System and method for acoustic two factor authentication

• US 20030159050A1
• Filed: 05/06/2002
• Published: 08/21/2003
• Est. Priority Date: 02/15/2002
• Status: Active Grant

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: Gantman, Alexander, Rose, Gregory G.
• Granted Patent: US 7,966,497 B2
• Time in Patent Office: Days
• US Class Current: 713/184
• CPC Class Codes: G06Q 20/3272 using an audio code
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/346 Cards serving only as information carrier of service
• CPC Class Codes: G06Q 20/367 involving electronic purses or money safes
• CPC Class Codes: G06Q 20/3672 initialising or reloading thereof
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G06Q 20/40975 using encryption therefor
• CPC Class Codes: G07F 19/20 Automatic teller machines [ATMs]
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: G07F 7/1016 Devices or methods for securing the PIN and other transaction-data, e.g. by encryption arrangements for secret communication, see H04L9/00
• CPC Class Codes: G07F 7/1025 Identification of user by a PIN code
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/65 : Environment-dependent, e.g. using captured environmental data

Abstract

A hand-held token can be operated to generate an acoustic or other wireless signal representing a digital signature produced from the private key of a public key/private key pair, with the public key being confidential in that it is known only to authorized entities, such as bank computers. The signal from the token can be received by, e.g., a receiver at a bank ATM that also requires a PIN for account access. The user enters the PIN into the ATM, and the ATM encrypts the signal from the token with the PIN and sends it on to the bank computer over a link that need not be secure, since even if the PIN is guessed there is no way to verify that it is the correct PIN without also knowing the confidential public key held by the bank computer.

Claims

1. A method for authentication, comprising:

providing at least a PIN and a confidential public key to an authorizing computer;

establishing a communication link between the authorizing computer and at least one receiver remote from the computer, the communication link not being constrained to be secure;

receiving, at the receiver, at least one acoustic signal representative of at least one private key-generated signal, the receiver transforming the acoustic signal to a signature signal;

receiving, at the receiver, the PIN, the PIN being received separately from the acoustic signal;

encrypting the signature signal with the PIN to render an encrypted signature signal; and

sending the encrypted signature signal to the authorizing computer for verification of the signature using the PIN and confidential public key.

2. The method of claim 1, wherein the act of encrypting is undertaken at the receiver.

3. The method of claim 1, comprising transmitting the acoustic signal using a hand-held token.

4. The method of claim 1, further comprising inputting a desired transaction to the receiver, the authorizing computer authorizing the receiver to execute the transaction only if the signature is verified.

5. The method of claim 1, wherein the signature is verified by:

decrypting the encrypted signature signal using the PIN to render the signature signal;

then

verifying the signature signal using the confidential public key.

6. The method of claim 3, wherein the token generates a signature signal by combining at least one message with the private key.

7. The method of claim 6, wherein the message includes at least a portion of at least one timestamp.

8. The method of claim 7, wherein the portion of the timestamp is a predetermined number of least significant bits of a timestamp having more bits than the predetermined number.

9. A system for two-factor authentication over a link not constrained to be secure, comprising:

at least one portable token generating at least one wireless signal representing a digitally signed message;

at least one receiver receiving the wireless signal and a PIN, the PIN being received separately from the wireless signal, the receiver encrypting the signed message with the PIN to render an encrypted signed message; and

at least one authorizing computer receiving at least the encrypted signed message over the link, the authorizing computer accessing the PIN and a confidential public key to attempt to verify the signed message.

10. The system of claim 9, wherein the wireless signal also represents at least an ID of a confidential public key and a message that was signed by a private key corresponding to the public key to render the digitally signed message.

11. The system of claim 10, wherein the receiver sends the encrypted signed message, ID, and message that was signed to the authorizing computer.

12. The system of claim 10, wherein the authorizing computer decrypts the encrypted signed message using the PIN and then verifies the signed message by accessing the confidential public key using the ID and using the confidential public key.

22. The system of claim 9, wherein the wireless signal is an acoustic signal.

13. A system for authentication including an authorizing computer accessing at least a PIN and a confidential public key and communicating over a link with at least one receiver remote from the computer, the communication link not being constrained to be secure, the system comprising:

means for receiving, at the receiver, at least one wireless signal representative of at least one digital signature produced from a private key, the receiver transforming the wireless signal to a signature signal;

means for receiving, at the receiver, the PIN; and

means for encrypting the signature signal with the PIN to render an encrypted signature signal, wherein the encrypted signature signal is sent to the authorizing computer over the link for verification of the signature using the PIN and confidential public key.

14. The system of claim 13, wherein the means for encrypting are at the receiver.

15. The system of claim 13, comprising means for transmitting the wireless signal using a hand-held token.

16. The system of claim 13, further comprising means for inputting a desired transaction to the receiver, the authorizing computer authorizing the receiver to execute the transaction only if the signature is verified.

17. The system of claim 13, comprising:

means for decrypting the encrypted signature signal using the PIN to render the signature signal; and

means for verifying the signature signal using the confidential public key.

18. The system of claim 15, wherein the token generates a signature signal by combining at least one message with the private key.

19. The system of claim 18, wherein the message includes at least a portion of at least one timestamp.

20. The system of claim 18, wherein the message is further combined with a pseudorandom number.

21. The system of claim 13, wherein the wireless signal is an acoustic signal.