System and method for encrypted smart card pin entry

• US 8,332,935 B2
• Filed: 06/07/2010
• Issued: 12/11/2012
• Est. Priority Date: 07/29/2005
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Research In Motion Limited (Blackberry Limited)
• Inventors: Brown, Michael K., Adams, Neil P., Little, Herbert A.
• Primary Examiner(s): Flynn, Nathan
• Assistant Examiner(s): Vaughan, Michael R
• Application Number:
  US12/795,383
• Publication Number:
  US 20100241867A1
• Time in Patent Office: 918 Days
• Field of Search: None
• US Class Current: 726/20
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: G06Q 20/40975 using encryption therefor
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: G07F 7/1025 Identification of user by a PIN code

Abstract

A smart card, system, and method for securely authorizing a user or user device using the smart card is provided. The smart card is configured to provide, upon initialization or a request for authentication, a public key to the user input device such that the PIN or password entered by the user is encrypted before transmission to the smart card via a smart card reader. The smart card then decrypts the PIN or password to authorize the user. Preferably, the smart card is configured to provide both a public key and a nonce to the user input device, which then encrypts a concatenation or other combination of the nonce and the user-input PIN or password before transmission to the smart card. The smart card reader thus never receives a copy of the PIN or password in the clear, allowing the smart card to be used with untrusted smart card readers.

Claims

1. An authentication method, comprising:

receiving, at a mobile communication device from a smart card via a smart card reader over a wireless communication link, a challenge comprising a public key and a nonce generated and stored at the smart card;

transmitting, from the mobile communication device to the smart card over the wireless communication link via the smart card reader, a response to the challenge, the response comprising user authentication information encrypted using the challenge comprising the public key and the nonce; and

receiving a verification signal at the mobile communication device over the wireless communication link from the smart card, the receiving the verification signal responsive to a determination that user authentication information obtained by decrypting the encrypted user authentication information at the smart card matches predetermined authentication information, the decrypting using a private key corresponding to the public key and the nonce, the private key and the predetermined authentication information stored in secure memory in the smart card.

2. The method of claim 1, further comprising the mobile communication device receiving the user authentication information via a user interface of the mobile communication device.

3. The method of claim 1, further comprising authenticating a user if the encrypted user authentication information thus decrypted matches predetermined authentication information.

4. The method of claim 1, further comprising providing the mobile communication device access to a further private key stored in the secure memory.

5. The method of claim 1, wherein the user authentication information comprises a PIN or password.

6. The authentication method of claim 1, further comprising determining that the user authentication information obtained by decrypting the encrypted user authentication information matches the predetermined authentication information.

7. A method for providing authentication information to a smart card, the method comprising:

receiving, at a mobile communication device from the smart card via a smart card reader over a wireless communication link, a challenge comprising a public key and a nonce generated and stored at the smart card;

transmitting, from the mobile communication device to the smart card over the wireless communication link via the smart card reader, a response to the challenge, the response comprising user authentication information encrypted using the challenge comprising the public key and the nonce; and

the smart card decrypting the encrypted user authentication information using a private key corresponding to the public key and the nonce,

wherein the response is verifiable by the smart card by;

matching the user authentication information thus decrypted with predetermined authentication information stored at the smart card.

8. The method of claim 7, further comprising the mobile communication device receiving the user authentication information via a user interface of the mobile communication device.

9. The method of claim 7, further comprising authenticating a user if the encrypted user authentication information thus decrypted matches predetermined authentication information.

10. The method of claim 7, further comprising providing the mobile communication device access to a further private key stored in the secure memory.

11. The method of claim 7, wherein the user authentication information comprises a PIN or password.

12. The method of claim 7, further comprising the smart card:

decrypting the encrypted user authentication information using the private key and the nonce; and

matching the user authentication information thus decrypted with the predetermined authentication information.

13. An authentication method, comprising:

transmitting, from a smart card to a mobile communication device via a smart card reader communicating with the mobile communication device over a wireless communication link, a challenge comprising a public key and a nonce generated and stored at the smart card;

receiving, at the smart card from the mobile communication device via the smart card reader, a response to the challenge, the response comprising user authentication information encrypted using the challenge comprising the public key and the nonce;

decrypting, at the smart card, the user authentication information thus encrypted using a private key corresponding to the public key, and the nonce; and

transmitting a verification signal from the smart card to the mobile communication device via the smart card reader upon determination that user authentication information thus decrypted matches predetermined authentication information stored at the smart card.

14. The method of claim 13, wherein the user authentication information is received by the mobile communication device via a user interface.

15. The method of claim 13, further comprising authenticating a user if the encrypted user authentication information thus decrypted matches predetermined authentication information.

16. The method of claim 13, further comprising providing the mobile communication device access to a further private key stored in the secure memory.

17. The method of claim 13, wherein the user authentication information comprises a PIN or password.

18. The authentication method of claim 13, further comprising the smart card determining that the user authentication information thus decrypted matches the predetermined authentication information.