Proxy authentication methods and apparatus
A proxy authentication method and apparatus is described for use in user authentication, e.g. for payment transactions. The authentication is carried out before the transaction between a electronic, e.g. digital identification device and a person terminal. Verification information is entered at the personal terminal to authenticate the user and if this is successful a verification flag is set in the digital identification device. The status of this flag, or an encrypted version thereof can be used by a transaction terminal of evidence that the user has been authenticated without having to transmit any secret identification information to the transaction terminal.
1. A method for authorizing a transaction using a personal terminal, a transaction terminal and an electronic identification device having memory, the electronic identification device having been offered up to the personal terminal for communication therewith and verification information having been entered into the personal terminal, the method comprising:
receiving the verification information at the electronic identification device from the personal terminal;
the electronic identification device verifying if the verification information is valid and setting a status of a verification flag in the memory of the electronic identification device indicative of the verification information being valid prior to introducing the electronic identification device to the transaction terminal;
receiving evidence of the status of the verification flag at the transaction terminal from the electronic identification device after introducing the electronic identification device to the transaction terminal;
verifying the status of said verification flag was not maliciously modified; and
receiving data indicating that the transaction was authorized.
2. The method of claim 1 wherein the evidence is generated by the electronic identification device by a computation of cryptographic code.
3. The method of claim 2 , wherein the cryptographic code is in the form of a digital signature.
4. The method of claim 1 , wherein the transaction terminal verifies the evidence offline.
5. The method of claim 1 , wherein verification of the evidence is carried out online by an authorization entity of an issuer of the digital identification device.
6. The method of claim 5 , wherein the evidence is a Message Authentication Code.
7. The method of claim 1 , wherein the verification information is a secret identification code.
8. The method of claim 1 , wherein the verification information is biometric data.
9. The method of claim 1 further comprising storing a cryptographic authentication token in the electronic identification device, the cryptographic authentication token being evidence of the status of the verification flag.
10. The method according to claim 1 , wherein the transaction terminal authorizes a transaction at the transaction terminal in response to the receipt of the evidence.
11. The method according to claim 10 , wherein the evidence is transmitted from the transaction terminal to the authorization entity over a communications link; further comprising: receiving a response from said authorization entity; and authorizing a transaction at the transaction terminal in response to said receiving step.
12. A system for authorizing a transaction using a personal terminal, a transaction terminal and an electronic identification device having memory, the electronic identification device having been offered up to the personal terminal for communication therewith and verification information having been entered into the personal terminal and communicated to the electronic identification device, wherein:
the electronic identification device has means for verifying if the verification information received from the personal terminal is valid and for setting a status of a verification flag in the memory of the electronic identification device indicative of the verification information being valid prior to introducing the electronic identification device to the transaction terminal, and
the transaction terminal has means for receiving evidence of the status of the verification flag at the transaction terminal from the electronic identification device after introducing the electronic identification device to the transaction terminal;
means for verifying the status of said verification flag was not maliciously modified; and
means for receiving data indicating that the transaction was authorized.
13. The system of claim 12 wherein the electronic identification device and/or the personal terminal has means for generating the evidence as a cryptographic code.
14. The system of claim 13 , wherein the means for generating evidence as a cryptographic code has means for generating a digital signature.
15. The system of claim 12 , wherein the transaction terminal has means for verifying the evidence offline.
16. The system of claim 12 , wherein the system has means for verification of the evidence online by an authorization entity of an issuer of the electronic identification device.
17. The system of claim 16 , wherein the evidence is a Message Authentication Code.
18. The system of claim 12 , wherein the verification information is a secret identification code.
19. The system of claim 12 , wherein the electronic identification device has means for storing a cryptographic authentication token in the digital identification device, the cryptographic authentication token being evidence of the status of the verification flag.
20. The system according to claim 12 , wherein the transaction terminal has means to authorize a transaction at the transaction terminal in response to the receipt of the evidence.
21. The system according to claim 20 , wherein the transaction terminal has means for transmitting the evidence from the transaction terminal to the authorization entity over a communications link, means for receiving a response from said authorization entity; and authorizing a transaction at the transaction terminal in response to said receiving step.