CN101944246A - 声学双要素认证的系统和方法 - Google Patents

声学双要素认证的系统和方法 Download PDF

Info

Publication number
CN101944246A
CN101944246A CN2010102822394A CN201010282239A CN101944246A CN 101944246 A CN101944246 A CN 101944246A CN 2010102822394 A CN2010102822394 A CN 2010102822394A CN 201010282239 A CN201010282239 A CN 201010282239A CN 101944246 A CN101944246 A CN 101944246A
Authority
CN
China
Prior art keywords
signature
pin
signal
receiver
message
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN2010102822394A
Other languages
English (en)
Inventor
A·甘特曼
G·G·罗斯
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Qualcomm Inc
Original Assignee
Qualcomm Inc
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from US10/077,365 external-priority patent/US7251730B2/en
Application filed by Qualcomm Inc filed Critical Qualcomm Inc
Publication of CN101944246A publication Critical patent/CN101944246A/zh
Pending legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07F—COIN-FREED OR LIKE APPARATUS
    • G07F7/00—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus
    • G07F7/08—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means
    • G07F7/10—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means together with a coded signal, e.g. in the form of personal identification information, like personal identification number [PIN] or biometric data
    • G07F7/1008—Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
    • G06Q20/327—Short range or proximity payments by means of M-devices
    • G06Q20/3272—Short range or proximity payments by means of M-devices using an audio code
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/34—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using cards, e.g. integrated circuit [IC] cards or magnetic cards
    • G06Q20/341—Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/34—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using cards, e.g. integrated circuit [IC] cards or magnetic cards
    • G06Q20/346—Cards serving only as information carrier of service
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/36—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using electronic wallets or electronic money safes
    • G06Q20/367—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using electronic wallets or electronic money safes involving electronic purses or money safes
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/36—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using electronic wallets or electronic money safes
    • G06Q20/367—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using electronic wallets or electronic money safes involving electronic purses or money safes
    • G06Q20/3672—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using electronic wallets or electronic money safes involving electronic purses or money safes initialising or reloading thereof
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/36—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using electronic wallets or electronic money safes
    • G06Q20/367—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using electronic wallets or electronic money safes involving electronic purses or money safes
    • G06Q20/3674—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using electronic wallets or electronic money safes involving electronic purses or money safes involving authentication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G06Q20/3821—Electronic credentials
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G06Q20/3829—Payment protocols; Details thereof insuring higher security of transaction involving key management
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/401—Transaction verification
    • G06Q20/4014—Identity check for transactions
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/409—Device specific authentication in transaction processing
    • G06Q20/4097—Device specific authentication in transaction processing using mutual authentication between devices and transaction partners
    • G06Q20/40975—Device specific authentication in transaction processing using mutual authentication between devices and transaction partners using encryption therefor
    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07F—COIN-FREED OR LIKE APPARATUS
    • G07F19/00—Complete banking systems; Coded card-freed arrangements adapted for dispensing or receiving monies or the like and posting such transactions to existing accounts, e.g. automatic teller machines
    • G07F19/20—Automatic teller machines [ATMs]
    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07F—COIN-FREED OR LIKE APPARATUS
    • G07F7/00—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus
    • G07F7/08—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means
    • G07F7/10—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means together with a coded signal, e.g. in the form of personal identification information, like personal identification number [PIN] or biometric data
    • G07F7/1016—Devices or methods for securing the PIN and other transaction-data, e.g. by encryption
    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07F—COIN-FREED OR LIKE APPARATUS
    • G07F7/00—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus
    • G07F7/08—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means
    • G07F7/10—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means together with a coded signal, e.g. in the form of personal identification information, like personal identification number [PIN] or biometric data
    • G07F7/1025—Identification of user by a PIN code
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0853—Network architectures or network communication protocols for network security for authentication of entities using an additional device, e.g. smartcard, SIM or a different communication terminal
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3234—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/80—Wireless
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2463/00—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00
    • H04L2463/082—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00 applying multi-factor authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/65—Environment-dependent, e.g. using captured environmental data

Abstract

本申请涉及声学双要素认证的系统和方法，尤其提供了一种手持令牌，用于生成代表着从公钥对(44)的私钥产生的数字签名的声学或其它无线信号，公钥是机密的，因为它仅为经授权的实体所知，例如银行计算机。来自所述令牌的信号可以被接收，例如被银行ATM(46)中的接收机接收，而要访问帐户还需要PIN。用户把PIN输入到ATM(48)，ATM(52)用PIN给来自所述令牌的信号加密，通过无需安全的链路把它发送到银行计算机(54)，因为如果不知道由银行计算机持有的机密公钥，即使PIN被猜到也无从验证它就是正确的PIN。

Description

声学双要素认证的系统和方法
本申请是申请号为03807031.6、国际申请日为2003年2月12日、发明名称为“声学双要素认证的系统和方法”的发明专利申请的分案申请。
有关申请
本申请是于2002年2月15日提交的美国专利申请第10/077,365号发明名称为“Method and Apparatus for Simplified Audio Authentication(简化的音频认证的方法和装置)”这一共同待批的专利申请的继续申请，这一专利申请通过引用被结合于此。
I.发明领域
本发明一般涉及使用音频音调的认证。
II.发明背景
随着因特网使用的增长，许多类型的便利型电子商务已经成为可能，诸如在线购买商品和服务、在线银行和使用连接到远程银行的自动柜员机(ATM)等等。但正是电子商务的便利性也使窃贼窃取宝贵信息和/或伪装成不想购买商品和不想从银行帐户提款等等的人更加容易。
因此，在电子交易中提供安全至关重要。为此，许多电子交易被加密来隐藏被交换的私人信息。但加密只是安全的一个方面，因为窃贼可能破解加密方法或进而持有诸如信用卡这类有效物品、伪装成所有者并参与加密的交易。
注意到这一点，就容易理解认证是安全的一个重要方面。在电子商务方面，试图认证的个人是通过计算机界面完成的。因此，如果没有普遍安装生物传感型计算机附件的基础设施，那么采取检验个人生物学特征来验证这人是他声称他是的人通常并不切实可行。
这使两个认证要素可用，即，基于个人所拥有的诸如信用卡或钥匙链之类物品认证一个人，或基于个人所知道的诸如密码或个人识别号(PIN)之类事物认证一个人。对一些特别敏感的诸如ATM提款之类的应用，也许两种要素都是需要的。
目前，ATM用户把诸如信用卡之类的认证设备插入ATM，然后输入PIN。这种方法完成了双要素认证。但是，ATM必须把卡上的秘密信息和PIN两者都发送到中央银行计算机进行认证。因此，银行和ATM之间的链路必须安全，以防止窃贼在线路上窃听并发现认证要素两者，所述认证要素使窃贼能够从用户帐户上窃取金钱。这给链路基础设施带来巨大负担。
上面指出的专利申请揭示了手持的基于声波的“令牌”，个人可以操作它来向称作“认证器”、“验证器”或“接收机”的设备发出表示秘密信息的声学信号，以便基于这个信号认证这个人。在那些申请中公认，基于声波的令牌的有利条件是已经存在着用于接收和发送话音和来源于话音的电子信号的庞大的已安装的基础设施。具体地说，已经存在全球电话系统发送代表声学信息的数据，还有，除了电话，现在由这同一个系统(包含在因特网中)连接的许多计算设备都有麦克风和扬声器(或可以很容易修改成有它们)。
如这里公认的，用在ATM环境中时，声波令牌的优势在于以阻止ATM在没有机密密钥时能伪造私人信息的方式把令牌上的私人信息发送到ATM。ATM简单地把私人信息发送到中央银行计算机进行认证。这样，ATM及ATM和银行的链路都无需安全来保护这个认证要素。但是，本发明还认识到第二个认证要素PIN仍然需要链路安全。这是因为PIN一般只有4到6位阿拉伯数字组成，攻击者可以窥探ATM和银行之间的链路，而如果通信允许猜测的PIN被验证，攻击者就可以简单地试验出大约百万个可能的PIN值并记住起作用的一个，直到攻击者能够偷取令牌并能够访问帐户。因此，不幸的是，银行和ATM之间的安全通信将仍然是必需的。
认识到上面的问题，提供了在这里揭示的发明。
发明内容
一种认证方法，包括最初向诸如银行计算机这样的授权计算机提供PIN和机密公钥，然后在授权计算机和远离计算机的诸如ATM这样的接收机之间建立通信链路。通信链路不限于是安全的。随后，用户的声学信号可以被接收机(例如ATM)接收，信号代表私钥产生的数字签名，接收机把声学信号转换为签名信号。PIN通过例如用户在与接收机相关联的数据输入设备上键入这样的方式也被接收机接收，所以PIN和声学信号分开地被接收。用PIN给签名信号加密得到一个加密的签名信号，然后把后者发到授权计算机以使用PIN和机密公钥来验证签名。
签名信号最好由接收机用PIN加密。另一方面，声学信号最好用手持令牌发送。期望的交易可以输入到接收机，只有在签名得到验证后，授权计算机才授权接收机执行交易。
通过使用PIN给加密签名信号解密以得到签名信号，签名由授权计算机来验证。然后，所产生的签名信号使用机密公钥验证。
在一个优选实施例中，令牌通过把一消息和私钥结合而产生签名信号。所述消息可以包括时间戳的至少一部分，例如，比预先确定数有更多位的时间戳中预先确定数量的最低有效位。
另一方面，揭示了一种用于不限于是安全的链路上的双要素认证的系统。所述系统包括产生代表数字签名消息的无线信号的便携式令牌。接收机接收无线信号和PIN，PIN是和无线信号分开接收的。接收机用PIN给签名消息加密得到加密的签名消息。授权计算机通过链路接收加密的签名消息，并访问PIN和机密公钥以试图验证签名消息。
还有另一方面，认证系统包括至少访问PIN和机密公钥并通过链路和至少一个远离该计算机的接收机通信的授权计算机。通信链路不限于是安全的。系统包括用于在接收机中接收代表一数字签名的无线信号的装置，所述数字前面通过把消息和私钥相结合而产生。接收机把无线信号转换为签名信号。在接收机中的装置也接收PIN。提供装置用PIN给签名信号加密以产生加密的签名信号。加密的签名信号通过链路被发送给授权计算机，以便使用PIN和机密公钥来验证签名。
本发明关于其结构和操作的两个方面的细节，参考附图可以更好理解。在整个附图中，相同的标号标识相应的部件。
附图简述
图1是基于音频认证的本发明系统的方框图；以及
图2是本发明逻辑的流程图。
优选实施例详述
最初参照图1，显示了一个系统，一般指定为10，所述系统包括可以被配置成钥匙链或其它小型设备的便携式手持令牌12。但是，根据需要，本发明也可以应用于其它令牌配置，例如手持的或便携的象安放在交通工具(包括汽车、卡车、小船、飞机和火车)上的移动通信站，包括膝上型电脑、无线手机或电话、数据收发机、或寻呼和位置确定接收机。无线通信设备有时也可以称为用户终端、移动站、移动单元、用户单元、移动无线电或无线电话、无线单元、或象在一些通信系统中那样简单地称为“用户”和“移动”。
不论如何，令牌12都能够产生可以被接收机16接收的声学信号，用多根线条14示意性地表示。接收机16和授权计算机18相关联。在说明性实施例中，接收机16是自动柜员机(ATM)，授权计算机18是银行主计算机，但是可以理解，接收机16可以是一接收设备，所述接收设备与诸如建筑物、家、交通工具相关联，或与期望使用双要素认证限制对预先授权用户的访问的任何其它部件相关联。还可以理解，优选令牌12是一个产生声学信号的声波令牌，本发明的原理可以应用到其它无线信号生成令牌，包括那些可能使用电磁波无线通信原理(例如诸如蓝牙和红外这样的射频)来向接收机16发射下面揭示的数字签名的令牌。
优选声学信号14可以代表使用存储在令牌12的电子数据存储器20中的私钥产生的数字签名。伪随机数(PN)发生器21也可以包括在令牌12中。为了简略揭示也可以将相应的机密公钥或机密公钥标识存储在那里。
按照本领域中熟知的和(美国)国家标准技术研究所(NIST)联邦信息处理标准出版物186-2.一月.2000所阐明的私钥/公钥原理，令牌12中的签名算法(由令牌12中的微处理器22执行)接收私钥和要被签名的消息的至少一部分作为输入(并从而“结合”)，加上来自PN发生器21的随机数“k”，以产生数字签名，即随机对(r，s)。微处理器22最好在收到来自诸如拨动开关、话音激活设备或按钮这样的一个或更多激活元件24的激活信号时立即执行签名算法。被签名的消息和对应于私钥的机密公钥的标识也最好包括在微处理器22产生的信号里。可以理解，微处理器22可以包括本领域中熟知的数字处理器、必要的时钟、模数转换电路和数模转换电路。
微处理器22访问数据存储器20，使得在使用多个激活元件24时，一个或更多个激活元件可以和存储器22中的相应私钥相关联。电子签名信号被发送到音频扬声器26以便把电子签名信号转换为声学信号14。声学信号可以是听得见的，也可以是听不见的。如果需要，也可以在令牌12中提供麦克风28来接收声学信号并把它们转换为电子信号，所述电子信号被送到微处理器22进行处理。使用电磁波无线原理时，扬声器26被取代，例如被射频发射机或红外发射机取代。
优选声学信号14被接收机16中的麦克风或其它声学接收设备30所接收。麦克风30把声学信号转换回电子签名信号(如果需要，还伴随着机密公钥ID和最初的签名前消息)，然后根据需要发送到可以访问数据存储器34的微处理器32。如果需要，也可以在接收机16中提供扬声器36以便把声学信号送回给令牌12，由令牌12中的麦克风28接收所述信号。
当接收机16是ATM而授权计算机18是中央银行计算机时，授权计算机18可以包括一处理器38，处理器38访问数据存储器40通过对从接收机16接收到的数字签名进行验证(或不验证)而选择性地准予授权。数据存储器40可以包括像列表或数据库表这样的数据结构，所述数据结构存储着和由信号代表的私钥相关联的机密公钥(和它的ID)。无论如何，由于下面揭示的密码学的新颖用法，连接银行和ATM的链路41无需是安全的。
图2显示了本发明的逻辑。从方块42开始，和令牌12相关联的机密公钥，和公钥的ID一起，被提供给授权计算机18(例如，主银行计算机)。而且还提供了用户的PIN。这个提供过程是亲自或通过安全连接安全地完成的。“机密公钥”是指和本领域内熟知的私钥/公钥原理一致的公钥，除了机密公钥不可公开地访问而是仅被提供给例如主银行计算机这样的可信实体以外。
移到方块44，在用户操作激活元件24之一时，令牌12中的签名算法接收私钥、伪随机数、以及诸如时间戳的全部或一部分这样的消息作为输入，以产生电子签名，例如随机对(r，s)。然后用户把认证的两个要素都输入到接收机16。特别地，在方块46处，数字签名是以无线方式(例如，声学方式)和经签名的消息一起，如果需要还和相应的机密公钥的ID一起，被发送到接收机16，在方块48处，用户使用如在多数ATM上提供的数字键区输入PIN。在方块50处进入期望的交易(如提款、转账等等)。可以理解，方块46、48和50的步骤可以以任何顺序执行。
按照本发明，在方块52，接收机16用PIN给签名(r，s)加密。这个加密可以是使用诸如AES加密原理的对称加密。经加密的签名与没有加密的机密公钥ID和没有加密的签名前的被签名的消息(例如，时间戳或它的两个最低有效位)一起被发送到主计算机处理器38。
在方块54，主处理器38先用PIN给数字签名解密。然后，通过使用机密公钥ID和最初的签名前的消息，处理器从数据存储器40中检取适当的机密公钥，并依照本领域中熟知的公钥/私钥原理来验证签名。如果验证成功，授权计算机18就用信号通知接收机16允许访问。在ATM验证器16和银行计算机授权计算机18的情况下，银行计算机用信号通知ATM执行所请求的交易。
现在可以理解可能截取链路41上的ATM-银行通信的攻击者不能推导出PIN。特别地，使用“正确的”PIN对签名解密和使用不正确的PIN对其解密会产生同等的结果：也就是不验证签名时不能被理解的随机对，也就是没有机密公钥和被签名的数据就不可能完成的事(注意只有时间戳的几个最低有效位被发送)。这一特征消除了链路41上对安全性的最后要求。
在这里详细地显示和描述的特定“声学双要素认证的系统和方法”完全能够达到本发明以上所述的目标，可以理解，这是本发明目前的优选实施例，是本发明广泛可构想的主题的代表，本发明的范围完全包括对本领域的熟练技术人员可能变得明显的其它实施例，从而，本发明的范围不受除了所附权利要求书之外的任何限制，在权利要求书中单数所指的元件，除非明确地说明之外不是要指“一个且只有一个”，而是“一个或更多”。对本领域的普通技术人员已经知道或将要知道的上述优选实施例中元件的所有结构性或功能性的等价物明确引用在此做为参考，而且都包含在本权利要求书中。此外，不必要求本发明解决致力于每个问题的设备或方法，仅仅因为它被包含在本权利要求书中。此外，本发明的没有任何元件、元素或方法步骤是要奉献给大众，不管这个元件、元素或方法步骤有没有明确地在权利要求书中陈述。这里没有权利要求元素要解释为是在35U.S.C§112第六节规定之下，除非这一条用“用于...的装置”明确叙述，或在方法权利要求的情况下这一条用“步骤”而不是“动作”叙述。

Claims (20)

1.一种认证方法，包括下述步骤：
在授权计算机和至少一个远离该计算机的接收机之间建立通信链路，所述通信链路不限于是安全的；
在所述接收机处，接收至少一个代表由私钥产生的至少一个数字签名的无线信号，所述接收机把所述无线信号转换为签名信号；
向所述授权计算机提供用户的PIN和不可公开访问的机密公钥；
在所述接收机处，从用户接收所述用户的PIN，所述PIN和所述无线信号被分开接收；
在所述接收机处，用所述用户的PIN对所述签名信号加密，以提供加密的签名信号；以及
把所述加密的签名信号从所述接收机发送给所述授权计算机，以使用所述提供的PIN和所述不可公开访问的机密公钥验证所述签名。
2.如权利要求1所述的方法，其特征在于，包括使用手持令牌发送所述无线信号。
3.如权利要求1所述的方法，其特征在于，还包括：把期望的交易输入到所述接收机，并且只有在所述签名得到验证时，述授权计算机才授权所述接收机执行所述交易。
4.如权利要求1所述的方法，其特征在于，所述签名是这样被验证的：
用所述提供的PIN给所述加密的签名信号解密，以提供所述签名信号；然后
使用所述不可公开访问的机密公钥来验证所述签名信号。
5.如权利要求2所述的方法，其特征在于，所述令牌通过把至少一个消息和所述私钥相结合而产生所述数字签名。
6.如权利要求5所述的方法，其特征在于，所述消息包括至少一个时间戳的至少一部分。
7.如权利要求6所述的方法，其特征在于，所述时间戳的所述部分是一时间戳中预定数量的最低有效位，而所述时间戳具有比所述预定数量更多的位。
8.一种链路上的双要素认证系统，该系统包括：
便携式令牌，其产生代表经数字签名的消息的无线信号；
接收机，其从所述便携式令牌接收所述无线信号并从用户接收PIN，所述PIN和所述无线信号被分开接收，所述接收机用所述PIN给所述经数字签名的消息加密，以提供在所述链路上发送的加密的签名消息，其中所述链路不限于是安全的；以及
授权计算机，其在所述链路上至少接收所述加密的签名消息，所述授权计算机通过下述步骤验证所述加密的签名消息：用所述PIN给所述签名消息解密，以恢复所述经数字签名的消息，其中所述PIN是在先提供给所述授权计算机的，并且使用不可公开访问的机密公钥，验证所述经数字签名的消息。
9.如权利要求8所述的系统，其特征在于，所述无线信号还至少表示所述不可公开访问的机密公钥的ID，和经对应于所述公钥的私钥签名后的消息，以提供所述经数字签名的消息。
10.如权利要求9所述的系统，其特征在于，所述接收机向所述授权计算机发送所述加密的签名消息、ID和经签名的消息。
11.如权利要求9所述的系统，其特征在于，所述授权计算机使用所述PIN对所述加密的签名消息解密，并通过使用所述ID访问所述机密公钥以及使用所述机密公钥来验证所述签名消息。
12.如权利要求8所述的系统，其特征在于，所述无线信号是声学信号。
13.一种包括授权计算机的认证系统，所述授权计算机至少访问不可公开访问的机密公钥，并通过链路和至少一个远离所述计算机的接收机通信，所述通信链路不限于是安全的，所述系统包括：
用于在所述接收机处接收至少一个代表用私钥产生的至少一个数字签名的无线信号的装置，所述接收机包括用于把所述无线信号转换为签名信号的装置，其中所述无线信号还至少表示所述不可公开访问的机密公钥的ID，以及经对应于所述公钥的私钥签名后的消息，以提供数字签名；
用于向所述授权计算机提供用户的PIN和不可公开访问的机密公钥的装置；
用于在所述接收机处从用户接收所述用户的PIN的装置，所述PIN和所述无线信号被分开接收；
用于在所述接收机处用所述用户的PIN对所述签名信号加密以提供加密的签名信号的装置；以及
用于把所述加密的签名信号、所述ID和所述经签名的消息通过所述链路从所述接收机发送给所述授权计算机，以便使用所述提供的PIN和所述不可公开访问的机密公钥来验证签名的装置。
14.如权利要求13所述的系统，其特征在于，还包括使用手持令牌发送所述无线信号的装置。
15.如权利要求13所述的系统，其特征在于，还包括把期望的交易输入到所述接收机的装置，其中只有在所述签名得到验证时，所述授权计算机才授权所述接收机执行所述交易。
16.如权利要求13所述的系统，其特征在于，包括：
使用所述提供的PIN对所述加密的签名信号解密以提供所述签名信号的装置；以及
使用所述不可公开访问的机密公钥验证所述签名信号的装置。
17.如权利要求14所述的系统，其特征在于，所述令牌通过把至少一个消息和所述私钥相结合而产生所述数字签名信号。
18.如权利要求17所述的系统，其特征在于，所述消息包括至少一个时间戳的至少一部分。
19.如权利要求17所述的系统，其特征在于，所述消息还与伪随机数结合。
20.如权利要求13所述的系统，其特征在于，所述无线信号是声学信号。
CN2010102822394A 2002-02-15 2003-02-12 声学双要素认证的系统和方法 Pending CN101944246A (zh)

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
US10/077,365 US7251730B2 (en) 2001-12-21 2002-02-15 Method and apparatus for simplified audio authentication
US10/077,365 2002-02-15
US10/139,873 US7966497B2 (en) 2002-02-15 2002-05-06 System and method for acoustic two factor authentication
US10/139,873 2002-05-06

Related Parent Applications (1)

Application Number Title Priority Date Filing Date
CNA038070316A Division CN1650603A (zh) 2002-02-15 2003-02-12 声学双要素认证的系统和方法

Publications (1)

Publication Number Publication Date
CN101944246A true CN101944246A (zh) 2011-01-12

Family

ID=27732633

Family Applications (2)

Application Number Title Priority Date Filing Date
CN2010102822394A Pending CN101944246A (zh) 2002-02-15 2003-02-12 声学双要素认证的系统和方法
CNA038070316A Pending CN1650603A (zh) 2002-02-15 2003-02-12 声学双要素认证的系统和方法

Family Applications After (1)

Application Number Title Priority Date Filing Date
CNA038070316A Pending CN1650603A (zh) 2002-02-15 2003-02-12 声学双要素认证的系统和方法

Country Status (16)

Country Link
US (2) US7966497B2 (zh)
EP (1) EP1481535B1 (zh)
JP (1) JP4565840B2 (zh)
CN (2) CN101944246A (zh)
AT (1) ATE462239T1 (zh)
AU (1) AU2003219752B2 (zh)
BR (1) BR0307657A (zh)
CA (1) CA2476485A1 (zh)
CO (1) CO5611229A2 (zh)
DE (1) DE60331817D1 (zh)
IL (1) IL163527A (zh)
MX (1) MXPA04007869A (zh)
NZ (1) NZ534700A (zh)
RU (1) RU2313916C2 (zh)
TW (1) TWI268688B (zh)
WO (1) WO2003071770A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2012142740A1 (en) * 2011-04-18 2012-10-26 Egonexus Limited Digital token generator, server for recording digital tokens and method for issuing digital token
CN104883350A (zh) * 2014-02-28 2015-09-02 Ncr公司 端到端设备认证

Families Citing this family (64)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7966497B2 (en) 2002-02-15 2011-06-21 Qualcomm Incorporated System and method for acoustic two factor authentication
US7487362B2 (en) * 2002-02-15 2009-02-03 Qualcomm, Inc. Digital authentication over acoustic channel
US7401224B2 (en) * 2002-05-15 2008-07-15 Qualcomm Incorporated System and method for managing sonic token verifiers
US7308703B2 (en) * 2002-12-18 2007-12-11 Novell, Inc. Protection of data accessible by a mobile device
US8100323B1 (en) * 2002-12-26 2012-01-24 Diebold Self-Service Systems Division Of Diebold, Incorporated Apparatus and method for verifying components of an ATM
JP2005204126A (ja) * 2004-01-16 2005-07-28 Amano Corp 電子署名方法および電子署名装置
WO2005119608A1 (en) * 2004-06-03 2005-12-15 Tyfone, Inc. System and method for securing financial transactions
US7616764B2 (en) * 2004-07-07 2009-11-10 Oracle International Corporation Online data encryption and decryption
US7581678B2 (en) 2005-02-22 2009-09-01 Tyfone, Inc. Electronic transaction card
CN101322346A (zh) 2005-12-01 2008-12-10 鲁库斯无线公司 借助于无线基站虚拟化的按需服务
EP2013758B1 (en) 2006-04-24 2016-08-03 Ruckus Wireless, Inc. Dynamic authentication in secured wireless networks
US9769655B2 (en) 2006-04-24 2017-09-19 Ruckus Wireless, Inc. Sharing security keys with headless devices
US9071583B2 (en) 2006-04-24 2015-06-30 Ruckus Wireless, Inc. Provisioned configuration for automatic wireless connection
US8739278B2 (en) * 2006-04-28 2014-05-27 Oracle International Corporation Techniques for fraud monitoring and detection using application fingerprinting
NZ547903A (en) * 2006-06-14 2008-03-28 Fronde Anywhere Ltd A method of generating an authentication token and a method of authenticating an online transaction
US9106422B2 (en) * 2006-12-11 2015-08-11 Oracle International Corporation System and method for personalized security signature
US7991158B2 (en) * 2006-12-13 2011-08-02 Tyfone, Inc. Secure messaging
US9741027B2 (en) 2007-12-14 2017-08-22 Tyfone, Inc. Memory card based contactless devices
US8451122B2 (en) 2008-08-08 2013-05-28 Tyfone, Inc. Smartcard performance enhancement circuits and systems
US7961101B2 (en) 2008-08-08 2011-06-14 Tyfone, Inc. Small RFID card with integrated inductive element
US8904177B2 (en) * 2009-01-27 2014-12-02 Sony Corporation Authentication for a multi-tier wireless home mesh network
CA2967042C (en) 2009-02-10 2023-03-07 4361423 Canada Inc. Apparatus and method for commercial transactions using a communication device
US8231061B2 (en) 2009-02-24 2012-07-31 Tyfone, Inc Contactless device with miniaturized antenna
EP2282297A1 (fr) * 2009-07-21 2011-02-09 Openways Sas Système sécurisé de commande d'ouverture de dispositifs de serrure par accréditions acoustiques chiffrées
US10713341B2 (en) * 2011-07-13 2020-07-14 Scott F. McNulty System, method and apparatus for generating acoustic signals based on biometric information
US9560035B2 (en) * 2010-08-04 2017-01-31 At&T Mobility Ii Llc Systems, devices, methods and computer program products for establishing network connections between service providers and applications that run natively on devices
US8917631B2 (en) * 2010-08-23 2014-12-23 Ortsbo Inc. System and method for sharing information between two or more devices
GB2546026B (en) * 2010-10-01 2017-08-23 Asio Ltd Data communication system
US9792188B2 (en) 2011-05-01 2017-10-17 Ruckus Wireless, Inc. Remote cable access point reset
US8756668B2 (en) 2012-02-09 2014-06-17 Ruckus Wireless, Inc. Dynamic PSK for hotspots
US8752156B1 (en) * 2012-03-30 2014-06-10 Emc Corporation Detecting soft token copies
US9092610B2 (en) 2012-04-04 2015-07-28 Ruckus Wireless, Inc. Key assignment for a brand
WO2013156076A1 (en) * 2012-04-20 2013-10-24 Payfair International Gmbh Transfer connector
US9184915B2 (en) * 2012-08-30 2015-11-10 Vasco Data Security, Inc. Strong authentication token with acoustic data input over multiple carrier frequencies
US9460590B2 (en) 2012-09-24 2016-10-04 Wal-Mart Stores, Inc. Determination of customer proximity to a register through use of sound and methods thereof
CN104919732B (zh) * 2012-12-28 2017-04-12 乐天株式会社 超声波通信系统
EP2965295B1 (en) * 2013-03-06 2018-08-08 Assa Abloy AB Localized pin management with reader verification and no disclosure
US9742825B2 (en) * 2013-03-13 2017-08-22 Comcast Cable Communications, Llc Systems and methods for configuring devices
US9100395B2 (en) * 2013-09-24 2015-08-04 International Business Machines Corporation Method and system for using a vibration signature as an authentication key
US9450682B2 (en) 2013-10-07 2016-09-20 International Business Machines Corporation Method and system using vibration signatures for pairing master and slave computing devices
US9722984B2 (en) * 2014-01-30 2017-08-01 Netiq Corporation Proximity-based authentication
TWI563853B (en) * 2014-02-27 2016-12-21 Beseye Cloud Security Co Ltd Surveillance system and the operation process thereof
SG11201608407UA (en) * 2014-04-07 2016-11-29 Eyeverify Inc Bio leash for user authentication
US10235512B2 (en) * 2014-06-24 2019-03-19 Paypal, Inc. Systems and methods for authentication via bluetooth device
US9648164B1 (en) 2014-11-14 2017-05-09 United Services Automobile Association (“USAA”) System and method for processing high frequency callers
US10652739B1 (en) 2014-11-14 2020-05-12 United Services Automobile Association (Usaa) Methods and systems for transferring call context
US9336092B1 (en) * 2015-01-01 2016-05-10 Emc Corporation Secure data deduplication
US9374370B1 (en) 2015-01-23 2016-06-21 Island Intellectual Property, Llc Invariant biohash security system and method
TWI576823B (zh) * 2015-05-12 2017-04-01 A sound transmission system for improving audio recognition rate and its data processing
US10509892B2 (en) * 2016-07-10 2019-12-17 B. G. Negev Technologies And Applications Ltd., At Ben-Gurion University Acoustic security code transmission
US10409974B2 (en) * 2016-10-01 2019-09-10 Intel Corporation Technologies for authorizing a user to a protected system
GB201617408D0 (en) 2016-10-13 2016-11-30 Asio Ltd A method and system for acoustic communication of data
GB201617409D0 (en) 2016-10-13 2016-11-30 Asio Ltd A method and system for acoustic communication of data
GB201704636D0 (en) 2017-03-23 2017-05-10 Asio Ltd A method and system for authenticating a device
GB2565751B (en) 2017-06-15 2022-05-04 Sonos Experience Ltd A method and system for triggering events
GB2570634A (en) 2017-12-20 2019-08-07 Asio Ltd A method and system for improved acoustic transmission of data
US11436311B2 (en) * 2018-05-22 2022-09-06 Arizona Board Of Regents On Behalf Of Arizona State University Method and apparatus for secure and usable mobile two-factor authentication
KR102179085B1 (ko) 2018-10-26 2020-11-16 주식회사 뮤즈라이브 비접촉 방식의 사용자 인증 방법
US11295758B2 (en) 2020-03-20 2022-04-05 Seagate Technology Llc Trusted listening
JP7254753B2 (ja) 2020-09-18 2023-04-10 株式会社東芝 システムおよびサーバ装置
CN112506267B (zh) * 2020-12-01 2024-04-19 上海银基信息安全技术股份有限公司 一种rtc校准方法、车载终端、用户端和存储介质
US11593807B2 (en) 2021-03-22 2023-02-28 Bank Of America Corporation Information security system and method for multi-factor authentication for ATMS using authentication media
US11640455B2 (en) 2021-05-27 2023-05-02 Bank Of America Corporation Systems and methods for dynamic polychrome lattice image security
US11876804B2 (en) * 2021-07-21 2024-01-16 Capital One Services, Llc Systems and methods for providing access to a secure device

Family Cites Families (102)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US4305143A (en) 1979-08-08 1981-12-08 Simms Larry L Automatic man overboard sensor and rescue system
IL64675A0 (en) * 1981-12-30 1982-03-31 Greenberg Avigdor Data verification system
US4961142A (en) * 1988-06-29 1990-10-02 Mastercard International, Inc. Multi-issuer transaction device with individual identification verification plug-in application modules for each issuer
FR2640835B1 (fr) 1988-12-07 1994-06-24 France Etat Dispositif d'authentification pour serveur interactif
JPH03214834A (ja) 1990-01-19 1991-09-20 Canon Inc マルチメデイアネツトワークシステム
US5196840A (en) * 1990-11-05 1993-03-23 International Business Machines Corporation Secure communications system for remotely located computers
US5200993A (en) 1991-05-10 1993-04-06 Bell Atlantic Network Services, Inc. Public telephone network including a distributed imaging system
US5561710A (en) 1992-11-17 1996-10-01 Helms; Ramon E. Interactive voice communication terminal with alpha and numeric keypad
US6408388B1 (en) * 1993-05-05 2002-06-18 Addison M. Fischer Personal date/time notary device
US5422953A (en) 1993-05-05 1995-06-06 Fischer; Addison M. Personal date/time notary device
US5450491A (en) 1993-08-26 1995-09-12 At&T Corp. Authenticator card and system
WO1995016238A1 (en) 1993-12-06 1995-06-15 Telequip Corporation Secure computer memory card
US5481611A (en) 1993-12-09 1996-01-02 Gte Laboratories Incorporated Method and apparatus for entity authentication
US5583933A (en) * 1994-08-05 1996-12-10 Mark; Andrew R. Method and apparatus for the secure communication of data
US6236724B1 (en) 1994-10-04 2001-05-22 Enco-Tone Ltd. Methods and apparatus for encoding and decoding data transmitted over telephone lines
US20010055320A1 (en) 1994-12-15 2001-12-27 Pierzga Wayne Francis Multiplex communication
CA2167631A1 (en) * 1995-01-20 1996-07-21 W. Dale Hopkins Method and apparatus for user and security device authentication
JPH08305662A (ja) 1995-05-02 1996-11-22 Fujitsu Ltd クライアント認証システムおよび方法
US5696879A (en) 1995-05-31 1997-12-09 International Business Machines Corporation Method and apparatus for improved voice transmission
US6505160B1 (en) 1995-07-27 2003-01-07 Digimarc Corporation Connected audio and other media objects
WO1997024857A1 (en) 1995-12-29 1997-07-10 Mci Communications Corporation Security for calling card validation
WO1997031437A1 (en) 1996-02-20 1997-08-28 Sonic Systems Digital sonic and ultrasonic communications networks
US5802176A (en) * 1996-03-22 1998-09-01 Activcard System for controlling access to a function, using a plurality of dynamic encryption variables
EP0891611B1 (fr) 1996-03-22 2006-07-05 Actividentity Europe Sa Systeme de controle d'acces a une fonction, dans lequel le chiffrement implique plusieurs variables dynamiques
US6216231B1 (en) 1996-04-30 2001-04-10 At & T Corp. Specifying security protocols and policy constraints in distributed systems
DE19632025C2 (de) * 1996-08-08 1998-07-23 Daimler Benz Ag Authentikationseinrichtung mit elektronischer Authentikationskommunikation
FR2753860B1 (fr) 1996-09-25 1998-11-06 Procede et systeme pour securiser les prestations de services a distance des organismes financiers
JPH10134157A (ja) 1996-10-28 1998-05-22 Nippon Telegr & Teleph Corp <Ntt> 計算機カードを利用した暗号認証処理方法および装置
DE19647833B4 (de) 1996-11-19 2005-07-07 Deutsches Zentrum für Luft- und Raumfahrt e.V. Verfahren zur gleichzeitigen Funkübertragung digitaler Daten zwischen mehreren Teilnehmerstationen und einer Basisstation
SG64957A1 (en) 1996-12-04 1999-05-25 Inst Of Systems Science Nation Microprocessor card payment system
US6023676A (en) * 1996-12-12 2000-02-08 Dspc Israel, Ltd. Keyword recognition system and method
JP2957507B2 (ja) 1997-02-24 1999-10-04 インターナショナル・ビジネス・マシーンズ・コーポレイション 小型情報処理機器
US6359923B1 (en) * 1997-12-18 2002-03-19 At&T Wireless Services, Inc. Highly bandwidth efficient communications
US6282522B1 (en) * 1997-04-30 2001-08-28 Visa International Service Association Internet payment system using smart card
US6018739A (en) * 1997-05-15 2000-01-25 Raytheon Company Biometric personnel identification system
US5953700A (en) 1997-06-11 1999-09-14 International Business Machines Corporation Portable acoustic interface for remote access to automatic speech/speaker recognition server
US6213391B1 (en) 1997-09-10 2001-04-10 William H. Lewis Portable system for personal identification based upon distinctive characteristics of the user
US6084967A (en) * 1997-10-29 2000-07-04 Motorola, Inc. Radio telecommunication device and method of authenticating a user with a voice authentication token
IL122375A (en) 1997-12-01 2001-05-20 Divecom Ltd Method and apparatus for carrying out high data rate underwater communication
US6130859A (en) 1997-12-01 2000-10-10 Divecom Ltd. Method and apparatus for carrying out high data rate and voice underwater communication
US7328350B2 (en) * 2001-03-29 2008-02-05 Arcot Systems, Inc. Method and apparatus for secure cryptographic key generation, certification and use
US6347122B1 (en) 1998-01-13 2002-02-12 Agere Systems Guardian Corp. Optimal complement punctured convolutional codes for use in digital audio broadcasting and other applications
US6389055B1 (en) 1998-03-30 2002-05-14 Lucent Technologies, Inc. Integrating digital data with perceptible signals
US6327314B1 (en) 1998-04-01 2001-12-04 At&T Corp. Method and apparatus for channel estimation for multicarrier systems
JPH11289324A (ja) 1998-04-03 1999-10-19 Matsushita Electric Ind Co Ltd 送受信装置および送受信方法
JPH11316740A (ja) 1998-05-06 1999-11-16 Meidensha Corp ワンタイムパスワード認証システム
US6157820A (en) * 1998-06-12 2000-12-05 Ericsson Inc. Pilot strength measurement and multipath delay searcher for CDMA receiver
US6272176B1 (en) 1998-07-16 2001-08-07 Nielsen Media Research, Inc. Broadcast encoding system and method
DE19981652D2 (de) 1998-08-21 2001-07-26 Rudolf Bannasch Verfahren zur Übertragung von Informationen sowie ein geeignetes System hierfür
US6594705B1 (en) 1998-09-11 2003-07-15 Lv Partners, L.P. Method and apparatus for utilizing an audibly coded signal to conduct commerce over the internet
US6607136B1 (en) 1998-09-16 2003-08-19 Beepcard Inc. Physical presence digital authentication system
CA2345745A1 (en) 1998-10-02 2000-04-13 Comsense Technologies, Ltd. Card for interaction with a computer
US6460138B1 (en) * 1998-10-05 2002-10-01 Flashpoint Technology, Inc. User authentication for portable electronic devices using asymmetrical cryptography
US6275934B1 (en) 1998-10-16 2001-08-14 Soft Book Press, Inc. Authentication for information exchange over a communication network
US6463537B1 (en) 1999-01-04 2002-10-08 Codex Technologies, Inc. Modified computer motherboard security and identification system
EP1024626A1 (en) 1999-01-27 2000-08-02 International Business Machines Corporation Method, apparatus, and communication system for exchange of information in pervasive environments
JP3515408B2 (ja) 1999-02-15 2004-04-05 日本電信電話株式会社 時刻認証装置
JP2000284689A (ja) 1999-04-01 2000-10-13 Hitachi Ltd 情報格納方法
US6778828B1 (en) * 1999-04-12 2004-08-17 Lucent Technologies Inc. Personal mobility registration system for registration of a user's identity in a telecommunications terminal
DE19923983B4 (de) 1999-05-25 2005-03-17 Siemens Ag Verfahren und Anordnung zur Fern-Zugangssteuerung
JP4519963B2 (ja) 1999-06-21 2010-08-04 富士通株式会社 生体情報の暗号化・復号化方法および装置並びに、生体情報を利用した本人認証システム
US6376952B1 (en) 1999-07-14 2002-04-23 E. I. Du Pont De Nemours And Company Bearing system for a rotating shaft
US6553494B1 (en) * 1999-07-21 2003-04-22 Sensar, Inc. Method and apparatus for applying and verifying a biometric-based digital signature to an electronic document
JP2003506919A (ja) 1999-08-03 2003-02-18 ポリコム・インコーポレイテッド 無線通信システムにおける保全データ転送のためのシステムおよび方法
WO2001011575A1 (en) 1999-08-09 2001-02-15 Wow Company S.A. Portable certification device with acoustic coupling
US6397368B1 (en) 1999-12-06 2002-05-28 Intellon Corporation Forward error correction with channel adaptation
IL133584A (en) * 1999-12-19 2010-02-17 Enco Tone Ltd Method for the acoustic encodification of dynamic identification codes
JP2001203688A (ja) 2000-01-24 2001-07-27 Kyocera Corp 音声通信端末
US20010039619A1 (en) * 2000-02-03 2001-11-08 Martine Lapere Speaker verification interface for secure transactions
AUPQ564400A0 (en) 2000-02-16 2000-03-09 Ong, Yong Kin (Michael) Electronic credit card-ecc
FI20000529A (fi) 2000-03-08 2001-09-09 Nokia Mobile Phones Ltd Menetelmä avainkoodin syöttämiseksi elektroniikkalaitteeseen ja elektroniikkalaite
JP2001265217A (ja) 2000-03-17 2001-09-28 Cti Co Ltd デジタルコンテンツの改ざん監視装置、改ざん監視方法及び記録媒体
CN1263324A (zh) 2000-03-20 2000-08-16 后健慈 指纹辨识键盘装置及其辨识方法
AU4274801A (en) 2000-03-22 2001-10-03 Vasara Research Inc. Communication system
JP2001309159A (ja) 2000-04-20 2001-11-02 Hitachi Ltd 記録装置
AU2001272018A1 (en) 2000-07-07 2002-01-21 Qualcomm Incorporated Method and apparatus for secure identity authentication with audible tones
WO2002013435A1 (en) 2000-08-04 2002-02-14 First Data Corporation Method and system for using electronic communications for an electronic contact
JP2002064461A (ja) 2000-08-18 2002-02-28 Mitsubishi Electric Corp 通信装置および通信方法
IL138109A (en) 2000-08-27 2009-11-18 Enco Tone Ltd Method and devices for digitally signing files, using a mobile device
US6343049B1 (en) 2000-09-19 2002-01-29 Kohji Toda Ultrasonic transmitting and receiving system for digital communication
US7093131B1 (en) 2000-09-29 2006-08-15 Seiko Epson Corporation Information authenticating apparatus and authenticating station
US6889209B1 (en) 2000-11-03 2005-05-03 Shieldip, Inc. Method and apparatus for protecting information and privacy
US6438367B1 (en) 2000-11-09 2002-08-20 Magis Networks, Inc. Transmission security for wireless communications
US20020095587A1 (en) 2001-01-17 2002-07-18 International Business Machines Corporation Smart card with integrated biometric sensor
US7162634B2 (en) 2001-04-18 2007-01-09 Thomson Licensing Method for providing security on a powerline-modem network
JP4174191B2 (ja) 2001-04-19 2008-10-29 日本電気株式会社 著作権保護システム及びその方法
US7421030B2 (en) 2001-05-08 2008-09-02 Siemens Aktiengesellschaft Method and device for transferring data in a multi-carrier system having parallel concatenated encoding and modulation
US7010806B2 (en) * 2001-05-18 2006-03-07 Sun Microsystems, Inc. Dynamic downloading of keyboard keycode data to a networked client
US7493363B2 (en) * 2001-09-19 2009-02-17 Microsoft Corporation Peer-to-peer group management and method for maintaining peer-to-peer graphs
US7146500B2 (en) 2001-11-14 2006-12-05 Compass Technology Management, Inc. System for obtaining signatures on a single authoritative copy of an electronic record
US7251730B2 (en) 2001-12-21 2007-07-31 Qualcomm Incorporated Method and apparatus for simplified audio authentication
US7966497B2 (en) * 2002-02-15 2011-06-21 Qualcomm Incorporated System and method for acoustic two factor authentication
US7487362B2 (en) * 2002-02-15 2009-02-03 Qualcomm, Inc. Digital authentication over acoustic channel
US7533735B2 (en) * 2002-02-15 2009-05-19 Qualcomm Corporation Digital authentication over acoustic channel
GB2386236A (en) * 2002-03-05 2003-09-10 Marconi Comm Ltd Cashless transactions via a telecommunications network
WO2003088165A1 (en) * 2002-04-16 2003-10-23 Ultra Proizvodnja Elektronskih Naprav D.O.O. Payment terminal device for payment data exchange
US20030212549A1 (en) * 2002-05-10 2003-11-13 Jack Steentra Wireless communication using sound
US7401224B2 (en) * 2002-05-15 2008-07-15 Qualcomm Incorporated System and method for managing sonic token verifiers
US7349481B2 (en) * 2002-07-01 2008-03-25 Qualcomm Incorporated Communication using audible tones
US20110191253A1 (en) * 2009-04-17 2011-08-04 Geomonkey, Inc. Use of mobile devices for communicating sound-based virtual transaction data
SI23227A (sl) 2010-03-10 2011-05-31 Margento R&D D.O.O. Brezžični mobilni transakcijski sistem in postopek izvedbe transakcije z mobilnim telefonom
US20110270764A1 (en) * 2010-08-08 2011-11-03 Ali Mizani Oskui Method and a sytem for electronic transaction using point of sales (pos) device

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2012142740A1 (en) * 2011-04-18 2012-10-26 Egonexus Limited Digital token generator, server for recording digital tokens and method for issuing digital token
CN103477372A (zh) * 2011-04-18 2013-12-25 埃戈耐克塞斯有限公司 数字令牌生成器、用于记录数字令牌的服务器和用于发布数字令牌的方法
CN104883350A (zh) * 2014-02-28 2015-09-02 Ncr公司 端到端设备认证

Also Published As

Publication number Publication date
EP1481535A4 (en) 2006-07-26
NZ534700A (en) 2005-03-24
US7966497B2 (en) 2011-06-21
EP1481535A1 (en) 2004-12-01
CN1650603A (zh) 2005-08-03
DE60331817D1 (de) 2010-05-06
JP2005518721A (ja) 2005-06-23
ATE462239T1 (de) 2010-04-15
TWI268688B (en) 2006-12-11
AU2003219752A1 (en) 2003-09-09
CO5611229A2 (es) 2006-02-28
BR0307657A (pt) 2005-04-26
AU2003219752B2 (en) 2008-05-22
US8391480B2 (en) 2013-03-05
TW200307438A (en) 2003-12-01
CA2476485A1 (en) 2003-08-28
EP1481535B1 (en) 2010-03-24
RU2004127588A (ru) 2006-01-27
MXPA04007869A (es) 2004-11-26
IL163527A (en) 2010-04-29
US20090141890A1 (en) 2009-06-04
WO2003071770A1 (en) 2003-08-28
JP4565840B2 (ja) 2010-10-20
US20030159050A1 (en) 2003-08-21
RU2313916C2 (ru) 2007-12-27

Similar Documents

Publication Publication Date Title
CN101944246A (zh) 声学双要素认证的系统和方法
JP2005518721A5 (zh)
US7251730B2 (en) Method and apparatus for simplified audio authentication
US8132012B2 (en) Method and apparatus for the secure identification of the owner of a portable device
EP0824814B1 (en) Methods and apparatus for authenticating an originator of a message
JP2001508563A (ja) 金融機関によって提供されるリモートサービスのセキュリティシステムおよび方法
CN109660359B (zh) 生成hd钱包名片的方法、设备及生成hd钱包可信地址的方法
CN102906776A (zh) 一种用于用户和服务提供商之间双向认证的方法
JP2001312477A (ja) 認証システム、並びに、認証装置およびその方法
JP3889660B2 (ja) 認証方法及び認証システム
JP2003032742A (ja) 携帯電話機の不正使用防止方法
JP2000200318A (ja) 電子現金譲渡方法、それに用いる装置、及びそのプログラム記録媒体
JPH02247790A (ja) Ｉｃカード機器

Legal Events

Date Code Title Description
C06 Publication
PB01 Publication
C10 Entry into substantive examination
SE01 Entry into force of request for substantive examination
C02 Deemed withdrawal of patent application after publication (patent law 2001)
WD01 Invention patent application deemed withdrawn after publication

Open date: 20110112