Device and method for identification and authentication

• US 8,806,586 B2
• Filed: 04/23/2007
• Issued: 08/12/2014
• Est. Priority Date: 04/24/2006
• Status: Active Grant

• Current Assignee: Yubico AB
• Original Assignee: Yubico, Inc. (Yubico AB)
• Inventors: Ehrensvrd, Jakob, Ehrensvrd, Stina
• Primary Examiner(s): Siddiqi, Mohammad A
• Application Number:
  US12/669,929
• Publication Number:
  US 20100199334A1
• Time in Patent Office: 2,668 Days
• Field of Search: 726/5, 713/168, 713/182
• US Class Current: 726/5
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions

Abstract

A device for identification and authentication of a remote user connecting to a service over a network includes a cryptographic processor and at least one cryptographic key and storage means, additional processing means and interface means to generate and transmit a unique authentication code as emulated keystrokes through a standard input, means of a client terminal. The code may be transmitted only by an explicit command of the user.

Claims

1. A method for generating an output code from a user device, comprising:

receiving, by the user device, an explicit command to generate the output code;

generating, by the user device in response to the explicit command, the output code using a cryptographic key, wherein generating the output code comprises;

comparing a unique identifier with information stored in a pre-determined template, the unique identifier identifying a holder of the user device and the information identifying one or more holders of the user device; and

responsive to the unique identifier matching the information stored in the pre-determined template, generating a dynamic authentication code associated with the unique identifier of the holder of the user device;

wherein the dynamic authentication code comprises a session identifier, a session counter and a timestamp of a plurality of variant fields, and the dynamic authentication code is variant and unique from other dynamic authentication codes generated by the user device and has characteristics that provide an indicator of potentially fraudulent usage of the user device;

translating the generated output code into a plurality of emulated keystrokes; and

outputting the plurality of emulated keystrokes from the user device to an input of a client device.

2. The method of claim 1, wherein the cryptographic key used in generating the output code is stored in the user device and is uniquely associated with the user device.

3. The method of claim 1, further comprising:

concatenating the unique identifier with the dynamic authentication code to generate a concatenated code sequence; and

applying the cryptographic key to the concatenated code sequence to generate an alphanumeric representation as the output code.

4. The method of claim 1, wherein the plurality of variant fields comprise:

a session identifier associated with the unique identifier of the holder of the user device;

a session counter, the session counter incremented by one in response to an output code generated by the user device;

a timestamp linearly incremented by a predetermined frequency;

a random number; and

a checksum indicating whether a valid encryption key is used to generate the dynamic authentication code.

5. The method of claim 1, wherein the unique identifier identifying the holder of the user device comprises at least one of:

a personal identification number;

a combination of user name and password;

a key sequence comprising a plurality of keystrokes of a keyboard;

a fingerprint of the holder of the device;

a sample of voice of the holder of the device; and

a sample of biometric scanning data from the holder of the device.

6. The method of claim 1, further comprising:

intercepting an output message comprising a plurality of keystrokes entered by the holder of the user device on a keyboard connected to the user device, the output message known to the holder of the user device only.

7. The method of claim 1, further comprising:

intercepting an output message comprising a plurality of keystrokes entered by the holder of the user device on a keyboard connected to the user device, the output message known to the holder of the user device only.

8. A user device for providing an output code, comprising:

a computer processor for executing computer program modules; and

a non-transitory computer readable storage device storing computer program modules executable to perform steps comprising;

receiving an explicit command to generate the output code;

generating, in response to the explicit command, the output code using a cryptographic key, wherein generating the output code comprises;

comparing a unique identifier with information stored in a pre-determined template, the unique identifier identifying a holder of the user device and the information identifying one or more holders of the user device; and

responsive to the unique identifier matching the information stored in the pre-determined template, generating a dynamic authentication code associated with the unique identifier of the holder of the user device;

wherein the dynamic authentication code comprises a session identifier, a session counter and a timestamp of a plurality of variant fields, and the dynamic authentication code is variant and unique from other dynamic authentication codes generated by the user device and has characteristics that provide an indicator of potentially fraudulent usage of the user device;

translating the generated output code into a plurality of emulated keystrokes; and

outputting the plurality of emulated keystrokes from the user device to an input of a client device.

9. The device of claim 8, wherein the cryptographic key used in generating the output code is stored in the user device and is uniquely associated with the user device.

10. The device of claim 8, further comprising:

concatenating the unique identifier with the dynamic authentication code to generate a concatenated code sequence; and

applying the cryptographic key to the concatenated code sequence to generate an alphanumeric representation as the output code.

11. The device of claim 8, wherein the plurality of variant fields comprise:

a session identifier associated with the unique identifier of the holder of the user device;

a session counter, the session counter incremented by one in response to an output code generated by the user device;

a timestamp linearly incremented by a predetermined frequency;

a random number; and

a checksum indicating whether a valid encryption key is used to generate the dynamic authentication code.

12. The device of claim 8, wherein the unique identifier identifying the holder of the user device comprises at least one of:

a personal identification number;

a combination of user name and password;

a key sequence comprising a plurality of keystrokes of a keyboard;

a fingerprint of the holder of the device;

a sample of voice of the holder of the device; and

a sample of biometric scanning data from the holder of the device.