Patent Publication Number: US-10764057-B2

Title: Method and system for authenticating a trusted user interface

Description:
The invention relates to a method for authenticating a trusted user interface of a user terminal incorporating a scan function, in particular a smart phone, as well as a system for realizing said method. Such a method and system are in particular of interest in the context of online payments for goods and services. 
     Online shops today often offer multiple authentication methods from among which to choose in the context of authorizing an online payment:
         via prepayment, instant bank transfer or PIN/TAN-based online banking procedures in which the customer must have his online banking PIN ready and manage the TAN   via ApplePay and Selfie-Pay (http://www.welt.de/finanzen/verbraucher/article152595657/Mastercard-Kunden-koennen-bald-per-Selfie-bezahlen.html) biometric processes which can lead to false rejections   via Paypal, a not all that technically secure method which only verifies a password.       

     In unpublished European patent application no. 16204208.9, the applicant proposes a method and system of the aforementioned type which is simple for the user and yet highly secure which reliably functions with high-quality mobile devices. 
     A suitable smartphone is thereby accorded the function of a point-of-sale terminal for debit and credit cards capable of near-field communication (NFC). With respect to fulfilling the usual security requirements for payment procedures, the security features of the respective user terminal as implemented by the manufacturer are of importance. 
     In unpublished German patent application no. 102017106295.2, the applicant posed the task of identifying a further user-friendly and yet concurrently secure method and system for authorizing online payments which can be implemented in mid-range and lower-priced end devices and thus accessible to a wider audience. 
     The cited application solves the task posed in particular by the fact that the card PIN, which is required for a smartcard-compliant activation of the signature function on the debit or credit card (card), is not entered via a user interface of the user terminal (smartphone), which would require safeguards against PIN phishing, but rather sent automatically to the card via the user terminal by a server secured end-to-end (from the server to the card). 
     When used in online banking, the method described therein replaces the TAN (international: one-time code) with a signature on the card which to date has only been able to be activated via special, contact-based card readers (secoders) and not by commercially available smartphones. 
     Even with respect to this newer prior art, the problem still persists of ensuring that all method steps and system components integrate as far as possible the highest possible security against attempts to ferret out critical user data, particularly in view of even further refined and aggressive phishing attacks. 
     This task is solved by a method having the features of claim  1 ,  2  or  5  or respectively a system having the features of claim  13  or  14 . Advantageous further developments of the inventive concept constitute the subject matter of the respective dependent claims. 
     The invention incorporates the idea of a one-time authentication of the trusted user interface used for online banking via interaction with a web page to be classified as trusted. It further incorporates the idea of thereby using a user-selected certificate of authenticity or security code which the user only uses once and thus does not need to remember or store anywhere and which at the same time serves as a “seal of authenticity” of his user interface. The cited user interface authentication in conjunction with the web page ensues by way of an asymmetric cryptosystem which preferentially at the same time serves in the encrypting of the certificate of authenticity during transmission between system components. Although the authentication thus includes an additional process, which is generally inconvenient for the user, it is kept within strict limits and would seem to be reasonable in view of the significant increase in method and system security. 
     The invention remedies a significant security vulnerability in methods and systems of the type outlined above and achieves the user being able to rely on the interface he uses without any worry, which strengthens the user&#39;s confidence in the cited methods and systems and thus substantially improves their marketability. 
     In preferential implementations of the method and system, the first user terminal is a smartphone and the app is a mobile app. In principle, however, the invention is also applicable to user terminals connected to data lines. 
     In further implementations of the method, the graphic code is a QR code and/or the self-chosen authenticity certificate is a multi-digit number and/or series of letters. 
     In a further implementation, the web session identification via which the certificate of authenticity is ultimately transmitted to the first user terminal is not displayed in a graphic code but is rather transmitted fully automatically and thus in more user-friendly manner by a notification service. 
     In a further implementation, said notification service is the Push Notification Service from Google® or Apple®. 
     In a further implementation, instead of the web session identification, a weblink is transmitted to the first user terminal via which the first user terminal ultimately obtains the certificate of authenticity. 
     In a further advantageous implementation, the app providing the trusted user interface comprises at least one first sub-app and one second sub-app installed in different areas of the first user terminal and which communicate with each other in encrypted manner. Particularly the encrypted communication between the first sub-app and the second sub-app thereby ensues using a symmetric cryptosystem. 
     In terms of system aspects, this implementation is in particular designed such that the first sub-app is installed in a trusted execution environment, TEE, and the second sub-app is installed in an embedded secure element, eSE, of the first user terminal. Specifically, the second sub-app conducts the communication with the trusted web page while the first sub-app realizes the display of the certificate of authenticity on the trusted user interface. 
    
    
     
       Advantages and functionalities of the invention in other respects are yielded by the following explanation of an example embodiment based on the lone FIGURE as well as a modification of same. 
       The FIGURE illustrates a system for authenticating a trusted user interface. 
       In step a), after the mobile app  1  to be checked for authenticity is installed on the user&#39;s smartphone  2 , the user opens a trusted web page  4  serving in verifying the authenticity of the mobile app from a desktop PC  3 . In step b), he then enters a security code of his own creation on the web page, which is depicted in the FIGURE as being “123456.” 
     
    
    
     The two-dimensional graphic code  5  displayed on the web page  4  in step c), a QR code in the example, is then scanned by the user in step d) with the mobile app  1 . The QR code  5  displays the web session currently connecting the PC  3  and web page  4  to the mobile app and enables the mobile app  1  to log into the same web session in step e). 
     In step f), the mobile app  1  and the web page  4  mutually authenticate each other. If the smart phone  2  preferably has a trusted execution environment (TEE); i.e. a separate operating system environment for fraud-proof input and output via the phone&#39;s screen, and an embedded secure element (eSE); i.e. an additional chip in the phone for security-critical computing processes, and the mobile app  1  uses both security environments and accordingly has a first sub-app installed in the TEE and a second sub-app installed in the eSE, the mobile app communicates with the trusted web page via its sub-app  2  and uses a private key in the second sub-app for the authentication. 
     In step g) following successful authentication, the web page  4  confidentially communicates the security code entered previously by the user to the second sub-app, preferably encrypted with the public key of the second sub-app used in the mutual authentication. The second sub-app confidentially passes the security code on to the first sub-app which then henceforth displays it in step h) as the certificate of authenticity on the trusted user interface (TUI). 
     In a slightly modified procedure, the security code could also be entered via the TUI and then displayed on the trusted web page in order to verify the authenticity of the TUI. The input of the security code would accordingly not be made on the web page in step b) but rather via the TUI of the mobile app following the QR code-based communication established between the web page and the mobile app between step f) and g). In a further step, the user would then have to check whether the same security code is displayed on the web page. 
     Furthermore, the invention can also be implemented in a plurality of modifications of the example depicted here and of the aspects of the invention emphasized further above.