OTP generation using a camouflaged key

• US 8,572,394 B2
• Filed: 08/30/2010
• Issued: 10/29/2013
• Est. Priority Date: 09/04/2009
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Computer Associates Think Inc. (Broadcom, Inc.)
• Inventors: Hird, Geoffrey R., Varadarajan, Rammohan
• Primary Examiner(s): Abrishamkar, Kaveh
• Assistant Examiner(s): Stoica, Adrian
• Application Number:
  US12/871,559
• Publication Number:
  US 20110060913A1
• Time in Patent Office: 1,156 Days
• Field of Search: None
• US Class Current: 713/184
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 9/0863 involving passwords or one-time passwords network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key

Abstract

A system and method is provided for generating a one-time passcode (OTP) from a user device. The method includes providing a passcode application and a cardstring defined by a provider account to the user device. The passcode application is configured to generate a passcode configured as a user OTP for the provider account, using the cardstring. The cardstring is defined by at least one key camouflaged with a personal identification number (PIN). The key may be camouflaged by modifying and encrypting the modified key under the PIN. The key may be configured as a symmetric key, a secret, a seed, and a controlled datum. The cardstring may be an EMV cardstring; and the key may be a UDKA or UDKB. The cardstring may be an OTP cardstring, and the key may be a secret configurable to generate one of a HOTP, a TOTP, and a counter-based OTP.

Claims

1. A method of generating a user one-time passcode (OTP) for a provider account, the method comprising:

providing a passcode application to a user device;

providing a cardstring to the user device, wherein;

the cardstring is defined by the provider account, and

the cardstring includes at least one key that is a modified key camouflaged with a personal identification number (PIN);

wherein the passcode application is operable to generate a passcode configured as a user OTP for the provider account using the cardstring in combination with the PIN;

providing the PIN to the passcode application; and

generating the user OTP on the user device using the passcode application, the PIN and the cardstring to generate the user OTP.

2. The method of claim 1, wherein providing the cardstring to the passcode application further comprises:

obtaining an activation code for the provider account;

providing the activation code to the passcode application;

accessing a provisioning server using the passcode application;

providing the activation code to the provisioning server;

generating the cardstring using the provisioning server; and

providing the cardstring to the passcode application using the provisioning server.

3. The method of claim 1,

wherein:

the at least one key includes a first key and a second key; and

each of the first key and the second key are;

defined by the provider account; and

a modified key camouflaged with the PIN.

4. The method of claim 1, further comprising:

providing the user OTP to an authenticating server;

evaluating the user OTP using the authenticating server; and

providing an authorization result to one of a provider system and the user.

5. The method of claim 4, wherein evaluating the user OTP further comprises:

generating the user OTP using the authenticating server to create a regenerated OTP; and

comparing the regenerated OTP and the user OTP.

6. The method of claim 1,

wherein the user device is a first user device, the method further comprising:

providing the passcode application and the cardstring to a second user device such that both of the first and second user devices are configured to generate the user OTP using the passcode application; and

providing the PIN to either of the first and second user devices to generate the user OTP.

7. The method of claim 4,

wherein the provider system is one of a payment system, a transaction system, an authentication system, a secure access system, and a secure data repository;

and

wherein the authorization result is one of a payment authorization, a transaction authorization, an authentication authorization, a system access authorization, and a data access authorization.

8. The method of claim 1, further comprising:

providing a data element to the passcode application; and

generating the user OTP on the user device using the data element.

9. The method of claim 1,

wherein the user device is configured for communication with a network;

the method further comprising;

accessing the network using the user device; and

receiving the cardstring on the user device;

wherein the cardstring is provided to the user device via the network.

10. The method of claim 1, wherein the key is one of a symmetric key, a Data Encryption Standard (DES) key, an Advanced Encryption Standard (AES) key, a secret, a secret byte array, a seed, and a controlled datum.

11. The method of claim 1, wherein the cardstring is configurable as an Eurocard, MasterCard and Visa (EMV) cardstring;

and the key is configurable as one of a Unique DEA Key A (UDKA) and a Unique DEA Key B (UDKB) key.

12. The method of claim 1, wherein cardstring is configurable as an OTP cardstring;

and the key is configurable as a secret configurable to generate one of a standardized counter-based OTP (HOTP), a time-based OTP (TOTP), and a counter-based OTP.

13. The method of claim 1, further comprising:

providing another cardstring to the passcode application, wherein the passcode application is configured to generate another passcode configured as a user OTP for another provider account using the another cardstring;

wherein the another cardstring is defined by at least another key, wherein the at least another key is camouflaged with another PIN;

providing the another PIN to the passcode application; and

generating the user OTP for the another provider account on the user device using the another cardstring in combination with the another PIN.

14. The method of claim 13, further comprising:

providing a plurality of passcode generating algorithms to the passcode application;

providing a plurality of cardstrings to the user device, wherein;

each respective one of the plurality of cardstrings is defined by a respective one of a plurality of provider accounts, and

each respective one of the plurality of cardstrings is defined by at least one respective key that is camouflaged with a respective personal identification number (PIN);

wherein the passcode application is configured to generate a respective passcode configured as a respective user one time passcode (OTP) for each respective one of the plurality of provider accounts, using at least one of the plurality of passcode generating algorithms and the respective one of the plurality of cardstrings in combination with the respective one of the PINs;

selecting one of the plurality of provider accounts;

providing the respective PIN for the selected one of the plurality of provider accounts to the passcode application; and

generating the respective user OTP for the selected one of the plurality of provider accounts on the user device using the respective one of the plurality of cardstrings, the respective one of the PINS, and the at least one of the plurality of passcode generating algorithms.

15. A system for providing a one-time passcode (OTP) for a provider account, the system comprising:

a user device configured to receive a passcode application, a cardstring, and a personal identification number (PIN);

a provisioning server configured to provide the cardstring to the user device;

wherein the cardstring is defined by at least one key that is camouflaged with the PIN;

wherein the passcode application is configured to generate a passcode configured as a user OTP for the provider account; and

wherein the passcode application uses the cardstring and the PIN to generate the user OTP for the provider account.

16. The system of claim 15,

wherein the passcode application is configured to execute at least one passcode generating algorithm;

wherein the at least one passcode generating algorithm is configured to generate one of an Europay, MasterCard, and Visa (EMV) OTP, a standardized counter-based OTP (HOTP), a time-based OTP (TOTP), and a counter-based OTP; and

wherein the passcode application executes the at least one passcode generating algorithm to generate the user OTP for the provider account.

17. The system of claim 15, further,

wherein the passcode application is configured to receive a data element;

and

wherein the passcode application uses the data element to generate the user OTP for the provider account.

18. The system of claim 15, further comprising:

an authenticating server configured to receive the user OTP; and

wherein the authenticating server is configured to provide an authorization result to one of a provider system and the user.

19. The system of claim 15, further comprising:

a user OTP counter configured to be received by the user device;

wherein the passcode application is configured to increment the user OTP counter;

wherein a provider system is configured to increment a provider OTP counter; and

one or the user device and the passcode application is configured to reset the user OTP counter to synchronize the user OTP counter and the provider OTP counter.

20. The system of claim 15, wherein the at least one camouflaged key is configured as a modified key encrypted with the PIN;

and

wherein the key which is modified is defined by the provider account and is configured as one of a symmetric key, a Data Encryption Standard (DES) key, an Advanced Encryption Standard (AES) key, a secret, a secret byte array, a seed, and a controlled datum.