System and method for providing time-limited access to people, objects and services

• US 7,058,814 B1
• Filed: 09/28/2000
• Issued: 06/06/2006
• Est. Priority Date: 09/28/2000
• Status: Active Grant

• Current Assignee: X Corp. (f/k/a Twitter, Inc.) (X Holdings Corp.)
• Original Assignee: International Business Machines Corporation
• Inventors: Zimmerman, Thomas Guthrie
• Primary Examiner(s): Morse, Gregory
• Assistant Examiner(s): Ho, Thomas
• Application Number:
  US09/672,360
• Time in Patent Office: 2,077 Days
• Field of Search: 380/270, 380/36, 713/159, 713/171, 713/172, 713/185, 713/401, 713/501, 713/502, 713/503, 713/178, 342/357.1, 342/357.07, 342/357.08, 342/357.12, 705/32
• US Class Current: 713/178
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 9/3297 involving time stamps, e.g. generation of time stamps

Abstract

A limited tracking system and associated method that enable the use of personal encoded identification media to limit access to tracking information. The tracking system provides concurrent time-limited access to a large number of people, objects, information, services, and other resources, and has particular applicability to credit cards, dining cards, telephone calling cards, health cards, driver'"'"'s licenses, video store cards, car access cards, building access cards, computer access cards, and like identification badges or cards. The tracking system includes a transmitter module incorporated in a badge, and a receiver module incorporated in a secure server. The transmitter module contains an encryptor and a watch crystal that keeps track of time, such that the encryptor encrypts the current time with the user'"'"'s private key, and periodically transmits the encrypted current time to the receiver module, as a code list. The server stores the private keys of all the users, and, in turn, encrypts the current times of all the badges with the corresponding private keys of the users, to generate an authentication table. An authenticator compares the received code list to the authentication table, seeking matches that are indicative of the validity of the transmitting badges.

Claims

1. An identification system for use with an identification medium to provide time-limit access to a resource, comprising:

a transmitter module secured to the identification medium;

a receiver module in selective communication with the transmitter module;

the transmitter module including an encryptor and a time generator that generates a temporal sequence of values (T_Bn), wherein the encryptor encrypts the temporal sequence of values (T_Bn) with a private, non-public key K_n which is unique to the identification medium, to generate a code list composed of encrypted code elements (T_Bn)K_n;

wherein the transmitter module transmits one or more encrypted code elements (T_Bn)K_n to the receiver module;

an authenticator in communication with the receiver module that has access to a subset of the encrypted code elements of the code list; and

wherein the subset corresponds to a specific time window during which access to the resource is authorized, so that the authenticator is capable of authenticating the identification medium without resorting to the private key, and only during the specific time window corresponding to the subset of the encrypted code elements, by mapping the subset of the encrypted code elements (TBn)Kn, in order to enable time-limited access to the resource during the specific time window.

2. The identification system according to claim 1, for use with a plurality of identification media, each identification medium including a transmitter module and a unique private key for transmitting at least one or more of the encrypted code elements (T_Bn)K_n to the receiver module for authentication.

3. The identification system according to claim 2, further comprising a storage for storing the private keys of the plurality of identification media.

4. The identification system according to claim 3, wherein the receiver module provides unidirectional communication with at least one of the plurality of identification media.

5. The identification system according to claim 3, wherein upon authenticating the identification medium, the authenticator provides authentication information to an application for initiating the application.

6. The identification system according to claim 3, wherein the temporal sequence of values is measured from an initial synchronized starting point of each identification medium.

7. The identification system according to claim 1, wherein the temporal sequence of values is incremented in substantially equal time increments.

8. The identification system according to claim 1, wherein the encryptor encrypts the temporal sequence of values (T_Bn) and an offset time value (T_on) for each identification medium with a corresponding unique private key K_n to generate a list of authentication codes, En, as represented by the following expression:

En=(T_Bn+T_on)_Kn.

9. The identification system according to claim 8, wherein the transmitter module transmits at least one encrypted code element to the receiver module as a packet;

and

wherein the packet includes three fields;

a preamble field, a payload field, and a checksum field.

10. The identification system according to claim 9, wherein the preamble field contains data bits indicating that the packet is originating from a valid identification medium;

the payload field contains an encrypted code element (T_Bn)K_n; and

wherein the checksum field allows for checking transmission integrity.

11. The identification system according to claim 8, wherein the temporal sequence of values (T_Bn) is represented by the following expression;

(T_Bn)=T_system−

T_{n creation,}

where T_system represents current time for a server, and T_{n creation} represents a creation time of the identification medium referenced to a same time standard as T_system;

and wherein the server stores T_{n creation} for each identification medium.

12. The identification system according to claim 11, wherein the server establishes a clock synchronization window for the list of authentication codes, En, to account for time drift between the current time of the identification medium and a current time of the server.

13. The identification system according to claim 12, wherein the clock synchronization window is centered around the current time (T_Bn) of the identification medium, as shown by the following expressions:

En1=(T_Bn+T_on)_Kn,

En2=(T_Bn+T_on−

Epsilon)_Kn, and

En3=(T_Bn+T_on+Epsilon)_Kn,

wherein En1 is the authentication code when the identification medium is in general synchrony with the server;

wherein En2 is the authentication code when the identification medium lags the server; and

wherein En3 is the authentication code when the identification medium leads the server;

wherein Epilson is the resolution of the temporal sequence of values (T_Bn).

14. The identification system according to claim 1, wherein the transmitter module is incorporated in any one or more of:

an identification badge, a card, and a label.

15. The identification system according to claim 14, wherein the identification medium includes any one or more of:

a credit card, a dining card;

a telephone calling card;

a health card;

a driver'"'"'s license;

a video store card;

a car access card;

a computer access card;

or a building access card;

an identification tag, a key fob.

16. The identification system according to claim 1, further comprising a server that stores the private key.

17. The identification system according to claim 1, further comprising a local processor that stores the private key.

18. The identification system according to claim 1, wherein the receiver module is secured to the identification medium.

19. An identification system for use with an identification medium to provide time-limit access to a resource, comprising:

a transmitter module in communication with the identification medium;

a receiver module in selective communication with the transmitter module, for transmitting challenge values to the transmitter module;

the transmitter module including an encryptor and a time generator that generates a temporal sequence of values (T_Bn), wherein the encryptor encrypts the challenge values with a private key K_n which is unique to the identification medium, to generate a code list composed of the encrypted challenge values;

wherein the transmitter module transmits at least a part of the code list to the receiver module;

an authenticator in communication with the receiver module that has access to a subset of the encrypted challenge values; and

wherein the subset corresponds to a specific time window during which access to the resource is authorized, so that the authenticator is capable of authenticating the identification medium without resorting to the private key, and only during the specific time window corresponding to the subset of the encrypted challenge values, by mapping the subset of the encrypted challenge values, in order to enable time-limited access to the resource during the specific time window.

20. An identification system for use with an identification medium to provide time-limit access to a resource, comprising:

a transmitter module in communication with the identification medium;

a receiver module in selective communication with the transmitter module, wherein the transmitter module transmits a sequence of time varying values to the receiver module;

a local processor in communication with the receiver module, includes an encryptor and a time generator that generates a temporal sequence of values (T_Bn), wherein the encryptor encrypts the time varying values with a private key K_n which is unique to the identification medium, to generate a code list composed of the encrypted time varying values;

an authenticator in communication with the receiver module that has access to a subset of the encrypted time varying values; and

wherein the subset corresponds to a specific time window during which access to the resource is authorized, so that the authenticator is capable of authenticating the identification medium without resorting to the private key, and only during the specific time window corresponding to the subset of the encrypted time varying values, by mapping the subset of the encrypted time varying values, in order to enable time-limited access to the resource during the specific time window.