Abstract:
Systems and methods for a smart card accessible over a personal area network (PAN). An example method may include: communicatively coupling a device to the PAN, storing a digital certificate that identifies a user, logging the user on to an additional device within the PAN, and providing an encryption service for the additional device, by: receiving a message to be encrypted, encrypting the message, sending the encrypted message to the additional device via the PAN, receiving an encrypted version of an additional message, decrypting the additional message using the private key associated with the user to produce an unencrypted version of the additional message, and sending the unencrypted version of the additional message to the additional device via the PAN.

Description:
RELATED APPLICATIONS 
       [0001]    The present application is a continuation of U.S. patent application Ser. No. 13/476,722, filed May 21, 2012 (now U.S. Pat. No. 9,060,274) which is a continuation of U.S. patent application Ser. No. 11/888,991, filed Aug. 2, 2007 (now U.S. Pat. No. 8,213,902), each of which is incorporated by reference herein. 
     
    
     TECHNICAL FIELD 
       [0002]    Embodiments of the present invention relate to smart cards, and more specifically to making smart cards accessible over wireless personal area networks. 
       BACKGROUND 
       [0003]    Today, the use of smart card has become more and more common in everyday life. For example, many credit cards, debit cards, identification cards, insurance cards, etc. are made of smart cards. In general, many conventional smart cards include storage media and processing modules, and thus, are more useful and powerful than cards having conventional magnetic strips. Some conventional smart cards provide digital certificates to allow users to authenticate themselves in order to access their financial accounts, healthcare records, etc. Typically, a smart card has to be physically coupled to a smart card reader (e.g., inserted into, or put onto), which is a dedicated device for communicating with smart cards. The smart card reader may be further connected to a computer, a workstation, a special-purpose machine (e.g., a cash register), etc., which may communicate with the smart card via the smart card reader. 
         [0004]    One problem with the above system is the need of the smart card reader. In order to enable a computer to communicate with smart cards, one has to spend extra money to purchase the smart card reader. For an entity (e.g., a company, a library, etc.) that has many computers, it may become costly to purchase a smart card reader for every computer. 
         [0005]    The above system also suffers from a potential security loophole. Users often forget to remove their smart cards when they leave the computer. Conventional smart card readers typically do not remind users to remove their cards when they are done. As a result, a user may leave his smart card in the smart card reader inadvertently and an unauthorized individual may use the smart card left behind to log onto the computer. This poses a security threat to the entire system. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0006]    The present invention is illustrated by way of example, and not by way of limitation, in the figures of the accompanying drawings and in which: 
           [0007]      FIG. 1A  illustrates one embodiment of a portable device in which embodiments of the present invention may be implemented. 
           [0008]      FIG. 1B  illustrates one embodiment of a system in which embodiments of the present invention may be implemented. 
           [0009]      FIG. 2A  illustrates a flow diagram of one embodiment of a process to authenticate a user. 
           [0010]      FIG. 2B  illustrates a flow diagram of one embodiment of a process to automatically log off a user. 
           [0011]      FIG. 3  illustrates one embodiment of a call diagram of a process to encrypt and/or decrypt messages. 
           [0012]      FIG. 4  illustrates a block diagram of an exemplary computer system. 
       
    
    
     DETAILED DESCRIPTION 
       [0013]    Described herein are some embodiments of a smart card accessible over a personal area network. In one embodiment, a smart card includes a wireless transceiver to communicatively couple to a personal area network (PAN) to receive an authentication request via the PAN from a computer. The smart card further includes a storage device to store a digital certificate that uniquely identifies a user. An authentication module in the smart card may authenticate the user in response to an authentication request from the computer using the digital certificate, wherein the user is allowed to access the computer upon authentication (e.g., the user is automatically logged onto the computer upon authentication). In some embodiments, the smart card is implemented on a portable device, such as a cellular telephone, a personal digital assistant, etc. 
         [0014]    In the following description, numerous details are set forth. It will be apparent, however, to one skilled in the art, that the present invention may be practiced without these specific details. In some instances, well-known structures and devices are shown in block diagram form, rather than in detail, in order to avoid obscuring the present invention. 
         [0015]    Some portions of the detailed descriptions below are presented in terms of algorithms and symbolic representations of operations on data bits within a computer memory. These algorithmic descriptions and representations are the means used by those skilled in the data processing arts to most effectively convey the substance of their work to others skilled in the art. An algorithm is here, and generally, conceived to be a self-consistent sequence of steps leading to a desired result. The steps are those requiring physical manipulations of physical quantities. Usually, though not necessarily, these quantities take the form of electrical or magnetic signals capable of being stored, transferred, combined, compared, and otherwise manipulated. It has proven convenient at times, principally for reasons of common usage, to refer to these signals as bits, values, elements, symbols, characters, terms, numbers, or the like. 
         [0016]    It should be borne in mind, however, that all of these and similar terms are to be associated with the appropriate physical quantities and are merely convenient labels applied to these quantities. Unless specifically stated otherwise as apparent from the following discussion, it is appreciated that throughout the description, discussions utilizing terms such as “processing” or “computing” or “calculating” or “determining” or “displaying” or the like, refer to the action and processes of a computer system, or similar electronic computing device, that manipulates and transforms data represented as physical (electronic) quantities within the computer system&#39;s registers and memories into other data similarly represented as physical quantities within the computer system memories or registers or other such information storage, transmission or display devices. 
         [0017]    The present invention also relates to apparatus for performing the operations herein. This apparatus may be specially constructed for the required purposes, or it may comprise a general-purpose computer selectively activated or reconfigured by a computer program stored in the computer. Such a computer program may be stored in a machine-readable storage medium, such as, but is not limited to, any type of disk including floppy disks, optical disks, CD-ROMs, and magnetic-optical disks, read-only memories (ROMs), random access memories (RAMs), EPROMs, EEPROMs, magnetic or optical cards, or any type of media suitable for storing electronic instructions, and each coupled to a computer system bus. 
         [0018]    The algorithms and displays presented herein are not inherently related to any particular computer or other apparatus. Various general purpose systems may be used with programs in accordance with the teachings herein, or it may prove convenient to construct more specialized apparatus to perform the required method steps. The required structure for a variety of these systems will appear from the description below. In addition, the present invention is not described with reference to any particular programming language. It will be appreciated that a variety of programming languages may be used to implement the teachings of the invention as described herein. 
         [0019]      FIG. 1A  illustrates one embodiment of a portable device in which embodiments of the present invention may be implemented. The portable device  100  may be a smart card. Alternatively, the portable device  100  may be a cellular telephone, a personal digital assistant (PDA), etc. The portable device  100  includes a wireless transceiver  110 , an authentication module  120 , a private key generator  130 , an encryption module  140 , a storage device  150 , and a decryption module  160 , which are coupled to each other via a bus system  180 . The wireless transceiver  110  is operable to communicatively couple to a wireless personal area network (PAN). One example of the wireless transceiver  110  is a radio frequency (RF) transceiver. A PAN in general refers to a computer network for computer and/or other electronic devices (e.g., cellular telephones, PDAs, smart cards, etc.) close to a person to communicate with each other. The PAN may adopt one of various short-range communication protocols or standards, such as Bluetooth™, IrDA (Infrared Data Association) specification, ultra-wideband (UWB) standard, etc. For example, the PAN may be implemented using Bluetooth™ technology, where the PAN includes a master device and a number of slave devices. In one embodiment, the PAN includes a computer (e.g., a desktop computer, a laptop computer, etc.) acting as a master device and up to seven slave devices (e.g., cellular telephones, PDAs, wireless mouse, etc.). The range of a PAN is typically a few meters. Thus, an electronic device in the PAN may be communicatively decoupled from the PAN if the electronic device is physically moved away from the master device of the PAN beyond a predetermined distance. An exemplary embodiment of a system having a PAN is shown in  FIG. 1B  as discussed below. 
         [0020]    Referring back to  FIG. 1A , the wireless transceiver  110  may detect the PAN and other devices communicatively coupled to the PAN when the wireless transceiver  110  is within a predetermined physical range of the PAN. The wireless transceiver  110  may include a radio frequency (RF) transceiver, such as a Bluetooth™ transceiver. 
         [0021]    Once the wireless transceiver  110  establishes communication with the PAN according to the communication protocol of the PAN, the wireless transceiver  110  may receive an authentication request from another device in the PAN (e.g., the master device in the PAN). For the following discussion, the authentication request is from a computer acting as a master device in the PAN. The wireless transceiver  110  forwards the authentication request to the authentication module  120 . The authentication module  120  may retrieve a digital certificate of a user from the storage device  150  in response to the authentication request. Using the digital certificate retrieved, the authentication module  120  may authenticate the user to the master device. Note that the digital certificate uniquely identifies the user who is a person, and thus, may function as a personal identification (ID) of the user. Thus, for security reason, the digital certificate is protected from being extracted from the portable device  100 . For example, the portable device  100  may allow only use of the digital certificate internal to the portable device  100 . The portable device  100  may not allow transmission of the digital certificate to any external device. Upon successful authentication, the master device may automatically allow the user to log on. However, the portable device  100  may be communicatively decoupled from the PAN when the portable device  100  is physically moved away from the master device beyond a predetermined distance. Thus, when the user carrying the portable device  100  moves away from the computer beyond the predetermined distance, the master device may detect a loss of signal from the portable device  100 . In response to detecting the loss of signal from the portable device  100  for over the predetermined time period, the computer may conclude that the user has left the room housing the computer. To protect the user&#39;s computer account from unauthorized access, the computer may automatically log off the user then. For example, the user may leave the computer and forget to log off. If the portable device  100  is a personal portable device (e.g., cellular telephone, PDAs, etc.), then the user typically carries the personal portable device on his person (e.g., in a pocket of the clothing of the user). Thus, the portable device  100  would be moved away from the computer as the person leaves the computer. When the portable device  100  is far enough from the computer, the portable device would be communicatively decoupled from the PAN. As such, the computer may automatically log off the user after the portable device  100  is communicatively decoupled from the PAN for the predetermined time period. 
         [0022]    Furthermore, many computers (both desktop computers and laptop computers) have been pre-installed with a wireless transceiver compatible with one or more communication protocols for PAN. Thus, there is no need to purchase a separate device reader for each computer in order to communicate with the portable device  100 . 
         [0023]    In addition to the above advantages, storing the digital certificate on the portable device  100  also makes the digital certificate portable, and hence, easier to use. Since the digital certificate is being carried on the portable device  100 , which may wirelessly access the PAN via the wireless transceiver  110 , the user may use the digital certificate on computers that can wirelessly communicate with the portable device  100 . Unlike many conventional systems, where the digital certificate is installed in a single computer and thus, usable with the single computer only, the user is not limited to using the digital certificate with a single computer. Furthermore, the user may not have to carry any extra portable devices (e.g., keys, fobs, etc.) if the portable device  100  is implemented on a commonly used portable device, such as a cellular phone. 
         [0024]    In addition to securely automating the user log-on and log-off process, the portable device  100  may perform other transactions with the computer using the digital certificate and/or a private key of the user, such as signing electronic mail (email), encrypting messages and/or documents, decrypting messages and/or documents, etc. In some embodiments, the private key generator  130  in the portable device  100  generates a private key for the user. The private key may also be stored in the storage device  150 . Using the private key, the encryption module  140  may encrypt documents (e.g., email) in response to an encryption request from the computer Likewise, the decryption module  160  may decrypt documents in response to a decryption request from the computer. Details of some embodiments of encryption and decryption of documents are discussed below. 
         [0025]      FIG. 1B  illustrates one embodiment of a system in which embodiments of the present invention may be implemented. The system  190  includes a PAN  191 , a computer  193 , a cellular telephone  195 , and a smart card  197 . The PAN  191  may be established according to Bluetooth™ protocol. The computer  193  may act as a master device in the PAN  191 , whereas the cellular telephone  195  and the smart card  197  act as slave devices in the PAN  191 . The portable device  100  in  FIG. 1A  may be implemented in the cellular telephone  195  and/or the smart card  197 . Thus, a user of the cellular telephone  195  and/or the smart card  197  may log onto the computer  193  using the digital certificate in the cellular telephone  195  and/or the smart card  197  as discussed above. While logged onto one&#39;s account, the user may further use the digital certificate and/or a private key in the cellular phone  195  and/or the smart card  197  to perform other tasks, such as encrypting and decrypting messages from the computer  193 . 
         [0026]    Note that any or all of the components and the associated hardware illustrated in  FIG. 1B  may be used in various embodiments of the system  190 . However, it should be appreciated that other configurations of the system  190  may include more or fewer devices than those shown in  FIG. 1B . For example, there may be additional slave devices coupled to the PAN  191  than those shown in  FIG. 1B . 
         [0027]      FIG. 2A  illustrates a flow diagram of one embodiment of a process to authenticate a user. The process may be performed by processing logic that may comprise hardware (e.g., circuitry, dedicated logic, programmable logic, microcode, etc.), software (such as instructions run on a processing device), firmware, or a combination thereof. For example, the computer  193  in  FIG. 1B  may perform at least part of the process. 
         [0028]    Referring to  FIG. 2A , processing logic searches for any portable device communicatively coupled to a PAN (processing block  210 ). For example, processing logic may send signals to scan for devices in the PAN. A portable device, such as the portable device  100  shown in  FIG. 1A , may wirelessly transmit signals identifying itself to other devices coupled to the PAN, and such signals may be picked up by processing logic during the scan. Processing logic thus detects the portable device. Then processing logic sends an authentication request to the portable device (processing block  212 ). In response to the authentication request, the portable device may perform authentication using a digital certificate stored in the portable device as discussed above. Processing logic checks if authentication is successful (processing block  214 ). If authentication is successful, then processing logic allows access by a user associated with the digital certificate in the portable device (processing block  218 ). For example, the user may be allowed to log onto his account and perform operations allowable under some predetermined privileges of the account. For example, if the account is an administrator account, the user is allowed to perform administrative operations after logging onto his account. Otherwise, if authentication fails, processing logic denies access to the user (processing block  219 ). 
         [0029]      FIG. 2B  illustrates a flow diagram of one embodiment of a process to automatically log off the user. The process may be performed by processing logic that may comprise hardware (e.g., circuitry, dedicated logic, programmable logic, microcode, etc.), software (such as instructions run on a processing device), firmware, or a combination thereof. For example, the computer  193  in  FIG. 1B  may perform the process. 
         [0030]    Referring to  FIG. 2B , processing logic detects a loss of signal from the portable device over the PAN (processing block  220 ). Then processing logic checks if a predetermined time period has expired yet (processing block  222 ). If the predetermined time period has not yet expired, then processing logic remains in processing block  222 . Otherwise, if the predetermined time period has expired, then processing logic checks if the communication with the portable device has been re-established (processing block  224 ). If the communication with the portable device has been re-established, then processing logic allows the user to remain logged on (processing block  226 ). Otherwise, if the communication with the portable device has not been re-established, then processing logic logs out the user (processing block  228 ). For example, processing logic may terminate the current transaction and/or session the user has been in. In addition to logging in and logging out users, the portable device  100  may be used to perform other tasks in cooperation with the computer in the PAN. One example of such tasks is discussed in details with reference to  FIG. 3  below. 
         [0031]      FIG. 3  illustrates one embodiment of a call diagram of a process to encrypt and/or decrypt messages. In the call diagram  300 , transactions are performed between a portable device  311  and a computer  321 , which communicate wirelessly via a PAN  330 . Operations shown to the left of line  310  are performed at the portable device  311 , and operations shown to the right of line  320  are performed at the computer  321 . Communications between the portable device  311  and the computer  321  via the PAN  330  are shown between the lines  310  and  320 . 
         [0032]    In some embodiments, the computer  321  sends an authentication request ( 1 ) to the portable device to try to authenticate a user. In response to the authentication request ( 1 ), the portable device  311  authenticates the user using a digital certificate stored in the portable device  311  ( 2 ). Then the portable device  311  sends the authentication result ( 3 ) back to the computer  321 . If the authentication has been successful, then the computer  321  allows the user to log on ( 4 A). Otherwise, the computer  321  denies access to the user ( 4 B). 
         [0033]    In the following discussion, suppose the user has been authenticated successfully and the computer  321  has allowed the user to log on. While being logged onto the computer  321 , the user may desire to send an encrypted message via electronic mail to a public network (e.g., the Internet). The message may be encrypted in the following manner. In some embodiments, the computer  321  sends an encryption request ( 5 A) and the message ( 5 B) to the portable device  311 . In response to the encryption request ( 5 A), the portable device may generate a private key for the user and encrypt the message ( 5 B) using the private key ( 6 ). Then the private key generated may be stored in the portable device  311 . Alternatively, the portable device  311  may retrieve a previously generated private key for the user and encrypt the message ( 5 B) using this private key. Note that this previously generated private key may be generated by the portable device  311  or by another device (e.g., another computer, a server, a dedicated device, etc.) and then loaded onto the portable device  311 . Then the portable device may send the encrypted message ( 7 ) to the computer  321 . Then the computer  321  sends the encrypted message to the public network ( 8 ). 
         [0034]    In addition to encrypting messages, the portable device  311  may decrypt messages for the computer  321 . In some embodiments, the computer  321  receives an encrypted message from the public network ( 9 ). The computer  321  sends a decryption request ( 10 A) and the encrypted message ( 10 B) to the portable device  311 . In response to the decryption request ( 10 A), the portable device  311  retrieved the private key to decrypt the encrypted message ( 10 B). After decrypting the message ( 10 B), the portable device  311  sends the decrypted message ( 12 ) to the computer  321 . Then the computer  321  receives the decrypted message to read ( 13 ). 
         [0035]    Since the digital certificate used in authenticating the user and the private key used in encryption and decryption are stored in the portable device  311 , the user may conveniently carry the digital certificate and the private key in the portable device  311  wherever the user goes, thus, allowing the user to use the digital certificate and the private key on different computers. Furthermore, the portable device  311  may be implemented on a device that is usually carried on the person by the user, such as a cellular telephone, a PDA, etc. Thus, the user does not have to carry an extra device (e.g., a card, a fob, etc.). 
         [0036]      FIG. 4  illustrates a diagrammatic representation of a machine in the exemplary form of a computer system  400  within which a set of instructions, for causing the machine to perform any one or more of the methodologies discussed herein, may be executed. In alternative embodiments, the machine may be connected (e.g., networked) to other machines in a LAN, an intranet, an extranet, and/or the Internet. The machine may operate in the capacity of a server or a client machine in client-server network environment, or as a peer machine in a peer-to-peer (or distributed) network environment. The machine may be a personal computer (PC), a tablet PC, a set-top box (STB), a Personal Digital Assistant (PDA), a cellular telephone, a web appliance, a server, a network router, a switch or bridge, or any machine capable of executing a set of instructions (sequential or otherwise) that specify actions to be taken by that machine. Further, while only a single machine is illustrated, the term “machine” shall also be taken to include any collection of machines that individually or jointly execute a set (or multiple sets) of instructions to perform any one or more of the methodologies discussed herein. 
         [0037]    The exemplary computer system  400  includes a processing device  402 , a main memory  404  (e.g., read-only memory (ROM), flash memory, dynamic random access memory (DRAM) such as synchronous DRAM (SDRAM) or Rambus DRAM (RDRAM), etc.), a static memory  406  (e.g., flash memory, static random access memory (SRAM), etc.), and a data storage device  418 , which communicate with each other via a bus  430 . 
         [0038]    Processing device  402  represents one or more general-purpose processing devices such as a microprocessor, a central processing unit, or the like. More particularly, the processing device may be complex instruction set computing (CISC) microprocessor, reduced instruction set computing (RISC) microprocessor, very long instruction word (VLIW) microprocessor, or processor implementing other instruction sets, or processors implementing a combination of instruction sets. Processing device  402  may also be one or more special-purpose processing devices such as an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), a digital signal processor (DSP), network processor, or the like. The processing device  402  is configured to execute the processing logic  426  for performing the operations and steps discussed herein. 
         [0039]    The computer system  400  may further include a network interface device  408 . The computer system  400  also may include a video display unit  410  (e.g., a liquid crystal display (LCD) or a cathode ray tube (CRT)), an alphanumeric input device  412  (e.g., a keyboard), a cursor control device  414  (e.g., a mouse), and a signal generation device  416  (e.g., a speaker). 
         [0040]    The data storage device  418  may include a machine-accessible storage medium  430  (also known as a machine-readable storage medium) on which is stored one or more sets of instructions (e.g., software  422 ) embodying any one or more of the methodologies or functions described herein. The software  422  may also reside, completely or at least partially, within the main memory  404  and/or within the processing device  402  during execution thereof by the computer system  400 , the main memory  404  and the processing device  402  also constituting machine-accessible storage media. The software  422  may further be transmitted or received over a network  420  via the network interface device  408 . 
         [0041]    While the machine-accessible storage medium  430  is shown in an exemplary embodiment to be a single medium, the term “machine-accessible storage medium” should be taken to include a single medium or multiple media (e.g., a centralized or distributed database, and/or associated caches and servers) that store the one or more sets of instructions. The term “machine-accessible storage medium” shall also be taken to include any medium that is capable of storing, encoding or carrying a set of instructions for execution by the machine and that cause the machine to perform any one or more of the methodologies of the present invention. The term “machine-accessible storage medium” shall accordingly be taken to include, but not be limited to, solid-state memories, optical and magnetic media, etc. 
         [0042]    Thus, some embodiments of a smart card accessible over a PAN have been described. It is to be understood that the above description is intended to be illustrative, and not restrictive. Many other embodiments will be apparent to those of skill in the art upon reading and understanding the above description. The scope of the invention should, therefore, be determined with reference to the appended claims, along with the full scope of equivalents to which such claims are entitled.