Securing access to an application service based on a proximity token

• US 7,269,732 B2
• Filed: 06/05/2003
• Issued: 09/11/2007
• Est. Priority Date: 06/05/2003
• Status: Active Grant

• Current Assignee: SAP SE
• Original Assignee: SAP AG (SAP SE)
• Inventors: Kilian-Kehr, Roger
• Primary Examiner(s): Vu; Kim
• Assistant Examiner(s): Dada; Beemnet W
• Application Number:
  US10/454,824
• Publication Number:
  US 20040250074A1
• Time in Patent Office: 1,559 Days
• Field of Search: 726/9, 726/20, 380/270, 713/172, 713/185, 713/150, 713/169, 713/68, 709/225, 709/229
• US Class Current: 713/172
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G07C 9/22 in combination with an identity check of the pass holder
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/30 Security of mobile devices; Security of mobile applications
• CPC Class Codes: H04W 12/64 using geofenced areas
• CPC Class Codes: H04W 88/02 Terminal devices

Abstract

A system for providing secured access to an application service includes a security token that couples to the application service. The security token performs a first element of a cryptographic technique, such as, for example, encryption or decryption. A proximity token is provided that is associated with the security token. The proximity token performs a second element of the cryptographic technique to validate a communication between the application service and the security token. The proximity token is operable to validate the communication only when the proximity token is located within a predetermined validation distance from the security token or the application service. The security token may perform the first element of the cryptographic technique to verify that the proximity token has validated the communication between the application service and the security token. The system may be configured to provide secured access to the application service when the proximity token validates the communication and to prevent secured access to the application service when the proximity token does not validate the communication.

Claims

1. A computer-implemented method comprising:

receiving an instruction at an application service;

generating a command at the application service based upon the instruction;

communicating the command to a security token;

modifying the command at the security token using a first cryptographic technique;

communicating the modified command from the security token to the application service;

communicating the modified command from the application service to a proximity token;

transforming the modified command at the proximity token using a second cryptographic technique;

communicating the transformed command from the proximity token to the application service;

communicating the transformed command from the application service to the security token;

recovering the modified command from the transformed command at the security token using a third cryptographic technique;

recovering the command from the recovered modified command at the security token using a fourth cryptographic technique;

executing the recovered command at the security token to produce a result; and

communicating the result from the security token to the application service.

2. The computer-implemented method of claim 1, wherein modifying the command at the security token using the first cryptographic technique further comprises digitally signing the command at the security token.

3. The computer-implemented method of claim 1, wherein modifying the command at the security token using the first cryptographic technique further comprises encrypting the command at the security token.

4. The computer-implemented method of claim 1, wherein modifying the command at the security token using the first cryptographic technique further comprises applying a hashing algorithm to the command at the security token.

5. The computer-implemented method of claim 1, wherein recovering the command from the transformed command at the security token using the third cryptographic technique further comprises recovering the command using a cryptographic key shared by the proximity token, or a public key of the security token.

6. The computer-implemented method of claim 1, wherein the application service is a mobile telephone, a personal digital assistant, a pen-based computer, a notebook computer, a desktop computer, a workstation, an automated teller machine, a security system, a web browser, an enterprise client, a subscriber identity module toolkit browser, an email client, a synchronization client, an electronic purse or wallet, an instant messaging client, a business productivity application, an operating system, or an operating system kernel.

7. The computer-implemented method of claim 1, wherein the command is communicated to the proximity token via a short message service (SMS) communication, a wireless application protocol (WAP) communication, a transport connection protocol (TCP) communication, an Internet protocol (IP) communication, a World Wide Web (WWW) communication, a local area network (LAN) communication, a wireless LAN (WLAN) communication, a wide area network (WAN) communication, a public switched telephone network (PTSN) communication, an integrated services digital network (ISDN) communication, a digital subscriber line (DSL) communication, an advanced mobile telephone service (AMPS) communication, a global system for mobile communications (GSM) communication, a general packet radio service (GPRS) communication, a code division multiple access (CDMA) communication, a wideband CDMA (WCDMA) communication, a universal mobile telecommunications system (UTMS) communication, a radio communication, a cable communication, or a satellite communication.

8. The computer-implemented method of claim 1, further comprising storing a secret cryptographic key within the security token.

9. The computer-implemented method of claim 1, wherein the transformed command is communicated from the proximity token to the application service if the proximity token is within a predetermined distance from the application service.

10. The computer-implemented method of claim 1, wherein the transformed command is communicated from the proximity token to the application service if the command is received from the application service above a predetermined power.

11. The computer-implemented method of claim 1, wherein the first and second cryptographic techniques are the same cryptographic techniques.

12. A computer-implemented method comprising:

receiving an instruction at an application service;

generating a command at the application service based upon the instruction;

communicating the command to a security token;

executing the command at the security token to produce a result;

modifying the result at the security token using a first cryptographic technique;

communicating the modified result from the security token to the application service;

communicating the modified result from the application service to a proximity token;

transforming the modified result at the proximity token using a second cryptographic technique;

communicating the transformed result from the proximity token to the application service;

communicating the transformed result from the application service to the security token;

recovering the modified result from the transformed result at the security token using a third cryptographic technique;

recovering the result from the recovered modified result at the security token using a fourth cryptographic technique; and

communicating the recovered result from the security token to the application service.

13. The computer-implemented method of claim 12, wherein modifying the result at the security token using the first cryptographic technique further comprises digitally signing the command at the security token.

14. The computer-implemented method of claim 12, wherein modifying the result at the security token using the first cryptographic technique further comprises encrypting the command at the security token.

15. The computer-implemented method of claim 12, wherein modifying the result at the security token using the first cryptographic technique further comprises applying a hashing algorithm to the command at the security token.

16. The computer-implemented method of claim 12, wherein recovering the result from the modified result at the security token using the third cryptographic technique further comprises recovering the result using a cryptographic key shared by the proximity token, or a public key of the proximity token.

17. The computer-implemented method of claim 12, wherein the application service is a mobile telephone, a personal digital assistant, a pen-based computer, a notebook computer, a desktop computer, a workstation, an automated teller machine, a security system, a web browser, an enterprise client, a subscriber identity module toolkit browser, an email client, a synchronization client, an electronic purse or wallet, an instant messaging client, a business productivity application, an operating system, or an operating system kernel.

18. The computer-implemented method of claim 12, wherein the command is communicated to the proximity token via a short message service (SMS) communication, a wireless application protocol (WAP) communication, a transport connection protocol (TCP) communication, an Internet protocol (IP) communication, a World Wide Web (WWW) communication, a local area network (LAN) communication, a wireless LAN (WLAN) communication, a wide area network (WAN) communication, a public switched telephone network (PTSN) communication, an integrated services digital network (ISDN) communication, a digital subscriber line (DSL) communication, an advanced mobile telephone service (AMPS) communication, a global system for mobile communications (GSM) communication, a general packet radio service (GPRS) communication, a code division multiple access (CDMA) communication, a wideband CDMA (WCDMA) communication, a universal mobile telecommunications system (UTMS) communication, a radio communication, a cable communication, or a satellite communication.

19. The computer-implemented method of claim 12, further comprising storing a secret cryptographic key within the security token.

20. The computer-implemented method of claim 12, wherein the transformed result is communicated from the proximity token to the application service if the proximity token is within a predetermined distance from the application service.

21. The computer-implemented method of claim 12, wherein the transformed result is communicated from the proximity token to the application service if the command is received from the application service above a predetermined power.

22. The computer-implemented method of claim 12, wherein the first, second, third and/or fourth cryptographic techniques are the same cryptographic techniques.

23. A system comprising:

an application service, the application service;

receiving an instruction,

generating a command based upon the instruction,

communicating the command,

receiving a modified command,

communicating the modified command,

receiving a transformed command, and

communicating the transformed command;

a security token, the security token;

receiving the command from the application service,

modifying the command using a first cryptographic technique,

communicating the modified command to the application service,

receiving the transformed command from the application service,

recovering the modified command from the transformed command using a third cryptographic technique,

recovering the command from the recovered modified command using a fourth cryptographic technique,

executing the recovered command to produce a result, and

communicating the result to the application service; and

a proximity token, the proximity token;

receiving the modified command from the application service,

transforming the modified command using a second cryptographic technique, and

communicating the transformed command to the application service.

24. A system comprising:

an application service, the application service;

receiving an instruction,

generating a command based upon the instruction,

communicating the command,

receiving a modified result,

communicating the modified result,

receiving a transformed result, and

communicating the transformed result; and

a security token, the security token;

receiving the command from the application service,

executing the command to produce a result,

modifying the result using a first cryptographic technique,

communicating the modified result to the application service,

receiving the transformed result from the application service,

recovering the modified result from the transformed result using a third cryptographic technique,

recovering the result from the recovered modified result using a fourth cryptographic technique, and

communicating the recovered result to the application service; and

a proximity token, the proximity token;

receiving the modified result from the application service,

transforming the modified result using a second cryptographic technique, and

communicating the transformed result to the application service.