Security Token and Authentication System

• US 20130086389A1
• Filed: 09/26/2012
• Published: 04/04/2013
• Est. Priority Date: 09/30/2011
• Status: Active Grant

• Current Assignee: NXP B.V. (NXP Semiconductors NV)
• Original Assignee: NX BV
• Inventors: Suwald, Thomas
• Granted Patent: US 9,898,695 B2
• Time in Patent Office: Days
• US Class Current: 713/185
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: G06F 21/77 in smart cards
• CPC Class Codes: G06F 21/83 input devices, e.g. keyboards, mice or controllers thereof
• CPC Class Codes: G06F 3/04883 for inputting data by handwriting, e.g. gesture or text
• CPC Class Codes: G06K 19/07354 by biometrically sensitive means, e.g. fingerprint sensitive fingerprint sensors in general G06V40/12; biometrically activated access control G07C9/25
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/352 Contactless payments by cards
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: G07F 7/084 Additional components relating to data transfer and storing, e.g. error detection, self-diagnosis
• CPC Class Codes: G07F 7/0846 On-card display means
• CPC Class Codes: G07F 7/0853 On-card keyboard means
• CPC Class Codes: G07F 7/1058 PIN is checked locally

Abstract

Techniques are provided for entering a secret into a security token using an embedded tactile sensing user interface with the purpose of verifying the secret against a stored representation of the same secret. In particular, an embodiment of the security token according to the invention comprises a tactile sensing user interface being arranged to receive a user-encoded secret, a decoding unit being arranged to generate a decoded secret by decoding the user-encoded secret, a comparison unit being arranged to compare the decoded secret with a copy of the secret stored in the token in order to verify the authenticity of a user. Thereby, the security token provides on-card matching functionality.

Claims

1. A security token comprising:

a tactile sensing user interface being arranged to receive a user-encoded secret;

a decoding unit being arranged to generate a decoded secret by decoding the user-encoded secret;

a comparison unit being arranged to compare the decoded secret with a copy of the secret stored in the token in order to verify the authenticity of a user.

2. The security token as claimed in claim 1,

wherein the tactile sensing user interface is arranged to capture tactile patterns and to provide a tactile pattern data stream which represents the user-encoded secret and which comprises a sequence of said tactile patterns to the decoding unit;

wherein the decoding unit is arranged to generate the decoded secret by applying a private inverse transfer function to the tactile pattern data stream;

wherein the private inverse transfer function is the inverse of a private transfer function applied by the user to encode the secret.

3. The security token as claimed in claim 2,

wherein the private inverse transfer function is definable by the user via the tactile sensing user interface in a configuration mode of the token.

4. The security token as claimed in claim 3,

wherein the private inverse transfer function further reflects user-specific tactile pattern deviations captured by the tactile sensing user interface in the configuration mode of the token, such that the entropy of the user-encoded secret is increased.

5. The security token as claimed in claim 3,

wherein the private inverse transfer function further reflects sensor-device-specific tactile pattern deviations applied by the tactile sensing user interface in the configuration mode of the token, such that the entropy of the user-encoded secret is increased.

6. The security token claimed in claim 2,

further comprising a release foil with printed tactile key information for defining the private inverse transfer function.

7. The security token as claimed in claim 1,

wherein the tactile sensing user interface comprises an array of proximity sensors or mechanical pressure sensors.

8. The security token as claimed in claim 1,

wherein the tactile sensing user interface comprises a mesh network of proximity sensing capacitors.

9. The security token as claimed in claim 7,

wherein the proximity sensors comprise one of the group of:

proximity sensing capacitors, proximity sensing resistors, surface acoustic wave sensors, infra-red light sources and optical receivers.

10. The security token as claimed in claim 9,

further comprising a compressible layer on which the array of proximity sensing capacitors is mounted;

further comprising counter-electrodes underneath the compressible layer;

wherein said counter-electrodes form pressure-dependent capacitances in conjunction with the proximity sensing capacitors.

11. The security token as claimed in claim 7,

further comprising button functions assigned to sub-areas of an area covered by the array of proximity sensors or mechanical pressure sensors;

and

further comprising a surface print design which provides a visual overview of said button functions.

12. The security token as claimed in claim 2,

wherein the user-encoded secret comprises a personal identification number and the private inverse transfer function translates elements of a user-defined character repertoire to digits of the personal identification number;

and wherein the user-defined character repertoire comprises at least one of the group of;

alphanumeric character tactile patterns corresponding to said digits, key position tactile patterns corresponding to said digits, graphical symbol tactile patterns corresponding to said digits.

13. The security token as claimed in claim 2,

wherein the user-encoded secret comprises a signature short-cut and the private inverse transfer function decodes a tactile pattern which represents said signature short-cut.

14. The security token as claimed in claim 1,

further comprising at least one of the group of:

a feedback indicator, a status indicator, a display, an audio output.

15. The security token as claimed in claim 1,

further comprising a display, the display comprising at least one of the group of:

icons, segments, active areas that have been structured by a printed shadow mask.

16. The security token as claimed in claim 1,

further comprising a backchannel implemented by a program element, such as a Java-applet, for communicating with a host system such that the token may use a display of the host system as a virtual display.

17. The security token as claimed in claim 1,

the token being arranged to receive power for operating the tactile sensing user interface, the decoding unit and the comparison unit from an external electromagnetic field.

18. The security token as claimed in claim 1,

further comprising a radio frequency identification (RFID) interface being arranged to enable communication with RFID devices and NFC-enabled devices and being arranged to receive power from an electromagnetic field generated by said RFID devices or NFC-enabled devices.

19. The security token as claimed claim 1,

further comprising a power unit being arranged to power the token from an external electromagnetic field;

wherein the power unit comprises one or more super capacitors for buffering energy;

wherein said super capacitors consist of electrochemical double-layer capacitors with an energy density substantially greater than the energy density of conventional electrolytic capacitors, in particular hundreds of times greater than the energy density of conventional electrolytic capacitors.

20. The security token as claimed in claim 1,

further comprising a tapped antenna structure or an antenna with at most three turns in order to maximize the efficiency of power coupling to the token.

21. The security token as claimed in claim 1,

further comprising an optical communication interface which is arranged to establish a secure backchannel;

wherein the optical communication interface is embedded into the body of the token.

22. The security token as claimed in claim 1,

wherein the surface of the token is overlaid by the tactile sensing user interface such that tactile patterns entered by a user are sensed through said surface.

23. The security token as claimed in claim 1,

wherein the tactile sensing user interface comprises a key-pad layout.

24. The security token as claimed in claim 1,

the token being an electronic identification card or an electronic passport.

25. The security token as claimed in claim 1,

the token having a portrait form factor.

26. An authentication system comprising an authentication server and a security token as claimed in claim 1,

wherein the security token is further arranged to send a verification result to the authentication server.

28. The authentication system as claimed in claim 26,

said authentication system selected from the group consisting of:

a governmental service, a web shop service, an online auction service, an online gaming service, an online banking service, an online media service, an online airline service, a car access system, a door lock system, an in-flight payment service, a flight attendant panel, a mobile phone based identification system, a mobile phone based payment system, and a software license control system.

27. An authentication system comprising an authentication server and a security token,

wherein the security token comprises:

a tactile sensing user interface being arranged to receive a user-encoded secret;

a decoding unit being arranged to generate a decoded secret by decoding the user-encoded secret;

an encryption unit being arranged to encrypt the decoded secret order to generate an encrypted decoded secret;

wherein the security token is further arranged to send the encrypted decoded secret to the authentication server;

wherein the authentication server comprises;

a decryption unit being arranged to decrypt the encrypted decoded secret;

a comparison unit being arranged to compare the decoded secret with a copy of the secret stored in the authentication server in order to verify the authenticity of a user.