TW200818207A - Reader for one time password generating device - Google Patents

Abstract

A portable one time password reader for use in two factor authentication systems and methods allows for the display of a one time password when coupled to a device that generates the value of the password. The reader of the present invention provides power and if appropriate a real time clock signal to these devices in place of the host, so that the devices can generate the real time password without being connected to the host. Therefore, when connected to the generating device, the reader functions not only to display the value, but also to enable generation of the value. The reader may also be coupled to the host and device simultaneously and submit the values to the host and entities coupled thereto.

Description

200818207 IX. Description of the Invention: [Technical Field of the Invention] The present invention generally relates to, for example, a memory card for storing large files to and from a digital device, and a portable universal serial convergence. A "USB" flash memory drive portable mass storage device, and more particularly, the present invention relates to implementation in such devices for access and login mechanism security and access Control mechanism [Prior technology] _ A password is metaphorized by its name: it is used only once, so it is more vague and more secure than a reusable password. A one-time password ΓΌΤΡ") is usually produced by an algorithm. Value. When submitted by a user, it is compared to a reference value generated by the same algorithm (otherwhere). There are a number of tokens and other devices that can generate and even submit a password value for a user. Historically, the special token has been produced for the most commonly used consumer OTP. The token has a 〇Tp value to display the type to be typed. a display, and the user item takes the value and treats it as a boulder horse and often loses it with some other identity code or verification information such as the name of the person or PIN. Two of the tokens are constantly displayed - The value, on the other hand, is displayed only after pressing the _ button. The 0TP generation can also be time-based or event-based. In time-based generation, the 〇τρ value is at a regular frequency. Incremental. In the event that Xuansheng is the main event, the value of οτρ is based on an irregular movement when a user of Putian presses the button of the symbol. 123717.doc 200818207 A device that has a device that should have or utilize an instant clock so that the device can increment the value on a regular basis. As expected, the most common form of the requirement The user reads the value from a glory and puts it on the brain. Another recently developed token allows the token to be transmitted directly to the computer, and then to a certain confirmation entity. The password once The concept generally provides - high level of security, but requires the user to carry a token for generating the one-time password value.

- A relatively recent trend is to integrate 0TP functionality into other more versatile devices. This exemption user must carry the - symbol that is only used to generate the value of 〇τρ. In the -example, the οτρ generation is integrated into a flash drive or a flash memory card. For more information about this, please refer to U.S. Patent Application Serial No. 319/835, the entire disclosure of which is incorporated herein by reference. SUMMARY OF THE INVENTION The present invention adds the flexibility of a device that automatically generates and retrieves the password of a parent. It allows a singer to use this *p t ^ 丄 more users can generate, item and type a once-poor ra in the absence of other methods. People in the code. Therefore, it provides maximum flexibility and allows for any scenario that can be needed. **Butada Plus, a one-time password is used in January. In addition, the "乂仫/, 体贝例巾" is designed to be used simultaneously with a portable mass storage device such as a USB flash drive or a memory card, in addition to the large slot storage capacity. Outside 'I also right one A 6 /, one-person fee code generation and password management capabilities. In this case, the present invention provides power to the stalker and supplies the instant storage time to the mass storage device in some specific cases. No electricity 123717.doc 200818207 Force, far a large number of storage device password generation and total evaluation, ,, ..., for archival storage purposes or - a large number of storage shocks can not be broken: - instant clock signal, in this case, When the cut will be produced. At the time, all of the enabling connections are generated and displayed to the bulk of the storage device and a password that cannot be used by you. The 宓W ® triggers the manual input by the singer, or the other is selected to connect the reader to the device and is selected to be triggered by pressing a button on the reader. The secret of the New Zealand is ^ ^ ^ ^ ^ 4 dominated or dominated by events. When the usage and the code value are directly submitted, the reader can be disconnected, and the mass storage device is directly inserted into a host. Preferably, the reader has a set or cover of the mass storage device: the shape of the device is V. Such as 'If the mass storage device is - Cong flash: 'The reader can be used as a cover for the device's USB connector - U (four) flash drive - this cover will be a convenient and this I Accessories. The right storage device is a set of readers that can be used as a set or carrying case for the memory card, which will also be a convenient and functional accessory for a memory card. - This - the accessory will be more useful than, for example, a smart card reader that can be read from a smart card (but not directly). But basically it must be inserted into the computer to work around the computer. device. In addition, the mass storage device and reader combination also has the advantage of being able to store and transmit a user's photo, music private library or other large files with a smart card or with the prior art οτρ = not possible. .卞 [Embodiment] 123717.doc 200818207 Although the system has evolved into a self-generating and almost invisible program that enables OTP to be generated and submitted as a user, when a user may need or expect to read and then manually type one at a time. There is still an inevitable time when the password value is used. The present invention adds this flexibility to an OT generating device that is designed to automatically submit the value directly to a host device. Erxiong, code power system, for example

The special token is generated. The tokens display a value that the user then taps into, for example, a personal computer, a cellular telephone, a personal digital assistant, or a host device connected to another electronic device such as the Internet. . The host then transmits the commit value to the -verify entity, or the server on = and then compares the committed value with a value of =π for the verifying entity. Assuming that other verification criteria (if any) are met, and if the values match, the user is given access. For many reasons, the use of this password has not been widely accepted. One: It is inconvenient to remember these special symbols, because it is an extra hardware, a =t must always be carried with you in order to gain access. Therefore, in order to promote the two people = system: the greater use and increase security, a password will be generated: I set. One such device is a flash memory-based storage device ("_,"), which can be a USB flash drive write, card. Because many users already have and often carry this analogy with them. At the same time, Youtian, 4 player, general computer and password management, including - secondary password generation and two-factor authentication - the secondary password, convenient carrier. These devices can generate and automatically submit, ° the verification entity. When the user directly submits the system 123717.doc 200818207 - option - this greatly simplifies the program, but many times it is not simply an option, because the user does access an appropriate 埠, so that D Hai The device is connected to the host system, or may not be expected to be connected to it. For more information on an MSD with one password generation and password management, please refer to G_alez et al., U.S. Patent Application Serial No. PCT/3, No. 9,835 and 11/319,259, which was previously incorporated by reference in its entirety. It is not self-powered compared to the ------------------------------------------------ For example, you must insert a memory card into a camera to store or view an image file, and you must insert a USB flash drive into a smart socket to manipulate the file on the drive. Otherwise it is in your In the pocket, it is not active. Relatively - the dedicated 0τρ character has a battery to generate a value at any time. In fact, some of the time-based tokens always show the current value of the password. The time-based token is displayed only when requested, and the event-based token is generated and displayed only when requested or triggered. The OTP generation scheme based on the inch depends on an instant clock. In order to increase from a seemingly random number to the next value. The sequence of values is in fact very predictive 'and this is how it can be compared to the sequence of values calculated by the verification entity. Use - given algorithm and Seeds, the resulting series of numbers are known. ^, and for those who do not have the knowledge of the seed and/or algorithm, 'the numbers appear to be random' and thus the program is called virtual chaotic production. Relatively, as mentioned above, the event-based οτρ generation scheme relies on an event to update the counts in the (virtual random) numerical sequence. A system with a response reduction of 123717.doc 200818207 The method uses some other secret or identity code to generate the value. Figure 1 illustrates a system 100 that includes an MSD 100A and an OTP reader 100B. The MSD 100A is described as a USB flash drive, however it can also be a The memory card is stored in a large amount. The MSD 100A includes a connector 102' in the case of a USB flash drive, which includes a USB connector, and conversely, in the case of a memory card connector 1〇2, including the card connection - The OTP reader 100B is in the form of a cover or a cover of the MSD 100A. In this way, as an accessory to the MSD, when coupled to the MSDa, it can display the password once for the user. The user must simply place the lid on the device to read the value. The body of the lid or sleeve can cover all, substantially all or only one knife of the MSD 100A. As seen in FIG. 1A, the ΟΤΡ reader 1 〇〇 B covers the USB connector 1G2 of msd. The reader is provided with a form factor that removes the lid/socket to enable the user to conveniently transfer it to the MSD and also to transfer it when not in use. In some embodiments, the lid may be tied or attached to the cartridge when it is directly on the connector. For example, 'all or part of the lid can be tied to the Tengwei. This can be done in any number of ways, including in particular - flexible parts, money keys or sliding mechanisms. Although the preferred embodiment has a cover or sleeve form factor, the reader can have any form factor that can be easily transferred or otherwise sized. Although the latter (10) reader is deleted: - The preferred shape of the tweezers or sleeve is due to +, but it should be understood that it is not limited to this factor. 123717.doc -11 - 200818207 In some embodiments, placing the cover on the msd will automatically trigger the device to display the value on display 1〇6. In other embodiments, a button 1 〇 8 is provided and the user must first depress the button before the value will be displayed. Figure 1B shows MSD 100A coupled to OTp reader 100B. The OTP reader includes an electronic connector or plug

Seat 124 (not shown), as will be described and described later, is used to make connections to connector 102 of MSD 1A. As seen in Figure ic, the cover can also have a second connector 11". This connector is used to make a connection to a host device, however connector 1〇2 or u〇 can be coupled to any type of electronic device. In the specific embodiment of the MSD 100A-based USB flash drive, the connector 1〇2 is preferably a male USB connector, and the connector 124 is preferably female. Thus, in this particular embodiment, the system that connects the 222 ruts is male. In this case, the read can be coupled to both the MSD 1 and a host or other electronic device at the same time. 1D and 1B illustrate a specific embodiment of an MSD 100A in which the reader 100B is larger than the MSD 100A in one or more dimensions and covers all or nearly all of the MSD 100A. It should be noted that (10) 〇 i〇〇a or eve or side may be exposed. When the MSD 1〇〇A is relatively small, for example, if it is a small USB drive or a memory card, the reader 1〇〇a will be better, if the mass storage device is For the memory card, the reading device can be used as a set or carrying case of the memory card, and the cymbal will also be a note: the card is convenient and functional. Although any mass storage memory card with OTP functionality can be used in conjunction with the present invention, (4) Leica, SD your SD card or micro-call (also known as card) can be used simultaneously with I23717.doc -12· 200818207 And the system required. Fig. 2A is a schematic diagram showing the main components and connections of the MSD 100A and the reader 100B. The MSD 10A includes a connector 102, a memory controller 122, and a plurality of storage flash memories 12A. The memory controller 〇2 controls the read/write operations of the mass storage flash memory 120, and the overall operation of the MSD 100A including the transfer of data to and from the MSD 100A via the connector 〇2. As mentioned earlier, the MSD 1-8 usually does not have a power supply because it is primarily a data storage device of a host that typically receives power from the host. Similarly, a mass storage drive can also rely on a clock signal from the host. The reader 100B includes a connector 124, a display unit 〇6, and a reader controller circuit 126, which includes a firmware 128, a battery 13A, and a button 1〇8. The reader controller ("RC") or controller circuit is preferably a specific application integrated circuit or "ASIC". The logic within the 0TP controller (e.g., firmware 128) is designed to control the reader and its various interactions with other devices. In the case of a USB flash drive embodiment of the MSD 100A, the connector 124 is preferably a female USB connector or, if the MSD 100A is a mass storage memory card, a card socket. The battery supplies power to both the readers 〇 OB & MSD 1 〇〇 A. The battery can be rechargeable, replaceable, or alternatively the battery can be placed when the battery 13 is no longer accommodated. Preferably, unlike the battery pack that must be placed when the battery is dead, the battery can be charged or replaced. , , button 10/8 can be used to trigger generation and display a parameter value on screen 1〇6. Alternatively, the connection between the MSD and the reader 100B can trigger 123717.doc -13 - 200818207 to generate and/or display the value of 0. Although, preferably, there is a button (10), some embodiments may omit the button altogether and simply rely on interconnecting the devices as a trigger. In most respects, Figure 2B is the same as Figure 2A, but RC 126 - in Figure 2B also includes the instant clock 132. This embodiment is designed to be the same as the system of the eight-body embodiment of the system 1〇〇 and msd capable of generating and identifying 〇TP based on the daytime. When the reader 1 is coupled, it supplies the instant clock signal to the memory controller 122. This signal is then used within the MSD 100A to establish these time-based primary passwords. In a particular embodiment of the MSD 100A that does not have an instant clock, the signal will additionally come from the host device to generate a time-based password. The RC 126 and the reader 10 can also supply any other identity code to the msd 100A' for use in the more general challenge response type OTP generation. In most aspects, Figure 2C is also similar to Figure 2A, but also includes connector 110. While the reader 100B is connected to the MSD 10QA, this second connector can be used to connect to another device. It can be a standardized or proprietary connector. As previously described, the connector 124 or 110 can be used to recharge the battery 13 〇. In the case where the connector 124 is a female USB connector, it is preferred that the connector is a male USB connector because it can be easily inserted into a female USB socket on a computer for receiving. Power for charging or other operations. This one-to-one connector can be implemented in any particular embodiment that includes an instant. Figure 2D again illustrates the system 10 in a larger context. One password is used to authenticate the system. The system 100 thus may also include one or more distal feeding suits I23717.doc • 14- 200818207. As previously described, the passwords generated in this system are compared against the password generated by a remote server 150 accessed over a network. Another remote server 150 can optionally be used to record the count of the MSD 100A generated by the event-based OTP, and can prepare and store the information needed to generate the τρρ. Preferably, access to any remote server is achieved over a secure connection of one of the secure sessions set up between the entities. Figure 3 is a summary illustration of the functionality of the system. 〇τρ produces 3〇4 in MSD 100Α. The generated 〇τρ value can be transmitted to the reader ιβ and temporarily stored in a memory of the MSD 1 。. If the value is stored, it can be stored in a secure area or an open access area, and the reader can retrieve the name by reading a location of the memory of the desired value. The display functionality of the values generated by MSD 1 00A occurs within reader 100B. The MSD 100A is capable of generating a value as a one-time password using a range of different algorithms and procedures. The reader 1〇〇B can be shipped simultaneously with these different algorithms and programs by utilizing the application programming interface (, API) that is coordinated and compliant with it. Within the RC 126 of the reader 100B. The prior art OTP token is incorporated into both the display and generation mechanisms, so that it is not necessary to incorporate the -API within the token. This is because the reader is only integrated with it. A specific OTP generation sequence/algorithm of the token operates simultaneously. The system of the present invention is flexible and provides a time-based, event-based and challenge response scheme and a broad lineup. Different algorithms and OTP generation devices coordinate a 0TP-generated reader. It is used to view and design devices that are automatically designed to automatically submit such values. 123717.doc -15- 200818207 The ability to manually type OTP values will be another dimension The flexibility is added to the security system and will not only make the user easier to use, but will also increase the penetration and acceptance of the 0TP-based system. Although specific embodiments of the invention have been described, it should be understood that The invention is not limited These illustrative embodiments are defined by the scope of the accompanying claims. [Simplified illustration]

In the following figures, the same reference numerals are used for the same or similar items throughout the drawings.

1A is an illustration of a system of a particular embodiment of the present invention including a plurality of storage devices 100A and a primary cryptographic reader 1B. Figure 1B is an illustration of system 100 in which a plurality of storage devices i〇〇a and a one-time weight reader are coupled to their individual connectors. Figure 1C is an illustration of a cipher reader 200 in accordance with another embodiment of the present invention. Figure 1D is an illustration of another embodiment of a system 1A. 1E illustrates a particular embodiment of the system 100 of the depiction of FIG. 1D in which a plurality of storage ’ σ 〇Α and a cipher reader 100 轻 are lightly coupled to their respective individuals. A block diagram of the components of the person-in-chief I purchaser. Figure 2 is a block diagram of a large number of event-based and time-based components. m〇〇A and one-time password reader are deleted. 123717.doc -16- 200818207 FIG. 2C is a block diagram showing the components of the mass storage device 100A and the primary password reader 200B. 2D is a block diagram of a larger system 100. FIG. 3 is a diagram illustrating the functional distribution within system 100. [Main component symbol description] 100 system 100A mass storage device 100B, 200B - secondary password reader

102, 110 Connector 106 Display / Screen 108 Button 120 Mass storage of flash memory 122 Memory controller 124 Connector or socket 126 128 130 132 150 304 306

RC Firmware Battery Instant Clock Remote Server One-time password generation Application Programming Interface 123717.doc •17-

Claims (1)

200818207 X. Patent application scope: 1 · A method for providing a one-time password to a user of a portable flash mass storage device: receiving a one-time password from a user to be coupled to the flash mass storage device A request on the display of one of the readers to view the first time; and the password is retrieved from the mass storage device. The method of Lunar 1 further includes causing the mass storage device to generate the one-time password. 3 · For the method of clearing the item 1 t, the soil λ Χ丄 丄, wherein the retrieval of the one-time password includes a request for transmitting the post-code. 4 · In the case of claim 3, + ^, and Wanfa, wherein the retrieval of the password further includes the method of claim 1, wherein the storage location of the memory is stored. 6. If the request item 2 古古^利, ', /, is further included in the generation of the one-time password (10) - the secondary password reader - instant clock. 7. The method of claim 6 is the same as the instant verification, wherein the instant-time synchronization of the instant-time cryptophone is synchronized. One-time password is given to the one-second password generating device--::: a reader coupled to the primary password generating device, the horse-horse generating device 1 is coupled to a host and is generated and transmitted by the host once. The password is given to the host, which reads 123717.doc 200818207: Operation: to provide power to the device in place of the host, and to display a password to the user of the device on the scoop. Method of providing a virtual random number to a user of a portable flash mass storage device: receiving a user from a reader in a light "to 4 portable flash mass storage device A requirement for the virtual random number; ^ a processor in the large storage device generates the virtual random number; and displays the virtual random number on a display taken as a result. The method of gamma finder 9 wherein causing the processing in the mass storage device to generate a virtual random number comprises causing a virtual random number generator increment. 11. The method of claim 10 wherein the increment is time based. 12 · If the method of item 1 is ,, the increment of the towel is mainly event-based. An accessory for a one-time password generating device that does not have a display, the accessory comprising: a display that displays a value generated by the one-time password generating device; a first connector, the first connector Operation to connect to the one-time password generator; and the trick circuit's control includes an operation of displaying an accessory of a password value generated by the one-time password generating device. 14. The accessory of claim 13 wherein the accessory has a set of shape factors for at least a portion of the one-time password generating device. 123717.doc -2 - 200818207 15. The password generating device has a USB connector, such as the accessory of claim 13, wherein the USB connector is provided, and the accessory has the form factor of the set. 16. The accessory of claim 13 wherein the further interface is operable to operate concurrently with one or more of the code hunting methods. 17 • If the accessory of claim 13 is further routed to a button of the display. Including one or more interfaces, a different one of each of the devices for generating the device includes an electrical device for triggering the controller 18. The accessory of the request item 13 includes its second step connector - the second connector connector is operable to connect To a host device. 19. As requested in item 18, the second connector is male. Wherein the first connector is a mother, the second and the 20. 21. If you want to use the accessories of the item 18, when you are connected to the host device, you can use the accessories of the item 20, a battery. Wherein the accessory device' provides power to the accessory via the second connector. The power provided therein recharges the component in the accessory. 22. If the accessory of claim 13 is suitable, and further includes an instant clock, the accessory is operable to provide a signal from the 兮# 卩 B B 守 pulse to the one time. Password generating device. 23. A system for identifying a user; a mass storage device, a package controller, and a memory controller for controlling a large key of the device. Taking data and writing the data into a mass storage body of the device, and also for generating a virtual random number; and 123717.doc 200818207, a scorpion, which can be coupled and decoupled from the mass storage device entity, The reader triggers the controller to generate the virtual random number, and wherein the master displays the virtual random number generated by the mass storage device. 24. The system of claim 23, further comprising a host for accepting manual input of the virtual random number displayed by the reader. The system of claim 23, further comprising an entity that verifies that the virtual random number generated by the global storage attack is the same as a virtual random number generated by the entity. 26. An authentication system, comprising: a garment that is operable to generate but not display a password, the device includes a host connector; " a binder, when connected to the host connector of the device, The operation is displayed but the password value is not generated once. 28. The system of claim 26, wherein the device generates a time-based mountain horse and the pick-up device supplies a clock signal used by the device. The system of claim 26, wherein the reader includes a connector operable to recharge itself through the connector. a removable cover that does not have a display of a one-time password generating device, the cover includes: a member for causing the one-time password generating device to generate a one-time password; and ', with a state, which is used for Communicate the password generated. 123717.doc 200818207 30. A one-piece removal cover for not having a display, the cover comprising: an integrated controller circuit; a user input of a secondary password generating device coupled to the integrated controller circuit Generating a one-time password; and to the integrated controller circuit to cause the one-time password generating device a display that displays the generated password for the user 123717.doc