

1. In a personal identification system of the type wherein a user is provided with a device generating a unique, time varying, nonpredictable code, with a nonsecret identifying code and with a secret PIN, the nonpredictable code at a given instant and the PIN being provided to a central verification computer to effect verification;

apparatus for providing improved security for the PIN comprising;

means for mixing the nonpredictable code generated by the device at a given time with the PIN according to a predetermined algorithm to generate a combined coded value;

means for separately communicating the nonsecret identifying code and the combined coded value to the central verification computer; and

wherein the central verification computer includes means for utilizing the nonsecret identifying code to retrieve the PIN and generate an appropriate, unique, time varying nonpredictable code for the individual, and means for utilizing the retrieved PIN, appropriate nonpredictable code and the combined coded value in performing a verification operation.

2. Apparatus as claimed in claim 1 including means operative prior to the communicating of the value from the mixing means for communicating the nonsecret identifying code to said verification computer.

3. Apparatus as claimed in claim 2 wherein said verification computer includes means for utilizing the communicated nonsecret identifying code to retrieve the PIN and a unique challenge value for the individual;

and

means for communicating the challenge value to the device.

4. Apparatus as claimed in claim 3 wherein said challenge value communicating means includes means for communicating the challenge value to the individual;

and

wherein the device includes means for permitting the individual to input the challenge value and his PIN to the device.

5. Apparatus as claimed in claim 4 wherein said device includes means responsive to the challenge value for generating the nonpredictable code;

and

wherein said mixing means includes means, included as part of the device, for receiving the inputted PIN and the generated nonpredictable value and for generating an output which is a predetermined function of the input.

6. Apparatus as claimed in claim 5 wherein said mixing means adds the PIN to the nonpredictable code.

7. Apparatus as claimed in claim 1 wherein said device includes means for permitting the individual to input his PIN to the device;

and

wherein said means for mixing is included as part of said device and is adapted to receive the PIN inputted by the individual and the nonpredictable code and to generate an output which is a predetermined function of the input.

8. Apparatus as claimed in claim 7 wherein said mixing means adds the PIN to the nonpredictable code.

9. Apparatus as claimed in claim 1 wherein said verification computer includes a means for mixing the retrieved PIN and appropriate nonpredictable code generated by the verification computer at a given time according to the predetermined algorithm to generate a second combined coded value.

10. Apparatus as claimed in claim 9 wherein the verification operation comprises comparing the combined coded value with the second combined coded value.

11. A method for identifying an individual comprising the steps of:

utilizing a device in the possession of the individual to generate a unique time varying, nonpredictable code;

mixing the nonpredictable code generated at a given time with a secret PIN for the individual to generate a combined code; and

communicating a nonsecret identifying code for the individual and the combined code to a central verification computer;

the verification computer utilizing the nonsecret identifying code to retrieve the PIN and generate an appropriate, unique, time-varying nonpredictable code for the individual, and utilizing the retrieved PIN, appropriate nonpredictable code, and the combined code to perform a verification operation.

12. A method as claimed in claim 11 wherein the verification computer also generates a unique challenge value in response to the nonsecret identifying code;

and

including the step of communicating the challenge value to the device in possession of the individual.

13. A method as claimed in claim 12 wherein the challenge value is communicated to the individual;

and

including the step of the individual inputting the challenge value and his PIN to the device.

14. A method as claimed in claim 13 wherein the device includes means responsive to the challenge value for generating the nonpredictable code;

and

wherein the mixing step includes the device receiving the PIN and the nonpredictable code and generating an output which is a predetermined function of the inputs.

15. A method as claimed in claim 14 wherein said predetermined function is a sum of said inputs.

16. A method as claimed in claim 14 including the step of the individual inputting his PIN to the device;

and

wherein the mixing step includes the device receiving the PIN inputted by the individual and the nonpredictable code and generating an output which is a predetermined function of the inputs.

17. A method as claimed in claim 16 wherein said predetermined function is a sum of said input.

18. A method as claimed in claim 11 wherein the verification computer utilizes the retrieved PIN and appropriate nonpredictable code by combining them to obtain a second combined code.

19. A method as claimed in claim 18 wherein the verification operation comprises comparing the combined code and the second combined code.