Method and system for verifying an access request
A system for verifying a request for access to data is provided, the system comprising a first module and a second module. The first module is arranged to generate a password, and the second module is arranged to receive a password associated with a request for data (received at step), validate the received password, and enable access to the requested data. The system is such that the first and second modules share a secret that has been uniquely assigned thereto, the shared secret being for use in generation and validation of a said password. Furthermore, the first module is communicatively disconnected from the second module.
1. A system for use in verifying a request for access to data, the system comprising:
a first module arranged to generate a password and output the generated password via an interface of the first module;
a second module arranged to receive a password associated with the request for access to data, validate the received password, and enable access to the requested data, wherein said received password is received via an interface of the second module and corresponds to the password generated by the first module,
wherein the first and second modules share a secret that has been uniquely assigned to the first and second modules for use in generation and validation of a said password, and
wherein the first module is communicatively disconnected from the second module, and
wherein the first module and second module are composite parts of a device, and
wherein the second module comprises a user interface and is arranged to receive the request for access to data and information that uniquely identifies a human from a user of the second module via that user interface, and wherein said data sent by the second module for use in enabling access to data comprises data that uniquely identifies said human.
2. A system according to claim 1 , wherein said second module is arranged to validate passwords associated with a further module with which it has been paired during a configuration process in which a secret is assigned to the second module and the further module.
3. A system according to claim 1 , wherein said device has a unique device identifier and said generated and received passwords are generated and validated in dependence upon the unique device identifier.
4. A system according to claim 1 , wherein said shared secret is stored in at least one of: a secure element of the first module and a secure element of the second module.
5. A system according to claim 1 , wherein the second module is arranged to send data for use in enabling access to the requested data, whereby to enable access to the requested data.
6. A system according to claim 1 , wherein the first module is adapted to:
generate a subsequent password in response to a subsequent input related to a request for access to data, or
generate one or more subsequent passwords at regular time intervals,
wherein a said subsequently generated password is different from a previously generated password.
7. A method of verifying a request for access to data, the method comprising:
generating at a first module a password and outputting the generated password via an interface of the first module;
receiving at a second module a password associated with the request for access to data via an interface of the second module, said received secret corresponding to the password generated by the first module;
validating at the second module said received password; and
enabling access to the requested data at the second module by sending data from the second module,
wherein the first and second modules share a secret that has been uniquely assigned to the first and second modules for use in generation and validation of a said password, and
wherein the first module is communicatively disconnected from the second module, and
wherein the first module and second module are composite parts of a device, and
wherein the second module comprises a user interface and is configured to receive the request for access to data and information that uniquely identifies a human from a user of the second module via that user interface, and wherein said data sent by the second module for use in enabling access to data comprises data that uniquely identifies said human.
8. A method according to claim 7 , wherein said second module validates passwords associated with a further module with which it has been paired during a configuration process in which a secret is assigned to both the second module and the further module.
9. A method according to claim 7 , wherein said device has a unique device identifier and said generated and received passwords are generated and validated in dependence upon the unique device identifier.
10. A method according to claim 7 , wherein said shared secret is stored in at least one of: a secure element of the first module and a secure element of the second module.
11. A method according to claim 7 , wherein the second module sends data for use in enabling access to the requested data, whereby to enable access to the requested data.
12. A method according to claim 7 , comprising one of:
generating at the first module a subsequent password in response to a subsequent input related to a request for access to data,
generating one or more subsequent passwords at regular time intervals,
in which a said subsequently generated password is different from a previously generated password.
13. A system for use in verifying a request for data received at a device as a request originating from a human in possession of the device, the system comprising:
a first module arranged to generate a password and output the generated password via an interface of the first module;
a second module arranged to receive a password associated with the request for data and validate the received password, and to enable access to data, wherein said received password is received via an interface of the second module and corresponds to the password generated by the first module,
wherein the interface of the second module comprises a user interface, and wherein the user interface is arranged to receive the request for data and information that uniquely identifies a human from a user of the second module via that user interface, and
wherein the user interface is further arranged to send data for use in enabling access to data, the sent data comprising data that uniquely identifies said human, and
wherein the first module and the second module are composite parts of the device, and
wherein the first module is communicatively disconnected from the second module.
14. A system according to claim 13 , wherein said first module and said second module are integrated within the device.
15. A system according to claim 13 , wherein the first and second modules share a secret for use in generation and validation of a said password.
16. A system according to claim 13 , wherein the second module is arranged to validate the received password by comparing the received password to a password generated by a third module.
17. A system according to claim 13 , wherein the first module is adapted to:
generate a subsequent password in response to a subsequent input related to a request for access to data, or
generate one or more subsequent passwords at regular time intervals, wherein a subsequently generated password is different from a previously generated password.
18. A method of verifying a request for data received at a device as a request originating from a human in possession of the device, the method comprising:
generating at a first module a password and outputting the generated password via an interface of the first module;
receiving at a second module a password associated with the request for date via a user interface of the second module, said received password corresponding to the password generated by the first module;
validating at the second module the received password; and
enabling access to data at the second module,
wherein the user interface receives the request for data and information that uniquely identifies a human from a user of the second module via that user interface, and
wherein enabling access to data further comprises sending data for use in enabling access to data, the sent data comprising data that uniquely identifies said human, and
wherein the first module and the second module are composite parts of the device, and
wherein the first module is communicatively disconnected from the second module.
19. A method according to claim 18 , wherein said first module and said second module are integrated within the device.
20. A method according to claim 18 , wherein the first and second modules share a secret for use in generation and validation of a said password.
21. A method according to claim 18 , wherein the second module validates the received password by comparing the received password to a password generated by a third module.
22. A method according to claim 18 , comprising one of:
generating at the first module a subsequent password in response to a subsequent input related to a request for access to data,
generating one or more subsequent passwords at regular time intervals,
in which a said subsequently generated password is different from a previously generated password.