Abstract: Provided is a method of programming an identification tag, the tag comprising a cryptographic engine. The method comprises writing a random value to the tag as a private key; reading at least one value identifying an attribute of the tag; encrypting the at least one value using the private key to generate an encrypted value; digitally signing the encrypted value to generate a digital signature; and programming the tag to include the digital signature and the encrypted value. There is also provided a method of verifying an identification tag, by reading a signature stored on the tag; verifying the signature; reading at least one value identifying an attribute of the tag; having the tag encrypt the at least one value using its cryptographic engine and a private key written to the tag to generate an encrypted value; and comparing the encrypted value with an encrypted value stored on the tag.

Abstract: A method used to authenticate an item using an identification tag is provided. At the time of manufacture, the tags are created with various hardware attributes (HA), including a unique identifier (UID); and encoded with a signature of a message that includes a URL, and optionally a serial number associated with a product to which the tag is to be attached. The URL embeds various data such as one or more of the HAs, a serial number, etc., which can be used to verify the authenticity of the tag when verifying the signature. When a tag is read, the message including the URL is recovered and the signature is verified by the processor of the reader. This can be done to ensure that the URL in the message is one designated by the signer. The data in the signature can then be used to verify the authenticity of the tag and/or to detect tampering. The results of the verification can also be displayed to a user, e.g., using an available display on the electronic device including or otherwise acting as the tag reader.

Abstract: A method used to authenticate an item using an identification tag is provided. At the time of manufacture, the tags are created with various hardware attributes (HA), including a unique identifier (UID); and encoded with a signature of a message that includes a URL, and optionally a serial number associated with a product to which the tag is to be attached. The URL embeds various data such as one or more of the HAs, a serial number, etc., which can be used to verify the authenticity of the tag when verifying the signature. When a tag is read, the message including the URL is recovered and the signature is verified by the processor of the reader. This can be done to ensure that the URL in the message is one designated by the signer. The data in the signature can then be used to verify the authenticity of the tag and/or to detect tampering. The results of the verification can also be displayed to a user, e.g., using an available display on the electronic device including or otherwise acting as the tag reader.

Abstract: A method used to authenticate an item using an identification tag is provided. At the time of manufacture, the tags are created with various hardware attributes (HA), including a unique identifier (UID); and encoded with a signature of a message that includes a URL, and optionally a serial number associated with a product to which the tag is to be attached. The URL embeds various data such as one or more of the HAs, a serial number, etc., which can be used to verify the authenticity of the tag when verifying the signature. When a tag is read, the message including the URL is recovered and the signature is verified by the processor of the reader. This can be done to ensure that the URL in the message is one designated by the signer. The data in the signature can then be used to verify the authenticity of the tag and/or to detect tampering. The results of the verification can also be displayed to a user, e.g., using an available display on the electronic device including or otherwise acting as the tag reader.

Abstract: Methods, systems, and computer programs for trusted communication among mobile devices are described. In some aspects, information is wirelessly transmitted from a first mobile device to a second mobile device. The information permits the second mobile device to detect proximity of the first mobile device. In some implementations, the information can be wirelessly transmitted by a proximity-activated wireless interface, such as, for example, a Near Field Communication (NFC) interface. In response to the information, the first mobile device receives a message and a first authentication value wirelessly transmitted from the second mobile device to the first mobile device. A second authentication value is generated at the first mobile device based on the message and the shared secret value. Integrity of the message is verified based on comparing the first authentication value and the second authentication value.

Abstract: Methods, systems, and computer programs for trusted communication among mobile devices are described. In some aspects, an authentication value is generated at a first mobile device based on a message and a shared secret value stored on the first mobile device. In response to detecting proximity of a second mobile device, the message and the authentication value are wirelessly transmitted from the first mobile device to the second mobile device. In some implementations, the message and the authentication value can be wirelessly transmitted by a proximity-activated wireless interface, such as, for example, a Near Field Communication (NFC) interface.

Abstract: There is provided a method and apparatus for communications using short range communications such as Near Field Communications (NFC). A mobile device comprising an NFC subsystem provides a dynamic credential for use to login to a network requiring two factor authentication. A terminal used for logging in to the network is associated with an NFC reader, and bringing the NFC device in proximity to the NFC reader provides the terminal with the dynamic credential required for two factor authentication.

Abstract: A method and system is operable to provide credentials by generating a first credential that conforms to a first specified format. A second credential conforming to a second specified format is included in the first credential so that the second credential may be distributed through the cryptosystem using the first specified format. The credential may be a digital certificate.

Abstract: A method of securely communicating a message for a financial transaction from a first correspondent to one or more recipients. The method comprises dividing the message into at least two portions. Each portion is intended for a recipient. Each portion intended for receipt by one of the recipients is encrypted with that recipient's public key. The message is signed and transmitted to one of the recipients to enable the recipient to verify the message and further transmit the message to a further recipient.

Abstract: A method used to authenticate an item using an identification tag is provided. At the time of manufacture, the tags are created with various hardware attributes (HA), including a unique identifier (UID); and encoded with a signature of a message that includes a URL, and optionally a serial number associated with a product to which the tag is to be attached. The URL embeds various data such as one or more of the HAs, a serial number, etc., which can be used to verify the authenticity of the tag when verifying the signature. When a tag is read, the message including the URL is recovered and the signature is verified by the processor of the reader. This can be done to ensure that the URL in the message is one designated by the signer. The data in the signature can then be used to verify the authenticity of the tag and/or to detect tampering. The results of the verification can also be displayed to a user, e.g., using an available display on the electronic device including or otherwise acting as the tag reader.

Abstract: A system and method are provided for using a mobile device to authenticate access to a private network. The mobile device may operate to receive a challenge from an authentication server, the challenge having being generated according to a request to access a private network; obtain a private value; use the private value, the challenge, and a private key to generate a response to the challenge; and send the response to the authentication server. An authentication server may operate to generate a challenge; send the challenge to a mobile device; receive a response from the mobile device, the response having been generated by the mobile device using a private value, the challenge, and a private key; verify the response; and confirm verification of the response with a VPN gateway to permit a computing device to access a private network.

Abstract: There are disclosed systems and methods for authenticating a mobile device by a network and/or for generating one or more keys that can be used for securely transmitting data between the mobile device and the network. In one embodiment, the following operations are performed by a mobile device: (i) the mobile device participates in at least a portion of a key agreement protocol with a network to compute a secret value; (ii) the mobile device obtains a response value derived from the secret value; and (iii) the mobile device sends the response value to a verification entity for use in authenticating the mobile device. There are also disclosed systems and methods for authenticating a network by a mobile device.

Abstract: There is provided a method and apparatus for communications using short range communications such as Near Field Communications (NFC). A mobile device comprising an NFC subsystem provides a dynamic credential for use to login to a network requiring two factor authentication. A terminal used for logging in to the network is associated with an NFC reader, and bringing the NFC device in proximity to the NFC reader provides the terminal with the dynamic credential required for two factor authentication.

Abstract: Methods, systems, and computer programs for trusted communication among mobile devices are described. In some aspects, information is wirelessly transmitted from a first mobile device to a second mobile device. The information permits the second mobile device to detect proximity of the first mobile device. In some implementations, the information can be wirelessly transmitted by a proximity-activated wireless interface, such as, for example, a Near Field Communication (NFC) interface. In response to the information, the first mobile device receives a message and a first authentication value wirelessly transmitted from the second mobile device to the first mobile device. A second authentication value is generated at the first mobile device based on the message and the shared secret value. Integrity of the message is verified based on comparing the first authentication value and the second authentication value.

Abstract: Methods, systems, and computer programs for trusted communication among mobile devices are described. In some aspects, an authentication value is generated at a first mobile device based on a message and a shared secret value stored on the first mobile device. In response to detecting proximity of a second mobile device, the message and the authentication value are wirelessly transmitted from the first mobile device to the second mobile device. In some implementations, the message and the authentication value can be wirelessly transmitted by a proximity-activated wireless interface, such as, for example, a Near Field Communication (NFC) interface.

Abstract: There are disclosed systems and methods for authenticating a mobile device by a network and/or for generating one or more keys that can be used for securely transmitting data between the mobile device and the network. In one embodiment, the following operations are performed by a mobile device: (i) the mobile device participates in at least a portion of a key agreement protocol with a network to compute a secret value; (ii) the mobile device obtains a response value derived from the secret value; and (iii) the mobile device sends the response value to a verification entity for use in authenticating the mobile device. There are also disclosed systems and methods for authenticating a network by a mobile device.

Abstract: Methods and devices for establishing trust on first use for close proximity communications are disclosed. An example method includes receiving a public key from a device via a close proximity communications connection, obtaining, via a user interface, an indication that the device is trusted, and storing at least one of the public key or an identifier for the device.

Abstract: Methods and devices for obtaining authorization for a requestor to access a service are provided. In accordance with one embodiment, there is provided a method comprising receiving a requestor request for access to a service; sending an authorization request to one or more mobile devices associated with one or more authorizers on a first approval list; receiving an authorization response from the one or more mobile devices associated with the one or more authorizers on the first approval list; determining whether a predetermined level of authorization is received; and when the predetermined level of authorization is received, authorizing access to the service.

Abstract: Data received over a network is processed by a server. The processing includes determining identity information corresponding to an identity associated with a document represented by document data received over an input port of the server from a sender. At the server, a private key is computed based on: a master private key, and the identity information. At the server digital information is computed based at least in part on the document data using the computed private key. The digital information is stored in a storage medium accessible to the server in association with the identify information.

Abstract: A system and method are provided for using a mobile device to authenticate access to a private network. The mobile device may operate to receive a challenge from an authentication server, the challenge having being generated according to a request to access a private network; obtain a private value; use the private value, the challenge, and a private key to generate a response to the challenge; and send the response to the authentication server. An authentication server may operate to generate a challenge; send the challenge to a mobile device; receive a response from the mobile device, the response having been generated by the mobile device using a private value, the challenge, and a private key; verify the response; and confirm verification of the response with a VPN gateway to permit a computing device to access a private network.