AUTHENTICATING A DEVICE AND A USER

• US 20110191837A1
• Filed: 09/21/2009
• Published: 08/04/2011
• Est. Priority Date: 09/26/2008
• Status: Active Grant

• Current Assignee: Koninklijke Philips N.V.
• Original Assignee: Koninklijke Philips Electronics N.V. (Koninklijke Philips N.V.)
• Inventors: Petkovic, Milan, Guajardo Merchan, Jorge
• Granted Patent: US 9,158,906 B2
• Time in Patent Office: Days
• US Class Current: 726/6
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user
• CPC Class Codes: G09C 1/00 Apparatus or methods whereby a given sequence of signs, e.g. an intelligible text, is transformed into an unintelligible sequence of signs by transposing the signs or groups of signs or by replacing them by others according to a predetermined system cryptographic typewriters G09C3/00
• CPC Class Codes: H04L 2209/88 Medical equipments
• CPC Class Codes: H04L 9/0866 involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
• CPC Class Codes: H04L 9/3278 using physically unclonable functions [PUF]

Abstract

A method of authenticating a device and a user comprises receiving a user input, generating a first key from the user input, performing a physical measurement of the device, obtaining helper data for the device, computing a second key from the physical measurement and the helper data, and performing an operation using the first and second keys. In a preferred embodiment, the method comprises performing a defined function on the first and second keys to obtain a third key. Additionally security can be provided by the step of receiving a user input comprising performing a biometric measurement of the user and the step of generating a first key from the user input comprises obtaining helper data for the user and computing the first key from the biometric measurement and the user helper data.

Claims

1. A method of authenticating a device (10) and a user (20) comprising:

receiving a user input (28, 34),

generating a first key (40) from the user input (28, 34),

performing a physical measurement (36) of the device (10),

obtaining helper data (42) for the device (10),

computing a second key (44) from the physical measurement (36) and the helper data (44), and

performing an operation (46) using the first and second keys (40, 44).

2. A method according to claim 1, wherein the step of performing an operation (46) using the first and second keys (40, 44) comprises performing a defined function on the first and second keys (40, 44) to obtain a third key.

3. A method according to claim 1, wherein the step of receiving a user input (28) comprises receiving a password (28) and the step of generating a first key (40) from the user input (28) comprises computing the first key (40) from the password (28).

4. A method according to claim 1, wherein the step of receiving a user input (34) comprises performing a biometric measurement (34) of the user (20) and the step of generating a first key (40) from the user input (34) comprises obtaining helper data (38) for the user (20) and computing the first key (40) from the biometric measurement (34) and the user helper data (38).

5. A method according to claim 4, wherein the step of obtaining helper data (42) for the device (10) comprises computing the helper data (42) from the first key (40) and a stored component.

6. A method according to claim 1, and further comprising obtaining a user share, obtaining a device share, and performing a defined function on the user share, device share, first and second keys (40, 44) to obtain a third key.

7. A system for authenticating a device (10) and a user (20) comprising:

a user interface (32) arranged to receive a user input (28, 34),

a query component arranged to perform a physical measurement (36) of the device (10), and

a processing component (30) connected to the user interface (32) and the query component, and arranged to generate a first key (40) from the user input (28, 34), to obtain helper data (42) for the device (10), to compute a second key (44) from the physical measurement (36) and the helper data (42), and to perform an operation (46) using the first and second keys (40, 44).

8. A system according to claim 7, wherein the processing component (30) is arranged, when performing an operation (46) using the first and second keys (40, 44), to perform a defined function on the first and second keys (40, 44) to obtain a third key.

9. A system according to claim 7, wherein the user input (28) comprises a password (28) and the processing component (30) is arranged, when generating a first key (40) from the user input (28), to compute the first key (40) from the password (28).

10. A system according to claim 7, wherein the user input (34) comprises a biometric measurement (34) of the user (20) and the processing component (30) is arranged, when generating a first key (40) from the user input (34), to obtain helper data (38) for the user (20) and to compute the first key (40) from the biometric measurement (34) and the user helper data (38).

11. A system according to claim 10, wherein the processing component (30) is arranged, when obtaining helper data (42) for the device (10), to compute the helper data (42) from the first key (40) and a stored component.

12. A system according to claim 7, wherein the processing component (30) is further arranged to obtain a user share, obtain a device share, and to perform a defined function on the user share, device share, first and second keys (40, 44) to obtain a third key

13. A system according to claim 7, wherein the user interface, the query component and the processing component are contained within a single device.

14. A system according to claim 7, wherein the user interface (32), the query component (10) and the processing component (30) are distributed across a plurality of devices.

15. A method of registering a device (10) and a user (20) comprising:

receiving a user input (28, 34),

generating a first key (40) from the user input (28, 34),

performing a physical measurement (36) of the device (10),

generating a second key (44) and helper data (42) for the device (10) from the physical measurement (36),

performing an operation (46) using the first and second keys (42, 44), and transmitting an output of the operation (46) to a remote data store.

16. A method according to claim 15, wherein the step of receiving a user input (34) comprises performing a biometric measurement (34) of the user (20) and the step of generating a first key (40) from the user input (34) includes generating helper data (38) for the user (20).

17. A system for registering a device (10) and a user (20) comprising:

a user interface (32) arranged to receive a user input (28, 34),

a query component arranged to perform a physical measurement (36) of the device (10), and

a processing component (30) arranged to generate a first key (40) from the user input (28, 34), to generate a second key (44) and helper data (42) for the device (10) from the physical measurement (36), to perform an operation (46) using the first and second keys (40, 44), and to transmit an output of the operation (46) to a remote data store.

18. A system according to claim 17, wherein the user input (34) comprises a biometric measurement (34) of the user (20) and the processing component (30) is further arranged, when generating a first key (40) from the user input (34), to generate helper data (38) for the user (20).