Secure mobile user interface

• US 9,760,888 B2
• Filed: 10/29/2014
• Issued: 09/12/2017
• Est. Priority Date: 10/29/2013
• Status: Active Grant

• Current Assignee: Cryptomathic Ltd (Cryptomathic A/S)
• Original Assignee: Cryptomathic Ltd (Cryptomathic A/S)
• Inventors: Landrock, Peter, Bond, Mike
• Primary Examiner(s): Ebersman, Bruce I
• Assistant Examiner(s): Bradley, Joshua D.
• Application Number:
  US14/429,748
• Publication Number:
  US 20160260098A1
• Time in Patent Office: 1,049 Days
• Field of Search: 705 44
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/83 input devices, e.g. keyboards, mice or controllers thereof
• CPC Class Codes: G06Q 20/3226 Use of secure elements separate from M-devices
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: H04L 63/067 using one-time keys cryptographic mechanisms or cryptographic arrangements for generation of one-time passwords H04L9/0863
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04M 1/22 Illumination; Arrangements for improving the visibility of characters on dials
• CPC Class Codes: H04M 1/724092 Interfacing with an external cover providing additional functionalities
• CPC Class Codes: H04M 1/72412 using two-way short-range wireless interfaces
• CPC Class Codes: H04M 2250/22 including a touch pad, a touch sensor or a touch detector digitizers for touch screens G06F3/041
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications

Abstract

The invention provides systems and method for securely inputting user data from a user into a mobile device and also for generating user data to be input by a user into a mobile device. For example, there is provided a mobile device case for securely inputting user data from a user into a mobile device, the case comprising: a microcontroller, a communication module for communicating with the mobile device and a user interface to enable the user to input the user data. The microcontroller is preferably configured to receive the user data which is input by a user via the user interface, process said user data to create processed data and communicate said processed data to said mobile device. Alternatively, the microcontroller is configured to receive a request to generate the user data; generate said user data and display said user data on the user interface.

Claims

1. A mobile device case for securely inputting user data from a user, the case comprising:

a microcontroller;

a communication module; and

a user interface, wherein the user interface of the mobile device case enables the user to input the user data; and

wherein the microcontroller of the mobile device case is configured to;

receive the user data which is selected for input by the user via the user interface, wherein following selection of each character of user data the microcontroller is configured to communicate with a mobile device held in the mobile device case to cause the mobile device to visually indicate selection of said character,

process said user data to create processed data, wherein the user data cannot be determined from the processed data by said mobile device or third party, wherein the microcontroller is configured to process the user data by;

verifying the user data and the processed data indicates whether or not the user data has been verified, said verifying comprising (i) comparing the user data with a passcode stored in the microcontroller, or (ii) applying a one-way function to the user data and matching the processed data to stored data created from the same user data to which the same one-way function has been applied;

or

encrypting the user data, and

output said processed data to said mobile device or said third party whereby said user data is securely communicated to said mobile device or said third party without said mobile device or said third party being able to interpret the user data which was entered via the user interface.

2. The mobile device case as claimed in claim 1, wherein the user interface comprises a touch mechanism for the user to input each character in the user data.

3. The mobile device case according to claim 2, wherein the touch mechanism comprises a touch sensor to change which light is lit or which light is switched off.

4. The mobile device case according to claim 2, wherein the touch mechanism comprises a plurality of touch sensors, one for each character of the user data whereby the user inputs the user data by pressing on the touch sensor corresponding to the desired character.

5. The mobile device case according to claim 3, wherein the touch sensor is a capacitive touch sensor.

6. The mobile device case as claimed in claim 1, wherein the user interface is configured to receive adjustment data from the mobile device via the communication module whereby the mobile device is usable to input the user data.

7. The mobile device case as claimed in claim 6, wherein the at least one visual indicator comprises a plurality of lights which are lit one at a time with the lit light indicating which character of the user data is being input, and wherein the microcontroller is configured to change which light is lit or which light is off based on the adjustment data.

8. The mobile device case as claimed in claim 6, wherein the at least one visual indicator comprises a plurality of lit lights which are switched off one at a time with the off light indicating which character of the user data is being input, and wherein the microcontroller is configured to change which light is lit or which light is off based on the adjustment data.

9. The mobile device case as claimed in claim 7, wherein the microcontroller is further configured to randomly illuminate one of the plurality of lights before at least a first character of the user data is entered.

10. The mobile device case as claimed in claim 7, wherein the user interface is configured to receive character data from the mobile device via the communication module wherein the character data indicates a character which is displayed on a screen of the mobile device and which is aligned with each light and the microcontroller is configured to determine which character is selected from the character data.

11. The mobile device case as claimed in claim 1, wherein the microcontroller is configured to process the user data to create a token which is then communicated to the mobile device.

12. The mobile device case as claimed in claim 11, further comprising a counter and the microcontroller is configured to generate the token using a count from the counter.

13. The mobile device case as claimed in claim 11, further comprising a clock and the microcontroller is configured to generate the token using a current time obtained from the clock.

14. The mobile device case as claimed in claim 11, wherein the microcontroller is configured to generate the token using authentication data, wherein the authentication data comprises one or more of:

data related to the type of application running on the mobile device, data related to the type of mobile device, and user-specific data.

15. The mobile device case as claimed in claim 14, further comprising a smartcard reader integrated in the case, wherein the user-specific data is obtained from a smartcard inserted in the reader.

16. The mobile device case as claimed in claim 14, further comprising an embedded EMV chip which incorporates the microcontroller and wherein the user-specific data is obtained from the EMV chip.

17. The mobile device case as claimed in claim 1, wherein the user interface further comprises a visual indicator to indicate whether the case is in an integrity or confidentiality protecting mode.

18. The mobile device case according to claim 1, wherein the user interface comprises at least one visual indicator to indicate to the user which character of the user data is being input.

19. The mobile device case according to claim 18, wherein the at least one visual indicator comprises a plurality of lights which are lit one at a time with the lit light indicating which character of the user data is being input.

20. The mobile device case according to claim 18, wherein the at least one visual indicator comprises a plurality of lit lights which are switched off one at a time with the off light indicating which character of the user data is being input.

21. A system for securely inputting data into a mobile device, the system comprising:

a mobile device case comprising;

a microcontroller;

a communication module; and

a user interface, wherein the user interface of the mobile device case enables the user to input the user data; and

wherein the microcontroller of the mobile device case is configured to;

receive the user data which is selected for input by the user via the user interface, wherein following selection of each character of user data the microcontroller is configured to communicate with a mobile device held in the mobile device case to cause the mobile device to visually indicate selection of said character,

process said user data to create processed data, wherein the user data cannot be determined from the processed data by said mobile device or third party, wherein the microcontroller is configured to process the user data by;

verifying the user data and the processed data indicates whether or not the user data has been verified, said verifying comprising (i) comparing the user data with a passcode stored in the microcontroller, or (ii) applying a one-way function to the user data and matching the processed data to stored data created from the same user data to which the same one-way function has been applied;

or

encrypting the user data, and

output said processed data to said mobile device or said third party whereby said user data is securely communicated to said mobile device or said third party without said mobile device or said third party being able to interpret the user data which was entered via the user interface; and

the mobile device comprising a display and a communication module for communicating with the mobile device case.

22. The system as claimed in claim 21, wherein the mobile device is configured to display a set of characters on the display.

23. The system as claimed in claim 22, wherein the mobile device case comprises a plurality of lights with each displayed character aligned with one of the plurality of lights and wherein, in use, a single light is lit at once to indicate which character is being selected.

24. The system as claimed in claim 22, wherein the mobile device case comprises a plurality of lights with each displayed character aligned with one of the plurality of lights and wherein, in use, a single light is unlit at once to indicate which character is being selected.

25. The system as claimed in claim 23, wherein the mobile device further comprises at least one touch sensor and sends adjustment data to the mobile device case whereby the light which is lit or unlit is controllable.

26. The system as claimed in claim 24, wherein the mobile device further comprises at least one touch sensor and sends adjustment data to the mobile device case whereby the light which is lit or unlit is controllable.

27. The system as claimed in claim 21, wherein the mobile device and mobile device case are integrated into a single device.

28. The system as claimed in claim 27, wherein the mobile device case is a virtual case.

29. The system as claimed in claim 21, wherein the mobile device is a smartphone or tablet computer.