Method for providing a user with an authenticated remote access to a remote secure device

• US 9,401,916 B2
• Filed: 11/18/2011
• Issued: 07/26/2016
• Est. Priority Date: 11/30/2010
• Status: Active Grant

• Current Assignee: Thales DIS France SA (Thales SA)
• Original Assignee: Gemalto SA (Thales SA)
• Inventors: Ganem, Herve
• Primary Examiner(s): Zhao, Don
• Application Number:
  US13/990,598
• Publication Number:
  US 20130247163A1
• Time in Patent Office: 1,712 Days
• Field of Search: 726/3, 726/7
• US Class Current: 1/1
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06F 21/43 wireless channels
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications

Abstract

The invention relates to a method for providing a user with an authenticated remote access to a remote secure device (2), said remote access being initiated from a local accessing device (1), said remote secure device (2) embedding secure data related to a specific service, characterized in that it comprises establishing a mutual authentication between said remote secure device (2) and a local secure device (3) different from the local accessing device (1) so as the user of the local accessing device (3) is able to access to the secure data of the remote secure device (2).

Claims

1. A method for providing a user with an authenticated remote access to a remote service device using two-factor authentication of the user, the user having a local accessing device, said remote access being initiated from the local accessing device, the method comprising:

establishing a mutual authentication between a remote secure device embedded in the remote service device, wherein the remote secure device is a secure element, and a local secure device, wherein the local secure device is a Universal Integrated Circuit Card (UICC), connected to a terminal distinct from the local accessing device so as to authenticate the user of the local accessing device thereby enabling the user access to secure data provided by the remote service device via the local accessing device, by;

establishing a secure communication channel between the local accessing device and the remote secure device so as to provide a one way authentication, said local accessing device authenticating the remote secure device;

using a peer application in the remote secure device and a peer application in the local secure device so as the two peer applications negotiate establishment of a data session between the remote secure device and the local secure device;

further using the peer application in the remote secure device and the peer application in the local secure device to mutually authenticate thereby providing a what-you-have authentication factor;

providing, by the remote secure device, the local secure device with a user interface after the establishment of said data session between the remote secure device and the local secure device;

operating a UICC application on the terminal to which the local secure device is connected to display the user interface from the local secure device onto the terminal;

authenticating the user to the remote secure device using the user interface from the local secure device and displayed on the terminal to which the local secure device is connected thereby providing a what-you-know authentication factor; and

upon authenticating the user and the local secure device, providing the user of the local access device access to the secure data provided by the remote service device.

2. The method according to claim 1, wherein the remote secure device contacts the local secure device using SIP protocol.

3. The method according to claim 2, wherein a storage area network is used as the remote service device.

4. The method according to claim 2, wherein a laptop PC is used as the local accessing device.

5. The method according to claim 1, wherein the authenticating the user to the remote secure device using the user interface on the terminal to which the local secure device is connected comprises capturing a PIN code entered by the user on said terminal via the user interface provided by the remote secure device to the local secure device and sending back said PIN code to the remote secure device for verification.

6. The method according to claim 5, wherein the remote secure device grants access to the secure data of the remote service device to the local accessing device after checking the PIN code entered on said terminal.

7. The method according to claim 1, wherein a storage area network is used as the remote service device.

8. The method according to claim 1, wherein a laptop PC is used as the local accessing device.