Dual-interface key management

• US 8,689,013 B2
• Filed: 10/20/2010
• Issued: 04/01/2014
• Est. Priority Date: 10/21/2008
• Status: Active Grant

• Current Assignee: Habraken G. Wouter
• Original Assignee: Habraken G. Wouter
• Inventors: Habraken, G. Wouter
• Primary Examiner(s): Shiferaw, Eleni
• Assistant Examiner(s): SIMS, JING F
• Application Number:
  US12/908,332
• Publication Number:
  US 20110035604A1
• Time in Patent Office: 1,259 Days
• Field of Search: 713193-194, 726 26- 30, 726 2- 3, 365/185.01, 711163-164
• US Class Current: 713/193
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06Q 20/327 Short range or proximity payments by means of M-devices
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/352 Contactless payments by cards
• CPC Class Codes: G06Q 20/409 Device specific authentication in transaction processing
• CPC Class Codes: G06Q 20/40975 using encryption therefor
• CPC Class Codes: G07C 2009/00388 code verification carried out according to the challenge/response method
• CPC Class Codes: G07C 2009/00412 the transmitted data signal being encrypted
• CPC Class Codes: G07C 2009/00793 by Hertzian waves
• CPC Class Codes: G07C 9/22 in combination with an identity check of the pass holder
• CPC Class Codes: G07F 7/08 by coded identity card or credit card or other personal identification means without personal verification means G07F7/02
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: G07F 7/1016 Devices or methods for securing the PIN and other transaction-data, e.g. by encryption arrangements for secret communication, see H04L9/00

Abstract

In one embodiment, a device includes a first interface, a second interface, a memory, and a processor coupled to the first and second interfaces and to the memory. The processor is configured to receive key-management information via the second interface, and to store the key-management information in a protected portion of the memory as stored key-management information. The processor is also configured to perform a challenge-response authentication interaction via the first interface. The challenge-response authentication interaction is based at least in part on the stored key-management information. The device is configured to prevent data in the protected portion of the memory from being modified in response to information received via the first interface.

Claims

1. A system comprising an access card, the access card comprising:

an interface;

a memory; and

a processor coupled to the interface and to the memory, wherein

the processor is configured to;

receive challenge data, according to an authentication protocol, via the interface of the access card, wherein

the challenge data is received in lieu of a challenge,

the challenge comprises one or more random numbers, and

the challenge is processed to generate a response according to the authentication protocol,

obtain key-management information from the challenge data, wherein the processor is configured to obtain the key-management information by

extracting encrypted key-management information by processing the challenge data, and

retrieving the key-management information by decrypting the encrypted key-management information, and

store the key-management information in the memory of the access card.

2. The system of claim 1, wherein

the challenge data is comprised in a public key infrastructure (PKI) authentication request;

and

the processor is configured to request a PKI authentication of a provider of the key-management information.

3. The system of claim 1, wherein the processor is configured to:

generate another response to the key-management information; and

transmit the another response in the form of a second challenge data to a provider of the key-management information.

4. The system of claim 1, wherein

the key-management information is encrypted within the challenge data.

5. The system of claim 1, wherein

the processor is further configured to generate another response based on the challenge data.

6. The system of claim 1, wherein

the authentication protocol is a secure socket layer (SSL) protocol that uses client certificate authentication,

the processing the challenge data comprises

using the client certificate authentication to perform the extracting of the encrypted key-management information.

7. The system of claim 1, wherein

the processor is further configured to

receive, according to the authentication protocol, the challenge, and

generate the response by decrypting, according to the authentication protocol, the challenge.

8. The system of claim 1, wherein

another key is encrypted within the challenge data,

the another key is used in a generation of an access request, and

the access request comprises a request for authentication.

9. The system of claim 1, wherein

the authentication protocol comprises a PKI protocol, and

the processing the challenge data comprises

using a cryptographic key according to the PKI protocol.

10. A method comprising:

receiving, by an access card, challenge data according to an authentication protocol, wherein

the receiving is performed via an interface,

the challenge data is received in lieu of a challenge,

the challenge comprises one or more random numbers, and

the challenge is processed to generate a response according to the authentication protocol;

obtaining, by the access card, key-management information from the challenge data,

wherein

the obtaining comprises

extracting encrypted key-management information by processing the challenge data, and

retrieving the key-management information by decrypting the encrypted key-management information; and

storing, by the access card, the key-management information in a memory of the access card.

11. The method of claim 10, wherein

the challenge data is comprised in a public key infrastructure (PKI) authentication request;

and

the method further comprises

requesting a PKI authentication of a provider of the key-management information.

12. The method of claim 10, further comprising:

generating another response to the key-management information; and

transmitting the another response in the form of a second challenge data to a provider of the key-management information.

13. The method of claim 10, wherein

the key-management information is encrypted within the challenge data.

14. The method of claim 10, further comprising:

generating another response based on the challenge data.

15. The method of claim 10, wherein

the authentication protocol is a secure socket layer (SSL) protocol that uses client certificate authentication,

the processing the challenge data comprises

using the client certificate authentication to perform the extracting of the encrypted key-management information.

16. The method of claim 10, wherein

another key is encrypted within the challenge data,

the another key is used in a generation of an access request, and

the access request comprises a request for authentication.

17. The method of claim 10, wherein

the authentication protocol comprises a PKI protocol, and

the processing the challenge data comprises

using a cryptographic key according to the PKI protocol.

18. The method of claim 10, further comprising:

receiving, according to the authentication protocol, the challenge; and

generating a response by decrypting, according to the authentication protocol, the challenge.

19. The computer program product of claim 18, wherein

the challenge data is comprised in a public key infrastructure (PKI) authentication request;

and

the plurality of instructions further comprise

a fourth set of instructions, executable on the computer system, configured to request a PKI authentication of a provider of the key-management information.

20. A computer program product comprising a non-transitory computer-readable medium storing:

a plurality of instructions, comprising;

a first set of instructions, executable on a computer system, configured to receive, by an access card, challenge data according to an authentication protocol, wherein

the challenge data is received in lieu of a challenge,

the challenge comprises one or more random numbers,

according to the authentication protocol, the challenge is processed to generate a response, and

the receiving is performed via an interface,

a second set of instructions, executable on the computer system, configured to obtain, by the access card, key-management information from the challenge data, wherein

the second set of instructions is further comprises instructions executable and configured to perform the obtaining the key-management information by

extracting encrypted key-management information by processing the challenge data, and

retrieving the key-management information by decrypting the encrypted key-management information; and

a third set of instructions, executable on the computer system, configured to store, by the access card, key-management information in a memory of the access card.

21. The computer program product of claim 20, wherein the plurality of instructions further comprise:

a fourth set of instructions, executable on the computer system, configured to

generate another response to the key-management information, and

a fifth set of instructions, executable on the computer system, configured to

transmit the another response in the form of a second challenge data to a provider of the key-management information.

22. The computer program product of claim 20, wherein the key-management information is encrypted within the challenge data.

23. The computer program product of claim 20, wherein the plurality of instructions further comprise:

a fourth set of instructions, executable on the computer system, configured to generate another response based on the challenge data.

24. The computer program product of claim 20, wherein

the authentication protocol is a secure socket layer (SSL) protocol that uses client certificate authentication,

wherein the second set of instructions is further executable and configured to use the client certificate authentication to perform the extracting of the encrypted key-management information.

25. The computer program product of claim 20, wherein

another key is encrypted within the challenge data,

the another key is used in a generation of an access request, and

the access request comprises a request for authentication.

26. The computer program product of claim 20, wherein

the authentication protocol comprises a PKI protocol, and wherein

the processing the challenge data comprises

using a cryptographic key according to the PKI protocol.

27. The computer program product of claim 20,

wherein the plurality of instructions further comprise:

a fourth set of instructions, executable on the computer system, configured to receive, according to the authentication protocol, the challenge, and

a fifth set of instructions, executable on the computer system, configured to generate the response by decrypting, according to the authentication protocol, the challenge.

28. An access card comprising:

an interface;

a memory; and

a processor coupled to the interface and to the memory, wherein

the processor is configured to

receive challenge data, according to an authentication protocol, via the interface, wherein

the challenge data is received in lieu of a challenge,

the challenge comprises one or more random numbers,

the challenge data comprises encrypted key-management information, and

the challenge is processed to generate a response according to the authentication protocol,

obtain key-management information from the challenge data, wherein

the processor is configured to obtain the key-management information by

retrieving the key-management information from the challenge data by decrypting the encrypted key-management information, and

store the key-management information in the memory of the access card.

29. The access card of claim 28, wherein

the challenge data is comprised in a public key infrastructure (PKI) authentication request;

and

the processor is configured to request a PKI authentication of a provider of the key-management information.

30. The access card of claim 28, wherein the processor is further configured to:

generate another response to the key-management information; and

transmit the another response in the form of a second challenge data to a provider of the key-management information.

31. The access card of claim 28, wherein

the processor is further configured to generate another response based on the challenge data.

32. The access card of claim 28, wherein

the authentication protocol is a secure socket layer (SSL) protocol that uses client certificate authentication.

33. The access card of claim 28, wherein

the processor is further configured to

receive, according to the authentication protocol, the challenge, and

generate the response by decrypting, according to the authentication protocol, the challenge.

34. The access card of claim 28, wherein

another key is encrypted within the challenge data,

the another key is used in a generation of an access request, and

the access request comprises a request for authentication.

35. The access card of claim 28, wherein

the authentication protocol comprises a PKI protocol.