Enabling access to data

Patent metadata

Field	Value
Publication number	US-10445484-B2
Application number	US-201514977400-A
Country	US
Kind code	B2
Filing date	Dec 21, 2015
Priority date	Jun 21, 2013
Publication date	Oct 15, 2019
Grant date	Oct 15, 2019

Abstract

Systems, methods and apparatus for enabling access to secure data. A first module is arranged to generate a limited use passcode and make the passcode available to a user. A second module and a third module are arranged to communicate whereby to enable detection of the third module being in proximity to the second module. A fourth module is arranged to receive a passcode via user input. The apparatus is arranged to enable access to secure data in dependence on the fourth module receiving a valid passcode generated by the first module and the third module being in proximity to the second module.

First claim

What is claimed is:

1. A system for enabling access to secure data, the system comprising:
a first module arranged to generate a passcode and make the passcode available to a user, wherein the passcode is limited use;
a second module and a third module arranged to communicate whereby to enable detection of the third module being in proximity to the second module; and
a fourth module arranged to receive the passcode via user input,
wherein the system is arranged to enable access to secure data in dependence on the fourth module receiving and validating the passcode generated by the first module and the third module being in proximity to the second module,
wherein the first, second, third and fourth modules share a secret which has been uniquely assigned thereto,
wherein the shared secret is used in determining whether the third module is in proximity to the second module, and
wherein the shared secret is also used in generating and validating the passcode.

2. The system of claim 1 , wherein:
the third and fourth modules are communicatively connected, and the fourth module is arranged to provide data indicative of the passcode received via user input to the third module;
the third module is arranged to transfer data indicative of the passcode to the second module;
the first and second modules are communicatively connected; and
the system is arranged to determine whether the passcode made available to the user by the first module was received via user input at the fourth module.

3. The system of claim 1 , wherein the third module is arranged to generate a secure signal and to cause the secure signal to be wirelessly transmitted, and the second module is arranged to receive and validate said secure signal whereby to detect whether the third module is in proximity to the second module.

4. The system of claim 3 , wherein the second and third modules are arranged to cooperate with wireless communications equipment whereby to cause said secure signal to be transmitted and received.

5. The system of claim 1 , wherein the first and fourth modules are communicatively unconnected.

6. The system of claim 1 , comprising:
a first element comprising the second and fourth modules;
a second element, communicatively unconnected to the first element, comprising the first module; and
a third element, physically separate from the first element, comprising the third module.

7. The system of claim 6 , wherein the second and third elements are physically connected.

8. The system of claim 1 , comprising:
a first element comprising the fourth module;
a second element, communicatively unconnected to the first element, comprising the first and second modules; and
a third element, physically separate from the second element, comprising the third module.

9. The system of claim 1 , comprising:
a first element comprising the second and fourth modules; and
a second element, physically separate from the first element, comprising the first and third modules.

10. The system of claim 1 , comprising:
a first element comprising the third and fourth modules; and
a second element, physically separate from the first element, comprising the first and second modules.

11. An apparatus for enabling access to secure data, the apparatus comprising:
a passcode generator arranged to provide a first security function based on a passcode which is made available to a user of the apparatus for entry as user input, wherein the passcode is limited use; and
a proximity detector arranged to provide a second security function based on proximity sensing,
wherein the apparatus is arranged to enable access to secure data in dependence on both the first and second security functions,
wherein the passcode generator and the proximity detector share a secret with a passcode receiver and another proximity detector,
wherein the shared secret is used in the first security function based on the passcode, and
wherein the shared secret is also used in the second security function based on proximity sensing.

12. A method for enabling access to secure data, the method comprising:
generating a passcode and making the passcode available to a user, wherein the passcode is limited use;
communicating between a second module and a third module whereby to enable detection of the third module being in proximity to the second module;
receiving the passcode via user input; and
enabling access to secure data in dependence on receiving and validating the passcode, and the third module being in proximity to the second module,
wherein a first module, the second module, the third module, and a fourth module share a secret which has been uniquely assigned thereto,
wherein the shared secret is used in determining whether the third module is in proximity to the second module, and
wherein the shared secret is also used in generating and validating the passcode.

13. The method of claim 12 , wherein the first module generates the passcode, and the fourth module receives the passcode.

14. The method of claim 12 , comprising:
generating a secure signal and causing the secure signal to be wirelessly transmitted; and
receiving and validating the secure signal whereby to detect whether the third module is in proximity to the second module.

15. The method of claim 14 , wherein the second and third modules are arranged to cooperate with wireless communications equipment whereby to cause the secure signal to be transmitted and received.

16. The method of claim 12 , wherein the secure data comprises one or more of:
at least one cryptographic key or shared secret;
a public key certificate;
at least one username; and
at least one passcode.

17. The system of claim 1 , wherein the third module and the second module share the secret via proximity communication.

Assignees

• Visa Europe Ltd

Inventors

• Taratine Boris

Classifications

• H04L9/12

  Transmitting and receiving encryption devices synchronised or initially set up in a particular manner · CPC title

• H04L63/18

  using different networks or channels, e.g. using out of band channels (cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215) · CPC title

• H04L63/0838

  using one-time-passwords · CPC title

• G06F21/725

  operating on a secure reference time value · CPC title

• H04L9/3228

  One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key · CPC title