US20090282247A1 - Method, system and device for authenticating a user - Google Patents

Method, system and device for authenticating a user Download PDF

Info

Publication number
US20090282247A1
US20090282247A1 US12/500,840 US50084009A US2009282247A1 US 20090282247 A1 US20090282247 A1 US 20090282247A1 US 50084009 A US50084009 A US 50084009A US 2009282247 A1 US2009282247 A1 US 2009282247A1
Authority
US
United States
Prior art keywords
electronic device
handheld electronic
authentication code
computer
user
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Abandoned
Application number
US12/500,840
Inventor
Michael G. Kirkup
Michael K. Brown
Michael S. Brown
Neil P. Adams
Herbert A. Little
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Malikie Innovations Ltd
Original Assignee
Research in Motion Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Research in Motion Ltd filed Critical Research in Motion Ltd
Priority to US12/500,840 priority Critical patent/US20090282247A1/en
Assigned to RESEARCH IN MOTION LIMITED reassignment RESEARCH IN MOTION LIMITED ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: ADAMS, NEIL P., BROWN, MICHAEL K., BROWN, MICHAEL S., LITTLE, HERBERT A., KIRKUP, MICHAEL G.
Publication of US20090282247A1 publication Critical patent/US20090282247A1/en
Assigned to BLACKBERRY LIMITED reassignment BLACKBERRY LIMITED CHANGE OF NAME (SEE DOCUMENT FOR DETAILS). Assignors: RESEARCH IN MOTION LIMITED
Assigned to MALIKIE INNOVATIONS LIMITED reassignment MALIKIE INNOVATIONS LIMITED ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: BLACKBERRY LIMITED
Abandoned legal-status Critical Current

Links

Images

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31User authentication
    • G06F21/34User authentication involving the use of external additional devices, e.g. dongles or smart cards
    • G06F21/35User authentication involving the use of external additional devices, e.g. dongles or smart cards communicating wirelessly
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31User authentication
    • G06F21/34User authentication involving the use of external additional devices, e.g. dongles or smart cards

Definitions

  • the invention relates generally to methods, systems and devices for authenticating a user of a computer by using a handheld electronic device.
  • the computer or handheld electronic device becomes locked.
  • a user wishes to unlock his desktop computer upon entering his office, he can withdraw his smart-card from his handheld electronic device and place it in a card reader associated with the desktop computer.
  • withdrawal of the smart-card from the handheld electronic device may cause it to be locked, thus preventing the user from accessing his handheld electronic device at the same time as accessing his desktop computer.
  • One aspect of the invention relates to a method of authenticating a user of a computer, comprising:
  • the first authentication code is stored on a smart-card received by the handheld electronic device. In an alternative embodiment, the first authentication code is stored in a memory of the handheld electronic device. In a further alternative embodiment, the first authentication code is stored in a subscriber identity module (SIM) card received by the handheld electronic device.
  • SIM subscriber identity module
  • Another aspect of the invention relates to a handheld electronic device having:
  • a first authentication code stored on a memory accessible by the handheld electronic device
  • processor means configured to authenticate the second authentication code and provide the first authentication code to the computer via the communication means to authenticate the user.
  • Provision of the first authentication code may be in immediate response to, or some time after, authentication of the second authentication code.
  • a further aspect of the invention relates to computer readable storage having stored thereon computer program instructions which, when executed by a computer processor of a handheld electronic device, cause the handheld electronic device to perform a method for authenticating a user of a computer, wherein the handheld electronic device has an authentication code accessible thereto and the method comprises:
  • a further aspect of the invention relates to a system for authenticating a user of a computer comprising:
  • a handheld electronic device having an authentication code accessible thereto and means for receiving a personal identification code of the user;
  • the handheld electronic device is configured to receive the personal identification code, authenticate the personal identification code and provide the authentication code to the computer over the communication link to authenticate the user.
  • the means for receiving comprises a user interface of the handheld electronic device.
  • the means for receiving comprises a communication port of the handheld electronic device and the personal identification code is received from the personal computer over the communication link.
  • Another aspect the invention relates to a method for authenticating a user of a personal computer by provision of an authentication code to the personal computer, the method comprising:
  • FIG. 1A is a block diagram of a system for authenticating a user of a computer, according to one embodiment for the invention
  • FIG. 1B is a block diagram of a system for authenticating a user of a computer, according to another embodiment of the invention.
  • FIG. 1C is a block diagram of a system for authenticating a user of a computer, according to another embodiment of the invention.
  • FIG. 1D is a block diagram of a system for authenticating a user of a computer, according to another embodiment of the invention.
  • FIG. 1E is a block diagram of a system for authenticating a user of a computer, according to another embodiment of the invention.
  • FIG. 1F is a block diagram of a system for authenticating a user of a computer, according to another embodiment of the invention.
  • FIG. 2 is a process flow diagram illustrating a method of authenticating a user of a computer, according to another embodiment of the invention.
  • FIG. 3 is a block diagram of a handheld electronic device for use in authenticating a user, according to another embodiment of the invention.
  • Embodiments of the invention generally relate to authenticating a user of a computer using a handheld electronic device having an authentication code stored thereon or otherwise accessible thereto.
  • the handheld electronic device is configured to transmit the authentication code to the computer so as to enable the user to unlock the desktop of the computer and thus gain access to the computer functions.
  • arrangements of the handheld electronic device and the computer may be such that if the handheld electronic device is itself unlocked, the user need do nothing more than enable it to communicate with the computer, in order to unlock the computer also.
  • the handheld electronic device can be configured to require entry of a user code, such as a personal identification number (PIN) or other form of authorization, to initiate release of the authentication code for transmission to the computer.
  • a user code such as a personal identification number (PIN) or other form of authorization
  • PIN personal identification number
  • the user is authenticated to the handheld electronic device by the smart-card received therein and becomes authenticated to the computer once the handheld electronic device transmits the authentication code read from the smart-card to the computer.
  • Alternative arrangements, involving different levels of security and physical set-ups can be employed and some of these are described below in relation to the drawings.
  • the system 100 A includes a handheld electronic device (HED) 120 in communication with a personal computer (PC) 110 through a communication link 115 .
  • the handheld electronic device 120 has a smart-card (SC) 130 received in a smart-card slot (for example, such as is shown in FIG. 3 and designated by reference numeral 350 ).
  • the handheld electronic device 120 is received in a cradle 125 , which in turn connects to communication link 115 through internal electrical connections (not shown) in the cradle 125 .
  • the communication link 115 is preferably established through a suitable connection cable (not specifically shown) for serial communication between a serial port (not shown) of the PC 110 and a serial port (shown in FIG. 3 and designated by reference numeral 330 ) of the handheld electronic device 120 (via cradle 125 ).
  • the connection cable may be a Universal Serial Bus (USB) cable, for example.
  • the handheld electronic device may be a dual mode (data and voice) communication device and personal digital assistant device, such as is described in further detail below in relation to FIG. 3 .
  • the handheld electronic device may be a single mode (data) communication device.
  • the handheld electronic device 120 requires the user to authenticate himself/herself by providing a password or PIN code to unlock the user interface of the handheld electronic device 120 and enable use thereof.
  • the handheld electronic device 120 has electrical contacts (not shown) exposed on an outer casing thereof for forming an electrical connection with corresponding contacts located on cradle 125 .
  • the electrical contacts on cradle 125 are electrically connected to a fixed or removeably connectable cable to form communication link 115 .
  • PC 110 may be of any kind of computer, such as a normal desktop computer, laptop or other portable or fixed computer system which may require authentication of the user identity prior to enabling use thereof. Accordingly, while the computer is described as a PC 110 , it should be understood that it need not be a personal computer or be of a particular type. Likewise, performance of the invention can be achieved whether the computer runs a Windows based operating system, Unix based operating system or other type of operating system.
  • PC 110 includes normal peripherals such as a display screen, a keyboard, mouse, etc. for enabling user interaction therewith.
  • a user identification code (either to the PC 110 or the handheld electronic device 120 ) to unlock the PC desktop and enable use thereof.
  • the user identification code which may be a PIN code or another code, is compared with a stored access code and, if the user identification code is valid, the authentication code stored on the smart-card is accessed and provided to PC 110 .
  • PC 110 is preferably configured to automatically seek the authentication code from handheld electronic device 120 over communication link 115 in response to activation. Depending on the configuration of the handheld electronic device 120 , receipt of a communication from PC 110 may trigger automatic retrieval of the authentication code from smart-card 130 or it may cause the handheld electronic device 120 to request user authentication before retrieving the authentication code and communicating it to PC 110 (or authorization). Alternatively, PC 110 may simply await input of the authentication code from handheld electronic device 120 over communication link 115 .
  • the communication protocol used between the PC 110 and the handheld electronic device 120 depends on the form of connection established therebetween.
  • Example connections include a serial connection, a USB connection and a Bluetooth connection.
  • Other suitable communication protocols may employed instead.
  • PC 110 may be configured to request the user to enter an authentication code for the handheld electronic device 120 , for example where the PC 110 has detected the presence of handheld electronic device 120 through communication link 115 .
  • the handheld electronic device 120 Once the user enters the authentication code of the handheld electronic device 120 through PC 110 , this is transmitted to the handheld electronic device 120 by communication link 115 for authentication. If the entered authentication code is correct, the handheld electronic device 120 then provides the authentication code for the PC 110 (as extracted from smart-card 130 ) across communication link 115 , thereby authenticating the user and unlocking the desktop of PC 110 .
  • the described arrangements generally allow a user to unlock both the PC 110 and the handheld electronic device 120 by simply inputting one authorization code, namely that for the handheld electronic device 120 .
  • the PIN code or other unlocking code for the handheld electronic device 120 may be entered either into a user interface of the handheld electronic device 120 or that of the PC 110 so as to unlock handheld electronic device 120 (if it is not already unlocked) and PC 110 . If the PIN code or other unlocking code for the handheld electronic device 120 is entered into PC 110 , the PC 110 communicates with handheld electronic device 120 to retrieve the necessary authentication code from smart-card 130 . Otherwise, if the user interfaces directly with handheld electronic device 120 then, upon authentication of the user (if required), the authentication code for PC 110 is extracted from smart-card 130 and provided to PC 110 over communication link 115 .
  • the user identification code may be a PIN code or may be an alphanumeric or alphabetic password, for example.
  • the user may be required to input the password in order to unlock the user interface of the handheld electronic device 120 , and subsequently input the PIN code in order to authorize access to the authentication code stored on the smart-card.
  • the handheld electronic device 120 may be configured to not require subsequent entry of any further user identification code in order to access the authentication code on the smart-card.
  • the user identification code thus required may be set so as to be the same code as that required for unlocking the handheld electronic device 120 , so that the user does not have to remember separate codes.
  • a user identification code is required to enable access to the authentication code on the smart-card, then upon receipt of the user identification code, it is compared with an appropriate access code stored on the smart-card.
  • the access code is compared with the inputted user identification code and, if they match, the user identity is effectively authenticated to the smart-card, which then enables access of the authentication code for transmission thereof to the computer.
  • the authentication code may be provided to the PC 110 automatically upon establishment of communication link 115 or in response to a simple authorization action performed by the user.
  • the authorization action may be responding “yes” or “ok” to a question in a dialog box on the user interface asking “ok to provide authorization code?”. While such an authorization action by the user provides more security than allowing automatic access to the authorization code on the smart-card, it is not as secure as providing a proper user identification code, such as a PIN code or password.
  • System 100 B is similar to system 100 A, except that it does not require a cradle 125 . Rather, in system 100 B, PC 110 and handheld electronic device 120 are directly connected through communication link 115 , for example by a communication cable connecting respective serial input/output (I/O) ports of PC 110 and handheld electronic device 120 . Apart from the absence of cradle 125 , system 100 B otherwise operates in a similar manner to system 100 A, as described in relation to FIG. 1A .
  • System 100 C is similar to system 100 A and system 100 B, except that it does not have a separate smart-card received in a slot of the handheld electronic device 120 .
  • the handheld electronic device 120 includes a subscriber identity module (SIM) card (shown in FIG. 3 and designated by reference numeral 316 ), such as those which are commonly used in the Global System for Mobile Communication (GSM) and General Packet Radio Services (GPRS) telecommunication standards.
  • SIM subscriber identity module
  • GSM Global System for Mobile Communication
  • GPRS General Packet Radio Services
  • system 100 C does not require a slot in the handheld electronic device 120 for receiving smart-card 130 , nor does it require use of a cradle 125 .
  • PC 110 and handheld electronic device 120 are directly connected through communication link 115 , for example by a communication cable connecting the serial I/O ports of PC 110 and handheld electronic device 120 .
  • system 100 C otherwise operates as described in relation to systems 100 A, 100 B, FIG. 1A and FIG. 1B .
  • a non-volatile memory of the handheld electronic device 120 may be used to store the authentication code of the user. This may be appropriate where the handheld electronic device is not compatible with the GSM or GPRS standards and is thus not suited to use with a SIM card.
  • the non-volatile memory used to store the authentication code should be suitably secure so as to prevent unauthorized access thereto.
  • System 100 D is similar to system 100 A, except that it does not require the handheld electronic device 120 to be received in cradle 125 . Rather, in system 100 D, a smart-card reader 132 may directly receive smart-card 130 and the handheld electronic device 120 communicates with the smart-card reader 132 over a communication link 135 to access the authentication code stored in the memory of smart-card 130 .
  • Communication link 135 may be established through a suitable cable interconnecting smart-card reader 132 and an auxiliary input/output port (such as is shown in FIG. 3 and designated by reference numeral 328 ) of handheld electronic device 120 .
  • Communication link 115 in system 100 D is formed in the same way as described in relation to systems 100 B and 100 C.
  • System 100 D is different from system 10 A in that the card reading function of smart-card 130 is not performed by the handheld electronic device 120 , but is instead performed by card reader 132 as a separate component of system 100 D.
  • System 100 D further differs from system 100 A in that it employs a direct communication link between PC 110 and handheld electronic device 120 , rather than indirectly through cradle 125 . Apart from the noted differences, system 100 D otherwise operates in a similar manner to system 100 A, as described in relation to FIG. 1A .
  • System 100 E is similar to system 100 C, except that communication link 115 is replaced by a wireless communication link 145 between PC 110 and handheld electronic device 120 .
  • Wireless communication link 145 may, for example, be established by infrared communications or short-range radio frequency communications, such as those specified by the Bluetooth or 802.11 standards. Such wireless communications require PC 110 to have corresponding hardware input/output functionality and software for executing that communication functionality. Other short-range wireless communications media and/or protocols may be used to provide communication link 145 .
  • Wireless communication link 145 may be employed in place of communication link 115 in any of the embodiments of systems 100 A, 100 B, 100 C, 100 D and 100 F (described hereinafter).
  • providing wireless communication link 145 enables a user to approach PC 110 , activate the PC 110 and have it communicate automatically and wirelessly, for example using the Bluetooth short-range communication specification, with handheld electronic device 120 to access the user's authentication code (stored on the smart-card, SIM card or memory of the handheld electronic device) and authenticate the user.
  • This example is particularly applicable to systems embodiments 100 B and 100 C (if using wireless communication link 145 ) and 100 E, where the user is not required to provide a user identification code to release the authentication code (i.e. because the handheld electronic device has already received such a code and is already unlocked).
  • System 100 F is similar to system 100 C, except that it involves a separate token generator 150 (for example, such as a SecurID Authenticator by RSA) and handheld electronic device 120 in system 100 F includes a software module for authenticating a user identification code generated by the token generator 150 .
  • System 100 F involves the use of token generator 150 to generate a secure identification token based on an objective criterion (such as the time or date, for example). The token thus generated is displayed on display 155 of token generator 150 for the user to read.
  • a separate token generator 150 for example, such as a SecurID Authenticator by RSA
  • handheld electronic device 120 in system 100 F includes a software module for authenticating a user identification code generated by the token generator 150 .
  • System 100 F involves the use of token generator 150 to generate a secure identification token based on an objective criterion (such as the time or date, for example). The token thus generated is displayed on display 155 of token generator 150 for the user to read.
  • an objective criterion such as the time or
  • Handheld electronic device 120 has software to generate an access code using the same algorithms used by token generator 150 to generate the token, and compares the access code to the user identification code (i.e. the generated token) input by the user. If the access code generated by the handheld electronic device 120 matches the manually inputted token, the authentication code becomes accessible for communication to PC 110 .
  • token generator 150 may be applied in relation to any of systems 100 A to 100 E as a secure means for authenticating the user to the handheld electronic device 120 , where the memory accessible thereto has the authentication code.
  • system 100 F otherwise operates in a similar manner to any of systems 100 A to 100 E, as described in relation to FIGS. 1A to 1E .
  • the function of token generator 150 may be incorporated into handheld electronic device 120 and, instead of the user manually inputting the token into handheld electronic device 120 , the token is automatically generated by the handheld electronic device 120 as an authentication code in response to an authenticated user identification code.
  • the token generated in this way is then transmitted to PC 110 over communication link 115 (or 145) for comparison with a token generated locally on PC 110 according to the same algorithm and objective criterion used to generate the token on handheld electronic device 120 .
  • the secure token generator may be used by the user to authenticate the user to the handheld electronic device 120 or by the handheld electronic device 120 to authenticate itself to PC 110 , using an encrypted token.
  • Each of the embodiments, and variations thereof, of systems for authenticating a user described above is generally related by the provision of a handheld electronic device 120 having an authentication code accessible thereto.
  • the authentication code is provided to PC 110 over a communication link 115 or 145 , the user can be authenticated as an authorized user of the PC 110 .
  • functional requirements can be achieved in a number of ways, at least some of which have been described. Further embodiments of the invention may be arrived at through combinations of features or functions described in relation to the various embodiments, and all such combinations are, if useful, within the scope of the invention.
  • Method 200 begins with an authentication initiation step 205 , at which the user indicates her desire to be authenticated as an authorized user of PC 110 .
  • Authentication initiation may begin at either the PC 110 or the handheld electronic device 120 .
  • authentication initiation may begin by selection of a menu item from a menu provided by the user interface or by pressing certain keys.
  • the handheld electronic device 120 may be configured to automatically check whether authentication is to be initiated by periodically polling the serial I/O port.
  • authentication initiation may begin by pressing a key on the keyboard on PC 110 , moving the mouse or otherwise attempting to provide input to PC 110 when it is in its locked state.
  • a computer will become locked after it is idle for a predetermined period of time, for example in the order of 15 to 30 minutes.
  • the handheld electronic device 120 (or PC 110 , depending on whether authentication initiation occurred at the handheld electronic device 120 or PC 110 ) checks whether communication link 115 has been established. If the communication link 115 has not been established, an error message is provided to the user at step 215 either on the user interface of handheld electronic device 120 or on the display of PC 110 .
  • the authorization input may be either coded or uncoded.
  • a coded form of authorization input may be a user identification code such as a PIN code, a user password or a secure token generated by token generator 150 .
  • An uncoded authorization input may be a response such as “yes” or “ok” to a dialog box on the user interface of handheld electronic device 120 .
  • the handheld electronic device 120 checks the received authorization input for validity and, if it is not found to be valid (i.e. by comparing it to the access code) at step 225 , outputs an error message at step 215 . If the authorization input is found to be valid, the handheld electronic device 120 proceeds to access the authentication code in its memory or in the memory of the smart-card or SIM card, at step 230 and transmits the authentication code to PC 110 at step 235 .
  • authentication method 200 halts and awaits authentication initiation step 205 to begin again.
  • authentication method 200 does not require steps 220 , 223 and 225 if handheld electronic device 120 is not configured to require any user input prior to provision of the authentication code to PC 110 , for example where the handheld electronic device 120 has already been unlocked by entry of an appropriate user identification code.
  • step 230 follows step 210 if the communication link 115 has been established.
  • Authentication method 200 may alternatively be performed so as to check the establishment of communication link 115 after the authorization input has been requested and validated (steps 220 , 225 ) but before accessing the user authentication code at step 230 .
  • handheld electronic device 120 is described in further detail. Depending on the functionality provided by the handheld electronic device 120 , it may be referred to as a data messaging device, a two-way pager, a cellular telephone with data messaging capabilities, a wireless Internet appliance, or a data communication device (with or without telephony capabilities).
  • Handheld electronic device 120 comprises a number of components, the controlling component being microprocessor 338 .
  • Microprocessor 338 controls the overall operation of the handheld electronic device 120 .
  • the hardware and software control functions described above in relation to FIGS. 1A to 1F and FIG. 2 are performed by microprocessor 338 .
  • communication subsystem 311 Communication functions, including data and voice communications, are performed through a communication subsystem 311 .
  • communication subsystem 311 is configured in accordance with the Global System for Mobile Communication (GSM) and General Packet Radio Services (GPRS) standards.
  • GSM Global System for Mobile Communication
  • GPRS General Packet Radio Services
  • the GSM/GPRS wireless network is used worldwide and it is expected that these standards will be superseded eventually by Enhanced Data GSM Environment (EDGE) and Universal Mobile Telecommunications Service (UMTS). New standards are still being defined, but it is believed that they will have similarities to the network behaviour described herein, and it will also be understood that the communication subsystem 311 is intended to use any other suitable standards that are developed in the future.
  • Microprocessor 338 also interacts with additional subsystems such as a Random Access Memory (RAM) 326 , a non-volatile memory 324 , a display 322 , an auxiliary input/output (I/O) subsystem 328 , a serial port 330 , a keyboard 332 , a communication subsystem 311 , a speaker and microphone 336 (which may be separately controlled) and short-range communications 340 .
  • RAM Random Access Memory
  • I/O auxiliary input/output subsystem
  • serial port 330 a serial port 330
  • keyboard 332 a keyboard 332
  • communication subsystem 311 a communication subsystem
  • speaker and microphone 336 which may be separately controlled
  • Some of the subsystems of handheld electronic device 120 perform communication-related functions, whereas other subsystems may provide “resident” or on-device functions.
  • display 322 and keyboard 332 may be used for both communication-related functions, such as entering a text message for transmission over a network and device-resident functions such as a calculator or task list.
  • Operating system software used by microprocessor 338 is typically stored in a persistent store such as non-volatile memory 324 , which may alternatively be a read-only memory (ROM) or similar storage element (not shown).
  • ROM read-only memory
  • Handheld electronic device 120 may require a SIM card 316 to be inserted in a SIM interface 318 in order to communicate with a network.
  • SIM card 316 is one type of a conventional smart-card used to identify a subscriber of handheld electronic device 120 and to personalize the handheld electronic device 120 , among other functions. By inserting SIM card 316 into SIM interface 318 , a subscriber can access all subscribed services in a network. Services may include: web browsing and messaging such as email, voice mail, Short Message Service (SMS), and Multimedia Messaging Services (MMS). More advanced services may include: point of sale, field service and sales force automation.
  • SIM card 316 includes a processor and memory for storing information.
  • SIM card 316 is inserted in SIM interface 318 , it is coupled to microprocessor 338 .
  • SIM card 316 contains some user parameters such as an International Mobile Subscriber Identity (IMSI) and encryption/decryption keys.
  • IMSI International Mobile Subscriber Identity
  • SIM card 316 may store additional subscriber information for a mobile device as well, including datebook (or calendar) information and recent call information.
  • Handheld electronic device 120 is a battery-powered device and includes a battery interface (not shown) for receiving one or more rechargeable batteries (not shown).
  • the battery interface is coupled to a regulator (not shown), which assists the batteries in providing power to handheld electronic device 120 .
  • a regulator not shown
  • future technologies such as micro fuel cells may provide the power to handheld electronic device 120 .
  • Microprocessor 338 in addition to its operating system functions, enables execution of software applications on handheld electronic device 120 .
  • a set of applications which control basic device operations, including data and voice communication applications, will normally be installed on handheld electronic device 120 during its manufacture.
  • Another application that may be loaded onto handheld electronic device 120 is a personal information manager (PIM).
  • PIM has functionality to organize and manage data items of interest to a subscriber, such as, but not limited to, e-mail, calendar events, voice mails, appointments, and task items.
  • Short-range communications subsystem 340 provides for communication between handheld electronic device 120 and different systems or devices, such as PC 110 .
  • subsystem 340 may include an infrared device and associated circuits and components for short-range communication.
  • Examples of short range communication include standards developed by the Infrared Data Association (IrDA), Bluetooth, and the 802.11 family of standards developed by IEEE.
  • Handheld electronic device 120 also includes a card slot 350 for receiving smart-card 130 therein.
  • Microprocessor 338 communicates with a processor on smart-card 130 to access the authentication code stored thereon (for embodiments of the invention using a smart-card).
  • Card slot 350 includes electrical contacts (not shown) for connecting with corresponding electrical contacts on a smart-card 130 to enable communication between microprocessor 338 and the processor on smart-card 130 .
  • handheld electronic device 120 may include both a SIM card 316 and a smart-card 130 .
  • the handheld electronic device 120 may include only one or neither of SIM card 316 and smart-card 130 . If neither SIM card 316 or smart-card 130 is received by handheld electronic device 120 , the authentication code must be stored in non-volatile memory 324 or other secure memory (not shown) or be accessible to the handheld electronic device 120 from an external source (for example, over a cable 135 as shown in FIG. 1D ). If smart-card 130 is received in smart-card slot 350 , microprocessor 338 will generally seek to access the authentication code on the smart-card 130 . Otherwise, microprocessor 338 will seek to access the authentication code on SIM card 316 (if present).
  • the authentication code (for authenticating the user to the PC 110 ) is preferably stored in non-volatile memory 324 or other secure memory.
  • the authentication code may be stored on the smart-card 130 or SIM card 316 (if present).
  • the software algorithm for generating a corresponding token is also stored in non-volatile memory 324 .
  • Microprocessor 338 runs software (stored in non-volatile memory 324 ) for providing the user interface of handheld electronic device 120 .
  • Display 322 and keyboard 332 together with auxiliary input/output 328 (including, for example, a mouse, touch pad, roller selector or rocker switch), are employed in concert with the user interface software to provide full user interface functionality to handheld electronic device 120 .
  • auxiliary input/output 328 including, for example, a mouse, touch pad, roller selector or rocker switch

Abstract

Embodiments described herein relate to a method and device for authenticating a user of a computer and a corresponding system using the method and device. The device is a handheld electronic device configured to receive a first authentication code and to generate a secure identification token. If the received first authentication code and the generated token match, a second authentication code is transmitted to a computer to unlock the computer.

Description

    CROSS REFERENCE TO RELATED APPLICATION
  • This application is a continuation of prior U.S. patent application Ser. No. 10/919,320, filed on Aug. 17, 2004, the entirety of which is hereby incorporated by reference.
  • FIELD OF THE INVENTION
  • The invention relates generally to methods, systems and devices for authenticating a user of a computer by using a handheld electronic device.
  • BACKGROUND OF THE INVENTION
  • Currently, some organizations require their personnel to authenticate themselves by use of a smart-card in order to gain access to a computer within the organization. Further, some of these organizations require that any handheld electronic devices used by the personnel in addition to a desktop computer be subject to similar authentication requirements. Thus, the smart-card may be required to unlock the desktop computer as well as the handheld electronic device.
  • Commonly, once the smart-card is removed from the card reader associated with the desktop computer or handheld electronic device, the computer or handheld electronic device becomes locked. Thus, if a user wishes to unlock his desktop computer upon entering his office, he can withdraw his smart-card from his handheld electronic device and place it in a card reader associated with the desktop computer. However, withdrawal of the smart-card from the handheld electronic device may cause it to be locked, thus preventing the user from accessing his handheld electronic device at the same time as accessing his desktop computer.
  • It is desired to address or ameliorate one or more drawbacks or disadvantages associated with existing ways of authenticating a user of a computer.
  • SUMMARY OF THE INVENTION
  • One aspect of the invention relates to a method of authenticating a user of a computer, comprising:
  • providing a handheld electronic device having accessible thereto a first authentication code of the user, the handheld electronic device requiring a second authentication code for use thereof; and
  • transmitting the first authentication code from the handheld electronic device to the computer over a communication link therebetween to authenticate the user.
  • In one embodiment, the first authentication code is stored on a smart-card received by the handheld electronic device. In an alternative embodiment, the first authentication code is stored in a memory of the handheld electronic device. In a further alternative embodiment, the first authentication code is stored in a subscriber identity module (SIM) card received by the handheld electronic device.
  • Another aspect of the invention relates to a handheld electronic device having:
  • a first authentication code stored on a memory accessible by the handheld electronic device;
  • means for receiving a second authentication code of the user;
  • communication means for communicating between the handheld electronic device and a computer; and
  • processor means configured to authenticate the second authentication code and provide the first authentication code to the computer via the communication means to authenticate the user.
  • Provision of the first authentication code may be in immediate response to, or some time after, authentication of the second authentication code.
  • A further aspect of the invention relates to computer readable storage having stored thereon computer program instructions which, when executed by a computer processor of a handheld electronic device, cause the handheld electronic device to perform a method for authenticating a user of a computer, wherein the handheld electronic device has an authentication code accessible thereto and the method comprises:
  • receiving a personal identification code of the user;
  • authenticating the personal identification code;
  • establishing a communication link between the handheld electronic device and the computer; and
  • providing the authentication code for the handheld electronic device to the computer over the communication link to authenticate the user.
  • A further aspect of the invention relates to a system for authenticating a user of a computer comprising:
  • a handheld electronic device having an authentication code accessible thereto and means for receiving a personal identification code of the user; and
  • a communication link between the handheld electronic device and the computer;
  • wherein the handheld electronic device is configured to receive the personal identification code, authenticate the personal identification code and provide the authentication code to the computer over the communication link to authenticate the user.
  • In one embodiment of this aspect, the means for receiving comprises a user interface of the handheld electronic device.
  • In another embodiment of this aspect, the means for receiving comprises a communication port of the handheld electronic device and the personal identification code is received from the personal computer over the communication link.
  • Another aspect the invention relates to a method for authenticating a user of a personal computer by provision of an authentication code to the personal computer, the method comprising:
  • providing a handheld electronic device having the authentication code accessible thereto receiving an identification code of the user;
  • authenticating the identification code;
  • accessing the authentication code based on the authenticated identification code;
  • establishing a communication link between the handheld electronic device and the personal computer; and
  • providing the authentication code from the handheld electronic device to the personal computer over the communication link to authenticate the user.
  • BRIEF DESCRIPTION OF THE DRAWINGS
  • FIG. 1A is a block diagram of a system for authenticating a user of a computer, according to one embodiment for the invention;
  • FIG. 1B is a block diagram of a system for authenticating a user of a computer, according to another embodiment of the invention;
  • FIG. 1C is a block diagram of a system for authenticating a user of a computer, according to another embodiment of the invention;
  • FIG. 1D is a block diagram of a system for authenticating a user of a computer, according to another embodiment of the invention;
  • FIG. 1E is a block diagram of a system for authenticating a user of a computer, according to another embodiment of the invention;
  • FIG. 1F is a block diagram of a system for authenticating a user of a computer, according to another embodiment of the invention;
  • FIG. 2 is a process flow diagram illustrating a method of authenticating a user of a computer, according to another embodiment of the invention; and
  • FIG. 3 is a block diagram of a handheld electronic device for use in authenticating a user, according to another embodiment of the invention.
  • DETAILED DESCRIPTION OF EMBODIMENTS OF THE INVENTION
  • Embodiments of the invention generally relate to authenticating a user of a computer using a handheld electronic device having an authentication code stored thereon or otherwise accessible thereto. The handheld electronic device is configured to transmit the authentication code to the computer so as to enable the user to unlock the desktop of the computer and thus gain access to the computer functions.
  • Advantageously, arrangements of the handheld electronic device and the computer may be such that if the handheld electronic device is itself unlocked, the user need do nothing more than enable it to communicate with the computer, in order to unlock the computer also. This requires that the handheld electronic device store, or have access to, an authentication code suitable for authenticating the user's identity to the computer.
  • Alternatively, if greater security is desired, the handheld electronic device can be configured to require entry of a user code, such as a personal identification number (PIN) or other form of authorization, to initiate release of the authentication code for transmission to the computer. Thus, for example, where the smart-card is received in a slot of the handheld electronic device (which effectively acts like a smart-card reader), the user is authenticated to the handheld electronic device by the smart-card received therein and becomes authenticated to the computer once the handheld electronic device transmits the authentication code read from the smart-card to the computer. Alternative arrangements, involving different levels of security and physical set-ups can be employed and some of these are described below in relation to the drawings.
  • Referring now to FIG. 1A, there is shown a system 100A for authenticating a user of a computer, according to one embodiment of the invention. The system 100A includes a handheld electronic device (HED) 120 in communication with a personal computer (PC) 110 through a communication link 115. The handheld electronic device 120 has a smart-card (SC) 130 received in a smart-card slot (for example, such as is shown in FIG. 3 and designated by reference numeral 350). The handheld electronic device 120 is received in a cradle 125, which in turn connects to communication link 115 through internal electrical connections (not shown) in the cradle 125.
  • The communication link 115 is preferably established through a suitable connection cable (not specifically shown) for serial communication between a serial port (not shown) of the PC 110 and a serial port (shown in FIG. 3 and designated by reference numeral 330) of the handheld electronic device 120 (via cradle 125). The connection cable may be a Universal Serial Bus (USB) cable, for example.
  • The handheld electronic device may be a dual mode (data and voice) communication device and personal digital assistant device, such as is described in further detail below in relation to FIG. 3. Alternatively, the handheld electronic device may be a single mode (data) communication device. The handheld electronic device 120 requires the user to authenticate himself/herself by providing a password or PIN code to unlock the user interface of the handheld electronic device 120 and enable use thereof.
  • The handheld electronic device 120 has electrical contacts (not shown) exposed on an outer casing thereof for forming an electrical connection with corresponding contacts located on cradle 125. The electrical contacts on cradle 125 are electrically connected to a fixed or removeably connectable cable to form communication link 115.
  • PC 110 may be of any kind of computer, such as a normal desktop computer, laptop or other portable or fixed computer system which may require authentication of the user identity prior to enabling use thereof. Accordingly, while the computer is described as a PC 110, it should be understood that it need not be a personal computer or be of a particular type. Likewise, performance of the invention can be achieved whether the computer runs a Windows based operating system, Unix based operating system or other type of operating system.
  • PC 110 includes normal peripherals such as a display screen, a keyboard, mouse, etc. for enabling user interaction therewith. Thus, for example, when the user wishes to use PC 110, he or she may perform an activation action, such as typing on the keyboard or moving the mouse, whereupon the user may be requested to provide a user identification code (either to the PC 110 or the handheld electronic device 120) to unlock the PC desktop and enable use thereof. The user identification code, which may be a PIN code or another code, is compared with a stored access code and, if the user identification code is valid, the authentication code stored on the smart-card is accessed and provided to PC 110.
  • PC 110 is preferably configured to automatically seek the authentication code from handheld electronic device 120 over communication link 115 in response to activation. Depending on the configuration of the handheld electronic device 120, receipt of a communication from PC 110 may trigger automatic retrieval of the authentication code from smart-card 130 or it may cause the handheld electronic device 120 to request user authentication before retrieving the authentication code and communicating it to PC 110 (or authorization). Alternatively, PC 110 may simply await input of the authentication code from handheld electronic device 120 over communication link 115.
  • The communication protocol used between the PC 110 and the handheld electronic device 120 depends on the form of connection established therebetween. Example connections include a serial connection, a USB connection and a Bluetooth connection. Other suitable communication protocols may employed instead.
  • Generally, embodiments which require the user to positively authorize release of the authentication code from the smart-card involve user input into the user interface of the handheld electronic device 120. However, in an alternative embodiment, PC 110 may be configured to request the user to enter an authentication code for the handheld electronic device 120, for example where the PC 110 has detected the presence of handheld electronic device 120 through communication link 115.
  • Once the user enters the authentication code of the handheld electronic device 120 through PC 110, this is transmitted to the handheld electronic device 120 by communication link 115 for authentication. If the entered authentication code is correct, the handheld electronic device 120 then provides the authentication code for the PC 110 (as extracted from smart-card 130) across communication link 115, thereby authenticating the user and unlocking the desktop of PC 110.
  • Advantageously, the described arrangements generally allow a user to unlock both the PC 110 and the handheld electronic device 120 by simply inputting one authorization code, namely that for the handheld electronic device 120. Advantageously, the PIN code or other unlocking code for the handheld electronic device 120 may be entered either into a user interface of the handheld electronic device 120 or that of the PC 110 so as to unlock handheld electronic device 120 (if it is not already unlocked) and PC 110. If the PIN code or other unlocking code for the handheld electronic device 120 is entered into PC 110, the PC 110 communicates with handheld electronic device 120 to retrieve the necessary authentication code from smart-card 130. Otherwise, if the user interfaces directly with handheld electronic device 120 then, upon authentication of the user (if required), the authentication code for PC 110 is extracted from smart-card 130 and provided to PC 110 over communication link 115.
  • The user identification code may be a PIN code or may be an alphanumeric or alphabetic password, for example. Depending on the configuration of the handheld electronic device 120, the user may be required to input the password in order to unlock the user interface of the handheld electronic device 120, and subsequently input the PIN code in order to authorize access to the authentication code stored on the smart-card. Alternatively, once the handheld electronic device 120 is unlocked by entry of an appropriate PIN code or password, it may be configured to not require subsequent entry of any further user identification code in order to access the authentication code on the smart-card.
  • If the handheld electronic device 120 is configured so as to require entry of a user identification code prior to enabling access to the authentication code on the smart-card, the user identification code thus required may be set so as to be the same code as that required for unlocking the handheld electronic device 120, so that the user does not have to remember separate codes.
  • If a user identification code is required to enable access to the authentication code on the smart-card, then upon receipt of the user identification code, it is compared with an appropriate access code stored on the smart-card. The access code is compared with the inputted user identification code and, if they match, the user identity is effectively authenticated to the smart-card, which then enables access of the authentication code for transmission thereof to the computer.
  • Where the handheld electronic device 120 is configured so as not to require entry of a user identification code prior to access of the authentication code on the smart-card, the authentication code may be provided to the PC 110 automatically upon establishment of communication link 115 or in response to a simple authorization action performed by the user. For example, the authorization action may be responding “yes” or “ok” to a question in a dialog box on the user interface asking “ok to provide authorization code?”. While such an authorization action by the user provides more security than allowing automatic access to the authorization code on the smart-card, it is not as secure as providing a proper user identification code, such as a PIN code or password.
  • Referring now to FIG. 1B, an alternative embodiment of the invention is shown, in the form of system 100B. System 100B is similar to system 100A, except that it does not require a cradle 125. Rather, in system 100B, PC 110 and handheld electronic device 120 are directly connected through communication link 115, for example by a communication cable connecting respective serial input/output (I/O) ports of PC 110 and handheld electronic device 120. Apart from the absence of cradle 125, system 100B otherwise operates in a similar manner to system 100A, as described in relation to FIG. 1A.
  • Referring now to FIG. 1C, a further alternative embodiment of the invention is shown, in the form of system 100C. System 100C is similar to system 100A and system 100B, except that it does not have a separate smart-card received in a slot of the handheld electronic device 120. Instead, the handheld electronic device 120 includes a subscriber identity module (SIM) card (shown in FIG. 3 and designated by reference numeral 316), such as those which are commonly used in the Global System for Mobile Communication (GSM) and General Packet Radio Services (GPRS) telecommunication standards. The SIM card is thus a form of smart-card, having an authentication code stored thereon for authenticating a user's identity to the network or as otherwise required.
  • The SIM card is received within the handheld electronic device in a fixed, but removable, manner and thus system 100C does not require a slot in the handheld electronic device 120 for receiving smart-card 130, nor does it require use of a cradle 125. As with system 100B, PC 110 and handheld electronic device 120 are directly connected through communication link 115, for example by a communication cable connecting the serial I/O ports of PC 110 and handheld electronic device 120. Apart from the differences noted, system 100C otherwise operates as described in relation to systems 100A, 100B, FIG. 1A and FIG. 1B.
  • In an alternative embodiment of system 100C, instead of a SIM card disposed in the handheld electronic device 120, a non-volatile memory of the handheld electronic device 120 may be used to store the authentication code of the user. This may be appropriate where the handheld electronic device is not compatible with the GSM or GPRS standards and is thus not suited to use with a SIM card. The non-volatile memory used to store the authentication code should be suitably secure so as to prevent unauthorized access thereto.
  • Referring now to FIG. 1D, a further alternative embodiment of the invention is shown, in the form of system 100D. System 100D is similar to system 100A, except that it does not require the handheld electronic device 120 to be received in cradle 125. Rather, in system 100D, a smart-card reader 132 may directly receive smart-card 130 and the handheld electronic device 120 communicates with the smart-card reader 132 over a communication link 135 to access the authentication code stored in the memory of smart-card 130.
  • Communication link 135 may be established through a suitable cable interconnecting smart-card reader 132 and an auxiliary input/output port (such as is shown in FIG. 3 and designated by reference numeral 328) of handheld electronic device 120.
  • Communication link 115 in system 100D is formed in the same way as described in relation to systems 100B and 100C. System 100D is different from system 10A in that the card reading function of smart-card 130 is not performed by the handheld electronic device 120, but is instead performed by card reader 132 as a separate component of system 100D.
  • System 100D further differs from system 100A in that it employs a direct communication link between PC 110 and handheld electronic device 120, rather than indirectly through cradle 125. Apart from the noted differences, system 100D otherwise operates in a similar manner to system 100A, as described in relation to FIG. 1A.
  • Referring now to FIG. 1E, a further alternative embodiment of the invention is shown, in the form of system 100E. System 100E is similar to system 100C, except that communication link 115 is replaced by a wireless communication link 145 between PC 110 and handheld electronic device 120.
  • Wireless communication link 145 may, for example, be established by infrared communications or short-range radio frequency communications, such as those specified by the Bluetooth or 802.11 standards. Such wireless communications require PC 110 to have corresponding hardware input/output functionality and software for executing that communication functionality. Other short-range wireless communications media and/or protocols may be used to provide communication link 145.
  • Wireless communication link 145 may be employed in place of communication link 115 in any of the embodiments of systems 100A, 100B, 100C, 100D and 100F (described hereinafter). Advantageously, providing wireless communication link 145 enables a user to approach PC 110, activate the PC 110 and have it communicate automatically and wirelessly, for example using the Bluetooth short-range communication specification, with handheld electronic device 120 to access the user's authentication code (stored on the smart-card, SIM card or memory of the handheld electronic device) and authenticate the user. This example is particularly applicable to systems embodiments 100B and 100C (if using wireless communication link 145) and 100E, where the user is not required to provide a user identification code to release the authentication code (i.e. because the handheld electronic device has already received such a code and is already unlocked).
  • Referring now to FIG. 1F, a further alternative embodiment of the invention is shown, in the form of system 100F. System 100F is similar to system 100C, except that it involves a separate token generator 150 (for example, such as a SecurID Authenticator by RSA) and handheld electronic device 120 in system 100F includes a software module for authenticating a user identification code generated by the token generator 150. System 100F involves the use of token generator 150 to generate a secure identification token based on an objective criterion (such as the time or date, for example). The token thus generated is displayed on display 155 of token generator 150 for the user to read.
  • In order for the user to enable the authentication code to be provided to PC 110, the user must enter the token displayed on token generator 150 into handheld electronic device 120. Handheld electronic device 120 has software to generate an access code using the same algorithms used by token generator 150 to generate the token, and compares the access code to the user identification code (i.e. the generated token) input by the user. If the access code generated by the handheld electronic device 120 matches the manually inputted token, the authentication code becomes accessible for communication to PC 110.
  • The use of token generator 150 may be applied in relation to any of systems 100A to 100E as a secure means for authenticating the user to the handheld electronic device 120, where the memory accessible thereto has the authentication code. Apart from the use of token generator 150 for providing the user identification code, system 100F otherwise operates in a similar manner to any of systems 100A to 100E, as described in relation to FIGS. 1A to 1E.
  • In an alternative embodiment (not shown), similar to system 100F, the function of token generator 150 may be incorporated into handheld electronic device 120 and, instead of the user manually inputting the token into handheld electronic device 120, the token is automatically generated by the handheld electronic device 120 as an authentication code in response to an authenticated user identification code. The token generated in this way is then transmitted to PC 110 over communication link 115 (or 145) for comparison with a token generated locally on PC 110 according to the same algorithm and objective criterion used to generate the token on handheld electronic device 120.
  • Thus, the secure token generator may be used by the user to authenticate the user to the handheld electronic device 120 or by the handheld electronic device 120 to authenticate itself to PC 110, using an encrypted token.
  • Each of the embodiments, and variations thereof, of systems for authenticating a user described above is generally related by the provision of a handheld electronic device 120 having an authentication code accessible thereto. When the authentication code is provided to PC 110 over a communication link 115 or 145, the user can be authenticated as an authorized user of the PC 110. It should be understood that such functional requirements can be achieved in a number of ways, at least some of which have been described. Further embodiments of the invention may be arrived at through combinations of features or functions described in relation to the various embodiments, and all such combinations are, if useful, within the scope of the invention.
  • Referring now to FIG. 2, there is shown a process flow diagram of a method of authenticating a user of a computer, such as PC 110, the method being designated generally by reference numeral 200. Method 200 begins with an authentication initiation step 205, at which the user indicates her desire to be authenticated as an authorized user of PC 110.
  • Authentication initiation may begin at either the PC 110 or the handheld electronic device 120. At handheld electronic device 120, authentication initiation may begin by selection of a menu item from a menu provided by the user interface or by pressing certain keys. Alternatively, the handheld electronic device 120 may be configured to automatically check whether authentication is to be initiated by periodically polling the serial I/O port.
  • At PC 110, authentication initiation may begin by pressing a key on the keyboard on PC 110, moving the mouse or otherwise attempting to provide input to PC 110 when it is in its locked state. Usually, a computer will become locked after it is idle for a predetermined period of time, for example in the order of 15 to 30 minutes.
  • At step 210, the handheld electronic device 120 (or PC 110, depending on whether authentication initiation occurred at the handheld electronic device 120 or PC 110) checks whether communication link 115 has been established. If the communication link 115 has not been established, an error message is provided to the user at step 215 either on the user interface of handheld electronic device 120 or on the display of PC 110.
  • If the communication link 115 has been established, the user is requested to provide an authorization (or confirmation) input to handheld electronic device 120 at step 220. The authorization input may be either coded or uncoded. For example, a coded form of authorization input may be a user identification code such as a PIN code, a user password or a secure token generated by token generator 150. An uncoded authorization input may be a response such as “yes” or “ok” to a dialog box on the user interface of handheld electronic device 120.
  • At step 223, the handheld electronic device 120 checks the received authorization input for validity and, if it is not found to be valid (i.e. by comparing it to the access code) at step 225, outputs an error message at step 215. If the authorization input is found to be valid, the handheld electronic device 120 proceeds to access the authentication code in its memory or in the memory of the smart-card or SIM card, at step 230 and transmits the authentication code to PC 110 at step 235.
  • If an error message is generated at step 215, authentication method 200 halts and awaits authentication initiation step 205 to begin again.
  • One embodiment of authentication method 200 does not require steps 220, 223 and 225 if handheld electronic device 120 is not configured to require any user input prior to provision of the authentication code to PC 110, for example where the handheld electronic device 120 has already been unlocked by entry of an appropriate user identification code. In such an embodiment, step 230 follows step 210 if the communication link 115 has been established.
  • Authentication method 200 may alternatively be performed so as to check the establishment of communication link 115 after the authorization input has been requested and validated (steps 220, 225) but before accessing the user authentication code at step 230.
  • Referring now to FIG. 3, handheld electronic device 120 is described in further detail. Depending on the functionality provided by the handheld electronic device 120, it may be referred to as a data messaging device, a two-way pager, a cellular telephone with data messaging capabilities, a wireless Internet appliance, or a data communication device (with or without telephony capabilities).
  • Handheld electronic device 120 comprises a number of components, the controlling component being microprocessor 338. Microprocessor 338 controls the overall operation of the handheld electronic device 120. The hardware and software control functions described above in relation to FIGS. 1A to 1F and FIG. 2 are performed by microprocessor 338.
  • Communication functions, including data and voice communications, are performed through a communication subsystem 311. In this example implementation of handheld electronic device 120, communication subsystem 311 is configured in accordance with the Global System for Mobile Communication (GSM) and General Packet Radio Services (GPRS) standards. The GSM/GPRS wireless network is used worldwide and it is expected that these standards will be superseded eventually by Enhanced Data GSM Environment (EDGE) and Universal Mobile Telecommunications Service (UMTS). New standards are still being defined, but it is believed that they will have similarities to the network behaviour described herein, and it will also be understood that the communication subsystem 311 is intended to use any other suitable standards that are developed in the future.
  • Microprocessor 338 also interacts with additional subsystems such as a Random Access Memory (RAM) 326, a non-volatile memory 324, a display 322, an auxiliary input/output (I/O) subsystem 328, a serial port 330, a keyboard 332, a communication subsystem 311, a speaker and microphone 336 (which may be separately controlled) and short-range communications 340.
  • Some of the subsystems of handheld electronic device 120 perform communication-related functions, whereas other subsystems may provide “resident” or on-device functions. By way of example, display 322 and keyboard 332 may be used for both communication-related functions, such as entering a text message for transmission over a network and device-resident functions such as a calculator or task list. Operating system software used by microprocessor 338 is typically stored in a persistent store such as non-volatile memory 324, which may alternatively be a read-only memory (ROM) or similar storage element (not shown). Those skilled in the art will appreciate that the operating system, specific device applications, or parts thereof, may be temporarily loaded into a volatile store such as RAM 326.
  • Handheld electronic device 120 may require a SIM card 316 to be inserted in a SIM interface 318 in order to communicate with a network. SIM card 316 is one type of a conventional smart-card used to identify a subscriber of handheld electronic device 120 and to personalize the handheld electronic device 120, among other functions. By inserting SIM card 316 into SIM interface 318, a subscriber can access all subscribed services in a network. Services may include: web browsing and messaging such as email, voice mail, Short Message Service (SMS), and Multimedia Messaging Services (MMS). More advanced services may include: point of sale, field service and sales force automation. SIM card 316 includes a processor and memory for storing information.
  • Once SIM card 316 is inserted in SIM interface 318, it is coupled to microprocessor 338. In order to identify the subscriber, SIM card 316 contains some user parameters such as an International Mobile Subscriber Identity (IMSI) and encryption/decryption keys. SIM card 316 may store additional subscriber information for a mobile device as well, including datebook (or calendar) information and recent call information.
  • Handheld electronic device 120 is a battery-powered device and includes a battery interface (not shown) for receiving one or more rechargeable batteries (not shown). The battery interface is coupled to a regulator (not shown), which assists the batteries in providing power to handheld electronic device 120. Although current technology makes use of a battery, future technologies such as micro fuel cells may provide the power to handheld electronic device 120.
  • Microprocessor 338, in addition to its operating system functions, enables execution of software applications on handheld electronic device 120. A set of applications which control basic device operations, including data and voice communication applications, will normally be installed on handheld electronic device 120 during its manufacture. Another application that may be loaded onto handheld electronic device 120 is a personal information manager (PIM). A PIM has functionality to organize and manage data items of interest to a subscriber, such as, but not limited to, e-mail, calendar events, voice mails, appointments, and task items.
  • Short-range communications subsystem 340 provides for communication between handheld electronic device 120 and different systems or devices, such as PC 110. For example, subsystem 340 may include an infrared device and associated circuits and components for short-range communication. Examples of short range communication include standards developed by the Infrared Data Association (IrDA), Bluetooth, and the 802.11 family of standards developed by IEEE.
  • Handheld electronic device 120 also includes a card slot 350 for receiving smart-card 130 therein. Microprocessor 338 communicates with a processor on smart-card 130 to access the authentication code stored thereon (for embodiments of the invention using a smart-card). Card slot 350 includes electrical contacts (not shown) for connecting with corresponding electrical contacts on a smart-card 130 to enable communication between microprocessor 338 and the processor on smart-card 130.
  • Depending on the functions and configuration of handheld electronic device 120, handheld electronic device 120 may include both a SIM card 316 and a smart-card 130. Alternatively, the handheld electronic device 120 may include only one or neither of SIM card 316 and smart-card 130. If neither SIM card 316 or smart-card 130 is received by handheld electronic device 120, the authentication code must be stored in non-volatile memory 324 or other secure memory (not shown) or be accessible to the handheld electronic device 120 from an external source (for example, over a cable 135 as shown in FIG. 1D). If smart-card 130 is received in smart-card slot 350, microprocessor 338 will generally seek to access the authentication code on the smart-card 130. Otherwise, microprocessor 338 will seek to access the authentication code on SIM card 316 (if present).
  • If token generator 150 is used to generate a token to authenticate the user to the handheld electronic device 120, the authentication code (for authenticating the user to the PC 110) is preferably stored in non-volatile memory 324 or other secure memory. Alternatively, the authentication code may be stored on the smart-card 130 or SIM card 316 (if present). The software algorithm for generating a corresponding token is also stored in non-volatile memory 324.
  • Microprocessor 338 runs software (stored in non-volatile memory 324) for providing the user interface of handheld electronic device 120. Display 322 and keyboard 332, together with auxiliary input/output 328 (including, for example, a mouse, touch pad, roller selector or rocker switch), are employed in concert with the user interface software to provide full user interface functionality to handheld electronic device 120.
  • It should be understood that some variation and modification of the described embodiments may be made by persons skilled in the art, without departing from the spirit and scope of the invention, and all such variations and modifications are intended to fall within the scope of the invention, as defined by the appended claims.

Claims (21)

1. A method of authenticating a user of a computer via a handheld electronic device, the method comprising:
receiving a first authentication code at the handheld electronic device, wherein the first authentication code has been generated using an algorithm and objective criterion;
generating a secure identification token at the handheld electronic device using the algorithm and objective criterion;
comparing the secure identification token generated at the handheld electronic device to the first authentication code received at the handheld electronic device; and
if the secure identification token generated at the handheld electronic device matches the first authentication code received at the handheld electronic device, transmitting a second authentication code from the handheld electronic device to the computer over a communication link therebetween, the second authentication code for unlocking the computer.
2. The method of claim 1, wherein the first authentication code is received at the handheld electronic device via a user interface.
3. The method of claim 1, wherein the handheld electronic device is received in a cradle and the communication link is established between the computer and the handheld electronic device through the cradle.
4. The method of claim 1, wherein the communication link is formed directly between an I/O port of the computer and an I/O port of the handheld electronic device.
5. The method of claim 4, wherein the communication link comprises a wireless communication link.
6. The method of claim 4, wherein the communication link comprises a serial cable or USB cable.
7. The method of claim 1, further comprising:
if the secure identification token generated at the handheld electronic device matches the first authentication code received at the handheld electronic device, permitting user access to the handheld electronic device.
8. The method of claim 1, further comprising:
requesting user confirmation input at the handheld electronic device prior to transmitting the second authentication code to the computer.
9. The method of claim 1, wherein the second authentication code is stored in a memory of the handheld electronic device or in a separate memory accessible to the handheld electronic device.
10. The method of claim 1, wherein the second authentication code is stored on a smart card readable by the handheld electronic device.
11. A handheld electronic device comprising:
a processor configured to implement a token generator at the handheld electronic device, the token generator configured to generate a secure identification token at the handheld electronic device using an algorithm and objective criterion; and
a communication interface configured to permit communications between the handheld electronic device and a computer;
wherein the processor is configured to receive a first authentication code at the handheld electronic device, wherein the first authentication code has been generated using the algorithm and objective criterion; and
wherein the processor is further configured to compare the secure identification token generated at the handheld electronic device to the first authentication code received at the handheld electronic device, and, if the secure identification token generated at the handheld electronic device matches the first authentication code received at the handheld electronic device, to transmit a second authentication code from the handheld electronic device to the computer over a communication link therebetween, the second authentication code for unlocking the computer.
12. The device of claim 11, further comprising a user interface, wherein the first authentication code is received at the handheld electronic device via the user interface.
13. The device of claim 11, further comprising a user interface, wherein the processor is further configured to control the user interface to request user confirmation input prior to providing the second authentication code to the computer.
14. The device of claim 11, wherein the second authentication code is stored in a memory of the handheld electronic device or in a separate memory accessible to the handheld electronic device.
15. The device of claim 11, wherein the second authentication code is stored on a smart card readable by the handheld electronic device.
16. The device of claim 11, further comprising a communication port coupled to the communication interface.
17. The device of claim 11, wherein the handheld electronic device is receivable in a cradle so that a communication link can be established between the computer and the handheld electronic device through the cradle.
18. The device of claim 11, wherein a communication link is formed directly between an I/O port of the computer and an I/O port of the handheld electronic device.
19. The device of claim 18, wherein the communication link comprises a wireless communication link.
20. The device of claim 18, wherein the communication link comprises a serial cable or USB cable.
21. A computer readable storage medium having stored thereon computer program instructions which, when executed by a processor of a handheld electronic device, cause the handheld electronic device to perform a method of authenticating a user of a computer via the handheld electronic device, wherein the method comprises:
receiving a first authentication code at the handheld electronic device, wherein the first authentication code has been generated using an algorithm and objective criterion;
generating a secure identification token at the handheld electronic device using the algorithm and objective criterion;
comparing the secure identification token generated at the handheld electronic device to the first authentication code received at the handheld electronic device; and
if the secure identification token generated at the handheld electronic device matches the first authentication code received at the handheld electronic device, transmitting a second authentication code from the handheld electronic device to the computer over a communication link therebetween, the second authentication code for unlocking the computer.
US12/500,840 2004-08-17 2009-07-10 Method, system and device for authenticating a user Abandoned US20090282247A1 (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US12/500,840 US20090282247A1 (en) 2004-08-17 2009-07-10 Method, system and device for authenticating a user

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
US10/919,320 US7562218B2 (en) 2004-08-17 2004-08-17 Method, system and device for authenticating a user
US12/500,840 US20090282247A1 (en) 2004-08-17 2009-07-10 Method, system and device for authenticating a user

Related Parent Applications (1)

Application Number Title Priority Date Filing Date
US10/919,320 Continuation US7562218B2 (en) 2004-08-17 2004-08-17 Method, system and device for authenticating a user

Publications (1)

Publication Number Publication Date
US20090282247A1 true US20090282247A1 (en) 2009-11-12

Family

ID=35910891

Family Applications (2)

Application Number Title Priority Date Filing Date
US10/919,320 Active 2027-01-30 US7562218B2 (en) 2004-08-17 2004-08-17 Method, system and device for authenticating a user
US12/500,840 Abandoned US20090282247A1 (en) 2004-08-17 2009-07-10 Method, system and device for authenticating a user

Family Applications Before (1)

Application Number Title Priority Date Filing Date
US10/919,320 Active 2027-01-30 US7562218B2 (en) 2004-08-17 2004-08-17 Method, system and device for authenticating a user

Country Status (1)

Country Link
US (2) US7562218B2 (en)

Cited By (18)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110167484A1 (en) * 2004-09-22 2011-07-07 Research In Motion Limited Apparatus and method for integrating authentication protocols in the establishment of connections between computing devices
US20130122866A1 (en) * 2010-12-29 2013-05-16 Huawei Device Co., Ltd. Method and apparatus for unlocking operating system
US20130298211A1 (en) * 2012-04-03 2013-11-07 Verayo, Inc. Authentication token
US8666906B1 (en) 2007-10-01 2014-03-04 Google Inc. Discrete verification of payment information
US8700895B1 (en) 2010-06-30 2014-04-15 Google Inc. System and method for operating a computing device in a secure mode
US8719952B1 (en) 2011-03-25 2014-05-06 Secsign Technologies Inc. Systems and methods using passwords for secure storage of private keys on mobile devices
US8739260B1 (en) 2011-02-10 2014-05-27 Secsign Technologies Inc. Systems and methods for authentication via mobile communication device
US8972762B2 (en) 2012-07-11 2015-03-03 Blackberry Limited Computing devices and methods for resetting inactivity timers on computing devices
US9118666B2 (en) 2010-06-30 2015-08-25 Google Inc. Computing device integrity verification
US9137668B2 (en) 2004-02-26 2015-09-15 Blackberry Limited Computing device with environment aware features
US9147063B1 (en) * 2013-09-27 2015-09-29 Emc Corporation Passcode generation utilizing selected permutation type applied to tokencode and personal identifier
WO2015148062A1 (en) * 2014-03-28 2015-10-01 Intel Corporation Centralized security for a computing device
US9342677B2 (en) 2010-08-04 2016-05-17 Blackberry Limited Method and apparatus to provide continuous authentication based on dynamic personal information
US9811827B2 (en) 2012-02-28 2017-11-07 Google Inc. System and method for providing transaction verification
US10951412B2 (en) 2019-01-16 2021-03-16 Rsa Security Llc Cryptographic device with administrative access interface utilizing event-based one-time passcodes
US11165571B2 (en) 2019-01-25 2021-11-02 EMC IP Holding Company LLC Transmitting authentication data over an audio channel
US11171949B2 (en) 2019-01-09 2021-11-09 EMC IP Holding Company LLC Generating authentication information utilizing linear feedback shift registers
US11651066B2 (en) 2021-01-07 2023-05-16 EMC IP Holding Company LLC Secure token-based communications between a host device and a storage system

Families Citing this family (48)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7444676B1 (en) * 2001-08-29 2008-10-28 Nader Asghari-Kamrani Direct authentication and authorization system and method for trusted network of financial institutions
CA2546700C (en) * 2003-11-07 2013-03-05 Telecom Italia S.P.A. Method and system for the authentication of a user of a data processing system
US9020854B2 (en) 2004-03-08 2015-04-28 Proxense, Llc Linked account system using personal digital key (PDK-LAS)
US7562218B2 (en) * 2004-08-17 2009-07-14 Research In Motion Limited Method, system and device for authenticating a user
US8086519B2 (en) * 2004-10-14 2011-12-27 Cfph, Llc System and method for facilitating a wireless financial transaction
US7860778B2 (en) 2004-11-08 2010-12-28 Cfph, Llc System and method for implementing push technology in a wireless financial transaction
US7643818B2 (en) 2004-11-22 2010-01-05 Seven Networks, Inc. E-mail messaging to/from a mobile terminal
AU2005319019A1 (en) 2004-12-20 2006-06-29 Proxense, Llc Biometric personal data key (PDK) authentication
JP2006201895A (en) * 2005-01-19 2006-08-03 Fujitsu Ltd Authentication key and apparatus
US7840204B2 (en) * 2005-11-22 2010-11-23 Kyocera Corporation System and method for unlocking wireless communications device
US8433919B2 (en) 2005-11-30 2013-04-30 Proxense, Llc Two-level authentication for secure transactions
US8511547B2 (en) * 2005-12-22 2013-08-20 Mastercard International Incorporated Methods and systems for two-factor authentication using contactless chip cards or devices and mobile devices or dedicated personal readers
US11206664B2 (en) 2006-01-06 2021-12-21 Proxense, Llc Wireless network synchronization of cells and client devices on a network
US8219129B2 (en) 2006-01-06 2012-07-10 Proxense, Llc Dynamic real-time tiered client access
US7664481B2 (en) * 2006-03-06 2010-02-16 Healthwyse, Llc Remote personnel tracking
US8768332B2 (en) 2006-09-01 2014-07-01 At&T Mobility Ii Llc Interactive personal information management system
US9269221B2 (en) 2006-11-13 2016-02-23 John J. Gobbi Configuration of interfaces for a location detection system and application
US7726568B2 (en) * 2007-03-21 2010-06-01 Research In Motion Limited Smart card session optimization
CA2636304C (en) 2007-06-27 2014-12-30 Research In Motion Limited System and method for improving smart card reader reconnections
US20090036096A1 (en) * 2007-07-30 2009-02-05 Ibrahim Wael M Using an authentication ticket to initialize a computer
KR101352248B1 (en) * 2007-08-30 2014-01-16 삼성전자주식회사 Apparatus and method for automatically switching user interface
WO2009062194A1 (en) 2007-11-09 2009-05-14 Proxense, Llc Proximity-sensor supporting multiple application services
US8171528B1 (en) 2007-12-06 2012-05-01 Proxense, Llc Hybrid device having a personal digital key and receiver-decoder circuit and methods of use
WO2009079666A1 (en) * 2007-12-19 2009-06-25 Proxense, Llc Security system and method for controlling access to computing resources
WO2009102979A2 (en) 2008-02-14 2009-08-20 Proxense, Llc Proximity-based healthcare management system with automatic access to private information
US11120449B2 (en) 2008-04-08 2021-09-14 Proxense, Llc Automated service-based order processing
US8522326B2 (en) 2008-05-30 2013-08-27 Motorola Mobility Llc System and method for authenticating a smart card using an authentication token transmitted to a smart card reader
US8201232B2 (en) * 2008-06-26 2012-06-12 Samsung Electronics Co., Ltd. Authentication, identity, and service management for computing and communication systems
US8776238B2 (en) * 2008-07-16 2014-07-08 International Business Machines Corporation Verifying certificate use
US8321916B2 (en) * 2008-12-19 2012-11-27 Intel Corporation Method, apparatus and system for remote management of mobile devices
US8800017B2 (en) * 2009-05-29 2014-08-05 Ncomputing, Inc. Method and apparatus for copy protecting a digital electronic device
US9418205B2 (en) 2010-03-15 2016-08-16 Proxense, Llc Proximity-based system for automatic application or data access and item tracking
US8918854B1 (en) 2010-07-15 2014-12-23 Proxense, Llc Proximity-based system for automatic application initialization
FR2968795B1 (en) * 2010-12-10 2013-01-18 Xiring DEVICE FOR DYNAMIC PAIRING
US8857716B1 (en) 2011-02-21 2014-10-14 Proxense, Llc Implementation of a proximity-based system for object tracking and automatic application initialization
WO2013022768A2 (en) 2011-08-05 2013-02-14 Gui Global Products, Ltd. Apparatus for cleaning view screens and lenses and method for the use thereof
JP5856012B2 (en) 2012-05-23 2016-02-09 日立マクセル株式会社 Mobile terminal and control method thereof
US20200137906A9 (en) 2012-11-05 2020-04-30 Gui Global Products, Ltd. Devices and accessories employing a living hinge
US9111401B2 (en) 2012-11-29 2015-08-18 Hid Global Gmbh Interactive reader commander
US20190068589A1 (en) * 2013-01-09 2019-02-28 Chris Outwater Range of Motion Tracking System
JP6107350B2 (en) * 2013-04-11 2017-04-05 株式会社リコー Use permission / rejection control device, use permission / rejection control method, and program
US9405898B2 (en) 2013-05-10 2016-08-02 Proxense, Llc Secure element as a digital pocket
JP6201835B2 (en) * 2014-03-14 2017-09-27 ソニー株式会社 Information processing apparatus, information processing method, and computer program
JP2015194947A (en) * 2014-03-31 2015-11-05 ソニー株式会社 Information processing device and computer program
US9775039B2 (en) * 2014-11-18 2017-09-26 T-Mobile Usa, Inc. Data stitching for networked automation
SG10201506662XA (en) * 2015-03-03 2016-10-28 Mastercard Asia Pacific Pte Ltd Method For Enabling A Communication Link Between A Mobile Terminal And A Receiving Terminal
DE102015103928B4 (en) 2015-03-17 2021-11-04 Maschinenfabrik Reinhausen Gmbh Energy storage for an on-load tap-changer and on-load tap-changer with energy storage
US20210099281A1 (en) * 2019-09-30 2021-04-01 Bank Of America Corporation System for authorization and authentication using nonce values and hash algorithms

Citations (47)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US4720860A (en) * 1984-11-30 1988-01-19 Security Dynamics Technologies, Inc. Method and apparatus for positively identifying an individual
US5241594A (en) * 1992-06-02 1993-08-31 Hughes Aircraft Company One-time logon means and methods for distributed computing systems
US5475377A (en) * 1991-10-31 1995-12-12 Lee; Kwang-Sil Electronic identification system having remote automatic response capability and automatic identification method thereof
US5539825A (en) * 1991-09-30 1996-07-23 Fujitsu Limited Electronic cashless transaction system
US5546463A (en) * 1994-07-12 1996-08-13 Information Resource Engineering, Inc. Pocket encrypting and authenticating communications device
US5657388A (en) * 1993-05-25 1997-08-12 Security Dynamics Technologies, Inc. Method and apparatus for utilizing a token for resource access
US5778071A (en) * 1994-07-12 1998-07-07 Information Resource Engineering, Inc. Pocket encrypting and authenticating communications device
US6367017B1 (en) * 1996-11-07 2002-04-02 Litronic Inc. Apparatus and method for providing and authentication system
US20020078362A1 (en) * 2000-12-20 2002-06-20 Nec Corporation Security system
US20020095588A1 (en) * 2001-01-12 2002-07-18 Satoshi Shigematsu Authentication token and authentication system
US20020097876A1 (en) * 2000-12-22 2002-07-25 Harrison Keith Alexander Communication methods, communication systems and to personal communication devices
US20020099665A1 (en) * 1999-09-28 2002-07-25 Burger Todd O. Portable electronic authorization system and method
US20020147926A1 (en) * 2001-04-04 2002-10-10 Pecen Mark E. Method and apparatus for authentication using remote multiple access SIM technology
US6473609B1 (en) * 1995-12-11 2002-10-29 Openwave Systems Inc. Method and architecture for interactive two-way communication devices to interact with a network
US20030046567A1 (en) * 2001-08-31 2003-03-06 Gene Carman Method and apparatus for storage of usernames in portable memory
US20030115473A1 (en) * 2001-12-14 2003-06-19 Fujitsu Limited Biometrics authentication system and method
US20030130957A1 (en) * 2002-01-07 2003-07-10 International Business Machines Corporation PDA password management tool
US20030135734A1 (en) * 2002-01-14 2003-07-17 Fagan Robert H. Secure mutual authentication system
US20030191949A1 (en) * 2000-08-30 2003-10-09 Akihiro Odagawa Authentication system, authentication request device, validating device and service medium
US6697864B1 (en) * 1999-10-18 2004-02-24 Microsoft Corporation Login architecture for network access through a cable system
US6718328B1 (en) * 2000-02-28 2004-04-06 Akamai Technologies, Inc. System and method for providing controlled and secured access to network resources
US6792536B1 (en) * 1999-10-20 2004-09-14 Timecertain Llc Smart card system and methods for proving dates in digital files
US6817521B1 (en) * 2003-08-21 2004-11-16 International Business Machines Corporation Credit card application automation system
US20040260608A1 (en) * 2003-02-05 2004-12-23 I-Coupon Limited Discount and/or loyalty reward system and retail apparatus therefor
US7003495B1 (en) * 1999-09-28 2006-02-21 Chameleon Network Inc. Portable electronic authorization system and method
US7065067B2 (en) * 2001-11-07 2006-06-20 Samsung Electronics Co., Ltd. Authentication method between mobile node and home agent in a wireless communication system
US7069439B1 (en) * 1999-03-05 2006-06-27 Hewlett-Packard Development Company, L.P. Computing apparatus and methods using secure authentication arrangements
US7092369B2 (en) * 1995-11-17 2006-08-15 Symbol Technologies, Inc. Communications network with wireless gateways for mobile terminal access
US7134024B1 (en) * 1998-07-15 2006-11-07 International Business Machines Corporation Method of establishing the trustworthiness level of a participant in a communication connection
US7158776B1 (en) * 2001-09-18 2007-01-02 Cisco Technology, Inc. Techniques for voice-based user authentication for mobile access to network services
US7197297B2 (en) * 2003-02-21 2007-03-27 Schlumberger Technology Corporation Authentication method for enabling a user of a mobile station to access to private data or services
US7299356B2 (en) * 2003-09-02 2007-11-20 Authernative, Inc. Key conversion method for communication session encryption and authentication system
US7337219B1 (en) * 2003-05-30 2008-02-26 Aol Llc, A Delaware Limited Liability Company Classifying devices using a local proxy server
US7346778B1 (en) * 2000-11-29 2008-03-18 Palmsource, Inc. Security method and apparatus for controlling the data exchange on handheld computers
US7404085B2 (en) * 2004-09-03 2008-07-22 Sap Ag Authentication of handheld devices for access to applications
US7424284B2 (en) * 2004-11-09 2008-09-09 Telefonaktiebolaget Lm Ericsson (Publ) Secure network/service access
US7437757B2 (en) * 2002-09-09 2008-10-14 Us Encode Corporation Token for use in online electronic transactions
US7469291B2 (en) * 2004-09-22 2008-12-23 Research In Motion Limited Apparatus and method for integrating authentication protocols in the establishment of connections between computing devices
US7506161B2 (en) * 2003-09-02 2009-03-17 Authernative, Inc. Communication session encryption and authentication system
US7562218B2 (en) * 2004-08-17 2009-07-14 Research In Motion Limited Method, system and device for authenticating a user
US7565326B2 (en) * 2000-05-25 2009-07-21 Randle William M Dialect independent multi-dimensional integrator using a normalized language platform and secure controlled access
US7581100B2 (en) * 2003-09-02 2009-08-25 Authernative, Inc. Key generation method for communication session encryption and authentication system
US7593716B2 (en) * 2003-02-28 2009-09-22 Siemens Aktiengesellschaft Method for transmitting data in a WLAN network
US7653378B2 (en) * 2005-01-20 2010-01-26 Fujifilm Corporation Authentication system for mobile terminal having electronic money function
US7702314B2 (en) * 2003-07-05 2010-04-20 Lg Electronics Inc. Method and system for controlling access to a mobile communication terminal
US7899753B1 (en) * 2002-03-25 2011-03-01 Jpmorgan Chase Bank, N.A Systems and methods for time variable financial authentication
US8108672B1 (en) * 2003-10-31 2012-01-31 Adobe Systems Incorporated Transparent authentication process integration

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
GB8525161D0 (en) 1985-10-11 1985-11-13 Blackwell V C Personalised identification device
US5373558A (en) * 1993-05-25 1994-12-13 Chaum; David Desinated-confirmer signature systems
KR100674792B1 (en) 1998-11-24 2007-01-26 텔레폰악티에볼라겟엘엠에릭슨(펍) Mobile telephone auto pc logon
WO2000048064A1 (en) 1999-02-10 2000-08-17 Vasco Data Security, Inc. Security access and authentication token with private key transport functionality
EP1483643A1 (en) 2002-02-13 2004-12-08 Vasco Data Security Inc. Method and apparatus for generating an access code

Patent Citations (52)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US4720860A (en) * 1984-11-30 1988-01-19 Security Dynamics Technologies, Inc. Method and apparatus for positively identifying an individual
US5539825A (en) * 1991-09-30 1996-07-23 Fujitsu Limited Electronic cashless transaction system
US5475377A (en) * 1991-10-31 1995-12-12 Lee; Kwang-Sil Electronic identification system having remote automatic response capability and automatic identification method thereof
US5241594A (en) * 1992-06-02 1993-08-31 Hughes Aircraft Company One-time logon means and methods for distributed computing systems
US5657388A (en) * 1993-05-25 1997-08-12 Security Dynamics Technologies, Inc. Method and apparatus for utilizing a token for resource access
US5778071A (en) * 1994-07-12 1998-07-07 Information Resource Engineering, Inc. Pocket encrypting and authenticating communications device
US5546463A (en) * 1994-07-12 1996-08-13 Information Resource Engineering, Inc. Pocket encrypting and authenticating communications device
US7092369B2 (en) * 1995-11-17 2006-08-15 Symbol Technologies, Inc. Communications network with wireless gateways for mobile terminal access
US6473609B1 (en) * 1995-12-11 2002-10-29 Openwave Systems Inc. Method and architecture for interactive two-way communication devices to interact with a network
US6367017B1 (en) * 1996-11-07 2002-04-02 Litronic Inc. Apparatus and method for providing and authentication system
US7134024B1 (en) * 1998-07-15 2006-11-07 International Business Machines Corporation Method of establishing the trustworthiness level of a participant in a communication connection
US7069439B1 (en) * 1999-03-05 2006-06-27 Hewlett-Packard Development Company, L.P. Computing apparatus and methods using secure authentication arrangements
US7080037B2 (en) * 1999-09-28 2006-07-18 Chameleon Network Inc. Portable electronic authorization system and method
US20020099665A1 (en) * 1999-09-28 2002-07-25 Burger Todd O. Portable electronic authorization system and method
US7003495B1 (en) * 1999-09-28 2006-02-21 Chameleon Network Inc. Portable electronic authorization system and method
US6697864B1 (en) * 1999-10-18 2004-02-24 Microsoft Corporation Login architecture for network access through a cable system
US6792536B1 (en) * 1999-10-20 2004-09-14 Timecertain Llc Smart card system and methods for proving dates in digital files
US6718328B1 (en) * 2000-02-28 2004-04-06 Akamai Technologies, Inc. System and method for providing controlled and secured access to network resources
US7565326B2 (en) * 2000-05-25 2009-07-21 Randle William M Dialect independent multi-dimensional integrator using a normalized language platform and secure controlled access
US20030191949A1 (en) * 2000-08-30 2003-10-09 Akihiro Odagawa Authentication system, authentication request device, validating device and service medium
US7346778B1 (en) * 2000-11-29 2008-03-18 Palmsource, Inc. Security method and apparatus for controlling the data exchange on handheld computers
US20020078362A1 (en) * 2000-12-20 2002-06-20 Nec Corporation Security system
US20020097876A1 (en) * 2000-12-22 2002-07-25 Harrison Keith Alexander Communication methods, communication systems and to personal communication devices
US20020095588A1 (en) * 2001-01-12 2002-07-18 Satoshi Shigematsu Authentication token and authentication system
US20020147926A1 (en) * 2001-04-04 2002-10-10 Pecen Mark E. Method and apparatus for authentication using remote multiple access SIM technology
US20030046567A1 (en) * 2001-08-31 2003-03-06 Gene Carman Method and apparatus for storage of usernames in portable memory
US7158776B1 (en) * 2001-09-18 2007-01-02 Cisco Technology, Inc. Techniques for voice-based user authentication for mobile access to network services
US7065067B2 (en) * 2001-11-07 2006-06-20 Samsung Electronics Co., Ltd. Authentication method between mobile node and home agent in a wireless communication system
US20030115473A1 (en) * 2001-12-14 2003-06-19 Fujitsu Limited Biometrics authentication system and method
US20030130957A1 (en) * 2002-01-07 2003-07-10 International Business Machines Corporation PDA password management tool
US20030135734A1 (en) * 2002-01-14 2003-07-17 Fagan Robert H. Secure mutual authentication system
US7899753B1 (en) * 2002-03-25 2011-03-01 Jpmorgan Chase Bank, N.A Systems and methods for time variable financial authentication
US7437757B2 (en) * 2002-09-09 2008-10-14 Us Encode Corporation Token for use in online electronic transactions
US20040260608A1 (en) * 2003-02-05 2004-12-23 I-Coupon Limited Discount and/or loyalty reward system and retail apparatus therefor
US7197297B2 (en) * 2003-02-21 2007-03-27 Schlumberger Technology Corporation Authentication method for enabling a user of a mobile station to access to private data or services
US7593716B2 (en) * 2003-02-28 2009-09-22 Siemens Aktiengesellschaft Method for transmitting data in a WLAN network
US7337219B1 (en) * 2003-05-30 2008-02-26 Aol Llc, A Delaware Limited Liability Company Classifying devices using a local proxy server
US7702314B2 (en) * 2003-07-05 2010-04-20 Lg Electronics Inc. Method and system for controlling access to a mobile communication terminal
US6817521B1 (en) * 2003-08-21 2004-11-16 International Business Machines Corporation Credit card application automation system
US7506161B2 (en) * 2003-09-02 2009-03-17 Authernative, Inc. Communication session encryption and authentication system
US7299356B2 (en) * 2003-09-02 2007-11-20 Authernative, Inc. Key conversion method for communication session encryption and authentication system
US7581100B2 (en) * 2003-09-02 2009-08-25 Authernative, Inc. Key generation method for communication session encryption and authentication system
US8108672B1 (en) * 2003-10-31 2012-01-31 Adobe Systems Incorporated Transparent authentication process integration
US7562218B2 (en) * 2004-08-17 2009-07-14 Research In Motion Limited Method, system and device for authenticating a user
US7404085B2 (en) * 2004-09-03 2008-07-22 Sap Ag Authentication of handheld devices for access to applications
US20090077644A1 (en) * 2004-09-22 2009-03-19 Research In Motion Limited Apparatus and method for integrating authentication protocols in the establishment of connections between computing devices
US7469291B2 (en) * 2004-09-22 2008-12-23 Research In Motion Limited Apparatus and method for integrating authentication protocols in the establishment of connections between computing devices
US7921209B2 (en) * 2004-09-22 2011-04-05 Research In Motion Limited Apparatus and method for integrating authentication protocols in the establishment of connections between computing devices
US20110167484A1 (en) * 2004-09-22 2011-07-07 Research In Motion Limited Apparatus and method for integrating authentication protocols in the establishment of connections between computing devices
US8533329B2 (en) * 2004-09-22 2013-09-10 Blackberry Limited Apparatus and method for integrating authentication protocols in the establishment of connections between computing devices
US7424284B2 (en) * 2004-11-09 2008-09-09 Telefonaktiebolaget Lm Ericsson (Publ) Secure network/service access
US7653378B2 (en) * 2005-01-20 2010-01-26 Fujifilm Corporation Authentication system for mobile terminal having electronic money function

Cited By (24)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9137668B2 (en) 2004-02-26 2015-09-15 Blackberry Limited Computing device with environment aware features
US8533329B2 (en) 2004-09-22 2013-09-10 Blackberry Limited Apparatus and method for integrating authentication protocols in the establishment of connections between computing devices
US20110167484A1 (en) * 2004-09-22 2011-07-07 Research In Motion Limited Apparatus and method for integrating authentication protocols in the establishment of connections between computing devices
US8666906B1 (en) 2007-10-01 2014-03-04 Google Inc. Discrete verification of payment information
US8700895B1 (en) 2010-06-30 2014-04-15 Google Inc. System and method for operating a computing device in a secure mode
US9081985B1 (en) 2010-06-30 2015-07-14 Google Inc. System and method for operating a computing device in a secure mode
US9118666B2 (en) 2010-06-30 2015-08-25 Google Inc. Computing device integrity verification
US9342677B2 (en) 2010-08-04 2016-05-17 Blackberry Limited Method and apparatus to provide continuous authentication based on dynamic personal information
US9131377B2 (en) * 2010-12-29 2015-09-08 Huawei Device Co., Ltd. Method and apparatus for unlocking operating system
US20130122866A1 (en) * 2010-12-29 2013-05-16 Huawei Device Co., Ltd. Method and apparatus for unlocking operating system
US8739260B1 (en) 2011-02-10 2014-05-27 Secsign Technologies Inc. Systems and methods for authentication via mobile communication device
US8719952B1 (en) 2011-03-25 2014-05-06 Secsign Technologies Inc. Systems and methods using passwords for secure storage of private keys on mobile devices
US9811827B2 (en) 2012-02-28 2017-11-07 Google Inc. System and method for providing transaction verification
US10839383B2 (en) 2012-02-28 2020-11-17 Google Llc System and method for providing transaction verification
US20130298211A1 (en) * 2012-04-03 2013-11-07 Verayo, Inc. Authentication token
US8972762B2 (en) 2012-07-11 2015-03-03 Blackberry Limited Computing devices and methods for resetting inactivity timers on computing devices
US9423856B2 (en) 2012-07-11 2016-08-23 Blackberry Limited Resetting inactivity timer on computing device
US9147063B1 (en) * 2013-09-27 2015-09-29 Emc Corporation Passcode generation utilizing selected permutation type applied to tokencode and personal identifier
WO2015148062A1 (en) * 2014-03-28 2015-10-01 Intel Corporation Centralized security for a computing device
TWI570588B (en) * 2014-03-28 2017-02-11 英特爾公司 Centralized security for a computing device
US11171949B2 (en) 2019-01-09 2021-11-09 EMC IP Holding Company LLC Generating authentication information utilizing linear feedback shift registers
US10951412B2 (en) 2019-01-16 2021-03-16 Rsa Security Llc Cryptographic device with administrative access interface utilizing event-based one-time passcodes
US11165571B2 (en) 2019-01-25 2021-11-02 EMC IP Holding Company LLC Transmitting authentication data over an audio channel
US11651066B2 (en) 2021-01-07 2023-05-16 EMC IP Holding Company LLC Secure token-based communications between a host device and a storage system

Also Published As

Publication number Publication date
US20060041746A1 (en) 2006-02-23
US7562218B2 (en) 2009-07-14

Similar Documents

Publication Publication Date Title
US7562218B2 (en) Method, system and device for authenticating a user
CN104012132B (en) Two-factor authentication system and method
EP2355443B1 (en) Network authentication method and device for implementing the same
US7395049B2 (en) Security element commanding method and mobile terminal
CN101517593B (en) Method, system and smart card reader for management of access to a smart card
US9325839B2 (en) Call authentification methods and systems
EP2113856A1 (en) Secure storage of user data in UICC and Smart Card enabled devices
US9667626B2 (en) Network authentication method and device for implementing the same
EP2023262A2 (en) Authentication system and authentication method
CN101933286A (en) Wireless authentication
JP2007087081A (en) Financial transaction system
CA2509119C (en) Method, system and device for authenticating a user
KR101125088B1 (en) System and Method for Authenticating User, Server for Authenticating User and Recording Medium
US10573109B2 (en) Electric lock and method for adding a user of the same
US20180365914A1 (en) Door Access Control System Through Identifiable Data Transmission And Method Thereof
US20030088794A1 (en) Method and system for rendering secure pin entry
US7752318B2 (en) Method of exchanging secured data through a network
KR101171235B1 (en) Method for Operating Certificate
CN115427950A (en) Unlocking method of electronic device, electronic device and computer-readable storage medium
CN101667915A (en) Method for generating dynamic password to execute remote security authentication and mobile communication device thereof
CA3028810A1 (en) Electric lock and method for adding a user of the same
KR19980043045A (en) Authentication system of remote financial service using input / output access means
WO2022138011A1 (en) Request processing system
KR20060114079A (en) Method for authenticating network user using authentication file stored in mobile phone and authentication file management method in mobile phone
JP2002288623A (en) Ic card system

Legal Events

Date Code Title Description
AS Assignment

Owner name: RESEARCH IN MOTION LIMITED, ONTARIO

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:KIRKUP, MICHAEL G.;BROWN, MICHAEL K.;BROWN, MICHAEL S.;AND OTHERS;REEL/FRAME:022940/0551;SIGNING DATES FROM 20040817 TO 20040830

STCB Information on status: application discontinuation

Free format text: ABANDONED -- FAILURE TO RESPOND TO AN OFFICE ACTION

AS Assignment

Owner name: BLACKBERRY LIMITED, ONTARIO

Free format text: CHANGE OF NAME;ASSIGNOR:RESEARCH IN MOTION LIMITED;REEL/FRAME:034150/0483

Effective date: 20130709

AS Assignment

Owner name: MALIKIE INNOVATIONS LIMITED, IRELAND

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:BLACKBERRY LIMITED;REEL/FRAME:064104/0103

Effective date: 20230511