Method and apparatus to provide authentication using an authentication card

1. A method comprising:

sending a challenge to a user to be authenticated, the challenge including a reference on a card issued to the user, that was utilized in conjunction with a secret key to calculate a corresponding value on the card;

receiving, from the user in response to the challenge, a user-supplied value from the card that is purported by the user to be associated with the reference on the card issued to the user;

accessing a secret key associated with the card issued to the user;

generating a code using a secure one-way function F of the secret key and the reference;

mapping the code to a value in an alphabet; and

authenticating the user by comparing the value in the alphabet to the user-supplied value from the card.

2. The method of claim 1 , wherein the function F comprises a hash-based one-time password (HOTP).

3. The method of claim 1 , further comprising receiving a user identifier from the user in response to the challenge, wherein accessing the secret key comprises mapping the user identifier to a card number associated with the user identifier, the card number being the card number of the card issued to the user.

4. The method of claim 1 , wherein generating the code using the secure one-way function F comprises generating the function F using a concatenation of the secret key and the reference.

5. The method of claim 1 , wherein the alphabet comprises a set of characters consisting of the English language alphabet A to Z and the Arab numerals 0 to 9.

6. The method of claim 1 , wherein accessing the secret key comprises accessing the secret key used to generate all values on the card issued to the user when the card was originally created.

7. A method comprising:

sending a challenge to a user to be authenticated, the challenge asking for information contained on a card issued to the user, wherein sending the challenge includes sending a set of references corresponding with a set of reference value pairs contained on the card;

receiving a response to the challenge, the response comprising user-supplied information from the card, wherein the user-supplied information purports to be a set of values corresponding with the set of reference-value pairs;

accessing a secret key associated with the card issued to the user;

generating the information requested in the challenge using a secure one-way function of the secret key; and

authenticating the user by comparing the generated information to the user-supplied information from the card in the received response.

8. The method of claim 7 , wherein accessing the secret key comprises accessing a hardware security module (HSM).

9. The method of claim 7 , wherein receiving the response to the challenge comprises receiving an indication of a correct reference-value pairs of a set of displayed reference-value pairs.

10. A method comprising:

sending a challenge to a user to be authenticated, the challenge asking for information contained on a card issued to the user;

receiving a response to the challenge the response comprising user-supplied information from the card;

accessing a secret key associated with the card issued to the user;

generating the information requested in the challenge using a secure one-way function of the secret key, wherein generating the information comprises calculating a secure one-way hash-based function of the secret key and at least a portion of the challenge;

and

authenticating the user by comparing the generated information to the user-supplied information from the card in the received response.

11. The method of claim 10 , wherein the portion of the challenge comprises a reference contained on the card.

12. An authentication system comprising:

a user interface to send a challenge to a user to be authenticated, the challenge including a reference on a card, that was utilized in conjunction with a secret key to calculate a corresponding value on the card, issued to the user, and to receive a response to the challenge, the response comprising a user-supplied value from the card purported by the user to be associated with the reference on the card issued to the user;

a key database containing a secret key associated with the card issued to the user; and

an authentication module to authenticate the user by generating the information requested in the challenge using a secure one-way function of the secret key and the reference to generate a code, mapping the code to a value, and comparing the value to the user-supplied information from the card in the received response for authentication.

13. The authentication system of claim 12 , further comprising: a challenge generator to generate a challenge comprising a set of references corresponding to a set of reference-value pairs contained on the card.

14. The authentication system of claim 12 , wherein accessing the key database comprises a hardware security module (FISM).

15. The authentication system of claim 12 , wherein the authentication module generates the information by calculating a one-way hash of the secret key and at least a portion of the challenge.

16. The authentication system of claim 12 , wherein the authentication module generates the information by calculating hash-based one-time password (HOTP) using a concatenation of the secret key and at least a portion of the challenge.

17. A method comprising:

sending a challenge to a user to be authenticated, the challenge comprising a display of a plurality of reference-value pairs;

receiving a response from the user indicating a first reference-value pair of the plurality of reference-value pairs that matches a reference-value pair printed on a card issued to the user;

accessing a secret key associated with the card issued to the user;

authenticating the user using the secret key and the received response with a secure one-way function of the secret key and at least a portion of the received response.

18. The method of claim 17 , wherein authentication the user comprises generating the correct values for the plurality of reference-value pairs using the secret key, and determining whether the first reference-value pair identified by the user was correctly displayed in the challenge.

19. A method for a card-based second factor authentication, the method comprising:

requesting information from a user based on a reference-value pair from a card supplied to a user;

calculating a value of the reference-value pair based on a secure one-way function of a secret key associated with the card and a reference of the reference-value pair; and

authenticating the user if the requested information from the card supplied to the user matches the calculated value.

20. The method of claim 19 , wherein the user is required to enter a value of the reference-value pair when provided with the reference of the reference-value pair.

21. The method of claim 19 , wherein the user is required to select a correct reference-value pair from a set including a plurality of incorrect reference-value pairs.