Secure element authentication

Patent metadata

Field	Value
Publication number	US-9509686-B2
Application number	US-95971510-A
Country	US
Kind code	B2
Filing date	Dec 3, 2010
Priority date	Dec 3, 2010
Publication date	Nov 29, 2016
Grant date	Nov 29, 2016

Abstract

Secure element authentication techniques are described. In implementations, a confirmation is received that an identity of a user has been physically verified using one or more physical documents. One or more credentials that are usable to authenticate the user are caused to be stored in a secure element of a mobile communication device of the user, the secure element implemented using tamper-resistant hardware.

First claim

What is claimed is:

1. A method comprising:
receiving at a mobile communication device of a user, from a third party computing device, a confirmation that an identity of the user has been verified; and
causing one or more credentials usable to authenticate the identity of the user to be stored in a secure element of the mobile communication device of the user, the secure element implemented using tamper-resistant hardware, and the one or more credentials kept from being exposed outside the secure element,
wherein the one or more credentials are encrypted using a public key by an entity that obtains the public key responsive to provision of an identifier of a serial number of an integrated circuit that forms the hardware secure element of the mobile communication device, wherein the public key is one of a plurality of public keys which are located on one or more devices of a provisioning service that are auditable by an outside party to determine that information stored by the one or more devices is not configured to decrypt data encrypted by one or more of the plurality of public keys.

2. A method as described in claim 1 , wherein in the secure element includes a private key configured to decrypt data that includes the one or more credentials that was encrypted using a corresponding public key, the secure element configured to perform the decryption without exposing the private key and the one or more credentials outside of the hardware of the secure element.

3. A method as described in claim 1 , wherein the hardware is tamper resistant such that the credentials, after storage, are not exposed outside of the secure element by the mobile communication device.

4. A method as described in claim 1 , wherein the hardware is tamper resistant such that an integrated circuit that is used to implement the secure element is resistant to removal from a circuit board of the mobile communication device.

5. A method as described in claim 1 , wherein the hardware is tamper resistant such that an integrated circuit that is used to implement the secure element is resistant to snooping.

6. A method as described in claim 1 , wherein the one or more credentials are usable to authenticate the user without manual entry of information by the user.

7. A method as described in claim 1 , wherein the mobile communication device is configured to include telephone functionality.

8. A method as described in claim 1 , wherein the one or more credentials are configured for use by the mobile communication device to authenticate the user to make a purchase using information relating to a credit card, provide an identifier for use as a transit access card, provide an identifier associated with a loyalty card, or provide credentials usable by the mobile communication device to access a premises.

9. A method comprising:
receiving a challenge at a mobile communication device to authenticate an identity of a user of the mobile communication device;
processing the challenge by a secure element of the mobile communication device, the secure element being implemented in tamper-resistant hardware, said processing using one or more credentials stored by the secure element, the challenge being processed without exposing the one or more credentials outside of hardware that implements the secure element and without requiring further input from the user, wherein the one or more credentials are encrypted using a public key by an entity that obtains the public key responsive to provision of an identifier of a serial number of an integrated circuit that forms the hardware that implements the secure element of the mobile communication device, wherein the public key is one of a plurality of public keys which are located on one or more devices of a provisioning service that are auditable by an outside party to determine that information stored by the one or more devices is not configured to decrypt data encrypted by one or more of the plurality of public keys; and
exposing an answer to the challenge by the secure element.

10. A method as described in claim 9 , wherein the receiving is performed by an application that executes on a processor of the mobile communication device that is not part of the secure element and the exposing of the answer by the secure element exposes the answer to the application.

11. A method as described in claim 9 , wherein the secure element includes a private key configured to decrypt data that includes the challenge that was encrypted using a corresponding public key, the secure element configured to perform the decryption without exposing the private key outside of the secure element.

12. A method as described in claim 9 , wherein the processing involves an encryption or decryption operation using one or more encryption keys stored in the secure element.

13. A method as described in claim 9 , wherein the answer is configured to be provided along with a user name and password to gain access to a resource.

14. A method as described in claim 9 , wherein the answer is configured to be provided along with personal identification number (PIN) to gain access to a resource.

15. A method as described in claim 9 , wherein successive said processing used to authenticate the user involves different challenges, respectively.

16. A mobile communication device comprising a secure element implemented in tamper-resistant hardware that is configured to decrypt credentials received from a third party computing device using a private key included in the secure element configured during manufacture to include the private key and store the credentials once decrypted in the secure element without exposing said credentials outside of the secure element, the credentials configured to authenticate the identity of a user of the mobile communication device for access to a resource without further input from the user, wherein the credentials are encrypted using a public key by an entity that obtains the public key responsive to provision of an identifier of a serial number of an integrated circuit that forms the hardware secure element of the mobile communication device, wherein the public key is one of a plurality of public keys which are located on one or more devices of a provisioning service that are auditable by an outside party to determine that information stored by the one or more devices is not configured to decrypt data encrypted by one or more of the plurality of public keys.

17. A mobile communication device as described in claim 16 , wherein the credentials are configured for use by the mobile communication device to make a purchase using information relating to a credit card, provide an identifier for use as a transit access card, provide an identifier associated with a loyalty card, provide credentials usable by the mobile communication device to access a premises, open a vehicle, or start a vehicle.

18. A mobile communication device as described in claim 16 , wherein the credentials are usable by the secure element to generate a signature to sign a document.

19. A method comprising:
receiving a confirmation that an identity of a user has been verified; and
causing one or more credentials usable to authenticate the identity of the user to be stored in a secure element of a mobile communication device of the user, the secure element implemented using tamper-resistant hardware, and the one or more credentials kept from being exposed outside the secure element wherein:
the one or more credentials are encrypted using a public key by an entity that obtains the public key responsive to provis

Assignees

• Anantha Anoop
• Krishnan Murali R
• Marshall Alan L
• Zargahi Kamran Rajabi
• Abel Miller Thomas
• Microsoft Technology Licensing Llc

Inventors

• Anantha Anoop
• Krishnan Murali R
• Marshall Alan L
• Zargahi Kamran Rajabi
• Abel Miller Thomas

Classifications

• H04L9/0897 Primary

  involving additional devices, e.g. trusted platform module [TPM], smartcard or USB · CPC title

• H04W12/04

  Key management, e.g. using generic bootstrapping architecture [GBA] · CPC title

• H04L9/3271

  using challenge-response · CPC title

• H04L9/3234

  involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853) · CPC title

• H04L9/3226

  using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083) · CPC title