Method and apparatus for personal identification

• US 5,367,572 A
• Filed: 07/31/1992
• Issued: 11/22/1994
• Est. Priority Date: 11/30/1984
• Status: Expired due to Term

• Current Assignee: EMC Corporation (Dell Technologies Inc.)
• Original Assignee: Kenneth P. Weiss
• Inventors: Weiss, Kenneth P.
• Primary Examiner(s): Gregory, Bernarr E.
• Application Number:
  US07/923,085
• Time in Patent Office: 844 Days
• Field of Search: 235/379, 235/380, 235/382, 380/23-25, 380/4, 380/30, 380/49, 380/50, 380/3, 340/825.31, 340/825.34
• US Class Current: 713/184
• CPC Class Codes: G06F 21/313 using a call-back technique via a telephone network
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06F 21/725 operating on a secure reference time value
• CPC Class Codes: G06F 2211/007 Encryption, En-/decode, En-/decipher, En-/decypher, Scramble, (De-)compress
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: G06F 7/582 Pseudo-random number generators
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/346 Cards serving only as information carrier of service
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: G06Q 20/40975 using encryption therefor
• CPC Class Codes: G07C 9/215 the system having a variable access-code, e.g. varied as a function of time
• CPC Class Codes: G07C 9/33 by means of a password
• CPC Class Codes: G07F 7/10 together with a coded signal , e.g. in the form of personal identification information, like personal identification number [PIN] or biometric data
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: G07F 7/1016 Devices or methods for securing the PIN and other transaction-data, e.g. by encryption arrangements for secret communication, see H04L9/00

Abstract

A method and apparatus for providing improved security for a personal identification number (PIN) in a personal identification and verification system of the type wherein a time dependent nonpredictable code is generated at a device in the possession of the individual, which code is unique to the individual and this code is communicated to, and compared with a nonpredictable code generated at a central verification computer. In this system, the PIN is mixed with the nonpredictable code before transmission of these values to the central verification computer. A nonsecret code is previously transmitted to the central verification computer and is used to retrieve the PIN and the appropriate nonpredictable code for the user. These values are used to strip the PIN from the transmitted nonpredictable code and the stripped PIN and remaining nonpredictable code are compared with the corresponding retrieved values in order to determine verification.

Claims

1. A system for verifying an individual, the system being of the type wherein a user is provided with a nonsecret identification, with a secret PIN and with a user device generating a unique, time-varying, nonpredictable code, the nonpredictable code at a given time being provided to a central verification computer to effect verification, the system characterized by:

the user device having means for inputting the PIN, and means for utilizing the PIN in an algorithm to produce the nonpredictable code for a given time interval; and

the central verification computer having means for receiving the nonsecret identification and the nonpredictable code produced at the user device, means for utilizing the nonsecret identification to obtain the time-varying nonpredictable code for the user for the given time interval, and means for utilizing the communicated nonpredictable code and the obtained nonpredictable code to verify the user.

2. A system as claimed in claim 1, including a coded value stored at the user device which value is utilized in addition to the PIN to produce the nonpredictable code.

3. A system as claimed in claim 2 wherein said means for utilizing includes a first means for utilizing a value related to the coded value to produce a nonpredictable value, and a second means for utilizing the PIN to modify at least one of the input to and the output from the first means.

4. A system as claimed in claim 3 wherein the value utilized by the first means is the stored coded value, and wherein said second means includes a means for utilizing the PIN to modify the nonpredictable value output from the first means to produce the nonpredictable code.

5. A method for identifying an individual comprising the steps of:

inputting a PIN for the individual into a device in the possession of the individual;

utilizing the inputted PIN in an algorithm to produce at the device a nonpredictable code for a given time interval; and

communicating a nonsecret identifying code for the individual and the nonpredictable code to a central verification computer, the verification computer receiving the communicated nonsecret identification and the nonpredictable code, utilizing the nonsecret identification to obtain the time-varying nonpredictable code for the individual for the given time interval, and utilizing the communicated nonpredictable code and the obtained nonpredictable code to verify the individual.