Classifications

• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
  • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
  • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
  • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
  • H04L63/0838—Network architectures or network communication protocols for network security for authentication of entities using passwords using one-time-passwords
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
  • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
  • H04L63/0846—Network architectures or network communication protocols for network security for authentication of entities using passwords using time-dependent-passwords, e.g. periodically changing passwords
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
  • H04L63/0853—Network architectures or network communication protocols for network security for authentication of entities using an additional device, e.g. smartcard, SIM or a different communication terminal
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
  • H04W12/06—Authentication
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
  • H04W12/06—Authentication
  • H04W12/068—Authentication using credential vaults, e.g. password manager applications or one time password [OTP] applications
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
  • H04W12/08—Access security
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
  • H04W4/80—Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication

Definitions

• the invention relates to securing remote access to computers and applications and remote transactions over computer networks. More specifically, the invention relates to methods and apparatus for authenticating users using a smartphone to access a remote application.
• the invention is based on an insight of the inventors that most smartphones nowadays support NFC (Near Field Communication) technology to
• NFC can for example by used to communicate with contactless smart cards.
• the operating system of a number of smartphones don't give access to a low level API to directly exchange commands and responses over NFC with an NFC tag. Instead they may only support some limited high level services over NFC.
• One aspect of the invention provides an authentication device for securing interaction of a user with a computer based application.
• the authentication device may comprise a memory component adapted to store a secret key; a data processing component adapted to generate a dynamic credential by cryptographically combining said secret key with the value of a dynamic variable; a Near-Field Communication (NFC) interface to couple the authentication device to an NFC transfer device; whereby the authentication device may be adapted to: present itself to said NFC transfer device as an NFC tag ; make said generated dynamic credential available to said NFC transfer device by including said dynamic credential in first data contents of said NFC tag that can be read by said NFC transfer device using NFC mechanisms for reading data contents of NFC tags.
• NFC Near-Field Communication
• the authentication device may comprise an
• authentication device of any of the previously described embodiments may be further adapted to present itself as an NFC Forum-compliant tag of Type 1, Type 2, Type 3 or Type 4 and to make said generated dynamic credential available to said NFC transfer device by including said dynamic credential in an NFC Data Exchange Format (NDEF) record of an NDEF message of an NDEF file of the authentication device for said NFC transfer device to read using NFC mechanisms for reading NDEF messages from NFC Forum-compliant tags.
• NDEF NFC Data Exchange Format
• the authentication device may comprise an
• authentication device of any of the previously described embodiments may further comprise a clock and wherein said dynamic variable may be based on a time value provided by said clock.
• the authentication device may comprise an
• said dynamic variable may be based on an event related value that is stored in said memory component and that may be updated by the
• said specific event may coincide with said generation of said dynamic credential.
• said event related value may comprise a counter that may be monotonically incremented or decremented by said authentication each time said specific event occurs.
• the authentication device may comprise an
• said cryptographically combining said secret key with the value of said dynamic variable may comprise applying a symmetric cryptographic algorithm to said dynamic variable whereby said symmetric cryptographic algorithm is parameterized with said secret key and whereby said secret key is shared with an entity for verifying said generated dynamic credential.
• the authentication device may comprise an
• authentication device of any of the previously described embodiments may be further adapted to store a user identifier and to make said user identifier available to said NFC transfer device by including said dynamic credential in data contents of said NFC tag that can be read by said NFC transfer device using NFC mechanisms for reading data contents of NFC tags.
• the authentication device may comprise an
• authentication device of any of the previously described embodiments that may further comprise a user input interface for capturing an input from said user and that may be further adapted to require a specific input from said user as a condition for said generating said dynamic credential and/or for said making said generated dynamic credential available to said NFC transfer device.
• said user input interface may comprise an activation button and said specific input may comprise the user pressing said activation button.
• the authentication device may be further adapted to be activated by the user by said user input interface and the authentication device may present itself to said NFC transfer device as an NFC tag only after the user has activated the device by using said user input interface.
• the authentication device may comprise an
• the authentication device of any of the previously described embodiments that may be further adapted to be permanently or semi-permanently fixed to said NFC transfer device.
• the authentication device may further comprise an adhesive component for attaching the device to said NFC transfer device.
• the authentication device may be comprised in a protective shell or a protective cover of an access device comprising said NFC transfer device.
• the authentication device may further comprise a user input interface and a user output interface, wherein said external data may comprise transaction data and wherein the device may be further adapted to present said transaction data to the user and to capture with said input interface an approval or a rejection by said user of said presented transaction data and to generate said dynamic credential and/or for make said generated dynamic credential available to said NFC transfer device only if said user approved said presented transaction data.
• said user input interface may comprise an approval button for capturing said approval and a rejection button for capturing said rejection.
• the authentication device may be further adapted to not present itself to said NFC transfer device as an NFC tag for a certain period after having received said external data from said NFC transfer device and to present itself again to said NFC transfer device only after said user approved or rejected said presented transaction data.
• authentication device of any of the previously described embodiments may be further adapted to: receive a password value from said NFC transfer device by extracting said password value from third data contents of said NFC tag that have been updated by said NFC transfer device using NFC
• Another aspect of the invention provides a system for securing interaction of a user with a computer based application.
• the system may comprise any of the authentication devices of the previously described embodiments.
• the system may comprise: an authentication device for generating a dynamic credential; an application server for hosting a server part of said application and verifying said dynamic credential generated by said authentication device; and an access device for allowing said user to access said computer based application, the access device connected to the application server by a computer network and adapted to obtain said dynamic credential from said authentication device and to forward said obtained dynamic credential to said application server for verification;
• said access device may comprise an NFC transfer device; and said authentication device may comprise a memory component adapted to store a secret key, a data processing component adapted to generate said dynamic credential by cryptographically combining said secret key with a first value of a first dynamic variable, and a Near-Field
• NFC Network Communication
• the system may comprise any system of the previously described embodiments whereby said cryptographically combining said secret key with said first value of said first dynamic variable may comprise performing a symmetric cryptographic algorithm on said first value of said first dynamic variable whereby said symmetric cryptographic algorithm may be parameterized with said secret key and whereby said secret key may be shared between said authentication device and said application server and whereby said application server may use a server copy of said secret key to ' verify said dynamic credential .
• the system may comprise any system of the previously descri bed embodiments whereby said authentication device and said access device may share a binding secret; said access device may be further adapted to communicate to said authentication device a binding value that the access device may have derived from said binding secret, whereby the access device may communicate the binding value to the authentication device by said NFC transfer device updating second data contents of said NFC tag using NFC mechanisms for updating data contents of NFC tags; and said authentication device may be further adapted to : receive said binding value from said access device by extracting said binding value from said second data contents of said NFC tag that have been updated by said NFC transfer device using said NFC mechanisms for updating data contents of NFC tags; verify said received binding value using said binding secret; and generate said dynamic credential and/or make said generated dynamic credential available to said NFC transfer device only if the authentication device has successfully verified the correctness of said received binding value.
• Yet another aspect of the invention provides a method for secu ring interaction of a user with a computer based application.
• the method may be used with any of the authentication devices or any of the systems of the previously described embodiments.
• the method may comprise the steps of: at an authentication device that comprises a Near-Field Communication (NFC) interface to couple the authentication device to an NFC transfer device generating a dynamic credential by cryptographically combini ng a first value of a first dynamic variable with a secret key that is stored in said authentication device and shared with an application server that is hosting a server part of said application; the authentication device presenting itself to said NFC transfer device as an N FC tag ; at the authentication device making said generated dynamic credential available to said NFC transfer device by including said dynamic credential in first data contents of said NFC tag that can be read by said NFC transfer device using NFC mechanisms for reading data contents of NFC tags; allowing said user to access said computer based application using an access device that comprises said NFC transfer and that is connected to the
• NFC Near-Fi
• an authentication device that presents itself to the smartphone as a standard passive NFC memory tag.
• the smartphone may be an NFC Forum-compliant device.
• the authentication device may comprise or present itself as an NFC Forum compliant tag.
• the NFC Reader/Writer Mode may be used .
• the smartphone may take on the NFC Reader/Writer role.
• aspects of the communication between the smartphone and the authentication device may be defined in at least some of the NFC Forum Technical Specifications, such as for example the NFC Digital Protocol Technical Specification, or the NFC Activity Technical Specification, and other specifications and standards such as for example ISO/IEC (International Organization for Standardization / International Electrotechnical Commission) 18092, ISO/IEC 18000-3, ISO/IEC 14443 (type A or type B), and Japanese Industry Standard (JIS) X 6319-4.
• NFC Forum Technical Specifications such as for example the NFC Digital Protocol Technical Specification, or the NFC Activity Technical Specification
• ISO/IEC International Organization for Standardization / International Electrotechnical Commission
• ISO/IEC 18000-3 International Electrotechnical Commission
• ISO/IEC 14443 type A or type B
• JIS Japanese Industry Standard
• the authentication device may present itself as a standard NFC Type 1 Tag. In some embodiments the authentication device may present itself as a standard NFC Type 2 Tag. In some embodiments the authentication device may present itself as a standard NFC Type 1 Tag. In some embodiments the authentication device may present itself as a standard NFC Type 2 Tag. In some embodiments the NFC Forum Technical Specifications, such as for example the NFC Data Exchange Format (NDEF) Technical Specifications, the NFC Forum Tag Type Technical Specifications (such as the NFC Forum Type 1/2/3/4 Tag Operation Specifications) and the Record Type Definition Technical Specifications (such as the NFC Record Type Definition (RTD) Technical Specification, the NFC Uniform Resource Identifiers (URI) RTD Technical Specification, and the NFC Smart Poster RTD Technical Specification).
• NDEF NFC Data Exchange Format
• the NFC Forum Tag Type Technical Specifications such as the NFC Forum Type 1/2/3/4 Tag Operation Specifications
• the Record Type Definition Technical Specifications such as the NFC Record Type Definition (RTD) Technical Specification, the NFC Uni
• the authentication device may present itself as a standard NFC Type 3 Tag. In some embodiments the authentication device may present itself as a standard NFC Type 4 Tag.
• NFC transfer device may refer to an NFC Forum Device or other similar device that may operate in the NFC
• NFC tag or NFC memory tag may refer to an NFC Tag as defined in the NFC Digital Protocol Technical Specification and the NFC Forum Tag Type Technical Specifications i.e. a contactless tag or (smart) card supporting NDEF over Passive Communication wherein Passive Communication is a communication mode in which one device
• RF field Radio Frequency field
• this second device uses load modulation (i.e., it does not generate an RF field but it draws more or less power from the RF field).
• the authentication device (which may be further referred to as an NFC token device or NFC token) may be adapted to generate a one-time password (which may be further referred to as OTP), to present itself as an NFC tag and to populate the contents of the NFC memory tag with the generated one-time password.
• a one-time password (which may be further referred to as OTP)
• OTP one-time password
• the contents of the memory tag may comprise an NDEF message comprising an NDEF record comprising the generated OTP.
• the contents of the memory tag (which may comprise the OTP) may be read by an NFC transfer device (such as a smartphone) by the standard protocols for reading the contents of an NFC memory tag.
• the NFC token may generate the one-time password and populate the contents of the tag with the generated OTP when the NFC token is activated by bringing it into the NFC field of the smartphone.
• the NFC token may generate the one-time password and populate the contents of the tag on the fly upon receiving a read command from the NFC transfer device to read the memory tag contents.
• the NFC token may be an NFC Type 4 tag and the NFC token may be adapted to generate an OTP, generate an NDEF message comprising the generated OTP and populate an NDEF file, upon receiving a ReadBinary command to read the NDEF file and before responding with the contents of the populated NDEF file.
• the NFC token generates a new one-time password and populates the contents of the tag with the new OTP after the current contents of the tag have been read by the smartphone.
• the NFC token may comprise one or more memory components and may be adapted to store a secret key in the one or more memory components, and the NFC token may further comprise one or more data processing components and may be further adapted to generate the OTP by cryptographically combining the stored secret key with a dynamic variable.
• the NFC token may comprise a clock for generating a time value which the NFC token may use to determine the value of the dynamic variable for generating a time-based OTP.
• the NFC token may store and maintain in memory an event related value that it updates upon specific events and the NFC token may use this event related value to determine the value of the dynamic variable for generating an event- based OTP.
• the NFC token may update the event related value each time that the NFC token generates a one-time password.
• the event related value may be a counter and updating the event related value may comprise for example incrementing (or decrementing) the counter.
• updating the event related value may comprise the NFC token replacing the current value of the event related value by a new value that the NFC token may calculate from the current value of the event related value.
• the NFC token may calculate the new value of the event related value for example by applying a hashing function to the current value of the event related value.
• the smartphone and the NFC token may be configured such that when the NFC token is brought in the NFC field of the smartphone, the NFC token may be automatically activated and the smartphone may detect the presence of the NFC token (which may present itself as an ordinary standard passive NFC tag) whereupon the smartphone may read the contents of the tag containing the OTP.
• the smartphone may automatically launch an application (such as a browser or for example a mobile banking application) associated with the tag and pass the contents of the tag to the application.
• the contents of the tag may, in addition to an OTP, also comprise a data element identifying a user associated with the NFC token.
• the contents of the tag may automatically provide for example User ID (user identifier) and dynamic password information to the application associated with the tag that is automatically launched by the smartphone thus providing a convenient and secure application launch and login experience to the user.
• the contents of the tag may comprise an NDEF message and the NDEF message may comprise an NDEF record of the URI type which may comprise a URI that is parameterized with a User ID and an OTP.
• a smartphone may launch a browser application and pass the URI (which is parameterized with the User ID and OTP) to the browser upon which the browser passes the User ID and OTP as parameters of the URI to the application server indicated by the URI thus enabling the user to be automatically logged in into the application indicated by the URI.
• the NFC reader device reading the contents of the tag may select an application or an app based on the Record
• the Record Type may be an External Type.
• the application or app may for example comprise a mobile banking app.
• the NFC token ' doesn't make an OTP available to an
• NFC transfer device by default, but only after an explicit action of the user.
• the NFC token may comprise a user input interface (such as a button) and the NFC token may be adapted to make an
• OTP available only when the user has indicated by using the user input interface (e.g . by pressing the button) that the OTP should be made available.
• the NFC token may be adapted to make a generated
• OTP available in an NDEF record of an NDEF file and the token may be adapted to automatically generate an OTP and update the NDEF file with the new OTP value when a user has- used the user input interface to instruct the
• the NFC token by default does not present an NFC tag to the smartphone even when it is brought in the NFC field of the smartphone.
• the NFC token requires an explicit physical action of the user to prompt the NFC token to present itself as an NFC tag to the smartphone.
• the NFC token may comprise a user input interface and the NFC token may be adapted to present itself as an NFC tag only when the user has indicated by using the user input interface that it should do so.
• the NFC token may comprise an activation button and the NFC token may be adapted to present itself as an NFC tag to the smartphone after the user has pressed the activation button.
• the NFC token may be adapted such that the NFC antenna of the NFC token may be electrically disconnected from the other components of the NFC token and the antenna may be connected to the other components of the NFC token when the user pushes the activation button upon which the NFC token may become perceivable to the smartphone as an NFC tag.
• the contents of the NFC tag (which may comprise an OTP and User ID) only become accessible for read out when the user explicitly pushes the activation button thus preventing surreptitious reading out of the OTP and user id by some rogue application without the user being aware of it.
• This also has the additional advantage that the user does not need to move the NFC token out and back into the NFC field to activate the NFC token, let the NFC token generate a new OTP and force the smartphone to read the contents of the NFC tag again. This means that the user can keep the NFC token
• the activation button may allow the user to launch an application and to securely login into the application with just one push on the activation button of the NFC token.
• the NFC token may be adapted to generate an OTP or a signature by cryptographically combining a secret key stored in the NFC token with a dynamic variable that is based on external data that the NFC token may receive from the smartphone.
• the terminology dynamic credential as used in this description may refer to an OTP or a signature that is generated by cryptographically combining a secret key with a dynamic variable that is based on external data may also be referred.
• the external data may for example comprise a challenge (which may be provided by an application) or transaction data.
• the smartphone may transfer these external data to the NFC token by using the standard mechanism for updating the contents of an NFC memory tag.
• the smartphone or other device which may comprise an NFC transfer device, may update an NDEF record in an NDEF file of the NFC token with the external data.
• the NFC token may generate for example the response to the received challenge or the signature over the transaction data after receiving the external data comprising for example the challenge or the transaction data.
• the NFC token may be adapted to update the contents of the memory tag with the generated response or signature.
• the NFC token disconnects and reconnects the memory tag that it presents to the smartphone to prompt the smartphone to read the updated contents of the memory tag.
• the NFC token may be adapted to stop presenting itself during a certain period as an NFC tag after it has received the external data. After that period the NFC token may again present itself as an NFC tag the NDEF file of which the NFC token may have updated with a signature that the NFC token has in the meantime generated over the external data.
• the period that the NFC token is thus not visible to the NFC transfer device or smartphone as an NFC tag may be less than 2 seconds. In some embodiments this period of time is less than 1 second. In some embodiments this period of time is less than 0.5 seconds.
• this period of time is less than 0.1 seconds. In some embodiments this period of time is the minimum period of time that must elapse between the removal and the (re)insertion of an NFC tag in the near field of an NFC transfer device to guarantee that the NFC transfer device will notice that an NFC tag has been removed and then presented again.
• the NFC token may be adapted to put the generated response or signature in another part of the tag contents than an OTP that is not based on external data.
• the smartphone may include a session id in the external data that it writes to the NFC token and the NFC token may include this session id along with the generated response or signature with which it updates the memory tag.
• the NFC token may comprise the generated response or signature, and optionally also the session id or a user id or another identifying data element, in a memory tag that is associated with a specific helper application that is adapted to forward data comprised in that memory tag (e.g., the generated response or signature and optionally a session id, user id or other identifying data element) to a verification server associated with the mobile application being accessed by the user.
• a specific helper application that is adapted to forward data comprised in that memory tag (e.g., the generated response or signature and optionally a session id, user id or other identifying data element) to a verification server associated with the mobile application being accessed by the user.
• a first application or app on the NFC transfer device or smartphone may update the memory tag with external data.
• the NFC token may use these external data to generate a dynamic credential and update the contents of the memory tag (e.g. by updating an NDEF record in an NDEF message in an NDEF file of the NFC token) with the generated dynamic credential.
• the NFC transfer device or smartphone may then read the updated contents and pass the updated contents that it has read to a second application or app on the NFC transfer device that the NFC transfer device may have selected on the basis of information in the updated contents that is has read (such as for example the NDEF type of an NDEF record in the NDEF message).
• the NFC token may comprise a signature button and may require the user to push the signature button to generate the signature and/or make the signature available to be read by the smartphone or the NFC transfer device.
• the signature button may be the same as the activation button for generating an OTP. In some embodiments the signature button may be a different button than the activation button.
• the NFC token may comprise a user output interface
• the NFC token may be adapted to present the external data to be signed to the user and wait for the user to approve the presented external data before generating the signature and/or making the signature available to be read by the smartphone or the NFC transfer device.
• the NFC token may be adapted to capture the user's approval of the external data by the user input interface.
• the NFC token may be adapted to capture the user's rejection of the external data by the user input interface, and the NFC token may be adapted to communicate the user's rejection by updating the contents of the memory tag accordingly (e.g. by including an indication of the rejection in an NDEF record of an NDEF message of an NDEF file of the NFC token).
• the NFC token may have an activation button for the user to indicate approval and a rejection button for the user to indicate rejection.
• the NFC token may be adapted to verify a Personal
• Identification Number PIN and/or a password and may require that a correct PIN and/or password is provided to generate for example a signature or a response to external data.
• the user may enter the PIN and/or password of the NFC token on the smartphone and the smartphone may provide the PIN and/or password to the NFC token for example together with or as part of the external data.
• the PIN or password to be verified may be communicated by an NFC transfer device (e.g., NFC transfer device within a smartphone) to the NFC token by the NFC transfer device updating an NDEF record in an NDEF file of the NFC token.
• NFC transfer device e.g., NFC transfer device within a smartphone
• the NFC token may comprise one or more memory components and may be adapted to store a PIN reference value and/or a password reference value in the one or more memory components and the NFC token may be adapted to verify a PIN and/or a password that it has received from for example the smartphone by comparing the received PIN and/or password with the stored PIN reference value and/or password reference value.
• the PIN may comprise a string of decimal digits.
• the password may comprise a string of alphanumerical characters.
• the NFC token may be adapted to verify a biometric measurement of the legitimate user and may require that a correct biometric of the legitimate user associated with the NFC token is provided to generate for example a signature or a response to external data.
• the smartphone may capture a biometric measurement of the user (e.g. by using a biometric sensor on the smartphone) and the smartphone may provide the biometric measurement to the NFC token for example together with or as part of the external data.
• the NFC token may comprise one or more memory components and may be adapted to store biometric reference data in the one or more memory components and the NFC token may be adapted to verify a biometric measurement that it has received from for example the smartphone by comparing the received biometric
• the NFC token may be bound to a particular NFC
• the NFC reading device and the NFC token may be bound the first time the NFC token is used with the NFC transfer device. In some embodiments the binding is done using a binding secret that is shared by the NFC token and the NFC reading device. In some embodiments the NFC transfer device may receive the value of the binding secret from the user. In some embodiments the NFC reading device may receive the value of the binding secret once (e.g . the first time the NFC token is used with that NFC transfer device) and may store the value of the binding secret for future use. In some embodiments the NFC token may require that a correct value for the binding secret is provided to the NFC token (e.g.
• the NFC reading device may use the binding secret with a cryptographic algorithm to generate a cryptographic binding value and the NFC transfer device may provide the generated binding value to the NFC token (e.g. in the same way that a PIN or password value may be provided as described above) and the NFC token may verify whether the binding value is cryptographically correct and the NFC token may use the cryptographic correctness of the binding value as a condition to generate a dynamic credential.
• the NFC token may have a form factor that allows the NFC token be easily fixed in a permanent or semi-permanent way to an access device comprising an NFC reading device (e.g., smartphone) such that the NFC token remains fixed to the access device until explicit action is taken by a user to detach the NFC token (or an object comprising the NFC token) from the access device.
• the NFC token may comprise an adhesive part that allows the NFC token to be stuck or glued to the access device.
• the NFC token may have a thickness of maximally 2 mm. In some embodiments the NFC token may have a thickness of maximally 1 mm.
• the NFC token may have a width of maximally 54 mm and a length of maximally 86 mm. In some embodiments the NFC token may have a width and a length of maximally 3 cm. In some embodiments the NFC token may be comprised in a sticker that may be attached to a smartphone. In some embodiments the NFC token may be comprised in for example a shell or protective cover of a smartphone. In some embodiments the NFC token may be portable. In some embodiments the NFC may have a weight of less than 10 gram.
• the NFC token may comprise an autonomous electrical energy source for powering the NFC token for example when it can't get (sufficient) electrical power from the NFC field of a smartphone or other device comprising an NFC transfer device.
• the autonomous electrical energy source may be rechargeable.
• the NFC token may be adapted to recharge the autonomous electrical energy source using energy captured from the NFC field of the smartphone or other device comprising an NFC transfer device.
• the NFC token may comprise a battery.
• the battery may be rechargeable.
• the NFC token may be adapted to recharge the battery using energy captured from the NFC field of the smartphone or other device comprising an NFC transfer device.
• the NFC token may comprise a capacitor for providing electrical energy to the electronics of the NFC token.
• the NFC token may be adapted to recharge the capacitor using energy captured from the NFC field of the smartphone or other device comprising an NFC transfer device.
• Figure 1 schematically illustrates an exemplary apparatus according to an aspect of the invention.
• Figure 2 schematically illustrates an exemplary system according to an
• Figure 3 is a flow chart illustrating steps of a method for securing interaction of a user with an application in accordance with aspects of the invention. Detailed description
• Figure 1 schematically illustrates an exemplary apparatus (100) of the
• the apparatus (100) may comprise any of the authentication devices and/or NFC tokens described elsewhere in this description.
• the illustrated apparatus comprises: an NFC antenna/interface (110), one or more memory components (120) for storing a secret key and for storing (at least temporarily) the contents of an NFC memory tag, one or more data processing components ( 130), an activation button (140), and a signature button (150).
• the apparatus may be adapted to generate an OTP and/or a signature or response to external data and to function as an NFC token described above.
• the apparatus may be adapted to present itself as an NFC memory tag to a smartphone (or other device comprising an NFC transfer device).
• the apparatus may be adapted to generate a one-time password using the secret key stored in the one or more memory components and the apparatus may be adapted to populate or update the contents of the memory tag such that it includes the generated one-time password.
• the apparatus is adapted to enable the read-out of the contents of the memory tag comprising the one-time password using a standard NFC memory tag read operation.
• the one or more data processing components may be adapted to generate the one-time password. In some embodiments the one or more data processing components may be adapted to perform
• the cryptographic calculations may comprise for example performing a symmetric cryptographic algorithm parameterized with the secret key and using the dynamic variable.
• this symmetric cryptographic algorithm may comprise a symmetric
• encryption/decryption algorithm such as AES (Advanced Encryption Standard) or may comprise a keyed hashing algorithm such as HMAC (Hash-based
• the apparatus may comprise a clock (160) for
• FIG. 2 schematically illustrates an exemplary system (200) according to an aspect of the invention.
• the system may comprise: an NFC token (210), a client device (220), and an application server (230) .
• the NFC token (210) may comprise any of the NFC tokens described elsewhere in this description.
• the client device (220) may comprise a personal
• the client device may comprise a smartphone (or other device comprising an NFC transfer device such as a tablet).
• the client application may be adapted to be operated by and to interface with a user (240).
• the client device may comprise a user output interface (such as a display) for presenting information to the user.
• the client device may comprise a user input interface (such as a keyboard or touch screen) to receive inputs or information from the user.
• the client device may be adapted to run a client application or a client app that the user may use to interact with an application e.g. by using the user input interface and the user output interface of the client device.
• the client application of client app may comprise a web browser to interact with a web-based application.
• the application server (230) may comprise one or more computers.
• the application server may be adapted to host a server part of the application.
• the application may for example comprise a web banking application.
• the client device and the application server may be connected over a computer network (250) and/or a telecommunications network (250) such as for example the internet and/or a wireless data and/or telephone network.
• Figure 3 depicts a flow chart 300 of steps for securing interaction of a user with a computer based application in accordance with an aspect of the invention.
• a dynamic credential is generated by an authentication device.
• the dynamic credential may be generated by authentication device 100.
• the authentication device includes a Near-Field Communication (NFC) interface to couple the authentication device to an NFC transfer device (e.g., of an access device such as client device 220).
• NFC Near-Field Communication
• the authentication device 100 may generate the dynamic credential (e.g., using data processing component 130) by cryptographically combining a first value of a first dynamic variable with a secret key that is stored in the authentication device 100 (e.g., in memory 120).
• the secret key in the authentication device 100 may be shared with an application server (e.g., application server 230) that hosts a server part of the computer based application.
• the authentication device 100 presents itself to the NFC transfer device as an NFC tag.
• the dynamic credential is made available by the authentication device to an NFC transfer device.
• the NFC transfer device may be a device capable of communication via NFC (e.g., client device
• the authentication device may make the dynamic credential generated (e.g., at step 310) available to the NFC transfer device by including the dynamic credential in first data contents of the NFC tag that can be read by the NFC transfer device using NFC mechanisms for reading data contents of NFC tags.
• an access device obtains the dynamic credential.
• the access device may be a device such as a smartphone that comprises the NFC transfer device.
• the access device may be connected to the application server that hosts the server part of the computer based application by a computer network.
• the access device may obtain the dynamic credential by extracting the dynamic credential from the data contents of the NFC tag that the NFC transfer device reads using the NFC mechanisms for reading data contents of NFC tags.
• the access device forwards the dynamic credential to the
• application server and the application server receives the dynamic credential, which was generated by the authentication device and obtained by the access device.
• the application server verifies the received dynamic credential.
• the application server may be configured to verify the dynamic credential for example by determining the value of the dynamic variable used to create the dynamic credential and by using the secret key that is shared with the authentication device e.g. to generate a reference value that may then be compared to the received dynamic credential.
• a user is allowed to access the computer based application using the access device. The user may be allowed to access the computer based application responsive to the application server verifying the received dynamic credential.

Landscapes

• Engineering & Computer Science (AREA)
• Computer Security & Cryptography (AREA)
• Computer Networks & Wireless Communication (AREA)
• Signal Processing (AREA)
• Computer Hardware Design (AREA)
• Computing Systems (AREA)
• General Engineering & Computer Science (AREA)
• Telephone Function (AREA)

Priority Applications (4)

Applications Claiming Priority (2)

Publications (1)

Family

ID=52350373

Family Applications (1)

Country Status (6)

Cited By (3)

Families Citing this family (29)

Citations (2)

Family Cites Families (14)

• 2014
  • 2014-12-23 EP EP14827678.5A patent/EP3090521B1/en active Active
  • 2014-12-23 US US14/580,438 patent/US9510192B2/en active Active
  • 2014-12-23 WO PCT/US2014/072102 patent/WO2015103031A1/en not_active Ceased
  • 2014-12-23 CN CN201480074247.6A patent/CN106233689B/zh active Active
  • 2014-12-23 JP JP2016544601A patent/JP6556145B2/ja active Active
  • 2014-12-23 KR KR1020167020999A patent/KR101706173B1/ko active Active
• 2018
  • 2018-12-27 JP JP2018243834A patent/JP6629952B2/ja active Active

Patent Citations (2)

Also Published As

Similar Documents

Legal Events