System and method for encrypted smart card pin entry
View Patent ↗A smart card, system, and method for securely authorizing a user or user device using the smart card is provided. The smart card is configured to provide, upon initialization or a request for authentication, a public key to the user input device such that the PIN or password entered by the user is encrypted before transmission to the smart card via a smart card reader. The smart card then decrypts the PIN or password to authorize the user. Preferably, the smart card is configured to provide both a public key and a nonce to the user input device, which then encrypts a concatenation or other combination of the nonce and the user-input PIN or password before transmission to the smart card. The smart card reader thus never receives a copy of the PIN or password in the clear, allowing the smart card to be used with untrusted smart card readers.
1. An authentication method, comprising:
receiving, at a mobile communication device from a smart card via a smart card reader over a wireless communication link, a challenge comprising a public key and a nonce generated and stored at the smart card;
transmitting, from the mobile communication device to the smart card over the wireless communication link via the smart card reader, a response to the challenge, the response comprising user authentication information encrypted using the challenge comprising the public key and the nonce; and
receiving a verification signal at the mobile communication device over the wireless communication link from the smart card, the receiving the verification signal responsive to a determination that user authentication information obtained by decrypting the encrypted user authentication information at the smart card matches predetermined authentication information, the decrypting using a private key corresponding to the public key and the nonce, the private key and the predetermined authentication information stored in secure memory in the smart card.
2. The method of claim 1 , further comprising the mobile communication device receiving the user authentication information via a user interface of the mobile communication device.
3. The method of claim 1 , further comprising authenticating a user if the encrypted user authentication information thus decrypted matches predetermined authentication information.
4. The method of claim 1 , further comprising providing the mobile communication device access to a further private key stored in the secure memory.
5. The method of claim 1 , wherein the user authentication information comprises a PIN or password.
6. The authentication method of claim 1 , further comprising determining that the user authentication information obtained by decrypting the encrypted user authentication information matches the predetermined authentication information.
7. A method for providing authentication information to a smart card, the method comprising:
receiving, at a mobile communication device from the smart card via a smart card reader over a wireless communication link, a challenge comprising a public key and a nonce generated and stored at the smart card;
transmitting, from the mobile communication device to the smart card over the wireless communication link via the smart card reader, a response to the challenge, the response comprising user authentication information encrypted using the challenge comprising the public key and the nonce; and
the smart card decrypting the encrypted user authentication information using a private key corresponding to the public key and the nonce,
wherein the response is verifiable by the smart card by:
matching the user authentication information thus decrypted with predetermined authentication information stored at the smart card.
8. The method of claim 7 , further comprising the mobile communication device receiving the user authentication information via a user interface of the mobile communication device.
9. The method of claim 7 , further comprising authenticating a user if the encrypted user authentication information thus decrypted matches predetermined authentication information.
10. The method of claim 7 , further comprising providing the mobile communication device access to a further private key stored in the secure memory.
11. The method of claim 7 , wherein the user authentication information comprises a PIN or password.
12. The method of claim 7 , further comprising the smart card:
decrypting the encrypted user authentication information using the private key and the nonce; and
matching the user authentication information thus decrypted with the predetermined authentication information.
13. An authentication method, comprising:
transmitting, from a smart card to a mobile communication device via a smart card reader communicating with the mobile communication device over a wireless communication link, a challenge comprising a public key and a nonce generated and stored at the smart card;
receiving, at the smart card from the mobile communication device via the smart card reader, a response to the challenge, the response comprising user authentication information encrypted using the challenge comprising the public key and the nonce;
decrypting, at the smart card, the user authentication information thus encrypted using a private key corresponding to the public key, and the nonce; and
transmitting a verification signal from the smart card to the mobile communication device via the smart card reader upon determination that user authentication information thus decrypted matches predetermined authentication information stored at the smart card.
14. The method of claim 13 , wherein the user authentication information is received by the mobile communication device via a user interface.
15. The method of claim 13 , further comprising authenticating a user if the encrypted user authentication information thus decrypted matches predetermined authentication information.
16. The method of claim 13 , further comprising providing the mobile communication device access to a further private key stored in the secure memory.
17. The method of claim 13 , wherein the user authentication information comprises a PIN or password.
18. The authentication method of claim 13 , further comprising the smart card determining that the user authentication information thus decrypted matches the predetermined authentication information.