EP2553867A1 - Procédé de transmission sûre d'une application d'un serveur à une unité lecteur - Google Patents

Procédé de transmission sûre d'une application d'un serveur à une unité lecteur

Info

Publication number
EP2553867A1
EP2553867A1 EP11710438A EP11710438A EP2553867A1 EP 2553867 A1 EP2553867 A1 EP 2553867A1 EP 11710438 A EP11710438 A EP 11710438A EP 11710438 A EP11710438 A EP 11710438A EP 2553867 A1 EP2553867 A1 EP 2553867A1
Authority
EP
European Patent Office
Prior art keywords
server
application
unit
data carrier
reader
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
EP11710438A
Other languages
German (de)
English (en)
Inventor
Dieter Weiss
Gisela Meister
Jan Eichholz
Florian Gawlas
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Giesecke and Devrient GmbH
Original Assignee
Giesecke and Devrient GmbH
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Giesecke and Devrient GmbH filed Critical Giesecke and Devrient GmbH
Publication of EP2553867A1 publication Critical patent/EP2553867A1/fr
Ceased legal-status Critical Current

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3234—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3215—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a plurality of channels
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/80—Wireless
    • H04L2209/805—Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor

Definitions

  • the invention relates to a method and a system for the method for securely transferring an application from a server to a reader unit.
  • a protected Kornmunikationsitati should be established between the disk unit and the server or the reader and the server.
  • the server in this application is an application server that offers applications, so-called e-services.
  • E-services are all services and activities that are created by computers and interactively offered and executed via electronic media such as the Internet.
  • server in this application is synonymous with the term application server.
  • an application to be transferred offered by the e-service will be information and educational services such as e-education, e-learning, e-teaching, e-publishing, e-book, e-zine and e Catalog to provide procurement, trading and ordering services such as e-business, e-commerce, e-procurement, e-cash, e-shop, e-intermediary, e-auction, cultural and administrative services such as e-culture, E-government or e-vote to improve the services of marketing, the product or the customer relationship to electronic consulting such as E-Consult or E-Advising.
  • information and educational services such as e-education, e-learning, e-teaching, e-publishing, e-book, e-zine and e Catalog to provide procurement, trading and ordering services such as e-business, e-commerce, e-procurement, e-cash, e-shop, e-intermediary, e-auction
  • the application is preferably security-related services, production-related, scientific or logistic services. E-services will be used in many other applications in the future.
  • eBanking eBanking, ticketing, VPN or much more, which are provided on the server, for example, the server of a bank for performing payment transactions, the server of an official office to perform an official matter (tax return etc) , the server of a transport association for the electronic purchase of travel tickets.
  • the type of server for offering an application that requires the secure transfer of an application and local installation and use of the application is not limiting here.
  • a first cryptographically secured channel is established between the data carrier unit and the server built on a first cryptographic information. Furthermore, a second cryptographically secured channel based on a second cryptographic information is set up between a security module of the reader unit and the server. Finally, the application is transferred from the server to the reader unit via the second cryptographically secured channel.
  • this cryptographic information may be access data, passwords, PINs or other secret information.
  • the data carrier unit negotiates with the server a first cryptographic key over which the first cryptographically secured channel is established.
  • the security module of the reader unit negotiates with the server a second cryptographic key over which the second cryptographically secured channel is established.
  • methods known from the prior art can be used again.
  • the Diffie-Hellmann key exchange can be used to generate the first or second cryptographic key.
  • the data carrier unit is preferably portable data carriers, in particular with corresponding security functionalities, such as smart cards, chip cards, tokens and / or electronic identity documents, such as an electronic identity card, passport etc with machine-readable identification data of a person stored on a chip.
  • the data carrier unit is used with a contactless, for example NFC, interface.
  • the reader unit is preferably a so-called smart reader.
  • SAM Secure Application Module
  • the smart reader is a reader with a contact interface, in particular USB, and a security module therein.
  • the security module for example a smartcard chip, preferably has a contactless interface for communicating with the data carrier unit, so that the contactless interface of the data carrier unit and the security module is used to set up the first cryptographically secured channel.
  • the reader unit is a mobile terminal, in particular a mobile device.
  • a security element is integrated in the mobile terminal while a security element is integrated.
  • the security element is configured in particular as a hardware component and arranged as a firmly integrated component in the mobile terminal, wherein it can not be removed either in the form of the mobile terminal, for example as M2M module, co-processor or Trusted Base or as a removable module with Security functionality is connected to the mobile terminal, for example as a smart card, in particular a Subscriber Identification Module, SIM card short, smart card, mass storage card, USB token, multimedia card, Secure MicroSD card, Mobilfunknetztoken, eg a UMTS Surfstick.
  • the security element is a software component in the form of a trusted platform module as a trustworthy part of the operating system. system kernel of the mobile terminal or designed as a security software algorithm.
  • the mobile terminal is equipped with communication interfaces to the server and to the data carrier unit.
  • the reader unit is used with a contact interface, wherein the contact interface is used to build the second cryptographically secured channel.
  • the application is installed and managed on the security module of the reader unit, in particular with Global Platform Card Management Interfaces, GPCS for short.
  • the application is preferably personalized for the user before being transmitted.
  • the application is already personalized prior to installation on the security module, which is achieved due to the user authentication by means of the data carrier unit.
  • the application on the reader module safety module is personalized for the user only after installing the application.
  • the server is a signature terminal known from the prior art for electronic identity documents
  • the so-called secure messaging providing the first and / or second cryptographically secured channel between the signature terminal and the first and second or second data carrier unit, which are each electronic identity documents, is constructed.
  • Secure messaging is preferably based on a password-based Transport protocol and particularly preferably based on the PACE protocol, see Technical Guideline TR-03110, "Advanced Security Mechanisms for Machine Readable Travel Documents", Version 2.02, BSI, 2009.
  • the reader unit is incorporated in a data processing device and operable by means of the data processing device.
  • a data processing device are PC, notebook, especially untrustworthy devices to call.
  • the data processing unit uses a secure data connection, in particular by means of transport layer security (TLS), to the server for establishing the first and / or second cryptographically secured channel (K1, K2).
  • TLS transport layer security
  • the reader unit and in particular the security module are preferably connected via the contact-type interface to the data processing unit, so that the untrusted data processing unit can be connected to the server via the security module.
  • This allows personalization at any time in a simple way even on an insecure computing device, such as a PC in the Internet cafe, or a PC that you do not trust allowed.
  • the first cryptographically secured channel is established directly between the contactless interface of the data carrier unit via the contactless interface of the reader unit to the server via the data processing device, whereas the second cryptographically secured channel between the contact interface of the reader unit via the data processing device Server is built.
  • the application is enabled only by authentication of the user by means of the data carrier unit on the reader unit, in particular by restriced identification.
  • the invention further relates to a system consisting of server, data carrier unit and reader unit, which is configured such that the method according to the invention and in particular also one or more preferred variants of this method can be carried out during operation of the system.
  • Fig. 1 shows a first embodiment of an inventive
  • FIG. 2 is a diagram illustrating a message exchange performed in the embodiment of FIG. 1.
  • FIG. 2 is a diagram illustrating a message exchange performed in the embodiment of FIG. 1.
  • FIG. 1 shows an embodiment of a method according to the invention, in which the first and second cryptographically secured channels K1 and K2 are used for the secure loading of applications.
  • Fig. 1 shows an embodiment of a method according to the invention, in which the first and second cryptographically secured channels K1 and K2 are used for the secure loading of applications.
  • the data carrier unit 1 represents an elD token, for example an electronic identity card.
  • the reader unit is represented by a so-called smart terminal 2, which has a security module 3 (eg a SAM module).
  • the smart terminal has a contact-based te interface 2a, for example USB, and via a contactless interface 2b.
  • the smart terminal is configured in particular as a smart reader, which is integrated via a USB interface in a data carrier processing device 4, for example a notebook.
  • the smart terminal 2 and the elD token 1 can communicate with one another via corresponding interfaces, preferably via NFC interfaces, as indicated by the arrow P.
  • a central server S Remote to the smart terminal 2, the elD token 1 and the notebook 4, a central server S is arranged, which provides electronic services (so-called eServices).
  • the server S represents an eService Terrninal server, for example a bank server for mternetbanking, a tax office server or a trust center, which can communicate via a network with the notebook 4 in the form of a PC.
  • TLS Transport Lay er Security
  • an end-to-end encrypted Internet connection or a VPN connection is established between the server S and the smart reader 2, which is connected via its USB interface 2 a to a corresponding USB interface of the notebook 4.
  • TLS Transport Lay er Security
  • the second cryptographically secured channel K2 is established between server S and smart reader 2 via this connection.
  • the encrypted connection between server S and smart reader 2 is also used within the framework of the construction of the first cryptographically secured channel K1.
  • the communication is routed via the Smart Reader 2.
  • the first cryptographically secured channel K1 between server S and elD token 1 via the encrypted connection to the smart reader 2 and via the contactless interface of the smart reader is functioning as an RFID reader for the data carrier unit 1 2 and the elD Token 1 set up.
  • corresponding keys A and B are negotiated for the individual channels K1 or K2.
  • a password-based or asymmetric transport protocol (e.g., the PACE protocol known in the art) may be used.
  • a key A between server S and elD Token 1 can be generated, which is provided for the encryption of the communication in the channel Kl.
  • a second session key B which is provided for the encrypted communication in the channel K2 is generated by the same mechanism within the framework of the construction of a second secure channel K2 between the smart reader 2 and the server S.
  • an identifier is used in the generation of the corresponding key A, B, which does not correspond to the identity identifier of the elD token 1 or the security module 3.
  • a so-called. Restricted ID is used.
  • a first cryptographically secured channel is established, which in turn is designated by Kl.
  • the connection is established via Secure Messaging (denoted by SM) and an authentication between the server S and the elD token 1 with protocols known per se is carried out.
  • the smart terminal 2 can take an active role in the execution of the logs.
  • the smart terminal 2 executes the PACE protocol.
  • a second cryptographically secured channel K2 is also established between the server S and the smart terminal 2 or the security module 3. In this case, an authentication takes place between the server S and the security module 3.
  • B was again used in the construction of the channels Kl and K2.
  • an application in the form of an applet is transmitted from the server S via this channel K2 to the security module 3 of the smart terminal 2 and installed there.
  • a personalization of the applet can take place via the same channel, for which purpose a corresponding identification of the elD token 1 or corresponding authentication data is used which has been made available to the server S via the first secure channel K1. If necessary, the personalization can also take place at a later time, in which case a secure channel between server S and security module 3 has to be set up again separately.
  • the installed applet can represent any program and cover various applications from the field of e-banking, ticketing and the like.
  • the applet can be installed and managed with the known from the prior art Global Platf orm Card Management Schruttstellen.
  • the elD token 1 can be used again in this phase as user authentication and, if necessary, identification with respect to the server S.
  • authentication is performed between the elD token 1 and the installed and personalized application on the smart terminal 2.
  • FIG. 2 again shows a flow chart which clarifies the method steps carried out in the embodiment of FIG.
  • the messages exchanged between elD token 1, smart reader 2 and server S are clarified.
  • the installation phase of the applet is indicated and with U the later use or use phase.
  • step S1 and S2 the authentication between the server S and the elD token 1, which is denoted by AUT.
  • step S3 and S4 the authentication takes place between the server S and the smart reader 2 or the security module 3, which in turn is designated AUT.
  • step S5 the applet is installed by the server S on the smart terminal 2 or the security module 3. This is called INST.
  • step S6 a suitable personalization of the applet based on an identity of the elD token 1 takes place.
  • step S7 and S8 an authentication between the elD token 1 and the smart reader 2, which in turn is designated by AUT.
  • a restricted identification (referred to as RI) of the elD token is transmitted to the smart terminal 2 in step S9.
  • step S10 and Sil an authentication of the smart terminal 2 with respect to the server S, which in turn is indicated by AUT.
  • the installed application can then be unlocked via the restricted identification RI, which is then used in step S12, which is illustrated by the designation US.
  • a secure loading and installing of an applet on a corresponding smart terminal is described. reached.
  • this applet can be used even for insecure devices, such as notebooks 4.
  • a first cryptographically secured channel K1 and a second cryptographically secured channel K2 are constructed using corresponding cryptographic information or keys A, B respectively.
  • an authentication key for establishing a secure channel between smart terminal 2 and elD token 1 in the use phase of the applet is then defined using this cryptographic information.
  • the reader unit is a mobile device with integrated security element.
  • the security element is either in the form of an M2M module, co-processor or
  • Trusted Base or as a removable module with security functionality with the mobile terminal is ally, for example, as a smart card, in particular a Subscriber Identification Module, short SIM card, smart card, mass storage card, multimedia card, Secure MicroSD card.
  • the security element is designed as a software component in the form of a trusted platform module as a trusted part of the operating system of the mobile terminal or as a security software algorithm.
  • the mobile terminal is equipped with communication interfaces to the server and to the data carrier unit.
  • Communication to the server takes place via pure TLS via the mobile radio network, in particular UMTS or GPRS.
  • the connection to the data carrier unit is via NFC, RFID or contact-based. LIST OF REFERENCE NUMBERS

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Storage Device Security (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)

Abstract

L'invention concerne un procédé et un système de transmission sûre d'une application d'un serveur (S) à une unité lecteur (2) par authentification d'un utilisateur à l'aide d'une unité (1) support de données (1), le serveur (S) fournissant l'application. Selon ce procédé, un premier canal (K1) cryptographiquement sécurisé basé sur une première information cryptographique (A) est établi entre l'unité (1) support de données et le serveur (S), un deuxième canal (2) cryptographiquement sécurisé basé sur une deuxième information cryptographique (B) est établi entre un module de sécurité (3) de l'unité lecteur (2) et le serveur (S); et l'application est transmise du serveur à l'unité lecteur par le deuxième canal (K2) cryptographiquement sécurisé.
EP11710438A 2010-03-29 2011-03-25 Procédé de transmission sûre d'une application d'un serveur à une unité lecteur Ceased EP2553867A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
DE102010013202A DE102010013202A1 (de) 2010-03-29 2010-03-29 Verfahren zum sicheren Übertragen einer Anwendung von einem Server in eine Lesegeräteinheit
PCT/EP2011/001525 WO2011124333A1 (fr) 2010-03-29 2011-03-25 Procédé de transmission sûre d'une application d'un serveur à une unité lecteur

Publications (1)

Publication Number Publication Date
EP2553867A1 true EP2553867A1 (fr) 2013-02-06

Family

ID=44454056

Family Applications (1)

Application Number Title Priority Date Filing Date
EP11710438A Ceased EP2553867A1 (fr) 2010-03-29 2011-03-25 Procédé de transmission sûre d'une application d'un serveur à une unité lecteur

Country Status (5)

Country Link
US (1) US9325504B2 (fr)
EP (1) EP2553867A1 (fr)
CN (1) CN102823191B (fr)
DE (1) DE102010013202A1 (fr)
WO (1) WO2011124333A1 (fr)

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8874477B2 (en) 2005-10-04 2014-10-28 Steven Mark Hoffberg Multifactorial optimization system and method
DE102014000644A1 (de) 2014-01-17 2015-07-23 Giesecke & Devrient Gmbh Verfahren zum Autorisieren einer Transaktion
CN105530094B (zh) * 2014-09-28 2019-04-23 中国移动通信集团公司 一种身份认证方法、装置、系统以及密码器
DE102015011076A1 (de) * 2015-08-24 2017-03-02 Giesecke & Devrient Gmbh Transaktionssystem
EP3373545A1 (fr) * 2017-03-07 2018-09-12 Siemens Aktiengesellschaft Unité de sécurité en particulier pour un appareil iot et procédé d'exécution d'une ou plusieurs applications d'échange de données sécurisé avec un ou plusieurs serveurs de fournisseur de service web
DE102020108828A1 (de) 2020-03-31 2021-09-30 Bundesdruckerei Gmbh Personalisierter, serverindividueller Authentifizierungsmechanismus

Family Cites Families (36)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
AU746459B2 (en) * 1997-03-24 2002-05-02 Visa International Service Association A system and method for a multi-application smart card which can facilitate a post-issuance download of an application onto the smart card
DE19932149A1 (de) * 1999-07-12 2001-01-25 Giesecke & Devrient Gmbh System zur Ausführung von Transaktionen
US6990464B1 (en) * 2000-01-11 2006-01-24 Ncr Corporation Apparatus, system and method for electronic book distribution
US20020174347A1 (en) * 2001-05-18 2002-11-21 Imprivata, Inc. Authentication with variable biometric templates
JP3826764B2 (ja) * 2001-10-31 2006-09-27 ソニー株式会社 データ処理方法、データ処理装置およびプログラム
AU2003209194A1 (en) * 2002-01-08 2003-07-24 Seven Networks, Inc. Secure transport for mobile communication network
US20050138380A1 (en) * 2003-12-22 2005-06-23 Fedronic Dominique L.J. Entry control system
JP4696449B2 (ja) * 2004-01-09 2011-06-08 ソニー株式会社 暗号化装置およびその方法
EP1733305A1 (fr) * 2004-04-08 2006-12-20 Matsushita Electric Industries Co., Ltd. Memoire semi-conductrice
JP4391375B2 (ja) * 2004-09-30 2009-12-24 フェリカネットワークス株式会社 情報管理装置および方法、並びにプログラム
JP4794269B2 (ja) * 2004-11-08 2011-10-19 パナソニック株式会社 セキュアデバイスおよび中継端末
JP2006295234A (ja) * 2005-04-05 2006-10-26 Toshiba Corp 認証システム、認証方法および入退場管理システム
DE102005032311A1 (de) * 2005-07-11 2007-01-25 Giesecke & Devrient Gmbh Verfahren zum nachträglichen Implementieren einer SIM-Funktionalität in einem Sicherheitsmodul
ATE527797T1 (de) 2005-10-05 2011-10-15 Privasphere Ag Verfahren und einrichtungen zur benutzerauthentifikation
US11018724B2 (en) * 2006-09-24 2021-05-25 Rfcyber Corp. Method and apparatus for emulating multiple cards in mobile devices
US8118218B2 (en) * 2006-09-24 2012-02-21 Rich House Global Technology Ltd. Method and apparatus for providing electronic purse
US20080141313A1 (en) * 2006-12-06 2008-06-12 Ryoji Kato Authentication bootstrap by network support
US8955083B2 (en) * 2006-12-19 2015-02-10 Telecom Italia S.P.A. Method and arrangement for secure user authentication based on a biometric data detection device
US7975312B2 (en) * 2007-01-08 2011-07-05 Apple Inc. Token passing technique for media playback devices
US20080212495A1 (en) * 2007-01-23 2008-09-04 Nokia Corporation Configuration mechanism in hosted remote access environments
US11275826B2 (en) * 2007-01-31 2022-03-15 Nokia Technologies Oy Managing applications related to secure modules
EP1976248B1 (fr) * 2007-03-29 2011-10-19 Vodafone Holding GmbH Terminal mobile et son procédé de fonctionnement
KR100948604B1 (ko) * 2008-03-25 2010-03-24 한국전자통신연구원 서버 기반 이동 인터넷 프로토콜 시스템에 있어서 보안방법
US20110131640A1 (en) * 2008-02-18 2011-06-02 Microelectronica Espanola S.A.U. Secure transfer of data
WO2009127984A1 (fr) * 2008-04-18 2009-10-22 International Business Machines Corporation Authentification des transmissions de données
DE102008028701B4 (de) * 2008-06-17 2024-05-29 Giesecke+Devrient ePayments GmbH Verfahren und System zum Erzeugen einer abgeleiteten elektronischen Identität aus einer elektronischen Hauptidentität
US8214890B2 (en) * 2008-08-27 2012-07-03 Microsoft Corporation Login authentication using a trusted device
EP2159762A1 (fr) * 2008-08-27 2010-03-03 Deutsche Telekom AG Procédé d'authentification à base de cartes à puce
DE102008047639A1 (de) * 2008-09-17 2010-03-25 Giesecke & Devrient Gmbh Verfahren und Vorrichtung zum Zugriff auf ein maschinenlesbares Dokument
US8370640B2 (en) * 2008-12-01 2013-02-05 Research In Motion Limited Simplified multi-factor authentication
CN101547095B (zh) * 2009-02-11 2011-05-18 广州杰赛科技股份有限公司 基于数字证书的应用服务管理系统及管理方法
US20100211627A1 (en) * 2009-02-13 2010-08-19 Mobitv, Inc. Reprogrammable client using a uniform bytecode model
WO2010105259A1 (fr) * 2009-03-13 2010-09-16 Assa Abloy Ab Module d'accès à une carte sécurisée pour des applications de carte à circuits intégrés
US9572025B2 (en) * 2009-04-16 2017-02-14 Telefonaktiebolaget Lm Ericsson (Publ) Method, server, computer program and computer program product for communicating with secure element
US8522021B2 (en) * 2010-04-30 2013-08-27 Hewlett-Packard Development Company, L.P. Communication channel of a device
US20120050046A1 (en) * 2010-09-01 2012-03-01 Harris Corporation Systems and methods for monitoring physical, biological and chemical characteristics of a person, animal, object and/or surrounding environment

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
PETER SCHMITZ: "Elektronischen Personalausweis dank NFC-Technik mit dem Handy nutzen", SECURITY INSIDER, 1 March 2010 (2010-03-01), pages 3PP, XP055214135, Retrieved from the Internet <URL:http://www.security-insider.de/themenbereiche/identity-und-access-management/authentifizierung/articles/251956/> [retrieved on 20150917] *
See also references of WO2011124333A1 *

Also Published As

Publication number Publication date
DE102010013202A1 (de) 2011-09-29
US20130031357A1 (en) 2013-01-31
CN102823191B (zh) 2016-04-27
US9325504B2 (en) 2016-04-26
CN102823191A (zh) 2012-12-12
WO2011124333A1 (fr) 2011-10-13

Similar Documents

Publication Publication Date Title
EP3574625B1 (fr) Procédé de réalisation d&#39;une authentification
DE60200081T2 (de) Sichere Benutzer- und Datenauthenifizierung über ein Kommunikationsnetzwerk
EP2533172B2 (fr) Accès sécurisé aux données d&#39;un appareil
WO2011124333A1 (fr) Procédé de transmission sûre d&#39;une application d&#39;un serveur à une unité lecteur
EP1902404A1 (fr) Systeme comprenant plusieurs appareils electroniques et un module de secrite
DE102011082101A1 (de) Verfahren zur Erzeugung eines Soft-Tokens, Computerprogrammprodukt und Dienst-Computersystem
DE10212619A1 (de) Sichere Benutzerauthentisierung über ein Kommunikationsnetzwerk
EP2393032B1 (fr) Procédé de sortie d&#39;une application à l&#39;aide d&#39;un support de données portatif
EP3748521B1 (fr) Méthode pour lire les attributs d&#39;un témoin d&#39;identité
WO2020001807A1 (fr) Carte à puce en tant que jeton de sécurité
DE19710249A1 (de) Netzwerkunterstütztes Chipkarten-Transaktionsverfahren
EP3577873B1 (fr) Unité de sécurité en particulier pour un appareil iot et procédé d&#39;exécution d&#39;une ou plusieurs applications d&#39;échange de données sécurisé avec un ou plusieurs serveurs de fournisseur de service web
DE102009027268B3 (de) Verfahren zur Erzeugung eines Identifikators
EP2562669B1 (fr) Procédé d&#39;exécution d&#39;un accès en écriture, produit de programme informatique, système informatique et carte à puce
EP2169579B1 (fr) Procédé et dispositif d&#39;accès à un document lisible sur machine
EP2893483B1 (fr) Procédé de personnalisation d&#39;un élément sécurisé (se) et système informatique
EP3035270A1 (fr) Generation de jetons hors ligne a base de cartes
DE102010013200A1 (de) System zum Eingeben eines Geheimnisses
EP2764671A1 (fr) Marquage de données non sûres au moyen d&#39;un module nfc
EP3361436B1 (fr) Procédé d&#39;autorisation d&#39;une transaction
WO2015162086A1 (fr) Procédé permettant de munir une carte d&#39;identité d&#39;une personne d&#39;un certificat cryptographique
DE102011122972B3 (de) Verfahren zum Starten einer externen Applikation und bidirektionaler Kommunikation zwischen einem Browser und einer externen Applikation ohne Browsererweiterungen
EP2439900B1 (fr) Procédé et dispositif destinés à l&#39;authentification
WO2005073826A1 (fr) Systeme comprenant au moins un ordinateur et au moins un support de donnees portatif
DE102010013201A1 (de) Verfahren zum Zuordnen einer ersten Datenträgereinheit zu einer zweiten Datenträgereinheit

Legal Events

Date Code Title Description
PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

17P Request for examination filed

Effective date: 20121029

AK Designated contracting states

Kind code of ref document: A1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

DAX Request for extension of the european patent (deleted)
17Q First examination report despatched

Effective date: 20150504

REG Reference to a national code

Ref country code: DE

Ref legal event code: R003

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE APPLICATION HAS BEEN REFUSED

18R Application refused

Effective date: 20160303