Key camouflaging method using a machine identifier

• US 8,533,460 B2
• Filed: 11/03/2010
• Issued: 09/10/2013
• Est. Priority Date: 11/06/2009
• Status: Expired due to Fees

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Computer Associates Think Inc. (Broadcom, Inc.)
• Inventors: Hird, Geoffrey R., Varadarajan, Rammohan
• Primary Examiner(s): Patel, Ashok
• Assistant Examiner(s): Mangialaschi, Tracy
• Application Number:
  US12/938,666
• Publication Number:
  US 20110113237A1
• Time in Patent Office: 1,042 Days
• Field of Search: 713/155, 713/184
• US Class Current: 713/155
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G07F 7/1091 Use of an encrypted form of the PIN
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0863 involving passwords or one-time passwords network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067
• CPC Class Codes: H04L 9/0866 involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key

Abstract

A method is provided for generating a human readable passcode to an authorized user including providing a control access datum and a PIN, and generating a unique machine identifier for the user machine. The method further includes modifying the controlled access datum, encrypting the controlled access datum using the PIN and/or a unique machine identifier to camouflage the datum, and generating a passcode using the camouflaged datum and the PIN and/or the unique machine identifier. A mobile user device may be used to execute the method in one embodiment. The passcode may be used to obtain transaction authorization and/or access to a secured system or secured data. The unique machine identifier may be defined by a machine effective speed calibration derived from information collected from and unique to the user machine.

Claims

1. A method of generating a user one-time passcode (OTP) for a provider account, the method comprising:

providing a fingerprint code (FPC) to a user device using a provisioning server;

collecting FPC information from the user device using the fingerprint code, wherein the FPC information is unique to the user device;

generating a machine effective speed calibration (MESC) using the FPC information and a MESC generator;

camouflaging at least one key with a personal identification number (PIN) and the MESC to provide at least one camouflaged key;

wherein the at least one camouflaged key is defined by the provider account and camouflaged with the personal identification number (PIN) and the (MESC);

generating a cardstring using the at least one camouflaged key and the provisioning server prior to providing the cardstring to a passcode application, wherein the cardstring is defined by the at least one camouflaged key and configured to generate the OTP for the provider account;

providing the passcode application to the user device;

providing the cardstring to the passcode application on the user device;

storing the cardstring on the user device;

providing the PIN and the MESC to the passcode application;

wherein the passcode application is configured to generate a passcode configured as the user OTP for the provider account using the cardstring and the PIN and the MESC; and

generating the user OTP on the user device using the passcode application and the cardstring on the user device.

2. The method of claim 1, wherein camouflaging the at least one key further comprises:

modifying the at least one key defined by the provider account, to create at least one modified key; and

encrypting the at least one modified key with the PIN and the MESC to create the at least one camouflaged key.

3. The method of claim 1, wherein collecting FPC information from the user device further comprises:

measuring a runtime of one or more iterations of a portion of the fingerprint code on the user device; and

counting a number of iterations completed by a portion of the fingerprint code in a fixed amount of time on the user device.

4. The method of claim 1, wherein generating the MESC further comprises:

determining at least one of;

a time to load a standard picture on the user device; and

a screen resolution corresponding to the standard picture loaded on the user device.

5. The method of claim 1, further comprising:

providing the user OTP to an authenticating server;

generating an authenticating OTP using the authenticating server;

comparing the authenticating OTP and the user OTP; and

providing an authorization result to one of a provider system and the user.

6. The method of claim 5, further comprising:

wherein the provider system is one of a payment system, a transaction system, an authentication system, a secure access system, and a secure data repository; and

wherein the authorization result is one of a payment authorization, a transaction authorization, an authentication authorization, a system access authorization, and a data access authorization.

7. The method of claim 1, further comprising:

providing a data element to the passcode application; and

generating the user OTP on the user device using the data element.

8. The method of claim 7, wherein the data element is a challenge.

9. The method of claim 1, wherein the key is one of a symmetric key, a Data Encryption Standard (DES) key, an Advanced Encryption Standard (AES) key, a secret, a secret byte array, a seed, and a controlled datum.

10. The method of claim 1,

wherein the cardstring is configured as one of an Eurocard, MasterCard and Visa (EMV) cardstring and an OTP cardstring;

and

wherein the key is configured as one of a Unique DEA Key A (UDKA), a Unique DEA Key B (UDKB) key, and a secret configured to generate one of a standardized counter-based OTP (HOTP), a time-based OTP (TOTP), and a counter-based OTP.

11. The method of claim 1, further comprising:

providing another cardstring to the passcode application, wherein the passcode application is configured to generate another passcode configured as another user OTP for another provider account using the another cardstring;

wherein the another cardstring is defined by at least another key, wherein the at least another key is camouflaged with another PIN and another MESC;

storing the another cardstring on the user device;

providing the another PIN and the another MESC to the passcode application; and

generating the another user OTP for the another provider account on the user device using the another cardstring stored on the user device.

12. The method of claim 11, further comprising:

providing a plurality of passcode generating algorithms to the passcode application;

providing a plurality of cardstrings to the passcode application;

storing the plurality of cardstrings on the user device;

wherein;

each respective one of the plurality of cardstrings is defined by a respective one of a plurality of provider accounts, and

each respective one of the plurality of cardstrings is defined by at least one respective key that is camouflaged with a respective PIN and a respective MESC;

wherein the passcode application is configured to generate a respective passcode configured as a respective user one time passcode (OTP) for the respective one of the plurality of provider accounts, using one of the plurality of passcode generating algorithms and the respective one of the plurality of cardstrings stored on the user device;

selecting one of the plurality of provider accounts;

providing the respective PIN and the respective MESC for the selected one of the plurality of provider accounts to the passcode application; and

generating the respective user OTP for the selected one of the plurality of provider accounts on the user device using the respective one of the plurality of cardstrings stored on the user device and the respective one of the plurality of passcode generating algorithms.

14. The system of claim 3, wherein the fingerprint code is configured to collect FPC information by one of:

measuring a runtime of one or more iterations of a portion of the fingerprint code on the user device; and

counting a number of iterations completed by a portion of the fingerprint code in a fixed amount of time on the user device.

13. A system for providing a one-time passcode (OTP), for a provider account, the system comprising:

a user device configured to receive a passcode application, a fingerprint code (FPC);

a cardstring, and a personal identification number (PIN);

wherein the fingerprint code is configured to collect FPC information from the user device, wherein the FPC information is unique to the user device;

a machine effective speed calibration (MESC) generator configured to generate a MESC using the FPC information; and

a provisioning server configured to provide a cardstring to the user device;

wherein the cardstring is defined by at least one key defined by the provider account and camouflaged with the PIN and the MESC to provide a camouflaged key;

wherein the passcode application is configured to generate a passcode configured as a user OTP for the provider account using the cardstring; and

wherein the cardstring is stored on the user device.

15. The system of claim 13, wherein

the FPC information includes a power supply level collected from a power supply of the user device;

and

the MESC is generated using the power supply level.

16. The system of claim 13,

wherein the passcode application is configured to execute at least one passcode generating algorithm;

wherein the at least one passcode generating algorithm is configured to generate one of an Europay, MasterCard, and Visa (EMV) OTP, a standardized counter-based OTP (HOTP), a time-based OTP (TOTP), and a counter-based OTP; and

wherein the passcode application executes the at least one passcode generating algorithm to generate the user OTP for the provider account.

17. The system of claim 13,

wherein the passcode application is configured to receive a data element;

and

wherein the passcode application uses the data element to generate the user OTP for the provider account.

18. The system of claim 13, further comprising:

an authenticating server configured to receive the user OTP;

wherein the authenticating server is configured to provide an authenticating OTP and an authorization result to one of a provider system and the user.

19. The system of claim 13, wherein the at least one camouflaged key is configured as a modified key encrypted with the PIN and the MESC;

and

wherein the modified key is defined by the provider account, and is configured as one of;

a symmetric key, a Data Encryption Standard (DES) key, an Advanced Encryption Standard (AES) key, a secret, a secret byte array, a seed, and a controlled datum.