Abstract:
A smart card is adapted to partially include and employ a triply-secure algorithm for data exchange. The algorithm verifies a user&#39;s identity and his simultaneous membership in any groups that he has joined. For this purpose, the algorithm requires only a single insertion of the smart card and only a single input of the user&#39;s personal identification number. The algorithm can be used in smart cards or in computer networks for identity verification and membership proof. A combination of three different hard problems is used. The first one is based on integer factorization, such as the RSA authenticating technique, and the second one is based on a discrete logarithm, and the third one is based on the coefficients of a polynomial function. In a typical application using smart cards, a certification authority (CA) establishes requirements for preparation and issuance of a multi-purpose card.

Description:
TECHNICAL FIELD  
         [0001]    The invention relates generally to cryptographic communications systems, to security management devices and methods, and methods for identity verification. More particularly, the invention relates to client/server applications, such as smart card applications, wherein there exists a need to provide an authentication mechanism to simultaneously provide identity verification and membership proof for multiple groups.  
         BACKGROUND OF THE INVENTION  
         [0002]    With the rapid growth of electronic mail systems and electronic commerce, including electronic funds transfer systems and the like, users and service providers are demanding increased security for data transferred over unsecured communication channels such as the Internet and increased security of sensitive data during access and storage. Consequently, cryptographic schemes of various sorts are now often used to ensure the privacy and authenticity of messages when accessing and communicating via the Internet or any other unprotected data access channel or unsecured communication channel.  
           [0003]    In conventional cryptographic systems, a method of encryption is utilized to transform a “plain text” message into “cipher” or a “ciphertext” message, which presumably is in an unintelligible form. Thereafter, a method of decryption is utilized for decoding the encrypted message to restore the message to its original intelligible form.  
           [0004]    In many popular cryptographic systems, binary coded data is cryptographically protected using an encryption algorithm in conjunction with a “key”, e.g., a binary number or series of numbers, for enciphering and deciphering the message or underlying data. This key makes the results of encrypting data using the encryption algorithm unique. Selection of a different key causes the encryption that is produced for a given set of inputs to be different. Unauthorized recipients of the ciphertext, who may know the encryption algorithm but who do not have the key, cannot derive the original data or message.  
           [0005]    In such systems, unrecorded plain text information is encrypted into ciphertext and decrypted back into its original form utilizing an algorithm that sequences through enciphering and deciphering operations which depend on the binary key code. For example, the National Bureau of Standards approved a block cipher algorithm in 1977, referred to as the  Data Encryption Standard  ( DES ), e.g., Data Encryption Standard FIPS Pub 46, National Bureau of Standards, Jan. 15, 1977.  
           [0006]    Often, cryptographic signature and authentication systems utilize a “one-way” hashing function to transform the plain text message into a condensed form that is also unintelligible. A “hashing” function, as generally referred to herein, is a mathematical operation or series of operations that are performed on an aggregation of digital data to create a smaller, more easily processed aggregation of data.  
           [0007]    In the cryptographic environment, an important characteristic of the hashing function is its “one-way” function. Ideally, this means that the hashing function should be computationally easy to compute given a set of underlying data, but that it should be computationally impossible to determine that some underlying data give the calculated hash value. For practical reasons, the value obtained from applying a hashing function to the original message or aggregation of data should also be unique, i.e., a virtual certified message of the original message or data. Consequently, if the original message data is different in any manner, the “hash” of such modified data will also be different.  
           [0008]    In a “public key” cryptographic system, the encryption and decryption processes are decoupled in such a manner that the encrypting process key is separate and distinct from the decrypting key. Thus, for each encryption key there is a corresponding decryption key that is not the same as the encryption key. Moreover, given the knowledge of one key, it is usually not feasible to compute the other corresponding key.  
           [0009]    In this type of public key system, the encryption keys for all users may be distributed or published and anyone desiring to communicate over an unsecured communication channel simply encrypts a message using the recipient&#39;s public key. Only the recipient who retains the corresponding secret decrypting key is able to decipher the received (or intercepted) message. Revealing the encryption key discloses nothing useful about the decrypting key, i.e., only persons having knowledge of the decrypting key can decrypt the message. An example methodology for the practical implementation of such a public key cryptographic system, known as the RSA cryptographic system, is disclosed in U.S. Pat. No. 4,405,829, issued to Rivest et al.  
           [0010]    A major concern in public key and other cryptographic systems is the need to confirm that the person seeking access to a message is actually the person who is the “owner” of, i.e., is authorized to have access to, this message. This concern gives rise to the need for “identity verification”, which can be used to authenticate the person seeking access to the message. In this regard, an identity verification scheme is analogous to an ordinary photo ID but used to verify the identity of a person electronically. Consequently, the identity must be unique and recognizable to everyone. Moreover, in order to be practical, the identity should be easy to validate, impossible to forge, and acceptable as admissible evidence in any court of law.  
           [0011]    The general rule is that a public key cryptosystem is based on a hashing function. There are basically two kinds of hashing functions that have been proven secure and have been widely used throughout the past decades or so of scientific scrutiny. One is the factoring of a large integer and the other is a discrete logarithm.  
           [0012]    Nevertheless, neither technique has provided sufficient security, including identity verification, to enable different service providers to allow convenient combinations of their services.  
         SUMMARY OF THE INVENTION  
         [0013]    According to the principles of the invention, a multi-purpose end-user authentication scheme and mechanism provides cryptographically strong security, including services of strong authentication of a user&#39;s membership in a group upon request for use and strong verification of the user&#39;s identity. The principles of the invention rely on the use of a combination of three hard problems, in the mathematical sense. That combination makes multi-purpose end-user information secure and extremely easy to manage. More specifically, authentication and verification are based on a plurality of types of cryptographic security including a combination of integer factorization, such as the RSA authenticating technique, a discrete logarithm, and coefficients of a polynomial function.  
           [0014]    In one illustrative embodiment, a smart card is adapted to partially include and employ a triply-secure algorithm for data exchange. The algorithm verifies a users identity and his simultaneous membership in any groups that he has joined. For this purpose, the algorithm requires only a single insertion of the smart card and only a single input of the user&#39;s personal identification number. The algorithm can be used in smart cards or in computer networks for identity verification and membership proof.  
           [0015]    According to the principles of the invention, the multi-purpose, end-user authentication scheme and mechanism not only brings convenience to the bearers, but also brings the bearers the best security protections for their sensitive information. All these features combine to offer a multi-purpose, end-user authentication scheme and mechanism with very significant advantages over prior techniques and a resultant opportunity for commercial acceptance. For example, a user can carry just one multi-purpose smart card and use just one personal identification number (PIN) card instead of carrying multiple credit, debit, and other membership cards, each requiring separate entry of a PIN. Moreover, the multiple-purpose functions do not have to be from the same service provider. 
       
    
    
     BRIEF DESCRIPTION OF THE DRAWING  
       [0016]    A more complete understanding of the present invention may be obtained from consideration of the following detailed description of the invention in conjunction with the drawing, with like elements referenced with like reference numerals, in which:  
         [0017]    [0017]FIG. 1 is a block diagrammatic that shows an exemplary digital communication system at a client/server site, which system may be used in conjunction with embodiments of the present invention;  
         [0018]    [0018]FIG. 2A is a partially pictorial and partially block diagrammatic that shows a more specific implementation to the invention;  
         [0019]    [0019]FIG. 2B is a partially pictorial and partially block diagrammatic that shows a smart card adapted for use with an algorithm according to the principles of the invention;  
         [0020]    [0020]FIG. 3 is a flow diagram of a method implemented by a certification authority according to the principles of the invention;  
         [0021]    [0021]FIG. 4 is a flow diagram of registration of a client, such as a smart card user, with a certification authority according to the principles of the invention;  
         [0022]    [0022]FIG. 5 is a flow diagram of registration of an exemplary group, such as a credit card agency, with the certification authority according to the principles of the invention;  
         [0023]    [0023]FIG. 6 is a flow diagram of the registration of a client with an exemplary group according to the principles of the invention;  
         [0024]    [0024]FIG. 7 is a flow diagram of verification of a client&#39;s membership in an exemplary group at the server site according to the principles of the invention; and  
         [0025]    [0025]FIG. 8 is a flow diagram of verification of a clients membership in multiple groups according to the principles of the invention.  
     
    
     DETAILED DESCRIPTION  
       [0026]    In the following description, for purposes of explanation and not limitation, specific details are set forth, such as particular components, interface, techniques, etc., in order to provide a thorough description of the present invention. However, it will be apparent to one skilled in the art that the present invention may be practical in other embodiments that depart from these specific details. In other instances, detailed descriptions of well-known methods, algorithms and programming procedures are omitted so as not to obscure the description of the present invention with unnecessary detail.  
         [0027]    In order to interest diverse card-issuing agencies, such as credit card agencies, debit card agencies, medical insurance agencies, recreational and prestige clubs, and other private or public agencies in the use of a single smart card by a client, it will be necessary to provide an unprecedented level of security, not only as to the identity of the client, but also his status, particularly his membership in each participating agency. Even with the growing use of smart cards, the existing systems require a user of such services to carry a large number of cards, each of which provides only limited protection to the user and to the issuing agency. A single-card system with improved security is central to the preferred implementation of the invention described herein.  
         [0028]    In one exemplary embodiment, CA represents a certification authority and ID represents the identification number of an individual user. Each user needs to register with the CA, and once registered, may also register as a member with as many participating agencies or groups as he desires or can qualify for. According to one illustrative embodiment, preparation and registration could include the exemplary processes and steps set forth below. It should be noted that the processes and steps set forth below will be subsequently described in further detail with reference to specific figures, e.g., flow diagrams. As such, the corresponding figure is included for cross-reference purposes.  
         [0029]    CA Preparation Process (FIG. 3)  
         [0030]    Step 1. Select two prime numbers p, q.  
         [0031]    Step 2. Let n=pq.  
         [0032]    Step 3. Calculate φ(n)=(p−1)(q−1).  
         [0033]    Step 4. Let Certification Authority (CA)&#39;s public key be (d, n).  
         [0034]    Step 5. Let, for an RSA algorithm, a corresponding private key be (e, n).  
         [0035]    Step 6. CA selects s+1 integers a 0 , a 1 , . . . , a s  randomly, such that gcd(a 0 , a 1 , . . . , a s )=1, where gcd stands for “greatest common denominator”.  
         [0036]    Step 7. Define f(x)=a 0 +a 1 x+a 2 x 2  . . . +a s x s (mod φ(n)). In general, a mod φ(n) is defined as r, for which a=d·φ(n)+r, where 0≦r&lt;φ(n). The a i &#39;s are random numbers that the CA needs to select, and x is a variable used to show to the nature of f(x). The function f(x) and its calculation for a specific variable are a third module of the algorithm of the present invention. Modules 1 and 2 will be defined hereinafter in the context of their use.  
         [0037]    Group G Registers with the CA (FIG. 5)  
         [0038]    Step 1. CA selects a private key C for group G such that gcd(f(C), φ(n))=1, where gcd stands for greatest common denominator and f(C) is a particular application of the third module of the algorithm.  
         [0039]    Step 2. CA calculates the public key R for group G such that f(C). R=1(modφ(n)).  
         [0040]    Step 3. CA keeps f(C) to itself as group G&#39;s registration record.  
         [0041]    User U Registers with the CA (FIG. 4)  
         [0042]    Step 1. User U selects a number y that contains U&#39;s some predefined personal information, e.g., SSN, etc.  
         [0043]    Step 2. Calculate g=y e (mod n), making g readable to only User U. These first two steps are the first module of the algorithm of the invention.  
         [0044]    Step 3. Store (g,y) and T=(y a     0   , y a     1   , . . . y a     s   ) (mod n) in U&#39;s smart card, where notations are meant to be consistent with related ones given above. From the preceding, recall that a i &#39;s are the same random numbers that the CA has selected for calculating f(x). The function T and its calculation are the second module of the algorithm of the invention.  
         [0045]    Step 4. CA calculates and stores K=y 2e (mod n) in U&#39;s smart card.  
         [0046]    U registers with a Group G (FIG. 6)  
         [0047]    Step 1. User U provides y and K to group G.  
         [0048]    Step 2. G checks whether y 2 =K d (mod n). If no, stop. Otherwise, go to Step 3.  
         [0049]    Step 3. G calculates  
         G        (   U   )       =         ∏     j   =   0     s                       (     y     a   j       )       C   j         =       y       a   0     +       a   1        C     +   …   +       a   s          C   s           =       y     f        (   C   )                         (     mod                 n     )                                 
 
         [0050]     where C is group G&#39;s private key selected by the CA, notations being consistent. G(U) and its calculation comprise the fourth module of the algorithm of the invention.  
         [0051]    Step 4. Store G(U) in User U&#39;s smart card.  
         [0052]    According to one illustrative embodiment, verification could include the following:  
         [0053]    Verification that a User U is a Member of G (FIG. 7)  
         [0054]    Step 1. User U selects an r, 0&lt;r&lt;n, randomly.  
         [0055]    Step 2. U calculates x=r d·R (mod n), and provides x and y to a verifier V.  
         [0056]    Step 3. User U provides rky f(C) (mod n) to V;  
         [0057]    Step 4. V checks whether (rKy f(C) ) d·R =x·y 2R+d (mod n). If yes, then U is a legitimate user, otherwise, U is an illegitimate user.  
         [0058]    It should be noted that this verification process can be repeated until the verifier is sure the user U is a legitimate user. To prevent “play-back” attack, r may be required to contain the time of the current verification with a limited pre-assigned time difference.  
         [0059]    Verification that a User U is a Member of Groups G 1 , G 2 , . . . G(FIG. 8)  
         [0060]    Step 1. User U selects an r, 0&lt;r&lt;n, randomly.  
         [0061]    Step 2. U calculates x=r dR     1   ·R   2   · . . . ·R   l   (mod n), where notations are meant to be consistent with related ones given above.  
         [0062]    Step 3. User U provides to the Verifier x, y, and  
                    rK          ∏     i   =   1     l                       y     f        (     C   1     )                           (     mod                 n     )     .                                 
 
         [0063]    Step 4. V checks whether:  
           (     rK          ∏     i   =   1     l                     y     f        (     C   1     )             )         d   ·     R   1     ·     R   2                     …                   R   l         =     x   ·       y           2   ·     R   1     ·     R   2                     …                   R   l       +     d        (           R   2     ·     R   3                     …                   R   l       +   …   +         R   1     ·     R   2                     …                   R     l   -   1           )                             (     mod                 n     )                               
 
         [0064]    If yes, then U is a legitimate user, otherwise, U is an illegitimate user.  
         [0065]    It should be noted that this verification can be repeated and U is a legitimate user if and only if V succeeds in each verification. To prevent “play-back” attack, r may be required to contain the time of the current verification with a limited pre-assigned time difference.  
         [0066]    While the smart card, according to the principles of the invention, must store items of information and elements of the algorithm as specified above, preferably it stores the entire algorithm and thereby serves as a back-up for downstream elements of a communication system using the invention.  
         [0067]    In FIG. 1, the illustrative algorithm application model is shown in a block diagram of a digital communication system in which the user presents his multi-purposes card to a smart card reader included in a source encoder  11 . The user indicates to source encoder  11  which group G, represented at source decoder  24 , he wishes to use. Source encoder  11  sends appropriate data to en-crypto stage  12 , which includes the above-described cryptographic mechanisms, including digital signature. En-crypto stage  12  then sends the encrypted data to channel encoder  14 , which in turn sends it over channel  16 . It is noted that channel  16  is typically subject to noise from at least one noise source  18 . The digital nature of the encoded data should enable a superior level of resistance to such noise. All the usual techniques may be employed. Channel  16  connects to channel decoder  20  of the requested group, for example, group G 1 . Decoder  20  connects to de-crypto stage  22 , which includes not only decryption, but also the verification techniques described above.  
         [0068]    Source decoder  24  decodes the result to give an intelligible signal to group G 1  and also to encode the automatic acceptance or rejection response in the reverse direction back to source encoder  11  and user U. Thus, the above-described algorithm of the invention is used as needed, mainly in en-crypto stage  12  and in de-crypto stage  22 .  
         [0069]    In FIG. 2A, three different exemplary ways are shown for presenting a smart card to the system for presentation to various banks, financial institutions, or other organizations. In each of three instances, essentially the same smart card  32 , assuming the same user U, is inserted into the appropriate smart card reader. In the first example, smart card  32 , prepared as described above, is inserted into authenticator  33  associated with palm computer smart card reader  34 . Authenticator  33  may be a separate device connected to smart card reader  34 , as shown, or may be within palm computer smart card reader  34  bearing the insertion slot. Authenticator  33  provides the function of verifying the identity of the user U as described above, while smart card reader  34  provides other functions normally associated with handling smart cards. From smart card reader  34 , information is transmitted over radio link  40  via microwave relay tower  42  to the selected institution. The conversion from a computer signal to a microwave signal can occur in reader  34 , or separately, for example, as a part of microwave link  40 .  
         [0070]    In the second example, card  32 , or card  32 ′ if the information therein has been changed by user U, is inserted into authenticator  35  associated with personal computer  36  for verifying user identity. Again, authenticator  35  may be part of personal computer  36 . The appropriate information is transmitted via communication link  44 , e.g., microwave link  44 A in this instance, which may include radio relay tower  46 , for transmission to the selected institution. Alternatively, the information can be transmitted over Internet  48  via paths  47 A and  49  to the same destination.  
         [0071]    In the third example, card  32 ″ is inserted into authenticator  37  associated with some other smart card reader  38  for transmission of information, again by communication link  44 , or more specifically  44 B and microwave relay tower  46  or by path  47 B, Internet  48  and path  49 .  
         [0072]    The variety of smart card readers and communication links are virtually limitless, but all may be adapted for use with the multi-purpose smart card according to the principles of the invention.  
         [0073]    For use with the illustrative configurations of FIG. 2A, an exemplary smart card structure is shown in FIG. 2B. More specifically, smart card  51 , which looks and feels like an ordinary credit card, includes memory module  52 , which provides the information storing functions described in the algorithm above. In one exemplary embodiment, memory module  52  is an electrically-erasable field-programmable read-only memory although other memory elements are also contemplated by the teachings herein. Memory module  52  communicates bi-directionally with processing module  54 , which provides any calculations necessary to provide parameters required by the encrypting and decrypting functions shown in FIG. 1, as set out in the algorithm above. Processing module  54  also determines the location of items within memory module  52  and provides communication functions with the various card readers and/or authenticators. Electrical coupling with card readers and authenticators is provided, in the illustrative embodiment, through electrodes  56  and  58 , which may be configured to provide either direct electrical contact coupling or capacitive coupling. Illustratively, smart card  51  stores the first, second, and third modules of the algorithm, but also stores all of the other elements of the algorithm to serve as a back-up for authenticators  33 ,  35 , and  37  of FIG. 2A and to serve as a back-up for en-crypto unit  12  and de-crypto unit  22  of FIG. 1. Other optional details of such smart cards are known in the art, as for example disclosed in U.S. Pat. No. 4,795,898 to Bernstein et al.  
         [0074]    The flow diagram shown in FIG. 3 shows the steps that correspond to the equations, as set forth above, for the preparation process by the certification authority (CA). In step  60 , CA selects two large prime numbers and in steps  62 - 68  proceeds to calculate and select quantities appropriate to an RSA system and in steps  70 - 72  makes a selection of f(x) based on the ‘hard’ problem as described in step 7 of the “CA Preparation Process” above. These quantifies reappear in the hashing functions used to identify user U to the various groups in which he registers and to verify his membership. Please refer to the preceding description of the formulas and equations for further information. Note the use of public and private keys in steps  67  and  69 .  
         [0075]    In the flow diagram of FIG. 4, user U registers with the CA and its process provides the basis for securely encrypted, verifiable identity via steps  80 - 86 . Herein, step  84  is based on a discrete logarithm. Other details are as given above in the initial presentation of the algorithm. Note that this procedure uses some of the same parameters, such as mod(n), e, and the a i &#39;s (a 0 , a 1 , . . . ) developed for the RSA system.  
         [0076]    In the flow diagram of FIG. 5, Group G registers with the CA (Certification Authority) and invokes its process. In step  90 , the CA selects a private key C for Group G satisfying that f(C) and φ(n) are relatively prime. In step  92 , the CA calculates G&#39;s public key R such that f(C)·R=1 (mod φ(n)). In step 93, the CA safeguards the private key, which in effect can be G&#39;s registration record.  
         [0077]    In the flow diagram of FIG. 6, User U registers with Group G and invokes its process. In step  100 , U provides the parameters y and K developed for him in his registration with the CA. In step  102 , Group G checks these parameters for consistency. Rejection occurs in step  104  if the test fails. Otherwise, U&#39;s identity has been verified and G calculates indicia of membership for U in step  106  using the discrete logarithm and then stores the indicia of membership in his smart card in step  108 .  
         [0078]    The following events set out in the verification process of the flow diagram of FIG. 7 occur before Group G decrypts any transaction information from user U. Hereby, U unequivocally establishes whether he is a member of Group G. Based on the above algorithm, U himself performs steps  110 ,  112 ,  114  and  116 . In step  118 , Verifier V performs a consistency check. Acceptance or rejection occurs at steps  122  or  120 .  
         [0079]    The verification process of FIG. 8 differs from that of FIG. 7, in that the steps  130  to  142 , while similar to the membership proof of FIG. 7, assist U&#39;s gaining approval simultaneously for transactions with several different groups, G 1 , G 2 , etc. The calculation of step  134  and the submission to Verifier V in step  136  are adapted to this end. The fail or pass checks of step  138  are performed in a sequential manner as indicated by the mathematics.  
         [0080]    It should be apparent that various changes can be made in the above examples without departing from the spirit of the invention, as claimed hereinafter. For example, it is not necessary to limit the extent of the proposed algorithm as long as the hardware and process capacities of the implementation allow the extension of the algorithm.