US5347580A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Authentication method and system with a smartcard
Assignee: International Business Machines Corp
•
Filing: 1993-06-01
•
Granted: 1994-09-13
•
Expires: 2013-06-01
Abstract
Abstract This invention relates to a novel smartcard-based authentication technique using a smartcard that encrypts the time displayed on the card with a secret, cryptographically strong key. The (public) work station receives as input certain values defining the user, the card and a particular value derived from the encrypted time and encrypts and/or transmits these values to the server. The server, in turn, computes from received values some potential values and compares these to other received values. If the server determines a match, an accept signal is transmitted to the work station.
Inventors
- 👤 Refik Molva
- 👤 Gene Tsudik
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-25 09:43
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/08; H04L63/0853; G; G06; G06F; G06F21/00; G06F21/30; G06F21/305; G06F21/31; G06F21/33; G06F21/335; G06F21/34; G06Q; G06Q20/00; G06Q20/30; G06Q20/34; G06Q20/341; G06Q20/3415; G06Q20/38; G06Q20/40; G06Q20/409; G06Q20/4097; G06Q20/40975; G07; G07F; G07F7/00; G07F7/08; G07F7/10; G07F7/1008; H04L9/00; H04L9/08; H04L9/0816; H04L9/0838; H04L9/0841; H04L9/0844; H04L9/0861; H04L9/0877; H04L9/32; H04L9/3226; H04L9/3234; H04L9/3271; H04L9/3273; G06F2221/00; G06F2221/21; G06F2221/2151
Claims Analysis
Total Claims: 25
Claim 1
Independent Claim
288 words
A method for authenticating a user with a smartcard to a system including an authentication server and a plurality of distributed work stations connected to said server, said smartcard having a unique card identifier and including a running value device, input-output means, and encrypting means with a secret card key, said server having stored user names, user personal identifiers, at least one secret key, and card identifiers, said method comprising the following steps: (1) indicating with a smartcard a card running value and computing with the smartcard a first encryption of the card running value under a the secret card key; (2) receiving at a work station a user name, a card identifier, the card running value, and a user authenticator computed from a user's personal identifier and the first encryption; (3) transmitting from the work station to the server the user name, the card running value, the card identifier, and a second encryption of the card running value under the user authenticator; (4) determining with the server a potential secret card key from the received card identifier and a potential personal identifier from the received user name; (5) computing with the server a first potential encryption of the received card running value under the potential secret card key, and, combining the potential personal identifier and the computed first potential encryption to obtain a potential user authenticator; (6) computing with the server a second potential encryption of the received card running value under the potential user authenticator, and comparing the second potential encryption to the received second encryption; and (7) determining if the second potential encryption matches the received second encryption, and transmitting an accept signal from the server to the work station if a match is determined.
Claim 2
Independent Claim
288 words
A method for authenticating a user with a smartcard to a system including an authentication server and a plurality of distributed work stations connected to said server, said smartcard having a unique card identifier and including a running value device, input-output means, and encrypting means with a secret card key, said server having stored user names, user personal identifiers, at least one secret key, and card identifiers, said method comprising the following steps: (1) indicating with a smartcard a card running value and computing with the smartcard a first encryption of the card running value under a the secret card key; (2) receiving at a work station a user name, a card identifier, the card running value, and a user authenticator computed from a user's personal identifier and the first encryption; (3) transmitting from the work station to the server the user name, the card running value, the card identifier, and a second encryption of the card running value under the user authenticator; (4) determining with the server a potential secret card key from the received card identifier and a potential personal identifier from the received user name; (5) computing with the server a first potential encryption of the received card running value under the potential secret card key, and, combining the potential personal identifier and the computed first potential encryption to obtain a potential user authenticator; (6) computing with the server a second potential encryption of the received card running value under the potential user authenticator, and comparing the second potential encryption to the received second encryption; and (7) determining if the second potential encryption matches the received second encryption, and transmitting an accept signal from the server to the work station if a match is determined.
Claim 3
Dependent Claim
64 words
The method according to claim 1, further comprising deriving the secret card key of the smartcard from the card identifier by encrypting the card identifier with a server secret key, storing at the server user names, user personal identifiers, and said server secret key, and determining at the server the potential secret card key from the received card identifier and the server secret key.
Claim 4
Dependent Claim
23 words
The method according to claim 1, wherein the smartcard data resulting from said indicating step (1) is electrically entered into the work station.
Claim 5
Dependent Claim
23 words
The method according to claim 1, wherein the smartcard data resulting from said indicating step (1) is optically entered into the work station.
Claim 6
Dependent Claim
23 words
The method according to claim 1, wherein the smartcard data resulting from said indicating step (1) is manually entered into the work station.
Claim 7
Dependent Claim
17 words
The method according to claim 1, wherein the smartcard must be activated to indicate a running value.
Claim 8
Dependent Claim
39 words
The method according to claim 1, further comprising validating with the server the received card running value, comparing the received card running value to the server's internal running value, and, if the difference exceeds a predetermined size, discontinuing processing.
Claim 9
Dependent Claim
44 words
The method according to claim 1, further comprising validating with the server the received card running value, comparing the received card running value to the server's internal running value, and, if the difference exceeds a predetermined size, transmitting a message to the work station.
Claim 10
Dependent Claim
53 words
The method according to claim 1, further comprising that if a match of the second potential encryption with the received second encryption is determined, computing with the server a third encryption of a function of the received running value under the received user authenticator, and transmitting the third encryption to the work station.
Claim 11
Dependent Claim
27 words
The method according to claim 9, further comprising the step of displaying to the user the third encryption value transmitted by the server to the work station.
Claim 12
Dependent Claim
53 words
The method according to claim 1, further comprising that if a match of the second potential encryption with the received second encryption is determined, computing with the server a third encryption of a function of the received running value under the secret card key, and transmitting the third encryption to the work station.
Claim 13
Dependent Claim
27 words
The method according to claim 11, further comprising the step of displaying to the user the third encryption value transmitted by the server to the work station.
Claim 14
Independent Claim
291 words
A system for authenticating a user with a smartcard, said system including authentication server means and a plurality of distributed work stations connected to said server means, comprising: said smartcard having a card identifier, a running value device for indicating a card running value, input-output means, and encrypting means with a secret card key for computing a first encryption of the indicated card running value under the secret card key, each said work station having input means for receiving the user name the card identifier, the card running value, and a user authenticator computed from the user's personal identifier and the first encryption, means for encrypting the card running value under the user authenticator, means connectable to said server for transmitting to the server the user name, the card running value, the card identifier, and a second encryption of the card running value under the user authenticator, said server means having at least one memory storing user names, user personal identifiers, at least one secret key, and preferably, card identifiers, means for determining a potential secret card key from the received card identifier and a potential personal identifier from the received user name, means for computing a first potential encryption of the received card running value under the potential secret card key, means for obtaining a potential user authenticator from the potential personal identifier and the computed first potential encryption, means for computing a second potential encryption of the received card running value under the potential user authenticator, means for comparing the second potential encryption with the received second encryption, means for transmitting a signal to the work station, which is an accept signal if the second potential encryption matches the received second encryption, and which is a non-accept signal otherwise.
Claim 15
Independent Claim
291 words
A system for authenticating a user with a smartcard, said system including authentication server means and a plurality of distributed work stations connected to said server means, comprising: said smartcard having a card identifier, a running value device for indicating a card running value, input-output means, and encrypting means with a secret card key for computing a first encryption of the indicated card running value under the secret card key, each said work station having input means for receiving the user name the card identifier, the card running value, and a user authenticator computed from the user's personal identifier and the first encryption, means for encrypting the card running value under the user authenticator, means connectable to said server for transmitting to the server the user name, the card running value, the card identifier, and a second encryption of the card running value under the user authenticator, said server means having at least one memory storing user names, user personal identifiers, at least one secret key, and preferably, card identifiers, means for determining a potential secret card key from the received card identifier and a potential personal identifier from the received user name, means for computing a first potential encryption of the received card running value under the potential secret card key, means for obtaining a potential user authenticator from the potential personal identifier and the computed first potential encryption, means for computing a second potential encryption of the received card running value under the potential user authenticator, means for comparing the second potential encryption with the received second encryption, means for transmitting a signal to the work station, which is an accept signal if the second potential encryption matches the received second encryption, and which is a non-accept signal otherwise.
Claim 16
Dependent Claim
18 words
The system of claim 13, wherein the running value device in the smartcard is a continuously running clock.
Claim 17
Independent Claim
283 words
A method for authenticating a user with a smartcard to a system including an authentication server and at least one distributed work station connected to said server, said smartcard having a unique card identifier and including means for generating a running value, input-output means, and encrypting means with a secret card key, said server having stored user names, user personal identifiers, at least one secret key, and card identifiers, said method comprising the following steps: (1) generating a card running value with the running value generating means and computing with the smartcard a first encryption of the card running value under a secret card key; (2) receiving at a work station a user name, a card identifier, the card running value, and a user authenticator computed from a user's personal identifier and the first encryption; (3) transmitting from the work station to the server the user name, the card running value, the card identifier, and a second encryption of the card running value under the user authenticator; (4) determining a potential secret card key from the received card identifier and a potential personal identifier from the received user name; (5) computing a first potential encryption of the received card running value under the potential secret card key, and, combining the potential personal identifier and the computed first potential encryption to obtain a potential user authenticator; (6) computing a second potential encryption of the received card running value under the potential user authenticator, and comparing the second potential encryption to the received second encryption; and (7) determining if the second potential encryption matches the received second encryption, and transmitting an accept signal from the server to the work station if a match is determined.
Claim 18
Independent Claim
283 words
A method for authenticating a user with a smartcard to a system including an authentication server and at least one distributed work station connected to said server, said smartcard having a unique card identifier and including means for generating a running value, input-output means, and encrypting means with a secret card key, said server having stored user names, user personal identifiers, at least one secret key, and card identifiers, said method comprising the following steps: (1) generating a card running value with the running value generating means and computing with the smartcard a first encryption of the card running value under a secret card key; (2) receiving at a work station a user name, a card identifier, the card running value, and a user authenticator computed from a user's personal identifier and the first encryption; (3) transmitting from the work station to the server the user name, the card running value, the card identifier, and a second encryption of the card running value under the user authenticator; (4) determining a potential secret card key from the received card identifier and a potential personal identifier from the received user name; (5) computing a first potential encryption of the received card running value under the potential secret card key, and, combining the potential personal identifier and the computed first potential encryption to obtain a potential user authenticator; (6) computing a second potential encryption of the received card running value under the potential user authenticator, and comparing the second potential encryption to the received second encryption; and (7) determining if the second potential encryption matches the received second encryption, and transmitting an accept signal from the server to the work station if a match is determined.
Claim 19
Dependent Claim
17 words
The method according to claim 15, wherein steps 4, 5, and 6 are performed at the server.
Claim 20
Dependent Claim
21 words
The method according to claim 15, wherein steps 4, 5, and 6 are performed at a station within a computerized system.
Claim 21
Independent Claim
253 words
A system for authenticating a user with a smartcard to an authentication server and a plurality of distributed work stations connected to said server, comprising: (1) means for indicating with a smartcard a card running value and computing with the smartcard a first encryption of the card running value under a secret card key; (2) means for receiving at a work station a user name, a card identifier, the card running value, and a user authenticator computed from a user's personal identifier and the first encryption; (3) means for transmitting from the work station to the server a user name, the card running value, the card identifier, and a second encryption of the card running value under the user authenticator; (4) means for determining with the server a potential secret card key from the received card identifier and a potential personal identifier from the received user name; (5) means for computing with the server a first potential encryption of the received card running value under the potential secret card key, and, combining the potential personal identifier and the computed first potential encryption to obtain a potential user authenticator; (6) means for computing with the server a second potential encryption of the received card running value under the potential user authenticator, and comparing the second potential encryption to the received second encryption; and (7) means for determining if the second potential encryption matches the received second encryption, and transmitting an accept signal from the server to the work station if a match is determined.
Claim 22
Independent Claim
253 words
A system for authenticating a user with a smartcard to an authentication server and a plurality of distributed work stations connected to said server, comprising: (1) means for indicating with a smartcard a card running value and computing with the smartcard a first encryption of the card running value under a secret card key; (2) means for receiving at a work station a user name, a card identifier, the card running value, and a user authenticator computed from a user's personal identifier and the first encryption; (3) means for transmitting from the work station to the server a user name, the card running value, the card identifier, and a second encryption of the card running value under the user authenticator; (4) means for determining with the server a potential secret card key from the received card identifier and a potential personal identifier from the received user name; (5) means for computing with the server a first potential encryption of the received card running value under the potential secret card key, and, combining the potential personal identifier and the computed first potential encryption to obtain a potential user authenticator; (6) means for computing with the server a second potential encryption of the received card running value under the potential user authenticator, and comparing the second potential encryption to the received second encryption; and (7) means for determining if the second potential encryption matches the received second encryption, and transmitting an accept signal from the server to the work station if a match is determined.
Claim 23
Dependent Claim
38 words
The system according to claim 18, wherein the smartcard comprises: means for associating a unique card identifier with the smartcard, means for generating a running value, input-output means, and encryption means connectable to said running value generating means.
Claim 24
Dependent Claim
24 words
The smartcard of claim 19, further comprising: (1) means for activating input to the smartcard, and (2) means for displaying output of the smartcard.
Claim 25
Dependent Claim
19 words
The smartcard of claim 19, further comprising data transfer means for communicating the card data to an external device.
References Cited (Backward Citations)
EP0140013A2
Cited
US4679236A
Cited
US4799061A
Cited
EP0234100A2
Cited
WO1987003977A1
Cited
US4961224A
Cited
US5208858A
Cited
US5237614A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 1997-09-12 | 1998-03-14 | 1998-09-13 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2001-09-12 | 2002-03-14 | 2002-09-13 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2005-09-12 | 2006-03-14 | 2006-09-13 | $7700.00 | Window Closed / Lapsed |