Security token and service access system
According to an aspect of the invention, a security token for facilitating access to a remote computing service via a mobile device is conceived, said security token comprising an NFC interface, a smart card integrated circuit and a smart card applet stored in and executable by said smart card integrated circuit, wherein the smart card applet is arranged to support a cryptographic challenge-response protocol executable by the mobile device.
1. A security token configured to facilitate access to a remote computing service via a mobile device external to said security token, said security token comprising:
a Near Field Communication (NFC) interface;
a smart card integrated circuit; and
a smart card applet stored in and executable by said smart card integrated circuit, wherein the smart card applet is configured to support a cryptographic challenge-response protocol executable by the mobile device, wherein a plurality of credentials for the cryptographic challenge-response protocol are maintained inside a single security token.
2. The security token as claimed in claim 1 , wherein the cryptographic challenge-response protocol is executable between the remote computing service and the security token.
3. The security token as claimed in claim 1 , further comprising:
a real-time clock, wherein said real-time clock is configured to support a time-based cryptographic authentication protocol.
4. The security token as claimed in claim 1 , further comprising:
a NFC Data Exchange Format (NDEF) message read/write interface, wherein the cryptographic challenge-response protocol is executable via said NDEF message read/write interface.
5. The security token as claimed in claim 1 , wherein the smart card applet is further configured to receive a credential for use in the cryptographic challenge-response protocol.
6. The security token as claimed in claim 5 , wherein the plurality of credentials correspond to different remote computing services.
7. The security token as claimed in claim 3 , wherein the smart card applet is further configured to receive a personal identification number from the mobile device and to allow execution of the cryptographic challenge-response protocol or the time-based cryptographic authentication protocol only if said personal identification number corresponds to a predefined number.
8. A service access system comprising the security token as claimed in claim 3 , the service access system further comprising:
a mobile device external to said security token and configured to execute the cryptographic challenge-response protocol or the time-based cryptographic authentication protocol.
9. The security token of claim 1 , wherein the smart card applet uses an ISO 7816-4 compatible file system.
10. The security token of claim 1 , wherein each credential of the plurality of credentials comprises one or more secret values and a Personal Identification Number (PIN).
11. The security token of claim 10 , wherein each credential further comprises a clock synchronization value.