System and method for device registration and authentication

• US 8,984,276 B2
• Filed: 06/08/2012
• Issued: 03/17/2015
• Est. Priority Date: 01/10/2012
• Status: Active Grant

• Current Assignee: JP Morgan Chase Bank, N.A. (JP Morgan Chase & Co)
• Original Assignee: JP Morgan Chase Bank, N.A. (JP Morgan Chase & Co)
• Inventors: Benson, Glenn, Re, Salvatore Richard
• Primary Examiner(s): LE, CHAU D
• Application Number:
  US13/492,126
• Publication Number:
  US 20130179681A1
• Time in Patent Office: 1,012 Days
• Field of Search: 713/155
• US Class Current: 713/155
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06Q 20/047 using payment protocols involving electronic receipts
• CPC Class Codes: G06Q 20/38215 Use of certificates or encrypted proofs of transaction rights
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 2463/062 applying encryption of the keys cryptographic mechanisms or cryptographic arrangements for key distribution using key encryption key H04L9/0822
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/77 Graphical identity

Abstract

Systems and methods for device registration and authentication are disclosed. In one embodiment, a method for authentication of a device may include (1) receiving, at a mobile device, a first credential; (2) transmitting, over a network, the first credential to a server; (3) receiving, from the server, a first key and a first value, the first value comprising a receipt for the first credential; (4) receiving, at the mobile device, a data entry for a second credential; (5) generating, by a processor, a second key from the data entry; (6) retrieving, by the mobile device, a third credential using the first key and the second key; (7) signing, by the mobile device, the first value with the third credential; and (8) transmitting, over the network, the signed third value to the server.

Claims

1. A method for authentication of a device, comprising:

receiving, at a mobile device, a first credential;

transmitting, over a network, the first credential to a server;

receiving, from the server, a first key and a first value;

receiving, at the mobile device, a data entry for a second credential;

generating, by a processor, a second key from the data entry;

retrieving, by the mobile device, a third credential using the first key and the second key;

signing, by the mobile device, the first value with the third credential; and

transmitting, over the network, the signed first value to the server.

2. The method of claim 1, wherein the first credential comprises a biometric.

3. The method of claim 2, wherein the biometric is a voice biometric.

4. The method of claim 1, wherein the first credential comprises at least one of a value, a device footprint, and a geographic location for the device.

5. The method of claim 1, wherein the first key is a symmetric key.

6. The method of claim 1, wherein the second key is generated by applying a cryptographic hash function to the data entry.

7. The method of claim 1, wherein the second key is an asymmetric key.

8. The method of claim 1, wherein the third credential is encrypted with the second key, and further encrypted with the first key.

9. The method of claim 1, wherein the third credential is an asymmetric key.

10. The method of claim 1, wherein the second key is stored on one of removable memory, a fob, a token, and a USB device.

11. The method of claim 1, further comprising:

encrypting the first credential before transmitting the first credential to the server.

12. The method of claim 1, further comprising

generating, at the mobile device, a second value;

signing the second value with a device key; and

transmitting, to the server, the signed second value.

13. The method of claim 1, wherein the first value comprises a receipt for the first credential.

14. The method of claim 1, wherein the first value comprises a receipt for the first credential and at least one of a message digest for a transaction and a random number.

15. The method of claim 1, wherein the first value comprises a string to invalidate a transaction signature.

16. The method of claim 1, further comprising:

signing, by the mobile device, a second value with the third credential; and

transmitting, over the network, the signed second value to the server.

17. The method of claim 1, wherein the first credential is used with a second server.

18. The method of claim 1, wherein the third credential is used with a second server.

19. The method of claim 1, wherein the first credential and the third credential are used with a second server.

20. The method of claim 1, further comprising:

transmitting, over a second network, the first credential to a second server;

receiving, from the second server, a second server first key and a second server first value, the second server first value comprising a second server receipt for the first credential;

receiving, at the mobile device, a second data entry for a second server second credential;

generating, by the processor, a second server second key from the second data entry;

retrieving, by the mobile device, a second server third credential using the second server first key and the second server second key;

signing, by the mobile device, the second server first value with the second server third credential; and

transmitting, over the second network, the signed second server first value to the second server.

21. The method of claim 20, wherein the first credential comprises a biometric.

22. The method of claim 20, wherein the second server first key is a symmetric key, the second server second key is an asymmetric key, and the second server third credential is an asymmetric key.

23. The method of claim 1, further comprising:

receiving, at the mobile device, a second server first credential;

transmitting, over a second network, the second server first credential to a second server;

receiving, from the second server, a second server first key and a second server first value, the second server first value comprising a receipt for the second server first credential;

receiving, at the mobile device, a second data entry for a second server second credential;

generating, by the processor, a second server second key from the second data entry;

retrieving, by the mobile device, a second server third credential using the second server first key and the second server second key;

signing, by the mobile device, the second server first value with the second server third credential; and

transmitting, over the second network, the signed second server first value to the second server.

24. The method of claim 23, wherein the first credential and the second server first credential each comprise a biometric.

25. The method of claim 23, wherein the first credential and the second server first credential are the same type of biometric.

26. The method of claim 25, wherein the first credential and the second server first credential are both voice biometrics.

27. The method of claim 23, wherein the second server first key is a symmetric key, the second server second key is an asymmetric key, and the second server third credential is an asymmetric key.

28. A method for authentication of a device, comprising:

receiving, at a mobile device, a first credential;

transmitting, over a network, the first credential to a server;

receiving, from the server, a first key and a first value comprising a receipt for the first credential;

receiving, at the mobile device, a data entry for a second credential;

generating, by a processor, a second key from the data entry;

retrieving, by the mobile device, a third credential using the first key and the second key;

signing, by the mobile device, the first value with the third credential; and

transmitting, over the network, the signed first value to the server.

29. The method of claim 28, wherein the third credential is retrieved from a device that is separate from the mobile device.

30. The method of claim 28, wherein the third credential is retrieved from one of a token, a fob, a memory card, and a USB device.