Virtual smart card to perform security-critical operations

Patent metadata

Field	Value
Publication number	US-9602507-B1
Application number	US-201615137588-A
Country	US
Kind code	B1
Filing date	Apr 25, 2016
Priority date	Mar 12, 2013
Publication date	Mar 21, 2017
Grant date	Mar 21, 2017

Abstract

A portable data or information carrier in the form of a smart card with partially or fully virtualized components. To maximize the confidentiality of information stored in the carrier, and more specifically to limit the amount of information available to a potential defrauder, electronic components such as circuits, I/O, cryptographic, memory and dummy objects are built, modified or influenced on demand from physical characteristics of an eligible person or device. Digitized unique biometric or hardware identifiers are read upon start-up and runtime of the device and, in case of an eligible person or device, subsequently supply all values necessary for determination of the characteristics of the user specific virtual smart cards objects, their placement and connections. By multi-factor authentication, the end-user or device will retain sole control of its keys and use them for authentication, signature or encryption purposes as if he had a physical smart card in his hand.

First claim

What is claimed is:

1. A method, comprising:
initializing a virtual smart card in response to a received unique identifier;
reading data associated with the unique identifier via a reader device, wherein the data comprises a key stream of digital data bits associated with the unique identifier;
identifying a user's smart card base address from a first portion of the digital data bits of the key stream; and
authenticating the user based on the unique identifier and results of the read data.

2. The method of claim 1 , wherein the unique identifier comprises digital biometric data.

3. The method of claim 2 , wherein the digital biometric data is part of the key stream and is associated with a digitized fingerprint.

4. The method of claim 3 , wherein the reader device uses its own clock cycles to compute a defined part of the key stream of the digitized fingerprint.

5. The method of claim 4 , wherein a subsequent portion of bits of the key stream are offsets of corresponding objects.

6. The method of claim 1 , further comprising:
loading a secret 48-bit key into a shift register; and
shifting a string into a state that the received unique identifier matches an identifier of a corresponding tag.

7. The method of claim 6 , further comprising:
generating a random number; and
sending the random number to the reader device and proving that the tag and reader have knowledge of the secret 48-bit key.

8. An apparatus, comprising:
a processor configured to:
initialize a virtual smart card in response to a received unique identifier, read data associated with the unique identifier via a reader device, wherein the data comprises a key stream of digital data bits associated with the unique identifier;
identify a user's smart card base address from a first portion of the digital data bits of the key stream; and
authenticate the user based on the unique identifier and results of the read data.

9. The apparatus of claim 8 , wherein the unique identifier comprises digital biometric data.

10. The apparatus of claim 9 , wherein the digital biometric data is part of the key stream and is associated with a digitized fingerprint.

11. The apparatus of claim 10 , wherein the reader device uses its own clock cycles to compute a defined part of the key stream of the digitized fingerprint.

12. The apparatus of claim 11 , wherein a subsequent portion of bits of the key stream are offsets of corresponding objects.

13. The apparatus of claim 8 , wherein the processor is further configured to load a secret 48-bit key into a shift register, and shift a string into a state that the received unique identifier matches an identifier of a corresponding tag.

14. A non-transitory computer readable storage medium configured to store instructions that when executed cause a processor to perform:
initializing a virtual smart card in response to a received unique identifier;
reading data associated with the unique identifier via a reader device, wherein the data comprises a key stream of digital data bits associated with the unique identifier;
identifying a user's smart card base address from a first portion of the digital data bits of the key stream; and
authenticating the user based on the unique identifier and results of the read data.

15. The non-transitory computer readable storage medium of claim 14 , wherein the unique identifier comprises digital biometric data.

16. The non-transitory computer readable storage medium of claim 15 , wherein the digital biometric data is part of the key stream and is associated with a digitized fingerprint.

17. The non-transitory computer readable storage medium of claim 16 , wherein the reader device uses its own clock cycles to compute a defined part of the key stream of the digitized fingerprint.

18. The non-transitory computer readable storage medium of claim 17 , wherein subsequent bits of the key stream are offsets of corresponding objects.

19. The non-transitory computer readable storage medium of claim 14 , further comprising:
loading a secret 48-bit key into a shift register; and
shifting a string into a state that the received unique identifier matches an identifier of a corresponding tag.

20. The non-transitory computer readable storage medium of claim 19 , further comprising:
generating a random number; and
sending the random number to the reader device and proving that the tag and reader have knowledge of the secret 48-bit key.

Assignees

• Open Invention Network Llc

Inventors

• Wieland Martin

Classifications

• G06F21/77

  in smart cards · CPC title

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• G06F21/72

  in cryptographic circuits · CPC title

• H04W12/06

  Authentication · CPC title

• H04L63/0442

  wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30) · CPC title