Secure access to secure access module-enabled machine using personal security device
View Patent ↗A system and method are provided to access a secure host device using a personal security device (PSD). A user's PSD may hold a credential of a requesting component of the secure host device. The credential may only be readable from the PSD when a secure channel is established therewith. The establishment of a secure channel with the PSD may require access to keys. The secure host device may contain a SAM capable of securely storing and operating keys. The SMA may contain the relevant keys to support establishment of a secure channel with the personal security device and release a credential to its requesting component. These criteria may achieve the secure release of the credential from the PSD to the requesting component of the secure host device to achieve access by the user when the PSD is presented in the non-contract field of a card reader monitored by the secure host device.
1. A method for accessing a secure host device using a personal security device (PSD) of a user, comprising:
providing the PSD with a credential for accessing the secure host device, wherein the credential is only readable from or operable with the PSD when a secure channel is established between the PSD and the secure host device after presenting the PSD in a non-contact field of a reader monitored by the secure host device, wherein the secure host device includes a secure access module (SAM);
establishing the secure channel with the PSD using keys stored and operated on the secure host device, wherein the establishing of the secure channel is performed in at least one of: a tethered mode of operation or a roaming mode of operation, wherein, for the tethered mode of operation, the PSD releases the credential to the secure host device only when the PSD is cryptographically bound to the secure host device, and, wherein, for the roaming mode of operation, the PSD releases the OS credential to any secure host device activated for a specific group of PSDs; and
securely releasing the credential of the PSD to a requesting component of the secure host device to achieve access by the user to the secure host device when the PSD is presented in the non-contact field.
2. The method according to claim 1 , wherein the requesting component is an operating system (OS) of the secure host device, and wherein the credential is an OS credential.
3. The method according to claim 1 , wherein the requesting component is an application running on the secure host device.
4. The method according to claim 1 , wherein the credential is a one-time password.
5. The method according to claim 1 , wherein the PSD is at least one of: a smart card, a tag, a wearable, or a mobile terminal.
6. The method according to claim 1 , wherein the SAM runs on at least one of: dedicated secure hardware of the secure host device or a main processor of the secure host device.
7. The method according to claim 1 , further comprising:
binding the PSD to the user to provide two factor authentication.
8. A non-transitory computer readable medium storing software for accessing a secure host device using a personal security device (PSD) of a user, the software comprising:
executable code that stores on the PSD a credential for accessing the secure host device, wherein the credential is only readable from or operable with the PSD when a secure channel is established between the PSD and the secure host device after presenting the PSD in a non-contact field of a reader monitored by the secure host device, wherein the secure host device includes a secure access module (SAM);
executable code that establishes the secure channel with the PSD using keys stored and operated on the secure host device, the executable code that establishes the secure channel including at least one of: executable code that provides a tethered mode of operation or executable code that provides a roaming mode of operation, wherein, for the tethered mode of operation, the PSD releases the credential to the secure host device only when the PSD is cryptographically bound to the secure host device, and, wherein, for the roaming mode of operation, the PSD releases the OS credential to any secure host device activated for a specific group of PSDs;
executable code that securely releases the credential of the PSD to a requesting component of the secure host device to achieve access by the user to the secure host device when the PSD is presented in the non-contact field.
9. The non-transitory computer readable medium according to claim 8 , wherein the requesting component is an operating system (OS) of the secure host device, and wherein the credential is an OS credential.
10. The non-transitory computer readable medium according to claim 8 , wherein the requesting component is an application running on the secure host device.
11. The non-transitory computer readable medium according to claim 8 , wherein the credential is a one-time password.
12. The non-transitory computer readable medium according to claim 8 , wherein the PSD is at least one of: a smart card, a tag, a wearable, or a mobile terminal.
13. The non-transitory computer readable medium according to claim 8 , wherein the SAM runs on at least one of: dedicated secure hardware of the secure host device or a main processor of the secure host device.
14. The non-transitory computer readable medium according to claim 8 , further comprising:
executable code that binds the PSD to the user to provide two factor authentication.
15. A device that accesses a secure host device using a personal security device (PSD) of a user, the device comprising:
a non-contact field reader monitored by the secure host device; and
at least one processor that reads software stored on at least one computer readable medium, the software comprising:
executable code that stores on the PSD a credential for accessing the secure host device, wherein the credential is only readable from or operable with the PSD when a secure channel is established between the PSD and the secure host device after presenting the PSD in the non-contact field of the reader monitored by the secure host device, wherein the secure host device includes a secure access module (SAM);
executable code that establishes the secure channel with the PSD using keys stored and operated on the secure host device, the executable code that establishes the secure channel including at least one of: executable code that provides a tethered mode of operation or executable code that provides a roaming mode of operation, wherein, for the tethered mode of operation, the PSD releases the credential to the secure host device only when the PSD is cryptographically bound to the secure host device, and, wherein, for the roaming mode of operation, the PSD releases the OS credential to any secure host device activated for a specific group of PSDs;
executable code that securely releases the credential of the PSD to a requesting component of the secure host device to achieve access by the user to the secure host device when the PSD is presented in the non-contact field.
16. The device according to claim 15 , wherein the PSD is at least one of: a smart card, a tag, a wearable, or a mobile terminal., and wherein the secure host device includes a secure access module.