CA2183629C - Method and apparatus for utilizing a token for resource access - Google Patents
Method and apparatus for utilizing a token for resource access Download PDFInfo
- Publication number
- CA2183629C CA2183629C CA002183629A CA2183629A CA2183629C CA 2183629 C CA2183629 C CA 2183629C CA 002183629 A CA002183629 A CA 002183629A CA 2183629 A CA2183629 A CA 2183629A CA 2183629 C CA2183629 C CA 2183629C
- Authority
- CA
- Canada
- Prior art keywords
- code
- token
- processor
- user
- time
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Expired - Lifetime
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
- G06F21/31—User authentication
- G06F21/34—User authentication involving the use of external additional devices, e.g. dongles or smart cards
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
- G06F21/31—User authentication
- G06F21/34—User authentication involving the use of external additional devices, e.g. dongles or smart cards
- G06F21/35—User authentication involving the use of external additional devices, e.g. dongles or smart cards communicating wirelessly
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
- G06Q20/34—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using cards, e.g. integrated circuit [IC] cards or magnetic cards
- G06Q20/341—Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/385—Payment protocols; Details thereof using an alias or single-use codes
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
- G06Q20/409—Device specific authentication in transaction processing
- G06Q20/4093—Monitoring of device authentication
-
- G—PHYSICS
- G07—CHECKING-DEVICES
- G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
- G07C9/00—Individual registration on entry or exit
- G07C9/20—Individual registration on entry or exit involving the use of a pass
- G07C9/215—Individual registration on entry or exit involving the use of a pass the system having a variable access-code, e.g. varied as a function of time
-
- G—PHYSICS
- G07—CHECKING-DEVICES
- G07F—COIN-FREED OR LIKE APPARATUS
- G07F7/00—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus
- G07F7/08—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means
- G07F7/0873—Details of the card reader
- G07F7/088—Details of the card reader the card reader being part of the point of sale [POS] terminal or electronic cash register [ECR] itself
- G07F7/0886—Details of the card reader the card reader being part of the point of sale [POS] terminal or electronic cash register [ECR] itself the card reader being portable for interacting with a POS or ECR in realizing a payment transaction
-
- G—PHYSICS
- G07—CHECKING-DEVICES
- G07F—COIN-FREED OR LIKE APPARATUS
- G07F7/00—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus
- G07F7/08—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means
- G07F7/10—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means together with a coded signal, e.g. in the form of personal identification information, like personal identification number [PIN] or biometric data
- G07F7/1008—Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3234—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3271—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2211/00—Indexing scheme relating to details of data-processing equipment not covered by groups G06F3/00 - G06F13/00
- G06F2211/007—Encryption, En-/decode, En-/decipher, En-/decypher, Scramble, (De-)compress
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/2103—Challenge-response
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/2115—Third party
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/2151—Time stamp
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
- H04L2209/80—Wireless
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
- H04L2209/88—Medical equipments
Abstract
The system (10) has a token (12), a token processor (14), and a host process or (16). The token (12) may be a "dumb" token, and contains a memory (18) that contains a secret user code (22) and a read/writ e element (20). The memory (18) may also contain a publi c code (24), an algorithm (26), and a time-varying value (28). The token may h ave a numeric keypad (30) for an imput device.
Description
METHOD AND APPARATUS FOR UTILIZING A
TOKEN FOR RESOURCE ACCESS
Field of the Invention This invention relates to techniques for controlling access to electronic information or other resources and more particularly to a method and apparatus for securely controlling access to such resources by use of a relatively simple token in. conjunction with a remote and/or portable processor.
Background of the Invention There are many applications where information resources, such as databases, are maintained, which resources containing sensitive information to which authorized individuals require access, but to which there may be legal, moral, privacy, business or other reasons for denying access to unauthorized individuals. Examples of such resources or databases include medical records; at a hospital or other medical facility where selected personnel, such as doctors or nurses working with a particular patient, may require access to such records without undue delay while at the same time such records are not made available to other hospital personnel riot having a need to know or to nonhospital personnel. Similarly, companies may have engineering, business, accounting, or WO 95/25391 ~ PCT/US95/03181 other company records in a data processing system, with authorized individuals requiring easy access to only selected portions of the database and with access otherwise being denied. A resource may also be a building, room, file cabinet, safe, container or other area or item to which it is desired that access be limited only to authorized individuals. The term "resource" as used hereinafter will generally be considered to include both information resources and these other types of resources.
Heretofore, control of access to such resources has been primarily achieved by use of a personal identification code (PIN) or password known only to the user which the user keys or dials into the system before making an access request.
However, since this is a static value, an unauthorized individual may surreptitiously learn an authorized party's PIN by for example monitoring a data line over which such PIN
is being transmitted or surreptitiously observing the PIN
being inputted. The fact that the PIN has been compromised may not be learned for some time during which large quantities of data or other resources may be improperly obtained and/or used. Further, once an individual has access to the system, he may make changes in the database or other resources which may cause additional serious problems to the organization.
Password systems use only one of the three possible factors which are available to provide a secure system, namely, something the user knows. The other two factors are something an authorized individual has, for example a token, and something the individual is, for example a biocharacteristic. More secure resource access systems involve at least two of the factors, normally something the individual knows and something the individual has in his WO 95/25391 ~ ~ PCTIUS95103181 possession. However, it has been found that tokens containing a secret (i.e. nonobservable) static code value are also subject to surreptitious detection by for example the monitoring of a line over which such value is being transmitted. This problem is being exacerbated by the more extensive use of local and wide area networks and by the use of radiowaves to transmit data. It is also possible that the token could be "borrowed", read by a suitable device to obtain the secret user code and then returned before the owner realizes it is missing. In either event, the token containing the code could be recreated and used for some period of time to gain access to sensitive information within a database or to other information resources without detection. Therefore, improved "smart" tokens, such as those disclosed in U.S. Patent Nos. 4,720,860 and 5,023,908 and various related patents have varied the values stored in the token, or at least the value outputted from the token, in accordance with some algorithm which causes the values to vary in a nonpredictable way with time so as to provide unique one-time codes.
However, while such devices have provided significantly enhanced security for secret access codes, and therefore significantly enhanced security for the data processing system, database or other information resource with which such devices are being utilized, a "smart" card (which for purposes of this application as defined as a card having data processing capability) has been required to use such systems. Smart cards are usually somewhat larger and heavier than a standard credit card and are significantly more expensive. Since these devices are typically battery-operated, they also have a finite life, typically about three years, and need to be replaced at the end of such time, further increasing the cost of their use. For systems having large numbers of authorized users, this expense can become substantial and, in conjunction with some resistance to the bulk of such cards, has limited the applications of such systems.
A need therefore exists for an improved secure access technique which provides the advantages of one-time code and the possibility of two factor security while permitting the use of inexpensive and relatively small tokens, which tokens may have a theoretically unlimited life.
Summary of the Invention In accordance with the teachings of this invention, a "dumb token" is utilized which preferably only stores selected information which may be utilized to identify or verify the identity of a user, and/or provide data for an encryptior_ key and/or for file compression, such information being stored in machine readable form. The token is designed for use with a standard remote and/or portable processor such as (i) a lap-top computer, notebook computer, palm-top (i.e.
hand-held) computer or personal assistant or (ii) a telephone, credit card verifier or other device having a keyboard/keypad (or equivalent), card or other token reader, and processor, which processor/device (hereinafter "token processor") usually also provides an interface to a host processor, network, file server, other remote resource or the like (hereinafter "host processor"). The token processor is utilized to generate a one-time, nonpredictable code from inputs received both from the token and from the user through a token processor input device and to automatically utilize directly and/or transmit such code or a representation of such code to the host processor where it may be utilized for WO 95/25391 ~ PCT/US95103181 such functions as identifying the individual, verifying access to the resource or inferring an encryption key as taught in U.S. Patent No. 5,237,614.
The basic system may be utilized in a number of ways.
For example, the token may also contain a public ID for the user which is initially read and transmitted to the host, which then generates a query appropriate for such user. The query is transmitted to the token processor which then uses the query in conjunction with a secret user code read from the token, and preferably a PIN or other coded input from the user, to produce a nonpredictable one-time coded response which is transmitted to the host. A time-varying, event varying, use varying or the like value (hereinafter "time-varying value" or "one-time code") produced or stored at the token processor may also be utilized in generating the nonpredictable coded response.
For the preferred embodiment, the portable processor ut=lizes a clock as a time-varying value element. For an alternative embodiment, the time-varying value element changes its value each time a token is used with the token processor. This change may, for example, be made when the token is inserted or when the token is removed. One option which may be used with the system is that, instead of a static secret code being stored in the token, a value, such as the nonpredictable code generated during the last use, some intermediate value in the generation thereof, or another related value is stored in the token as a secret user code in place of the value previously stored therein. When this is done, it may not be necessary to include a time-varying value element as an input in the generation of the nonpredictable code since, in essence, the time-varying secret code assures that a different nonpredictable code will be generated for each use.
TOKEN FOR RESOURCE ACCESS
Field of the Invention This invention relates to techniques for controlling access to electronic information or other resources and more particularly to a method and apparatus for securely controlling access to such resources by use of a relatively simple token in. conjunction with a remote and/or portable processor.
Background of the Invention There are many applications where information resources, such as databases, are maintained, which resources containing sensitive information to which authorized individuals require access, but to which there may be legal, moral, privacy, business or other reasons for denying access to unauthorized individuals. Examples of such resources or databases include medical records; at a hospital or other medical facility where selected personnel, such as doctors or nurses working with a particular patient, may require access to such records without undue delay while at the same time such records are not made available to other hospital personnel riot having a need to know or to nonhospital personnel. Similarly, companies may have engineering, business, accounting, or WO 95/25391 ~ PCT/US95/03181 other company records in a data processing system, with authorized individuals requiring easy access to only selected portions of the database and with access otherwise being denied. A resource may also be a building, room, file cabinet, safe, container or other area or item to which it is desired that access be limited only to authorized individuals. The term "resource" as used hereinafter will generally be considered to include both information resources and these other types of resources.
Heretofore, control of access to such resources has been primarily achieved by use of a personal identification code (PIN) or password known only to the user which the user keys or dials into the system before making an access request.
However, since this is a static value, an unauthorized individual may surreptitiously learn an authorized party's PIN by for example monitoring a data line over which such PIN
is being transmitted or surreptitiously observing the PIN
being inputted. The fact that the PIN has been compromised may not be learned for some time during which large quantities of data or other resources may be improperly obtained and/or used. Further, once an individual has access to the system, he may make changes in the database or other resources which may cause additional serious problems to the organization.
Password systems use only one of the three possible factors which are available to provide a secure system, namely, something the user knows. The other two factors are something an authorized individual has, for example a token, and something the individual is, for example a biocharacteristic. More secure resource access systems involve at least two of the factors, normally something the individual knows and something the individual has in his WO 95/25391 ~ ~ PCTIUS95103181 possession. However, it has been found that tokens containing a secret (i.e. nonobservable) static code value are also subject to surreptitious detection by for example the monitoring of a line over which such value is being transmitted. This problem is being exacerbated by the more extensive use of local and wide area networks and by the use of radiowaves to transmit data. It is also possible that the token could be "borrowed", read by a suitable device to obtain the secret user code and then returned before the owner realizes it is missing. In either event, the token containing the code could be recreated and used for some period of time to gain access to sensitive information within a database or to other information resources without detection. Therefore, improved "smart" tokens, such as those disclosed in U.S. Patent Nos. 4,720,860 and 5,023,908 and various related patents have varied the values stored in the token, or at least the value outputted from the token, in accordance with some algorithm which causes the values to vary in a nonpredictable way with time so as to provide unique one-time codes.
However, while such devices have provided significantly enhanced security for secret access codes, and therefore significantly enhanced security for the data processing system, database or other information resource with which such devices are being utilized, a "smart" card (which for purposes of this application as defined as a card having data processing capability) has been required to use such systems. Smart cards are usually somewhat larger and heavier than a standard credit card and are significantly more expensive. Since these devices are typically battery-operated, they also have a finite life, typically about three years, and need to be replaced at the end of such time, further increasing the cost of their use. For systems having large numbers of authorized users, this expense can become substantial and, in conjunction with some resistance to the bulk of such cards, has limited the applications of such systems.
A need therefore exists for an improved secure access technique which provides the advantages of one-time code and the possibility of two factor security while permitting the use of inexpensive and relatively small tokens, which tokens may have a theoretically unlimited life.
Summary of the Invention In accordance with the teachings of this invention, a "dumb token" is utilized which preferably only stores selected information which may be utilized to identify or verify the identity of a user, and/or provide data for an encryptior_ key and/or for file compression, such information being stored in machine readable form. The token is designed for use with a standard remote and/or portable processor such as (i) a lap-top computer, notebook computer, palm-top (i.e.
hand-held) computer or personal assistant or (ii) a telephone, credit card verifier or other device having a keyboard/keypad (or equivalent), card or other token reader, and processor, which processor/device (hereinafter "token processor") usually also provides an interface to a host processor, network, file server, other remote resource or the like (hereinafter "host processor"). The token processor is utilized to generate a one-time, nonpredictable code from inputs received both from the token and from the user through a token processor input device and to automatically utilize directly and/or transmit such code or a representation of such code to the host processor where it may be utilized for WO 95/25391 ~ PCT/US95103181 such functions as identifying the individual, verifying access to the resource or inferring an encryption key as taught in U.S. Patent No. 5,237,614.
The basic system may be utilized in a number of ways.
For example, the token may also contain a public ID for the user which is initially read and transmitted to the host, which then generates a query appropriate for such user. The query is transmitted to the token processor which then uses the query in conjunction with a secret user code read from the token, and preferably a PIN or other coded input from the user, to produce a nonpredictable one-time coded response which is transmitted to the host. A time-varying, event varying, use varying or the like value (hereinafter "time-varying value" or "one-time code") produced or stored at the token processor may also be utilized in generating the nonpredictable coded response.
For the preferred embodiment, the portable processor ut=lizes a clock as a time-varying value element. For an alternative embodiment, the time-varying value element changes its value each time a token is used with the token processor. This change may, for example, be made when the token is inserted or when the token is removed. One option which may be used with the system is that, instead of a static secret code being stored in the token, a value, such as the nonpredictable code generated during the last use, some intermediate value in the generation thereof, or another related value is stored in the token as a secret user code in place of the value previously stored therein. When this is done, it may not be necessary to include a time-varying value element as an input in the generation of the nonpredictable code since, in essence, the time-varying secret code assures that a different nonpredictable code will be generated for each use.
While it is preferable that the token store as little information as possible, there are applications where it is advantageous to store the algorithm to be used in generating the nonpredictable code in the token. This permits a different algorithm to be used for each individual on the system, or at least for selected groups of individuals, further enhancing system security. This is particularly desirable where a single token processor may be utilized by multiple individuals, for example in a hospital environment where nurses on different shifts may use the same token processors. It is also possible for the time-varying value to be stored in the token rather than at the token processor. For example, a value originally stored on the token may be incremented or decremented in a predetermined way each time the token is utilized and its value may be read into the token processor to be used as the time-varying value in the algorithm for generating the nonpredictable code. Again, this procedure may be advantageous when a single token processor is used by a variety of individuals since it eliminates the requirement for the token processor to store appropriate clock values for each individual. However, in applications where the processor clock itself is used as the time-varying input, this is not a problem so long as this clock is synchronized with the clock at the host. A technique to compensate for any lack of such synchronization is taught in U.S. Patent No. 4,885,778. An alternate technique is for some hash/representation of tie remote processor time to be transmitted along with the one-time code as taught in U.S.
Patent No. 5,361,062.
Summary of the Invention The transmitter at the portable processor and receiver at the host processor may be modems interconnected by a telephone line network interface or the transmitter and receiver may be elements of a radio/cellular network. Other communication techniques between processors known in the art may also be utilized. Further, while for the preferred embodiment the token is a "dumb card", there are applications where a "smart card" having processing capabilities and its own clock may be utilized which may be used in the manner described in the prior patents as a smart card when token processors are not available, but may be used with a token processor, with the seed or secret user code stored thereat being read into the token processor in situations where it is preferable to operate in that mode. The token containing the machine readable secret user code may also be used to perform other functions such as supplemental memory (i.e. RAM or ROM chip containing files, application software, privileged or confidential data, private encryption keys single sign-on information, etc.) or hardware/software for additional system features such as modem, network interface, FAX, combined and integrated encryption/compression engine, etc.
Accordingly, a system for providing secure access by an authorized user to a selected resource is provided. The system comprises a token in the possession of the user which stores a secret user code for the system, the code being stored in a machine readable form; a token processor having a reader for the token, a time-varying value element, a code input device, means for receiving the secret user code read from the token and the time-varying value and for generating a one-time nonpredictable code in response thereto, and a transmitter for transmitting the generated nonpredictable code; and a host processor having a receiver for the transmitted nonpredictable code, and means responsive to a received nonpredictable code for authorizing access to said selected resource.
The foregoing and other objects, features and advantages of the invention will be apparent from the following more particular description of preferred embodiments of the invention as illustrated in the accompanying drawings.
In the Drawings FIG. 1 is a semi-schematic diagram of hardware suitable for use in practicing the teachings of this invention.
FIG. 2 is a flow diagram for the operation of the system of FIG. 1 in accordance with practicing various embodiments of the invention.
_g_ Detailed Description FIG. 1 illustrates the three basic components of a system utilized in practicing the teachings of this invention, these components being a token 12, a token processor 14, and a host processor 16. Token 12 is preferably a "dumb" token which contains only a memory 18 and a machine readable element, or for some embodiments a read/write element, 20.
In the simplest case, memory 18 would contain only a secret user code 22. However, for various embodiments of the invention, it may also be desirable for memory 18 to store a public code 24, an algorithm 26 and/or a time-varying value 28. As will be discussed in greater detail later, for some embodiments, the secret user code 22 and time-varying value 28 may be the same value. While not preferred, it is possible for token 12 to have an input device, such as numeric keypads 30, and, as will be discussed later, to also function as a "smart card", having certain processing and/or display capabilities.
Token processor 14 may be any of a variety of remote and/or portable processors which are currently available on the market. Such processors fall into two general classes, the first of which includes such processors as lap top computers, palm top (hand-held) computers, notebook computers, personal assistants, or other like computing devices. The recent proliferation of such computers, many of which have excess storage and processing capabilities as well as input/output capability such as floppy discs or links for a card or the like, such as a PCMCIA slot, or data button make such computers ideal for this application. The second class of devices include telephones, credit card verifiers or other like devices having a keyboard/keypad (or equivalent input device), a card reader or other device adapted to read WO 95/?5391 PCT/U595I03181 a value stored on a token and a microprocessor or other processor device. Thus,_token processor 14 would typically include a token reader or token read/write device 40, a microprocessor or other processing device 42, at least one memory device 44, which may be part of processor 42 or may be in addition to memory provided in processor 42, a keyboard or other data input device 46 for inputting data into processor 46, a clock 48 or other device for generating time-varying values and a transmitter, or preferably a transmitter/receiver, 50. For various processors 14, device 50 may be a modem which interconnects the processor to a telephone line, a network interface or may be some type of ratio communications device such as a cellular phone element.
Device 50 communicates with a compatible dev'_ce 60 at host processor 16. Host processor 16 would typically be a processor utilized for performing a variety of functions, and may for example be a server through which access may be ob~ained to various databases or other information resources or may be some other remote resource. Host processor 16 may be part of a network, which network may contain a plurality of such processors. The function of host processor 16 which is of concern in connection with this invention is to at least verify that the user possessing token 16 is authorized access to the system. In performing this function, host processor 16 utilizes a processor element 62 contained thereat and memory 64 containing information on tokens and au~horized users for such tokens. Once host processor 16 has ve=ified a user, it may grant the user access to certain resources and may also perform a variety of other functions which are not part of the present invention.
Referring now to FIG. 2, the first step in the use of the system 10 is for a user to insert the read/write element 20 oL token 12 into the token read/write device 40 of token processor 14. Where the read/write element 20 is for example a magnetic stripe or electrodes, this operation would involve physically inserting at least a portion of token 12 into read/write device 40. Where optical elements, such as light-emitting diodes (LED's) and photo diodes or infrared emitters and detectors, or RF elements are utilized as the read/write elements, this operation would be performed by bringing the token read/write element into proximity with the read/write device of the token processor. In either event, when this is done, one or more stored codes, and possibly additional information, is read from the token into token processor 14 (step 70). The information to be read out would typically either be scanned by the device 40 under control of processor 42 or would be sequentially presented.
For a preferred embodiment, only a secret code 22 is stored in token 12 and this is the code which is read during step 70. This code is applied as one input to processor 42.
The current time-varying value at clock 48 is also applied as ar, input to processor 42 (step 72) and the processor also receives from memory 44 or its internal memory an algorithm for utilizing the received inputs to generate a one-time nonpredictable code (step 74). Finally, the user utilizes keyboard 46 to input the user's personal identification number (PIN) or other secret code which is generally known only to the user (step 76). The PIN which may modify the token code is applied as the final input to processor 42 which then utilizes the secret code from the token, the time-varying or one-time value from clock 48 and the received PIN in the algorithm to generate a selected nonpredictable code. Since a time-varying value is involved in the generation of this code, this code will be a one-time code so that, should anyone surreptitiously intercept the code, the WO 95/25391 ~ PCT/US95/03181 code will be of no value to that person since it will not be operative to gain access to the resource in the future. The one-time nonpredictable code generated during step 78 is then transmitted to host processor 16 during step 80.
At host processor 16, the nonpredictable code is received by device 60 (step 82) and is provided to processor 62.
Processor 62 may operate in an identify mode, in which case the inputted code is compared against codes for the given time interval for authorized users and the user is identified as an authorized user if the received one-time nonpredictable code matches a code for the given time interval being generated at the host. Where the time-varying input is from a clock such as clock 48, this clock would normally be required to be in synchronism with a corresponding clock at host processor 16 in order for identification to occur. U.S.
Patent No. 4,885,778 teaches a mechanism which may be utilized in practicing the teachings of this invention which permits such identification to be ae::ieved when the clocks are out of synchronism and permits the clocks to be resynchronized. It is also possible during step 84 for processor 62 to operate in a verify mode. With verify, public code 24 is also transmitted with the one-time nonpredictable code. The public code may be obtained from token 12 or may be stored at token processor 14. Processor 62 utilizes the received public code to retrieve or generate the proper one-time nonpredictable code for the user indicated by the public code and then compares this with the received one-time nonpredictable code to verify the user.
A successful verification or identification during step 84 results in processor 62 granting the user access to the selected resource (step 86). The specific manner in which access to the resource is granted will depend on application ~'~~~~~~9 and the specific way this is accomplished does not form part of the present invention. For example, in a hospital application, once access has been granted, a user may use keyboard 46 to request medical records on at least selected patients, with such requests being transmitted to host processor 60, and host processor 60 may retrieve such records from its memory 64 and transmit such records to processor 14 to either be displayed thereat, printed out or otherwise made available to the user.
One option is that instead of a static secret user code 22 being stored in token 12, either the one-time nonpredictable code generated by processor 42, some intermediate value produced in the generation of the nonpredictable code, or some other related value is written in memory 18 of token 12 as the secret user code after each use. Since this value is a one-time time-varying code, use of this value could eliminate the need for clock 48 being used as an additional input to processor 42 and therefore eliminate the synchronization problem. However, this could only be done if the token 12 is being utilized with only a single host processor 16 or if the host processors 16 are somehow networked so that each host processor can be made aware of the current one-time code being stored at the token. The storing of this one-time code in the token is illustrated by step 88.
Another option is for system 10 to operate in a query/response mode. When operating in this mode, in addition to the steps previously described, public code 24 is also read from token 12 and is transmitted by token processor 14 to host processor 16 (step 90). The transmitted public code is received at transmitter/receiver device 60 of host processor 16 and is applied to processor 62 which utilizes --this public code to generate a query which may be unique for the given user (step 92). The query is then transmitted by device 60 of the host processor (step 94) and received by device 50 at the token processor (step 96). The received query is applied to processor 42 as an additional input which is utilized along with the secret code read from token 12, the time-varying value and the PIN in an algorithm to generate an appropriate one-time nonpredictable coded response (step 78). This response is then transmitted during step 80 to the host processor where it is received and applied to processor 62 which verifies that the response is correct and grants access to the resource in response to a verified response.
It is also possible that the public code transmitted during step 90 could be used by the host processor during step 84 to retrieve the proper nonpredictable code to verify the user. When this is done, receive PIN step 76 may not be required, but this step is still desirable for added security.
While receiving the current time-varying value during step 72 is normally achieved by reading the current clock value 48, as previously discussed, this step may be eliminated where a one-time code is stored as the secret user code 22 rather than a static secret code. It is also possible, in some applications, that token 12 may be used with a variety of token processor, all of which are not in time synchronization. It may, in such situations, be preferable for token 12 to contain its own clock, which clock is read and used as a current time-varying value during step 72. Alternatively, token 12 may store a one-time time-varying value 28 which is changed each time the token is used, or in response to the occurrence of a selected event.
In this case, the code value may be read out for use when a WO 95/25391 PCT/US95l03181 token is read during step 70 and this value may be modified in accordance with a predetermined algorithm, with the modified value then being stored in area 28 of memory.
A~ternatively, the value may for example be changed each time a resource is accessed during a given session with the final time-varying value being stored in area 28 before the token is removed from token processor 14. Other techniques for generating a one-time code known in the art may also be utilized.
Similarly, receive-algorithm step 74 normally involves obtaining the algorithm from the memory of processor 42 or from backup memory 44. However, it is generally desirable that the algorithm be secure and in some applications it may be easier to maintain security of the tokens than of the token processors. Further, it may also be desirable in some applications that the algorithm utilized for generating the nonpredictable one-time codes be different for each user on the system or at least for certain classes of users. In such applications, these objectives may be achieved by storing the algorithm in token 12, for example in area 26 of its memory, and reading the algorithm from token 12 into processor 42 during step 74.
While in most applications token 12 would be a "dumb token" dedicated to the function of authenticating a user, this is by no means a limitation on the invention. For example, many processors now utilize a read/write device such as the device 40 as a slot in which cards containing additional functionality such as a modem function, network interface, fax, or the like may be contained. Such card may contain extra memory and other selected hardware. It is possible that one of these function cards could be used as a token by merely adding the user's secret code in such card WO 95/25391 ~ PCTIUS95/03181 and programming the token processor to read such code from the card and utilize it in the manner described above to identify/verify the user as part of the initial log-on procedure. Further, there may be applications where a particular user has need to use his token in applications where a token processor is not available, for example to gain access to the resource from a standard telephone. In such applications, a token such as that disclosed in the beforementioned U.S. Patent No. 4,720,860 may be used which is capable of utilizing the stored seed and a time-varying value generated by its own internal clock to generate a one-time nonpredictable code which is displayed for use by the user. However, this token would also have a read/write element 20, permitting the seed to also be read into a token processor 14 to permit the token to also be used in system l0.
However, the need for a smart card discussed above might be eliminated where token processor 14 is for example a telephone such as those currently available in airline terminals and other public places which contain a credit card reader and other processing capabilities. In such applications, token 12 might contain the algorithm to be used in area 26 and might also contain a clock or the time-varying value in area 28. These would be read from the token by the token reader which forms part of the telephone and would be processed in the processor which also forms part of the telephone to produce the one-time nonpredictable code. The user could input his PIN on the touch keys of the telephone . in response to either a visual prompt appearing on a small display which is provided with many such telephones or in response to an oral prompt provided to the telephone headset. The "dumb" token could thus be utilized at any ._-location having such a telephone. Standard credit card verifiers could also be programmed to function as a token processor with dumb tokens in a system 10, and other devices either currently existing or developed in the future could be utilized, provided such device contains token reading capability, some type of input device to permit a PIN to be inputted, a processor which can be programmed to perform the one-time nonpredictable code generation function and at least a transmitter for transmitting such value to a host processor. Further, while for preferred embodiments access to the resources are gained only through the host, in some applications, access to at least some local resources) may be granted at or under control of the token processor. It has also been assumed that all processors utilized are programmable processors. However, in suitable applications, hybrid or special purpose processors may be utilized.
Thus, while the invention has been particularly shown and described above with reference to preferred embodiments, the foregoing and other changes in form and detail may be made therein by one skilled in the art without departing from the spirit and scope of the invention.
What is claimed is:
Patent No. 5,361,062.
Summary of the Invention The transmitter at the portable processor and receiver at the host processor may be modems interconnected by a telephone line network interface or the transmitter and receiver may be elements of a radio/cellular network. Other communication techniques between processors known in the art may also be utilized. Further, while for the preferred embodiment the token is a "dumb card", there are applications where a "smart card" having processing capabilities and its own clock may be utilized which may be used in the manner described in the prior patents as a smart card when token processors are not available, but may be used with a token processor, with the seed or secret user code stored thereat being read into the token processor in situations where it is preferable to operate in that mode. The token containing the machine readable secret user code may also be used to perform other functions such as supplemental memory (i.e. RAM or ROM chip containing files, application software, privileged or confidential data, private encryption keys single sign-on information, etc.) or hardware/software for additional system features such as modem, network interface, FAX, combined and integrated encryption/compression engine, etc.
Accordingly, a system for providing secure access by an authorized user to a selected resource is provided. The system comprises a token in the possession of the user which stores a secret user code for the system, the code being stored in a machine readable form; a token processor having a reader for the token, a time-varying value element, a code input device, means for receiving the secret user code read from the token and the time-varying value and for generating a one-time nonpredictable code in response thereto, and a transmitter for transmitting the generated nonpredictable code; and a host processor having a receiver for the transmitted nonpredictable code, and means responsive to a received nonpredictable code for authorizing access to said selected resource.
The foregoing and other objects, features and advantages of the invention will be apparent from the following more particular description of preferred embodiments of the invention as illustrated in the accompanying drawings.
In the Drawings FIG. 1 is a semi-schematic diagram of hardware suitable for use in practicing the teachings of this invention.
FIG. 2 is a flow diagram for the operation of the system of FIG. 1 in accordance with practicing various embodiments of the invention.
_g_ Detailed Description FIG. 1 illustrates the three basic components of a system utilized in practicing the teachings of this invention, these components being a token 12, a token processor 14, and a host processor 16. Token 12 is preferably a "dumb" token which contains only a memory 18 and a machine readable element, or for some embodiments a read/write element, 20.
In the simplest case, memory 18 would contain only a secret user code 22. However, for various embodiments of the invention, it may also be desirable for memory 18 to store a public code 24, an algorithm 26 and/or a time-varying value 28. As will be discussed in greater detail later, for some embodiments, the secret user code 22 and time-varying value 28 may be the same value. While not preferred, it is possible for token 12 to have an input device, such as numeric keypads 30, and, as will be discussed later, to also function as a "smart card", having certain processing and/or display capabilities.
Token processor 14 may be any of a variety of remote and/or portable processors which are currently available on the market. Such processors fall into two general classes, the first of which includes such processors as lap top computers, palm top (hand-held) computers, notebook computers, personal assistants, or other like computing devices. The recent proliferation of such computers, many of which have excess storage and processing capabilities as well as input/output capability such as floppy discs or links for a card or the like, such as a PCMCIA slot, or data button make such computers ideal for this application. The second class of devices include telephones, credit card verifiers or other like devices having a keyboard/keypad (or equivalent input device), a card reader or other device adapted to read WO 95/?5391 PCT/U595I03181 a value stored on a token and a microprocessor or other processor device. Thus,_token processor 14 would typically include a token reader or token read/write device 40, a microprocessor or other processing device 42, at least one memory device 44, which may be part of processor 42 or may be in addition to memory provided in processor 42, a keyboard or other data input device 46 for inputting data into processor 46, a clock 48 or other device for generating time-varying values and a transmitter, or preferably a transmitter/receiver, 50. For various processors 14, device 50 may be a modem which interconnects the processor to a telephone line, a network interface or may be some type of ratio communications device such as a cellular phone element.
Device 50 communicates with a compatible dev'_ce 60 at host processor 16. Host processor 16 would typically be a processor utilized for performing a variety of functions, and may for example be a server through which access may be ob~ained to various databases or other information resources or may be some other remote resource. Host processor 16 may be part of a network, which network may contain a plurality of such processors. The function of host processor 16 which is of concern in connection with this invention is to at least verify that the user possessing token 16 is authorized access to the system. In performing this function, host processor 16 utilizes a processor element 62 contained thereat and memory 64 containing information on tokens and au~horized users for such tokens. Once host processor 16 has ve=ified a user, it may grant the user access to certain resources and may also perform a variety of other functions which are not part of the present invention.
Referring now to FIG. 2, the first step in the use of the system 10 is for a user to insert the read/write element 20 oL token 12 into the token read/write device 40 of token processor 14. Where the read/write element 20 is for example a magnetic stripe or electrodes, this operation would involve physically inserting at least a portion of token 12 into read/write device 40. Where optical elements, such as light-emitting diodes (LED's) and photo diodes or infrared emitters and detectors, or RF elements are utilized as the read/write elements, this operation would be performed by bringing the token read/write element into proximity with the read/write device of the token processor. In either event, when this is done, one or more stored codes, and possibly additional information, is read from the token into token processor 14 (step 70). The information to be read out would typically either be scanned by the device 40 under control of processor 42 or would be sequentially presented.
For a preferred embodiment, only a secret code 22 is stored in token 12 and this is the code which is read during step 70. This code is applied as one input to processor 42.
The current time-varying value at clock 48 is also applied as ar, input to processor 42 (step 72) and the processor also receives from memory 44 or its internal memory an algorithm for utilizing the received inputs to generate a one-time nonpredictable code (step 74). Finally, the user utilizes keyboard 46 to input the user's personal identification number (PIN) or other secret code which is generally known only to the user (step 76). The PIN which may modify the token code is applied as the final input to processor 42 which then utilizes the secret code from the token, the time-varying or one-time value from clock 48 and the received PIN in the algorithm to generate a selected nonpredictable code. Since a time-varying value is involved in the generation of this code, this code will be a one-time code so that, should anyone surreptitiously intercept the code, the WO 95/25391 ~ PCT/US95/03181 code will be of no value to that person since it will not be operative to gain access to the resource in the future. The one-time nonpredictable code generated during step 78 is then transmitted to host processor 16 during step 80.
At host processor 16, the nonpredictable code is received by device 60 (step 82) and is provided to processor 62.
Processor 62 may operate in an identify mode, in which case the inputted code is compared against codes for the given time interval for authorized users and the user is identified as an authorized user if the received one-time nonpredictable code matches a code for the given time interval being generated at the host. Where the time-varying input is from a clock such as clock 48, this clock would normally be required to be in synchronism with a corresponding clock at host processor 16 in order for identification to occur. U.S.
Patent No. 4,885,778 teaches a mechanism which may be utilized in practicing the teachings of this invention which permits such identification to be ae::ieved when the clocks are out of synchronism and permits the clocks to be resynchronized. It is also possible during step 84 for processor 62 to operate in a verify mode. With verify, public code 24 is also transmitted with the one-time nonpredictable code. The public code may be obtained from token 12 or may be stored at token processor 14. Processor 62 utilizes the received public code to retrieve or generate the proper one-time nonpredictable code for the user indicated by the public code and then compares this with the received one-time nonpredictable code to verify the user.
A successful verification or identification during step 84 results in processor 62 granting the user access to the selected resource (step 86). The specific manner in which access to the resource is granted will depend on application ~'~~~~~~9 and the specific way this is accomplished does not form part of the present invention. For example, in a hospital application, once access has been granted, a user may use keyboard 46 to request medical records on at least selected patients, with such requests being transmitted to host processor 60, and host processor 60 may retrieve such records from its memory 64 and transmit such records to processor 14 to either be displayed thereat, printed out or otherwise made available to the user.
One option is that instead of a static secret user code 22 being stored in token 12, either the one-time nonpredictable code generated by processor 42, some intermediate value produced in the generation of the nonpredictable code, or some other related value is written in memory 18 of token 12 as the secret user code after each use. Since this value is a one-time time-varying code, use of this value could eliminate the need for clock 48 being used as an additional input to processor 42 and therefore eliminate the synchronization problem. However, this could only be done if the token 12 is being utilized with only a single host processor 16 or if the host processors 16 are somehow networked so that each host processor can be made aware of the current one-time code being stored at the token. The storing of this one-time code in the token is illustrated by step 88.
Another option is for system 10 to operate in a query/response mode. When operating in this mode, in addition to the steps previously described, public code 24 is also read from token 12 and is transmitted by token processor 14 to host processor 16 (step 90). The transmitted public code is received at transmitter/receiver device 60 of host processor 16 and is applied to processor 62 which utilizes --this public code to generate a query which may be unique for the given user (step 92). The query is then transmitted by device 60 of the host processor (step 94) and received by device 50 at the token processor (step 96). The received query is applied to processor 42 as an additional input which is utilized along with the secret code read from token 12, the time-varying value and the PIN in an algorithm to generate an appropriate one-time nonpredictable coded response (step 78). This response is then transmitted during step 80 to the host processor where it is received and applied to processor 62 which verifies that the response is correct and grants access to the resource in response to a verified response.
It is also possible that the public code transmitted during step 90 could be used by the host processor during step 84 to retrieve the proper nonpredictable code to verify the user. When this is done, receive PIN step 76 may not be required, but this step is still desirable for added security.
While receiving the current time-varying value during step 72 is normally achieved by reading the current clock value 48, as previously discussed, this step may be eliminated where a one-time code is stored as the secret user code 22 rather than a static secret code. It is also possible, in some applications, that token 12 may be used with a variety of token processor, all of which are not in time synchronization. It may, in such situations, be preferable for token 12 to contain its own clock, which clock is read and used as a current time-varying value during step 72. Alternatively, token 12 may store a one-time time-varying value 28 which is changed each time the token is used, or in response to the occurrence of a selected event.
In this case, the code value may be read out for use when a WO 95/25391 PCT/US95l03181 token is read during step 70 and this value may be modified in accordance with a predetermined algorithm, with the modified value then being stored in area 28 of memory.
A~ternatively, the value may for example be changed each time a resource is accessed during a given session with the final time-varying value being stored in area 28 before the token is removed from token processor 14. Other techniques for generating a one-time code known in the art may also be utilized.
Similarly, receive-algorithm step 74 normally involves obtaining the algorithm from the memory of processor 42 or from backup memory 44. However, it is generally desirable that the algorithm be secure and in some applications it may be easier to maintain security of the tokens than of the token processors. Further, it may also be desirable in some applications that the algorithm utilized for generating the nonpredictable one-time codes be different for each user on the system or at least for certain classes of users. In such applications, these objectives may be achieved by storing the algorithm in token 12, for example in area 26 of its memory, and reading the algorithm from token 12 into processor 42 during step 74.
While in most applications token 12 would be a "dumb token" dedicated to the function of authenticating a user, this is by no means a limitation on the invention. For example, many processors now utilize a read/write device such as the device 40 as a slot in which cards containing additional functionality such as a modem function, network interface, fax, or the like may be contained. Such card may contain extra memory and other selected hardware. It is possible that one of these function cards could be used as a token by merely adding the user's secret code in such card WO 95/25391 ~ PCTIUS95/03181 and programming the token processor to read such code from the card and utilize it in the manner described above to identify/verify the user as part of the initial log-on procedure. Further, there may be applications where a particular user has need to use his token in applications where a token processor is not available, for example to gain access to the resource from a standard telephone. In such applications, a token such as that disclosed in the beforementioned U.S. Patent No. 4,720,860 may be used which is capable of utilizing the stored seed and a time-varying value generated by its own internal clock to generate a one-time nonpredictable code which is displayed for use by the user. However, this token would also have a read/write element 20, permitting the seed to also be read into a token processor 14 to permit the token to also be used in system l0.
However, the need for a smart card discussed above might be eliminated where token processor 14 is for example a telephone such as those currently available in airline terminals and other public places which contain a credit card reader and other processing capabilities. In such applications, token 12 might contain the algorithm to be used in area 26 and might also contain a clock or the time-varying value in area 28. These would be read from the token by the token reader which forms part of the telephone and would be processed in the processor which also forms part of the telephone to produce the one-time nonpredictable code. The user could input his PIN on the touch keys of the telephone . in response to either a visual prompt appearing on a small display which is provided with many such telephones or in response to an oral prompt provided to the telephone headset. The "dumb" token could thus be utilized at any ._-location having such a telephone. Standard credit card verifiers could also be programmed to function as a token processor with dumb tokens in a system 10, and other devices either currently existing or developed in the future could be utilized, provided such device contains token reading capability, some type of input device to permit a PIN to be inputted, a processor which can be programmed to perform the one-time nonpredictable code generation function and at least a transmitter for transmitting such value to a host processor. Further, while for preferred embodiments access to the resources are gained only through the host, in some applications, access to at least some local resources) may be granted at or under control of the token processor. It has also been assumed that all processors utilized are programmable processors. However, in suitable applications, hybrid or special purpose processors may be utilized.
Thus, while the invention has been particularly shown and described above with reference to preferred embodiments, the foregoing and other changes in form and detail may be made therein by one skilled in the art without departing from the spirit and scope of the invention.
What is claimed is:
Claims (24)
1. A system for providing secure access by an authorized user to a selected resource comprising:
a token in the possession of the user which stores a secret user code for the system, said code being stored in a machine readable form;
a token processor having a reader for said token, a time-varying value element, a code input device, means for receiving the secret user code read from the token and the time-varying value and for generating a one-time nonpredictable code in response thereto, and a transmitter for transmitting the generated nonpredictable code; and a host processor having a receiver for the transmitted nonpredictable code, and means responsive to a received nonpredictable code for authorizing access to said selected resource.
a token in the possession of the user which stores a secret user code for the system, said code being stored in a machine readable form;
a token processor having a reader for said token, a time-varying value element, a code input device, means for receiving the secret user code read from the token and the time-varying value and for generating a one-time nonpredictable code in response thereto, and a transmitter for transmitting the generated nonpredictable code; and a host processor having a receiver for the transmitted nonpredictable code, and means responsive to a received nonpredictable code for authorizing access to said selected resource.
2. A system as claimed in claim 1 wherein said token also stores a public code in machine readable form, wherein the token reader of said token processor reads said public code and said means for transmitting transmits the read public code to the host processor, wherein the host processor generates a selected query in response to the received public code, which query is transmitted to the token processor, and wherein the nonpredictable code is a response to the query which is a function of at least the query and the secret code read from the token.
3. A system as claimed in claim 2 wherein the response is also a function of a secret personal identification code inputted by user.
4. A system as claimed in any one of claims 1 through 3 wherein the time-varying value element is a clock.
5. A system as claimed in any one of claims 1 through 3 wherein the time-varying value element varies the value each time a token is used with the token processor.
6. A system as claimed in claim 5 including means for storing of each generated nonpredictable code, an intermediate value used in generating each nonpredictable code and another value related to the nonpredictable code as the secret user code in the token in place of the code previously stored.
7. A system as claimed in any one of claims 1 through 6 wherein said token also stores an algorithm usable by the token processor to generate the nonpredictable code, said algorithm being read into the token processor by the token reader and utilized by the means for receiving and generating to generate the nonpredictable code.
8. A system as claimed in any one of claims 1 through 7 wherein the means for generating a nonpredictable code also receives and utilizes a secret personal identification code inputted by the user.
9. A system as claimed in claim 8 wherein the secret personal identification code is inputted by the user on the code input device of the token processor.
10. A system as claimed in claim 8 or 9 wherein the token includes a code input device, the secret personal identification code being inputted to the token by the user on said code input device, and wherein the secret personal identification code is ready by the means for receiving, either separately from the secret user code or algorithmically combined therewith.
11. A system as claimed in any one of claims 1 through wherein said transmitter and said receiver are modems interconnected by a telephone line.
12. A system as claimed in any one of claims 1 through 11 wherein said transmitter and said receiver are elements of a radio network.
13. A system as claimed in any one of claims 1 through 12 wherein said transmitter and receiver are elements of a network interface.
14. A system as claimed in any one of claims 1 through 13 wherein said token also includes a one-time code generator and a means responsive to the secret user code stored thereon and to a current one-time code for generating a readable nonpredictable code.
15. A system as claimed in any one of claims 1 through 14 wherein the token processor is a telephone having a token reader and a processor associated therewith.
16. A system for providing secure access by an authorized user to a selected resource comprising:
a token in the possession of the user which stores a secret user code for the system, said code being stored in a machine readable form; and a token processor having a reader for said token, a time-varying value element, a code input device, means for receiving the secret user code read from the token, a secret personal identification code inputted on the input device by the user and the time-varying value and for generating a one-time nonpredictable code in response thereto, and means responsive to the generated one-time nonpredictable code for verifying the acceptability of the nonpredictable code and for authorizing access to said selected resource in response to verifying the acceptability of the nonpredictable code.
a token in the possession of the user which stores a secret user code for the system, said code being stored in a machine readable form; and a token processor having a reader for said token, a time-varying value element, a code input device, means for receiving the secret user code read from the token, a secret personal identification code inputted on the input device by the user and the time-varying value and for generating a one-time nonpredictable code in response thereto, and means responsive to the generated one-time nonpredictable code for verifying the acceptability of the nonpredictable code and for authorizing access to said selected resource in response to verifying the acceptability of the nonpredictable code.
17. A method for providing secure access by an authorized user to a selected resource comprising the steps of a) reading a secret user code from a token into a token processor;
b) obtaining a time-varying value and an algorithm at the token processor;
c) the token processor receiving a user inputted secret personal identification code;
d) the token processor utilizing the secret user code, time-varying value and secret personal identification code in the algorithm to obtain a one-time nonpredictable code;
e) the token processor transmitting the generated one-time nonpredictable code to a host processor;
f) the host processor utilizing the received nonpredictable code to determine if the user is authorized for access to the resource; and g) the host processor granting the user access to the resource in response to a determination that the user is authorized.
b) obtaining a time-varying value and an algorithm at the token processor;
c) the token processor receiving a user inputted secret personal identification code;
d) the token processor utilizing the secret user code, time-varying value and secret personal identification code in the algorithm to obtain a one-time nonpredictable code;
e) the token processor transmitting the generated one-time nonpredictable code to a host processor;
f) the host processor utilizing the received nonpredictable code to determine if the user is authorized for access to the resource; and g) the host processor granting the user access to the resource in response to a determination that the user is authorized.
18. A method as claimed in claim 17 including the steps of:
h) the token processor reading a public code from the token and transmitting the public code to the host processor;
i) the host processor utilizing the public code to generate a query and transmitting the query to the token processor; and j) the token processor utilizing the query during step (d) in generating a one-time nonpredictable code which is also a response to the query;
k) step (f) including the step of verifying that the correct response is received.
h) the token processor reading a public code from the token and transmitting the public code to the host processor;
i) the host processor utilizing the public code to generate a query and transmitting the query to the token processor; and j) the token processor utilizing the query during step (d) in generating a one-time nonpredictable code which is also a response to the query;
k) step (f) including the step of verifying that the correct response is received.
19. In a system for providing secure access by an authorized user to a selected resource having a token in the possession of the user which stores a secret user code for the system, said code being stored in a machine readable form and a host processor having a transmitted nonpredictable code receiver and authorizing means for giving access to said selected resource;
a token processor having a token reader, a time-varying value element, a code input device, means for receiving the token secret user code and the time-varying value and for generating a one-time nonpredictable code in response thereto, and a transmitter for transmitting the generated nonpredictable code.
a token processor having a token reader, a time-varying value element, a code input device, means for receiving the token secret user code and the time-varying value and for generating a one-time nonpredictable code in response thereto, and a transmitter for transmitting the generated nonpredictable code.
20. A token processor as claimed in claim 19 wherein the time-varying value element is a clock.
21. A token processor as claimed in claim 19 or 20 including means for storing of each generated nonpredictable code, an intermediate value used in generating each nonpredictable code and another value related to the nonpredictable code.
22. A token processor as claimed in any one of claims 19 through 21 wherein the means for generating a nonpredictable code also receives and utilizes a secret personal identification code inputted by the user.
23. A token processor as claimed in claim 22 wherein the secret personal identification code is inputted by the user on the code input device.
24. A token processor as claimed in any one of claims 19 through 23 wherein the token processor is a telephone having a token reader and a processor associated therewith.
Applications Claiming Priority (3)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US08/213,951 | 1994-03-16 | ||
US08/213,951 US5657388A (en) | 1993-05-25 | 1994-03-16 | Method and apparatus for utilizing a token for resource access |
PCT/US1995/003181 WO1995025391A1 (en) | 1994-03-16 | 1995-03-16 | Method and apparatus for utilizing a token for resource access |
Publications (2)
Publication Number | Publication Date |
---|---|
CA2183629A1 CA2183629A1 (en) | 1995-09-21 |
CA2183629C true CA2183629C (en) | 2001-05-29 |
Family
ID=22797163
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
CA002183629A Expired - Lifetime CA2183629C (en) | 1994-03-16 | 1995-03-16 | Method and apparatus for utilizing a token for resource access |
Country Status (7)
Country | Link |
---|---|
US (1) | US5657388A (en) |
EP (1) | EP0750814A4 (en) |
JP (1) | JPH09510561A (en) |
KR (1) | KR970701956A (en) |
AU (1) | AU681500B2 (en) |
CA (1) | CA2183629C (en) |
WO (1) | WO1995025391A1 (en) |
Families Citing this family (347)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6175312B1 (en) | 1990-05-29 | 2001-01-16 | Microchip Technology Incorporated | Encoder and decoder microchips and remote control devices for secure unidirectional communication |
US5668878A (en) * | 1994-02-28 | 1997-09-16 | Brands; Stefanus Alfonsus | Secure cryptographic methods for electronic transfer of information |
CA2193846C (en) * | 1995-05-17 | 2004-02-17 | Bradford L. Farris | Rolling code security system |
US6690796B1 (en) | 1995-05-17 | 2004-02-10 | The Chamberlain Group, Inc. | Rolling code security system |
FR2739737B1 (en) * | 1995-10-09 | 1997-11-21 | Inside Technologies | MEMORY CARD IMPROVEMENTS |
US20070292006A1 (en) * | 1996-08-07 | 2007-12-20 | Johnson Alice A | Fingerprint compiler program of explanation |
JPH1079733A (en) * | 1996-09-03 | 1998-03-24 | Kokusai Denshin Denwa Co Ltd <Kdd> | Authentication method/system using ic card |
US5892902A (en) * | 1996-09-05 | 1999-04-06 | Clark; Paul C. | Intelligent token protected system with network authentication |
KR100213188B1 (en) * | 1996-10-05 | 1999-08-02 | 윤종용 | Apparatus and method for user authentication |
JP2001525961A (en) | 1997-05-13 | 2001-12-11 | パスロジックス,インコーポレイテッド | General user self-certification and authentication system |
US6070243A (en) * | 1997-06-13 | 2000-05-30 | Xylan Corporation | Deterministic user authentication service for communication network |
GB2329497B (en) * | 1997-09-19 | 2001-01-31 | Ibm | Method for controlling access to electronically provided services and system for implementing such method |
JP3185734B2 (en) | 1997-12-03 | 2001-07-11 | トヨタ自動車株式会社 | Information terminal equipment |
US6253325B1 (en) * | 1998-04-15 | 2001-06-26 | Hewlett-Packard Company | Apparatus and method for securing documents posted from a web resource |
US6317838B1 (en) * | 1998-04-29 | 2001-11-13 | Bull S.A. | Method and architecture to provide a secured remote access to private resources |
JP4194172B2 (en) * | 1998-05-18 | 2008-12-10 | キヤノン株式会社 | Image display device and inter-device communication method |
US6057764A (en) * | 1998-08-20 | 2000-05-02 | Williams; Melvin P. | Dynamically bypassed alarm system |
US6636973B1 (en) | 1998-09-08 | 2003-10-21 | Hewlett-Packard Development Company, L.P. | Secure and dynamic biometrics-based token generation for access control and authentication |
US6257486B1 (en) * | 1998-11-23 | 2001-07-10 | Cardis Research & Development Ltd. | Smart card pin system, card, and reader |
FR2790854A1 (en) * | 1998-12-01 | 2000-09-15 | Philippe Baron D | Device for securing computer data exchanges of payment or remote payment has inaccessible area in secret memory in which primary codes of list may be used as preference for secure exchange |
FR2788154A1 (en) * | 1998-12-01 | 2000-07-07 | Philippe Baron D | Secure data exchange for electronic or internet payments |
FR2788620B1 (en) * | 1998-12-01 | 2006-12-22 | Philippe Baron D | SUPPORTS AND SYSTEMS FOR SECURE DATA EXCHANGE, IN PARTICULAR FOR PAYMENTS AND TELEPAIEMENTS |
US6343280B2 (en) * | 1998-12-15 | 2002-01-29 | Jonathan Clark | Distributed execution software license server |
US7272723B1 (en) * | 1999-01-15 | 2007-09-18 | Safenet, Inc. | USB-compliant personal key with integral input and output devices |
HUP0201309A2 (en) * | 1999-02-08 | 2002-09-28 | Siemens Ag | Arrangement for determining and evaluating data or signals and method for verifying the identity or authorisation of a person |
EP1151369A1 (en) * | 1999-02-10 | 2001-11-07 | Vasco Data Security Inc. | Security access and authentication token with private key transport functionality |
US8538801B2 (en) | 1999-02-19 | 2013-09-17 | Exxonmobile Research & Engineering Company | System and method for processing financial transactions |
IL128720A (en) * | 1999-02-25 | 2009-06-15 | Cidway Technologies Ltd | Method for certification of over the phone transactions |
EP1035524A3 (en) * | 1999-03-10 | 2003-12-10 | Denis Philippe Baron | IC cards and secure data exchange systems, in particular for payments |
US6985583B1 (en) | 1999-05-04 | 2006-01-10 | Rsa Security Inc. | System and method for authentication seed distribution |
CA2375311C (en) | 1999-06-24 | 2013-10-01 | Edocs,Inc | Electronic bill presentment and payment |
US7287031B1 (en) * | 1999-08-12 | 2007-10-23 | Ronald Steven Karpf | Computer system and method for increasing patients compliance to medical care instructions |
GB9920502D0 (en) * | 1999-09-01 | 1999-11-03 | Ncr Int Inc | Portable terminal |
US7837116B2 (en) | 1999-09-07 | 2010-11-23 | American Express Travel Related Services Company, Inc. | Transaction card |
US7889052B2 (en) | 2001-07-10 | 2011-02-15 | Xatra Fund Mx, Llc | Authorizing payment subsequent to RF transactions |
US7239226B2 (en) * | 2001-07-10 | 2007-07-03 | American Express Travel Related Services Company, Inc. | System and method for payment using radio frequency identification in contact and contactless transactions |
AU7697300A (en) * | 1999-09-27 | 2001-04-30 | Tactel Ab | Automatic locking system |
US7742967B1 (en) * | 1999-10-01 | 2010-06-22 | Cardinalcommerce Corporation | Secure and efficient payment processing system |
US9430769B2 (en) | 1999-10-01 | 2016-08-30 | Cardinalcommerce Corporation | Secure and efficient payment processing system |
US20020103675A1 (en) * | 1999-11-29 | 2002-08-01 | John Vanelli | Apparatus and method for providing consolidated medical information |
US7012503B2 (en) | 1999-11-30 | 2006-03-14 | Bording Data A/S | Electronic key device a system and a method of managing electronic key information |
US6738901B1 (en) * | 1999-12-15 | 2004-05-18 | 3M Innovative Properties Company | Smart card controlled internet access |
JP3250557B2 (en) * | 1999-12-20 | 2002-01-28 | いわき電子株式会社 | Encryption display card |
US7870065B2 (en) * | 2000-01-05 | 2011-01-11 | Uniteller Financial Services, Inc. | Money-transfer techniques |
US7720754B1 (en) | 2000-01-05 | 2010-05-18 | Uniteller Financial Services, Inc. | Money-transfer techniques |
US6938013B1 (en) * | 2000-01-05 | 2005-08-30 | Uniteller Financial Services, Inc. | Money-transfer techniques |
US7172112B2 (en) | 2000-01-21 | 2007-02-06 | American Express Travel Related Services Company, Inc. | Public/private dual card system and method |
US8543423B2 (en) | 2002-07-16 | 2013-09-24 | American Express Travel Related Services Company, Inc. | Method and apparatus for enrolling with multiple transaction environments |
US8429041B2 (en) | 2003-05-09 | 2013-04-23 | American Express Travel Related Services Company, Inc. | Systems and methods for managing account information lifecycles |
US7268668B2 (en) | 2003-05-09 | 2007-09-11 | American Express Travel Related Services Company, Inc. | Systems and methods for managing multiple accounts on a RF transaction instrument |
US6834270B1 (en) * | 2000-02-28 | 2004-12-21 | Carlo Pagani | Secured financial transaction system using single use codes |
US7140036B2 (en) | 2000-03-06 | 2006-11-21 | Cardinalcommerce Corporation | Centralized identity authentication for electronic communication networks |
AU2001243473A1 (en) | 2000-03-07 | 2001-09-17 | American Express Travel Related Services Company, Inc. | System for facilitating a transaction |
EP1139200A3 (en) * | 2000-03-23 | 2002-10-16 | Tradecard Inc. | Access code generating system including smart card and smart card reader |
WO2001071516A1 (en) * | 2000-03-23 | 2001-09-27 | Tietech Co., Ltd. | Method and apparatus for personal identification |
WO2001082151A1 (en) * | 2000-04-24 | 2001-11-01 | Neotechkno Corporation | External device and authentication system |
US7814212B1 (en) | 2000-04-28 | 2010-10-12 | Chan Hark C | Data delivery system using local and remote communications |
US20080147564A1 (en) * | 2001-06-26 | 2008-06-19 | Tara Chand Singhal | Security in use of bankcards that protects bankcard data from merchant systems in a payment card system |
EP1312055A4 (en) * | 2000-06-30 | 2009-04-08 | Tara Chand Singhai | Method and apparatus for a payment card system |
AU2000267243A1 (en) * | 2000-08-08 | 2002-02-18 | Davide Martignon | Safety method and system for circulating confidential data on public-access communication means |
US7392388B2 (en) * | 2000-09-07 | 2008-06-24 | Swivel Secure Limited | Systems and methods for identity verification for secure transactions |
US7058814B1 (en) | 2000-09-28 | 2006-06-06 | International Business Machines Corporation | System and method for providing time-limited access to people, objects and services |
TW548535B (en) * | 2000-10-17 | 2003-08-21 | Ericsson Telefon Ab L M | Security system |
WO2002048846A2 (en) * | 2000-12-14 | 2002-06-20 | Quizid Technologies Limited | An authentication system |
US7295999B1 (en) | 2000-12-20 | 2007-11-13 | Jpmorgan Chase Bank, N.A. | System and method for determining eligibility and enrolling members in various programs |
US7606771B2 (en) * | 2001-01-11 | 2009-10-20 | Cardinalcommerce Corporation | Dynamic number authentication for credit/debit cards |
US20060269061A1 (en) * | 2001-01-11 | 2006-11-30 | Cardinalcommerce Corporation | Mobile device and method for dispensing authentication codes |
US8484710B2 (en) * | 2001-02-14 | 2013-07-09 | Pass Protect Technology, Llc | System and method for securely sending a network one-time-password utilizing a mobile computing device |
AT414054B (en) * | 2001-02-16 | 2006-08-15 | Evva Werke | METHOD FOR CONTROLLING ACCESS CONTROL WITH KEYS AND LOCKS AND DEVICE FOR CARRYING OUT THIS METHOD |
US7895098B2 (en) | 2001-03-01 | 2011-02-22 | Jpmorgan Chase Bank, N.A. | System and method for measuring and utilizing pooling analytics |
US20020129285A1 (en) * | 2001-03-08 | 2002-09-12 | Masateru Kuwata | Biometric authenticated VLAN |
US7237117B2 (en) * | 2001-03-16 | 2007-06-26 | Kenneth P. Weiss | Universal secure registry |
US7219235B2 (en) * | 2001-03-22 | 2007-05-15 | Bridgepoint Systems, Inc. | Locked portal unlocking control apparatus and method |
US7133662B2 (en) * | 2001-05-24 | 2006-11-07 | International Business Machines Corporation | Methods and apparatus for restricting access of a user using a cellular telephone |
US7133971B2 (en) * | 2003-11-21 | 2006-11-07 | International Business Machines Corporation | Cache with selective least frequently used or most frequently used cache line replacement |
US7650314B1 (en) | 2001-05-25 | 2010-01-19 | American Express Travel Related Services Company, Inc. | System and method for securing a recurrent billing transaction |
US7725427B2 (en) | 2001-05-25 | 2010-05-25 | Fred Bishop | Recurrent billing maintenance with radio frequency payment devices |
GB2376116A (en) * | 2001-06-01 | 2002-12-04 | Nicholas Paul Stevens | Locking system using real-time clocks to produce release code and checking code |
US7121471B2 (en) * | 2001-07-10 | 2006-10-17 | American Express Travel Related Services Company, Inc. | Method and system for DNA recognition biometrics on a fob |
US7746215B1 (en) | 2001-07-10 | 2010-06-29 | Fred Bishop | RF transactions using a wireless reader grid |
US7249112B2 (en) | 2002-07-09 | 2007-07-24 | American Express Travel Related Services Company, Inc. | System and method for assigning a funding source for a radio frequency identification device |
US8538863B1 (en) | 2001-07-10 | 2013-09-17 | American Express Travel Related Services Company, Inc. | System and method for facilitating a transaction using a revolving use account associated with a primary account |
US7303120B2 (en) | 2001-07-10 | 2007-12-04 | American Express Travel Related Services Company, Inc. | System for biometric security using a FOB |
US7827106B2 (en) | 2001-07-10 | 2010-11-02 | American Express Travel Related Services Company, Inc. | System and method for manufacturing a punch-out RFID transaction device |
US7119659B2 (en) | 2001-07-10 | 2006-10-10 | American Express Travel Related Services Company, Inc. | Systems and methods for providing a RF transaction device for use in a private label transaction |
US7705732B2 (en) | 2001-07-10 | 2010-04-27 | Fred Bishop | Authenticating an RF transaction using a transaction counter |
US8001054B1 (en) | 2001-07-10 | 2011-08-16 | American Express Travel Related Services Company, Inc. | System and method for generating an unpredictable number using a seeded algorithm |
US9454752B2 (en) | 2001-07-10 | 2016-09-27 | Chartoleaux Kg Limited Liability Company | Reload protocol at a transaction processing entity |
US7503480B2 (en) | 2001-07-10 | 2009-03-17 | American Express Travel Related Services Company, Inc. | Method and system for tracking user performance |
US20040236699A1 (en) | 2001-07-10 | 2004-11-25 | American Express Travel Related Services Company, Inc. | Method and system for hand geometry recognition biometrics on a fob |
US8294552B2 (en) | 2001-07-10 | 2012-10-23 | Xatra Fund Mx, Llc | Facial scan biometrics on a payment device |
US7805378B2 (en) | 2001-07-10 | 2010-09-28 | American Express Travel Related Servicex Company, Inc. | System and method for encoding information in magnetic stripe format for use in radio frequency identification transactions |
US9024719B1 (en) | 2001-07-10 | 2015-05-05 | Xatra Fund Mx, Llc | RF transaction system and method for storing user personal data |
US7463133B2 (en) * | 2001-07-10 | 2008-12-09 | American Express Travel Related Services Company, Inc. | Systems and methods for providing a RF transaction device operable to store multiple distinct calling card accounts |
US7228155B2 (en) * | 2001-07-10 | 2007-06-05 | American Express Travel Related Services Company, Inc. | System and method for remotely initializing a RF transaction |
US7312707B1 (en) | 2001-07-10 | 2007-12-25 | American Express Travel Related Services Company, Inc. | System and method for authenticating a RF transaction using a transaction account routing number |
US20040239480A1 (en) * | 2001-07-10 | 2004-12-02 | American Express Travel Related Services Company, Inc. | Method for biometric security using a transponder |
US8635131B1 (en) | 2001-07-10 | 2014-01-21 | American Express Travel Related Services Company, Inc. | System and method for managing a transaction protocol |
US8548927B2 (en) | 2001-07-10 | 2013-10-01 | Xatra Fund Mx, Llc | Biometric registration for facilitating an RF transaction |
US7668750B2 (en) | 2001-07-10 | 2010-02-23 | David S Bonalle | Securing RF transactions using a transactions counter |
US7059531B2 (en) | 2001-07-10 | 2006-06-13 | American Express Travel Related Services Company, Inc. | Method and system for smellprint recognition biometrics on a fob |
US20040257197A1 (en) * | 2001-07-10 | 2004-12-23 | American Express Travel Related Services Company, Inc. | Method for biometric security using a transponder-reader |
US20050116810A1 (en) * | 2001-07-10 | 2005-06-02 | American Express Travel Related Services Company, Inc. | Method and system for vascular pattern recognition biometrics on a fob |
US7154375B2 (en) | 2001-07-10 | 2006-12-26 | American Express Travel Related Services Company, Inc. | Biometric safeguard method with a fob |
US7360689B2 (en) | 2001-07-10 | 2008-04-22 | American Express Travel Related Services Company, Inc. | Method and system for proffering multiple biometrics for use with a FOB |
US7925535B2 (en) | 2001-07-10 | 2011-04-12 | American Express Travel Related Services Company, Inc. | System and method for securing RF transactions using a radio frequency identification device including a random number generator |
US20040239481A1 (en) * | 2001-07-10 | 2004-12-02 | American Express Travel Related Services Company, Inc. | Method and system for facial recognition biometrics on a fob |
US9031880B2 (en) | 2001-07-10 | 2015-05-12 | Iii Holdings 1, Llc | Systems and methods for non-traditional payment using biometric data |
US7762457B2 (en) | 2001-07-10 | 2010-07-27 | American Express Travel Related Services Company, Inc. | System and method for dynamic fob synchronization and personalization |
US8284025B2 (en) | 2001-07-10 | 2012-10-09 | Xatra Fund Mx, Llc | Method and system for auditory recognition biometrics on a FOB |
US7493288B2 (en) | 2001-07-10 | 2009-02-17 | Xatra Fund Mx, Llc | RF payment via a mobile device |
US8960535B2 (en) | 2001-07-10 | 2015-02-24 | Iii Holdings 1, Llc | Method and system for resource management and evaluation |
US7996324B2 (en) | 2001-07-10 | 2011-08-09 | American Express Travel Related Services Company, Inc. | Systems and methods for managing multiple accounts on a RF transaction device using secondary identification indicia |
US20030014641A1 (en) * | 2001-07-16 | 2003-01-16 | Delanghe Brad Albert | System for providing secure access to secure information |
US7590859B2 (en) * | 2001-08-24 | 2009-09-15 | Secure Computing Corporation | System and method for accomplishing two-factor user authentication using the internet |
US6908030B2 (en) * | 2001-10-31 | 2005-06-21 | Arcot Systems, Inc. | One-time credit card number generator and single round-trip authentication |
US7412720B1 (en) * | 2001-11-02 | 2008-08-12 | Bea Systems, Inc. | Delegated authentication using a generic application-layer network protocol |
US7363494B2 (en) * | 2001-12-04 | 2008-04-22 | Rsa Security Inc. | Method and apparatus for performing enhanced time-based authentication |
US7243853B1 (en) * | 2001-12-04 | 2007-07-17 | Visa U.S.A. Inc. | Method and system for facilitating memory and application management on a secured token |
US7246230B2 (en) | 2002-01-29 | 2007-07-17 | Bea Systems, Inc. | Single sign-on over the internet using public-key cryptography |
JP2003223420A (en) * | 2002-01-31 | 2003-08-08 | Fujitsu Ltd | Access control method, storage device, and information processing apparatus |
US7941533B2 (en) * | 2002-02-19 | 2011-05-10 | Jpmorgan Chase Bank, N.A. | System and method for single sign-on session management without central server |
US20030163694A1 (en) * | 2002-02-25 | 2003-08-28 | Chaing Chen | Method and system to deliver authentication authority web services using non-reusable and non-reversible one-time identity codes |
US7756896B1 (en) | 2002-03-11 | 2010-07-13 | Jp Morgan Chase Bank | System and method for multi-dimensional risk analysis |
US8751391B2 (en) * | 2002-03-29 | 2014-06-10 | Jpmorgan Chase Bank, N.A. | System and process for performing purchase transactions using tokens |
GB0210692D0 (en) * | 2002-05-10 | 2002-06-19 | Assendon Ltd | Smart card token for remote authentication |
US8645266B2 (en) * | 2002-06-12 | 2014-02-04 | Cardinalcommerce Corporation | Universal merchant platform for payment authentication |
US7693783B2 (en) * | 2002-06-12 | 2010-04-06 | Cardinalcommerce Corporation | Universal merchant platform for payment authentication |
AU2003243523B2 (en) * | 2002-06-12 | 2008-04-10 | Cardinalcommerce Corporation | Universal merchant platform for payment authentication |
US7587756B2 (en) * | 2002-07-09 | 2009-09-08 | American Express Travel Related Services Company, Inc. | Methods and apparatus for a secure proximity integrated circuit card transactions |
US6805287B2 (en) | 2002-09-12 | 2004-10-19 | American Express Travel Related Services Company, Inc. | System and method for converting a stored value card to a credit card |
US20040064453A1 (en) * | 2002-09-27 | 2004-04-01 | Antonio Ruiz | Large-scale hierarchical identification and verification for secured ingress and egress using biometrics |
US20040139021A1 (en) * | 2002-10-07 | 2004-07-15 | Visa International Service Association | Method and system for facilitating data access and management on a secure token |
US7900245B1 (en) * | 2002-10-15 | 2011-03-01 | Sprint Spectrum L.P. | Method and system for non-repeating user identification in a communication system |
FR2835078A1 (en) * | 2002-10-16 | 2003-07-25 | Thierry Baillietaieb | Credit card security system for secure credit card payments, uses an encryption unit which calculates a secure code from the invariant elements of the credit card and variable elements keyed in |
US7360096B2 (en) * | 2002-11-20 | 2008-04-15 | Microsoft Corporation | Securely processing client credentials used for Web-based access to resources |
US20040110487A1 (en) * | 2002-12-09 | 2004-06-10 | International Business Machines Corporation | Wireless network access system |
TW587226B (en) * | 2002-12-26 | 2004-05-11 | Min-Jie Su | Card verification and authorization system and method thereof |
EP1620970A4 (en) * | 2003-04-01 | 2010-12-22 | Entropic Technologies Pty Ltd | A system for secure communication |
AU2004225193B2 (en) * | 2003-04-01 | 2009-07-30 | Entropic Technologies Pty Ltd | A system for secure communication |
US7268667B2 (en) | 2003-05-09 | 2007-09-11 | American Express Travel Related Services Company, Inc. | Systems and methods for providing a RF transaction device operable to store multiple distinct accounts |
GB0314905D0 (en) * | 2003-06-26 | 2003-07-30 | Ibm | A system for controlling access to stored data |
US7519989B2 (en) * | 2003-07-17 | 2009-04-14 | Av Thenex Inc. | Token device that generates and displays one-time passwords and that couples to a computer for inputting or receiving data for generating and outputting one-time passwords and other functions |
US20050033995A1 (en) * | 2003-08-08 | 2005-02-10 | Paul Lin | System and method for utilizing information in publicly broadcast signals for shared secret purposes |
US7624068B1 (en) | 2003-08-18 | 2009-11-24 | Jpmorgan Chase Bank, N.A. | Method and system for dynamically adjusting discount rates for a card transaction |
JP4297836B2 (en) * | 2003-09-10 | 2009-07-15 | 三洋電機株式会社 | Consumable parts and identification device thereof |
EP1669877B1 (en) * | 2003-09-26 | 2017-11-15 | Nippon Telegraph And Telephone Corporation | Tag privacy protecting method, tag device, backend device, updating device, update requesting device, programs for these devices, and recording medium storing these programs |
TWI290439B (en) * | 2005-11-09 | 2007-11-21 | Min-Chieh Su | Mobile communication terminal verification authorization system and method thereof |
US7318550B2 (en) | 2004-07-01 | 2008-01-15 | American Express Travel Related Services Company, Inc. | Biometric safeguard method for use with a smartcard |
US7185806B2 (en) * | 2004-08-12 | 2007-03-06 | Sines Randy D | Financial and similar identification cards read by magnetic swipe card readers and methods relating thereto |
US7328850B2 (en) | 2004-08-12 | 2008-02-12 | Codecard, Inc. | Financial and similar identification cards and methods relating thereto |
EP2284762A3 (en) * | 2004-08-17 | 2011-04-20 | Research In Motion Limited | Method, system and device for authenticating a handheld device to a computer |
US7562218B2 (en) * | 2004-08-17 | 2009-07-14 | Research In Motion Limited | Method, system and device for authenticating a user |
US7469291B2 (en) * | 2004-09-22 | 2008-12-23 | Research In Motion Limited | Apparatus and method for integrating authentication protocols in the establishment of connections between computing devices |
US7890343B1 (en) | 2005-01-11 | 2011-02-15 | Jp Morgan Chase Bank | System and method for generating risk management curves |
NO338937B1 (en) * | 2005-01-11 | 2016-10-31 | Allclear Id Inc | Procedure for generating security code. |
NO20050152D0 (en) | 2005-01-11 | 2005-01-11 | Dnb Nor Bank Asa | Method of generating security code and programmable device therefor |
US9148409B2 (en) | 2005-06-30 | 2015-09-29 | The Chamberlain Group, Inc. | Method and apparatus to facilitate message transmission and reception using different transmission characteristics |
US8422667B2 (en) | 2005-01-27 | 2013-04-16 | The Chamberlain Group, Inc. | Method and apparatus to facilitate transmission of an encrypted rolling code |
WO2006087784A1 (en) * | 2005-02-17 | 2006-08-24 | Fujitsu Limited | Authentication method, authentication system, and tag device thereof, information reference client, authentication server, and information server |
EP1849119B1 (en) * | 2005-02-18 | 2019-07-10 | EMC Corporation | Derivative seeds |
US8684267B2 (en) | 2005-03-26 | 2014-04-01 | Privasys | Method for broadcasting a magnetic stripe data packet from an electronic smart card |
EP1882220A2 (en) | 2005-03-26 | 2008-01-30 | Privasys, Inc. | Electronic financial transaction cards and methods |
US8226001B1 (en) | 2010-06-23 | 2012-07-24 | Fiteq, Inc. | Method for broadcasting a magnetic stripe data packet from an electronic smart card |
US20080308627A1 (en) * | 2005-04-07 | 2008-12-18 | Sines Randy D | Financial and similar identification cards and methods relating thereto including awards |
US7509250B2 (en) * | 2005-04-20 | 2009-03-24 | Honeywell International Inc. | Hardware key control of debug interface |
US8266441B2 (en) * | 2005-04-22 | 2012-09-11 | Bank Of America Corporation | One-time password credit/debit card |
EP1882229B1 (en) | 2005-04-27 | 2014-07-23 | Privasys, Inc. | Electronic cards and methods for making same |
US7793851B2 (en) | 2005-05-09 | 2010-09-14 | Dynamics Inc. | Dynamic credit card with magnetic stripe and embedded encoder and methods for using the same to provide a copy-proof credit card |
US7831837B1 (en) * | 2005-06-15 | 2010-11-09 | Emc Corporation | Encoding token commands/data within data streams for standard interfaces |
US20070033649A1 (en) * | 2005-07-20 | 2007-02-08 | Booleansoft | Secure remote access technology |
US8181232B2 (en) * | 2005-07-29 | 2012-05-15 | Citicorp Development Center, Inc. | Methods and systems for secure user authentication |
US20070061868A1 (en) * | 2005-08-03 | 2007-03-15 | Aladdin Knowledge Systems Ltd. | One-time password client |
US7849323B2 (en) * | 2005-11-09 | 2010-12-07 | Emc Corporation | Password presentation for multimedia devices |
US20070124810A1 (en) * | 2005-11-29 | 2007-05-31 | Sigalow Ian D | Method and system for securing electronic transactions |
US9768963B2 (en) | 2005-12-09 | 2017-09-19 | Citicorp Credit Services, Inc. (Usa) | Methods and systems for secure user authentication |
US7904946B1 (en) | 2005-12-09 | 2011-03-08 | Citicorp Development Center, Inc. | Methods and systems for secure user authentication |
US9002750B1 (en) | 2005-12-09 | 2015-04-07 | Citicorp Credit Services, Inc. (Usa) | Methods and systems for secure user authentication |
US9137012B2 (en) * | 2006-02-03 | 2015-09-15 | Emc Corporation | Wireless authentication methods and apparatus |
US7962396B1 (en) | 2006-02-03 | 2011-06-14 | Jpmorgan Chase Bank, N.A. | System and method for managing risk |
US11227676B2 (en) | 2006-02-21 | 2022-01-18 | Universal Secure Registry, Llc | Universal secure registry |
WO2007145687A1 (en) | 2006-02-21 | 2007-12-21 | Weiss Kenneth P | Method and apparatus for secure access payment and identification |
US8234220B2 (en) | 2007-02-21 | 2012-07-31 | Weiss Kenneth P | Universal secure registry |
US8117459B2 (en) * | 2006-02-24 | 2012-02-14 | Microsoft Corporation | Personal identification information schemas |
US8104074B2 (en) * | 2006-02-24 | 2012-01-24 | Microsoft Corporation | Identity providers in digital identity system |
US20070203852A1 (en) * | 2006-02-24 | 2007-08-30 | Microsoft Corporation | Identity information including reputation information |
GB2436670B (en) * | 2006-03-10 | 2010-12-22 | Michael Paul Whitlock | Computer systems |
US7707192B1 (en) | 2006-05-23 | 2010-04-27 | Jp Morgan Chase Bank, N.A. | Confidence index for assets |
US8095966B1 (en) * | 2006-06-28 | 2012-01-10 | Emc Corporation | Methods and apparatus for password management |
JP2008015877A (en) * | 2006-07-07 | 2008-01-24 | Fujitsu Ltd | Authentication system and method |
US8078880B2 (en) * | 2006-07-28 | 2011-12-13 | Microsoft Corporation | Portable personal identity information |
US9251637B2 (en) | 2006-11-15 | 2016-02-02 | Bank Of America Corporation | Method and apparatus for using at least a portion of a one-time password as a dynamic card verification value |
US8407767B2 (en) * | 2007-01-18 | 2013-03-26 | Microsoft Corporation | Provisioning of digital identity representations |
US8087072B2 (en) * | 2007-01-18 | 2011-12-27 | Microsoft Corporation | Provisioning of digital identity representations |
FR2911743B1 (en) * | 2007-01-23 | 2009-04-24 | Ncryptone Sa | PORTABLE AUTHENTICATION DEVICE. |
US8689296B2 (en) * | 2007-01-26 | 2014-04-01 | Microsoft Corporation | Remote access of digital identities |
EP2034458A3 (en) | 2007-03-09 | 2009-09-02 | ActivIdentity, Inc. | One-time passwords |
US8002193B2 (en) | 2007-03-12 | 2011-08-23 | Visa U.S.A. Inc. | Payment card dynamically receiving power from external source |
US8533821B2 (en) * | 2007-05-25 | 2013-09-10 | International Business Machines Corporation | Detecting and defending against man-in-the-middle attacks |
US7930554B2 (en) * | 2007-05-31 | 2011-04-19 | Vasco Data Security,Inc. | Remote authentication and transaction signatures |
US8667285B2 (en) | 2007-05-31 | 2014-03-04 | Vasco Data Security, Inc. | Remote authentication and transaction signatures |
US8060750B2 (en) * | 2007-06-29 | 2011-11-15 | Emc Corporation | Secure seed provisioning |
US8059814B1 (en) | 2007-09-28 | 2011-11-15 | Emc Corporation | Techniques for carrying out seed or key derivation |
US20090159699A1 (en) | 2007-12-24 | 2009-06-25 | Dynamics Inc. | Payment cards and devices operable to receive point-of-sale actions before point-of-sale and forward actions at point-of-sale |
US8302167B2 (en) * | 2008-03-11 | 2012-10-30 | Vasco Data Security, Inc. | Strong authentication token generating one-time passwords and signatures upon server credential verification |
US8478637B1 (en) | 2008-04-08 | 2013-07-02 | Jpmorgan Chase Bank, N.A. | Index for assessing discount potential |
US8307210B1 (en) | 2008-05-02 | 2012-11-06 | Emc Corporation | Method and apparatus for secure validation of tokens |
US8762210B2 (en) | 2008-06-03 | 2014-06-24 | Cardinalcommerce Corporation | Alternative payment implementation for electronic retailers |
US10157375B2 (en) * | 2008-06-03 | 2018-12-18 | Cardinalcommerce Corporation | Alternative payment implementation for electronic retailers |
US7694130B1 (en) * | 2008-09-12 | 2010-04-06 | Michael Anthony Martinez | System and method to authenticate a user utilizing a time-varying auxiliary code |
US8579203B1 (en) | 2008-12-19 | 2013-11-12 | Dynamics Inc. | Electronic magnetic recorded media emulators in magnetic card devices |
KR20110126124A (en) * | 2009-02-04 | 2011-11-22 | 데이터 시큐어리티 시스템즈 솔루션스 피티이 엘티디 | Transforming static password systems to become 2-factor authentication |
US9032058B2 (en) * | 2009-03-13 | 2015-05-12 | Assa Abloy Ab | Use of SNMP for management of small footprint devices |
EP2406749B1 (en) * | 2009-03-13 | 2018-06-13 | Assa Abloy Ab | Transfer device for sensitive material such as a cryptographic key |
US8474026B2 (en) * | 2009-03-13 | 2013-06-25 | Assa Abloy Ab | Realization of access control conditions as boolean expressions in credential authentications |
US20100235900A1 (en) * | 2009-03-13 | 2010-09-16 | Assa Abloy Ab | Efficient two-factor authentication |
US8931703B1 (en) | 2009-03-16 | 2015-01-13 | Dynamics Inc. | Payment cards and devices for displaying barcodes |
US8622309B1 (en) | 2009-04-06 | 2014-01-07 | Dynamics Inc. | Payment cards and devices with budgets, parental controls, and virtual accounts |
US9329619B1 (en) | 2009-04-06 | 2016-05-03 | Dynamics Inc. | Cards with power management |
US8282007B1 (en) | 2009-04-06 | 2012-10-09 | Dynamics Inc. | Laminated cards with manual input interfaces |
US20100269162A1 (en) | 2009-04-15 | 2010-10-21 | Jose Bravo | Website authentication |
US8393545B1 (en) | 2009-06-23 | 2013-03-12 | Dynamics Inc. | Cards deployed with inactivated products for activation |
US8511574B1 (en) | 2009-08-17 | 2013-08-20 | Dynamics Inc. | Advanced loyalty applications for powered cards and devices |
US9306666B1 (en) | 2009-10-08 | 2016-04-05 | Dynamics Inc. | Programming protocols for powered cards and devices |
US8727219B1 (en) | 2009-10-12 | 2014-05-20 | Dynamics Inc. | Magnetic stripe track signal having multiple communications channels |
US8523059B1 (en) | 2009-10-20 | 2013-09-03 | Dynamics Inc. | Advanced payment options for powered cards and devices |
US8393546B1 (en) | 2009-10-25 | 2013-03-12 | Dynamics Inc. | Games, prizes, and entertainment for powered cards and devices |
US8683609B2 (en) * | 2009-12-04 | 2014-03-25 | International Business Machines Corporation | Mobile phone and IP address correlation service |
US8397281B2 (en) * | 2009-12-30 | 2013-03-12 | Symantec Corporation | Service assisted secret provisioning |
WO2011103160A1 (en) | 2010-02-16 | 2011-08-25 | Dynamics Inc. | Systems and methods for drive circuits for dynamic magnetic stripe communications devices |
US8348172B1 (en) | 2010-03-02 | 2013-01-08 | Dynamics Inc. | Systems and methods for detection mechanisms for magnetic cards and devices |
US10693263B1 (en) | 2010-03-16 | 2020-06-23 | Dynamics Inc. | Systems and methods for audio connectors for powered cards and devices |
EP3091473A1 (en) | 2010-05-18 | 2016-11-09 | Dynamics Inc. | Systems and methods for cards and devices operable to communicate via light pulses and touch sensitive displays |
NL2004825C2 (en) | 2010-06-04 | 2011-12-06 | Ubiqu B V | A method of authorizing a person, an authorizing architecture and a computer program product. |
US8317103B1 (en) | 2010-06-23 | 2012-11-27 | FiTeq | Method for broadcasting a magnetic stripe data packet from an electronic smart card |
USD670759S1 (en) | 2010-07-02 | 2012-11-13 | Dynamics Inc. | Multiple button interactive electronic card with light sources |
USD687094S1 (en) | 2010-07-02 | 2013-07-30 | Dynamics Inc. | Multiple button interactive electronic card with light sources |
USD672389S1 (en) | 2010-07-02 | 2012-12-11 | Dynamics Inc. | Multiple button interactive electronic card with light sources |
USD652448S1 (en) | 2010-07-02 | 2012-01-17 | Dynamics Inc. | Multiple button interactive electronic card |
USD674013S1 (en) | 2010-07-02 | 2013-01-08 | Dynamics Inc. | Multiple button interactive electronic card with light sources |
USD652449S1 (en) | 2010-07-02 | 2012-01-17 | Dynamics Inc. | Multiple button interactive electronic card |
USD652867S1 (en) | 2010-07-02 | 2012-01-24 | Dynamics Inc. | Multiple button interactive electronic card |
USD652075S1 (en) | 2010-07-02 | 2012-01-10 | Dynamics Inc. | Multiple button interactive electronic card |
USD651238S1 (en) | 2010-07-09 | 2011-12-27 | Dynamics Inc. | Interactive electronic card with display |
USD792511S1 (en) | 2010-07-09 | 2017-07-18 | Dynamics Inc. | Display with font |
USD651237S1 (en) | 2010-07-09 | 2011-12-27 | Dynamics Inc. | Interactive electronic card with display |
USD792512S1 (en) | 2010-07-09 | 2017-07-18 | Dynamics Inc. | Display with font |
USD643063S1 (en) | 2010-07-09 | 2011-08-09 | Dynamics Inc. | Interactive electronic card with display |
USD792513S1 (en) | 2010-07-09 | 2017-07-18 | Dynamics Inc. | Display with font |
USD651644S1 (en) | 2010-07-09 | 2012-01-03 | Dynamics Inc. | Interactive electronic card with display |
USD652076S1 (en) | 2010-07-09 | 2012-01-10 | Dynamics Inc. | Multiple button interactive electronic card with display |
USD666241S1 (en) | 2010-07-09 | 2012-08-28 | Dynamics Inc. | Multiple button interactive electronic card with light source |
USD665447S1 (en) | 2010-07-09 | 2012-08-14 | Dynamics Inc. | Multiple button interactive electronic card with light source and display |
USD653288S1 (en) | 2010-07-09 | 2012-01-31 | Dynamics Inc. | Multiple button interactive electronic card |
USD665022S1 (en) | 2010-07-09 | 2012-08-07 | Dynamics Inc. | Multiple button interactive electronic card with light source |
USD652450S1 (en) | 2010-07-09 | 2012-01-17 | Dynamics Inc. | Multiple button interactive electronic card |
US8322623B1 (en) | 2010-07-26 | 2012-12-04 | Dynamics Inc. | Systems and methods for advanced card printing |
US9818125B2 (en) | 2011-02-16 | 2017-11-14 | Dynamics Inc. | Systems and methods for information exchange mechanisms for powered cards and devices |
US9053398B1 (en) | 2010-08-12 | 2015-06-09 | Dynamics Inc. | Passive detection mechanisms for magnetic cards and devices |
US10055614B1 (en) | 2010-08-12 | 2018-08-21 | Dynamics Inc. | Systems and methods for advanced detection mechanisms for magnetic cards and devices |
WO2012037479A1 (en) | 2010-09-17 | 2012-03-22 | Universal Secure Registry, Llc | Apparatus, system and method employing a wireless user-device |
US10022884B1 (en) | 2010-10-15 | 2018-07-17 | Dynamics Inc. | Systems and methods for alignment techniques for magnetic cards and devices |
US8561894B1 (en) | 2010-10-20 | 2013-10-22 | Dynamics Inc. | Powered cards and devices designed, programmed, and deployed from a kiosk |
US9646240B1 (en) | 2010-11-05 | 2017-05-09 | Dynamics Inc. | Locking features for powered cards and devices |
US8567679B1 (en) | 2011-01-23 | 2013-10-29 | Dynamics Inc. | Cards and devices with embedded holograms |
US10095970B1 (en) | 2011-01-31 | 2018-10-09 | Dynamics Inc. | Cards including anti-skimming devices |
US9836680B1 (en) | 2011-03-03 | 2017-12-05 | Dynamics Inc. | Systems and methods for advanced communication mechanisms for magnetic cards and devices |
US8485446B1 (en) | 2011-03-28 | 2013-07-16 | Dynamics Inc. | Shielded magnetic stripe for magnetic cards and devices |
US8838988B2 (en) | 2011-04-12 | 2014-09-16 | International Business Machines Corporation | Verification of transactional integrity |
RU2589395C2 (en) | 2011-04-22 | 2016-07-10 | Пепсико, Инк. | Dispensing system for beverages with social services capabilities |
EP2707847A4 (en) | 2011-05-10 | 2015-04-01 | Dynamics Inc | Systems, devices, and methods for mobile payment acceptance, mobile authorizations, mobile wallets, and contactless communication mechanisms |
USD670330S1 (en) | 2011-05-12 | 2012-11-06 | Dynamics Inc. | Interactive card |
USD676904S1 (en) | 2011-05-12 | 2013-02-26 | Dynamics Inc. | Interactive display card |
USD670331S1 (en) | 2011-05-12 | 2012-11-06 | Dynamics Inc. | Interactive display card |
USD670332S1 (en) | 2011-05-12 | 2012-11-06 | Dynamics Inc. | Interactive card |
USD670329S1 (en) | 2011-05-12 | 2012-11-06 | Dynamics Inc. | Interactive display card |
US8628022B1 (en) | 2011-05-23 | 2014-01-14 | Dynamics Inc. | Systems and methods for sensor mechanisms for magnetic cards and devices |
US8827153B1 (en) | 2011-07-18 | 2014-09-09 | Dynamics Inc. | Systems and methods for waveform generation for dynamic magnetic stripe communications devices |
GB2495704B (en) | 2011-10-12 | 2014-03-26 | Technology Business Man Ltd | ID Authentication |
US11551046B1 (en) | 2011-10-19 | 2023-01-10 | Dynamics Inc. | Stacked dynamic magnetic stripe commmunications device for magnetic cards and devices |
US11409971B1 (en) | 2011-10-23 | 2022-08-09 | Dynamics Inc. | Programming and test modes for powered cards and devices |
US9218704B2 (en) | 2011-11-01 | 2015-12-22 | Pepsico, Inc. | Dispensing system and user interface |
US9619741B1 (en) | 2011-11-21 | 2017-04-11 | Dynamics Inc. | Systems and methods for synchronization mechanisms for magnetic cards and devices |
US8960545B1 (en) | 2011-11-21 | 2015-02-24 | Dynamics Inc. | Data modification for magnetic cards and devices |
US9064194B1 (en) | 2012-02-03 | 2015-06-23 | Dynamics Inc. | Systems and methods for spike suppression for dynamic magnetic stripe communications devices |
US9710745B1 (en) | 2012-02-09 | 2017-07-18 | Dynamics Inc. | Systems and methods for automated assembly of dynamic magnetic stripe communications devices |
US8888009B1 (en) | 2012-02-14 | 2014-11-18 | Dynamics Inc. | Systems and methods for extended stripe mechanisms for magnetic cards and devices |
US9916992B2 (en) | 2012-02-20 | 2018-03-13 | Dynamics Inc. | Systems and methods for flexible components for powered cards and devices |
US9734669B1 (en) | 2012-04-02 | 2017-08-15 | Dynamics Inc. | Cards, devices, systems, and methods for advanced payment game of skill and game of chance functionality |
US11418483B1 (en) | 2012-04-19 | 2022-08-16 | Dynamics Inc. | Cards, devices, systems, and methods for zone-based network management |
US9033218B1 (en) | 2012-05-15 | 2015-05-19 | Dynamics Inc. | Cards, devices, systems, methods and dynamic security codes |
CN102750474B (en) * | 2012-06-04 | 2015-09-23 | 飞天诚信科技股份有限公司 | A kind of method and device generating dynamic password in embedded systems |
US10140139B1 (en) * | 2012-06-19 | 2018-11-27 | Bromium, Inc. | Ensuring the privacy and integrity of a hypervisor |
US9064195B2 (en) | 2012-06-29 | 2015-06-23 | Dynamics Inc. | Multiple layer card circuit boards |
US8917826B2 (en) | 2012-07-31 | 2014-12-23 | International Business Machines Corporation | Detecting man-in-the-middle attacks in electronic transactions using prompts |
USD676487S1 (en) | 2012-08-27 | 2013-02-19 | Dynamics Inc. | Interactive electronic card with display and buttons |
USD687887S1 (en) | 2012-08-27 | 2013-08-13 | Dynamics Inc. | Interactive electronic card with buttons |
USD730439S1 (en) | 2012-08-27 | 2015-05-26 | Dynamics Inc. | Interactive electronic card with buttons |
USD828870S1 (en) | 2012-08-27 | 2018-09-18 | Dynamics Inc. | Display card |
USD729869S1 (en) | 2012-08-27 | 2015-05-19 | Dynamics Inc. | Interactive electronic card with display and button |
USD729871S1 (en) | 2012-08-27 | 2015-05-19 | Dynamics Inc. | Interactive electronic card with display and buttons |
USD675256S1 (en) | 2012-08-27 | 2013-01-29 | Dynamics Inc. | Interactive electronic card with display and button |
USD692053S1 (en) | 2012-08-27 | 2013-10-22 | Dynamics Inc. | Interactive electronic card with display and button |
USD687490S1 (en) | 2012-08-27 | 2013-08-06 | Dynamics Inc. | Interactive electronic card with display and button |
USD695636S1 (en) | 2012-08-27 | 2013-12-17 | Dynamics Inc. | Interactive electronic card with display and buttons |
USD694322S1 (en) | 2012-08-27 | 2013-11-26 | Dynamics Inc. | Interactive electronic card with display buttons |
USD687488S1 (en) | 2012-08-27 | 2013-08-06 | Dynamics Inc. | Interactive electronic card with buttons |
USD687487S1 (en) | 2012-08-27 | 2013-08-06 | Dynamics Inc. | Interactive electronic card with display and button |
USD687489S1 (en) | 2012-08-27 | 2013-08-06 | Dynamics Inc. | Interactive electronic card with buttons |
USD673606S1 (en) | 2012-08-27 | 2013-01-01 | Dynamics Inc. | Interactive electronic card with display and buttons |
USD687095S1 (en) | 2012-08-27 | 2013-07-30 | Dynamics Inc. | Interactive electronic card with buttons |
USD730438S1 (en) | 2012-08-27 | 2015-05-26 | Dynamics Inc. | Interactive electronic card with display and button |
USD729870S1 (en) | 2012-08-27 | 2015-05-19 | Dynamics Inc. | Interactive electronic card with display and button |
USD688744S1 (en) | 2012-08-27 | 2013-08-27 | Dynamics Inc. | Interactive electronic card with display and button |
US11126997B1 (en) | 2012-10-02 | 2021-09-21 | Dynamics Inc. | Cards, devices, systems, and methods for a fulfillment system |
US9094822B2 (en) * | 2012-10-18 | 2015-07-28 | Futurewei Technologies, Inc. | Seamless telephone login |
US9010647B2 (en) | 2012-10-29 | 2015-04-21 | Dynamics Inc. | Multiple sensor detector systems and detection methods of magnetic cards and devices |
US9659246B1 (en) | 2012-11-05 | 2017-05-23 | Dynamics Inc. | Dynamic magnetic stripe communications device with beveled magnetic material for magnetic cards and devices |
US9010644B1 (en) | 2012-11-30 | 2015-04-21 | Dynamics Inc. | Dynamic magnetic stripe communications device with stepped magnetic material for magnetic cards and devices |
US10949627B2 (en) | 2012-12-20 | 2021-03-16 | Dynamics Inc. | Systems and methods for non-time smearing detection mechanisms for magnetic cards and devices |
US8955075B2 (en) | 2012-12-23 | 2015-02-10 | Mcafee Inc | Hardware-based device authentication |
US9419953B2 (en) | 2012-12-23 | 2016-08-16 | Mcafee, Inc. | Trusted container |
US8850543B2 (en) | 2012-12-23 | 2014-09-30 | Mcafee, Inc. | Hardware-based device authentication |
USD751640S1 (en) | 2013-03-04 | 2016-03-15 | Dynamics Inc. | Interactive electronic card with display and button |
USD777252S1 (en) | 2013-03-04 | 2017-01-24 | Dynamics Inc. | Interactive electronic card with buttons |
USD751639S1 (en) | 2013-03-04 | 2016-03-15 | Dynamics Inc. | Interactive electronic card with display and button |
USD750167S1 (en) | 2013-03-04 | 2016-02-23 | Dynamics Inc. | Interactive electronic card with buttons |
USD765173S1 (en) | 2013-03-04 | 2016-08-30 | Dynamics Inc. | Interactive electronic card with display and button |
USD750168S1 (en) | 2013-03-04 | 2016-02-23 | Dynamics Inc. | Interactive electronic card with display and button |
USD750166S1 (en) | 2013-03-04 | 2016-02-23 | Dynamics Inc. | Interactive electronic card with display and buttons |
USD764584S1 (en) | 2013-03-04 | 2016-08-23 | Dynamics Inc. | Interactive electronic card with buttons |
USD765174S1 (en) | 2013-03-04 | 2016-08-30 | Dynamics Inc. | Interactive electronic card with button |
EP3019992B1 (en) * | 2013-07-08 | 2020-04-29 | Assa Abloy AB | One-time-password generated on reader device using key read from personal security device |
USD737373S1 (en) | 2013-09-10 | 2015-08-25 | Dynamics Inc. | Interactive electronic card with contact connector |
USD767024S1 (en) | 2013-09-10 | 2016-09-20 | Dynamics Inc. | Interactive electronic card with contact connector |
US10108891B1 (en) | 2014-03-21 | 2018-10-23 | Dynamics Inc. | Exchange coupled amorphous ribbons for electronic stripes |
US9378384B2 (en) | 2014-04-16 | 2016-06-28 | Bank Of America Corporation | Secure endpoint file export in a business environment |
US9430674B2 (en) | 2014-04-16 | 2016-08-30 | Bank Of America Corporation | Secure data access |
US10032049B2 (en) | 2016-02-23 | 2018-07-24 | Dynamics Inc. | Magnetic cards and devices for motorized readers |
US20170278127A1 (en) | 2016-03-28 | 2017-09-28 | Codebroker, Llc | Validating digital content presented on a mobile device |
WO2018013961A1 (en) | 2016-07-15 | 2018-01-18 | Cardinalcommerce Corporation | Authentication to authorization bridge using enriched messages |
US10387632B2 (en) | 2017-05-17 | 2019-08-20 | Bank Of America Corporation | System for provisioning and allowing secure access to a virtual credential |
US10574650B2 (en) | 2017-05-17 | 2020-02-25 | Bank Of America Corporation | System for electronic authentication with live user determination |
US10652743B2 (en) | 2017-12-21 | 2020-05-12 | The Chamberlain Group, Inc. | Security system for a moveable barrier operator |
US11074773B1 (en) | 2018-06-27 | 2021-07-27 | The Chamberlain Group, Inc. | Network-based control of movable barrier operators for autonomous vehicles |
CA3107457A1 (en) | 2018-08-01 | 2020-02-06 | The Chamberlain Group, Inc. | Movable barrier operator and transmitter pairing over a network |
US10997810B2 (en) | 2019-05-16 | 2021-05-04 | The Chamberlain Group, Inc. | In-vehicle transmitter training |
Family Cites Families (15)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US3764742A (en) * | 1971-12-23 | 1973-10-09 | Ibm | Cryptographic identification system |
US3956615A (en) * | 1974-06-25 | 1976-05-11 | Ibm Corporation | Transaction execution system with secure data storage and communications |
US4123747A (en) * | 1977-05-20 | 1978-10-31 | International Business Machines Corporation | Identity verification method and apparatus |
US4302810A (en) * | 1979-12-28 | 1981-11-24 | International Business Machines Corporation | Method and apparatus for secure message transmission for use in electronic funds transfer systems |
US4885778A (en) * | 1984-11-30 | 1989-12-05 | Weiss Kenneth P | Method and apparatus for synchronizing generation of separate, free running, time dependent equipment |
US5367572A (en) * | 1984-11-30 | 1994-11-22 | Weiss Kenneth P | Method and apparatus for personal identification |
US5168520A (en) * | 1984-11-30 | 1992-12-01 | Security Dynamics Technologies, Inc. | Method and apparatus for personal identification |
US4856062A (en) * | 1984-11-30 | 1989-08-08 | Kenneth Weiss | Computing and indicating device |
US4998279A (en) * | 1984-11-30 | 1991-03-05 | Weiss Kenneth P | Method and apparatus for personal verification utilizing nonpredictable codes and biocharacteristics |
GB8522569D0 (en) * | 1985-09-12 | 1985-10-16 | Philipsz B E | Computer security method |
US5367150A (en) * | 1988-09-26 | 1994-11-22 | Hitachi Maxell, Ltd. | Data processing system using IC card |
US5097505A (en) * | 1989-10-31 | 1992-03-17 | Securities Dynamics Technologies, Inc. | Method and apparatus for secure identification and verification |
US5237614A (en) * | 1991-06-07 | 1993-08-17 | Security Dynamics Technologies, Inc. | Integrated network security system |
US5280527A (en) * | 1992-04-14 | 1994-01-18 | Kamahira Safe Co., Inc. | Biometric token for authorizing access to a host system |
EP0566811A1 (en) * | 1992-04-23 | 1993-10-27 | International Business Machines Corporation | Authentication method and system with a smartcard |
-
1994
- 1994-03-16 US US08/213,951 patent/US5657388A/en not_active Expired - Lifetime
-
1995
- 1995-03-16 CA CA002183629A patent/CA2183629C/en not_active Expired - Lifetime
- 1995-03-16 JP JP7524140A patent/JPH09510561A/en active Pending
- 1995-03-16 WO PCT/US1995/003181 patent/WO1995025391A1/en active Search and Examination
- 1995-03-16 AU AU19924/95A patent/AU681500B2/en not_active Expired
- 1995-03-16 EP EP95912913A patent/EP0750814A4/en not_active Ceased
- 1995-03-16 KR KR1019960705158A patent/KR970701956A/en not_active Application Discontinuation
Also Published As
Publication number | Publication date |
---|---|
AU681500B2 (en) | 1997-08-28 |
WO1995025391A1 (en) | 1995-09-21 |
KR970701956A (en) | 1997-04-12 |
AU1992495A (en) | 1995-10-03 |
JPH09510561A (en) | 1997-10-21 |
EP0750814A1 (en) | 1997-01-02 |
EP0750814A4 (en) | 1997-04-09 |
CA2183629A1 (en) | 1995-09-21 |
US5657388A (en) | 1997-08-12 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
CA2183629C (en) | Method and apparatus for utilizing a token for resource access | |
US5233655A (en) | Data access verification system | |
EP0647895B1 (en) | Method for preventing inadvertent betrayal of stored digital secrets by a trustee | |
US5485519A (en) | Enhanced security for a secure token code | |
US5168520A (en) | Method and apparatus for personal identification | |
US5367572A (en) | Method and apparatus for personal identification | |
EP1791073B1 (en) | Processing device, helper data generating device, terminal device, authentication device and biometrics authentication system | |
US5023908A (en) | Method and apparatus for personal identification | |
US4993068A (en) | Unforgeable personal identification system | |
US20050144484A1 (en) | Authenticating method | |
GB2317983A (en) | Authenticating user | |
US20050044377A1 (en) | Method of authenticating user access to network stations | |
US20030101348A1 (en) | Method and system for determining confidence in a digital transaction | |
US20020138769A1 (en) | System and process for conducting authenticated transactions online | |
US20030105964A1 (en) | Method and apparatus for performing enhanced time-based authentication | |
KR20160070061A (en) | Apparatus and Methods for Identity Verification | |
US6580815B1 (en) | Page back intrusion detection device | |
WO1999012144A1 (en) | Digital signature generating server and digital signature generating method | |
AU649190B2 (en) | Method and apparatus for personal identification | |
JPH1188321A (en) | Digital signature generation server | |
JP2001236325A (en) | Individual identification system and its using method | |
US20020073345A1 (en) | Secure indentification method and apparatus | |
JP2002366527A (en) | Personal identification method | |
JP2002288623A (en) | Ic card system | |
KR20020004368A (en) | Operating method of computer system using electronic authentication system |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
EEER | Examination request | ||
MKEX | Expiry |
Effective date: 20150316 |