Two factor authentication using near field communications

Patent metadata

Field	Value
Publication number	US-9594896-B2
Application number	US-201213723429-A
Country	US
Kind code	B2
Filing date	Dec 21, 2012
Priority date	Dec 21, 2012
Publication date	Mar 14, 2017
Grant date	Mar 14, 2017

Abstract

There is provided a method and apparatus for communications using short range communications such as Near Field Communications (NFC). A mobile device comprising an NFC subsystem provides a dynamic credential for use to login to a network requiring two factor authentication. A terminal used for logging in to the network is associated with an NFC reader, and bringing the NFC device in proximity to the NFC reader provides the terminal with the dynamic credential required for two factor authentication.

First claim

The invention claimed is:

1. A method at a short range communications capable device for providing a dynamic credential to a terminal controlling access to a resource, the method comprising:
receiving, utilizing near field communications, an application identifier, a current time, and a random number from a reader associated with the terminal;
retrieving an encryption key, the encryption key corresponding to the application identifier;
transmitting, to the terminal, a response including a device identifier and the random number signed with the encryption key;
executing an applet on a secure element of the short range communications capable device, the applet corresponding to the application identifier;
computing, with the applet, the dynamic credential based on the current time; and
transmitting the dynamic credential to the reader;
wherein access to the resource is provided upon transmitting a valid dynamic credential and a valid signature corresponding to the signed random number; and
wherein the application identifier indicates two factor authentication.

2. The method of claim 1 , wherein the dynamic credential is updated periodically.

3. The method of claim 1 , wherein the short range communications capable device includes a powered timer circuit.

4. The method of claim 1 , wherein the short range communications capable device is a near field communications (NFC) capable device, including an NFC subsystem powered by induction when placed in proximity to the reader.

5. The method of claim 1 , wherein the encryption key is stored in a secure element of the short range communications capable device.

6. The method of claim 1 , further comprising receiving an indication at the short range communications capable device, that authentication was successful.

7. The method of claim 1 , wherein the response includes the dynamic credential in a payload field.

8. The method of claim 1 , wherein the dynamic credential is for a login to a network requiring two factor authentication.

9. The method of claim 1 wherein the short range communications capable device is a mobile communications device.

10. The method of claim 1 wherein the short range communications capable device is a dedicated dynamic credential providing device.

11. A short range communications capable device for providing a dynamic credential to a terminal controlling access to a resource, the short range communications capable device comprising:
an antenna;
a controller; and
at least one secure element,
wherein the antenna, controller and at least one secure element are configured to:
receive an application identifier, a current time, and a random number from a reader associated with the terminal;

retrieve an encryption key, the encryption key corresponding to the application identifier;
transmit, to the terminal, a response including a device identifier and the random number signed with the encryption key;
execute an applet on a secure element of the short range communications capable device, the applet corresponding to the application identifier;
compute, with the applet, the dynamic credential based on the current time; and
transmit the dynamic credential to the reader;
wherein access to the resource is provided upon transmitting a valid dynamic credential and a valid signature corresponding to the signed random number; and
wherein the application identifier indicates two factor authentication.

12. The short range communications capable device of claim 11 , wherein the dynamic credential is updated periodically.

13. The short range communications capable device of claim 11 , wherein the short range communications capable device includes a powered timer circuit.

14. The short range communications capable device of claim 11 , wherein the short range communications capable device is a near field communications (NFC) capable device powered by induction when placed in proximity to the reader.

15. The short range communications capable device of claim 11 , wherein the encryption key is stored in a secure element of the short range communications capable device.

16. The short range communications capable device of claim 11 , wherein the dynamic credential is for a login to a network requiring two factor authentication.

17. A non-transitory computer-readable medium having instructions stored thereon for execution by a processor of a short range communications capable device, the instructions comprising code for:
receiving, utilizing near field communications, an application identifier, a current time, and a random number from a reader associated with a terminal, the terminal controlling access to a resource;
retrieving an encryption key, the encryption key corresponding to the application identifier;
transmitting, to the terminal, a response including a device identifier and the random number signed with the encryption key;
executing an applet on a secure element of the short range communications capable device, the applet corresponding to the application identifier;
computing, with the applet, the dynamic credential based on the current time; and
transmitting the dynamic credential to the reader;

wherein access to the resource is provided upon transmitting a valid dynamic credential and a valid signature corresponding to the signed random number; and
wherein the application identifier indicates two factor authentication.

18. The non-transitory computer-readable medium of claim 17 , wherein the dynamic credential is updated periodically.

19. The non-transitory computer-readable medium of claim 17 , wherein the short range communications capable device includes a powered timer circuit.

20. The non-transitory computer-readable medium of claim 17 , wherein the short range communications capable device is a near field communications (NFC) capable device, including an NFC subsystem powered by induction when placed in proximity to the reader.

21. The non-transitory computer-readable medium of claim 17 , wherein the encryption key is stored in a secure element of the short range communications capable device.

22. The non-transitory computer-readable medium of claim 17 , wherein the instructions comprise code for receiving an indication at the short range communications capable device, that authentication was successful.

23. The non-transitory computer-readable medium of claim 17 , wherein the response includes the dynamic credential in a payload field.

24. The non-transitory computer-readable medium of claim 17 , wherein the dynamic credential is for a login to a network requiring two factor authentication.

25. The non-transitory computer-readable medium of claim 17 , wherein the short range communications capable device is a mobile communications device.

26. The non-transitory computer-readable medium of claim 17 , wherein the short range communications capable device is a dedicated dynamic credential providing device.

Assignees

• Certicom Corp
• Blackberry Ltd

Inventors

• Rosati Anthony

Classifications

• H04W4/80

  Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication · CPC title

• H04L63/0492

  by using a location-limited connection, e.g. near-field communication or limited proximity of entities · CPC title

• G07C2009/0042

  the transmitted data signal containing a code which is changed · CPC title

• G07C9/00309

  operated with bidirectional data transmission between data carrier and locks · CPC title

• G07C9/00174

  Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys (mechanical locks with electric permutation E05B49/00; arrangements for sensing or reading record carriers G06K7/00; electronic switching H03K17/00) · CPC title