SECURING A TRANSACTION PERFORMED FROM A NON-SECURE TERMINAL
In a general aspect, a method for authenticating a user can include: receiving, from a secure processor, a software component configured to generate an image frame including information intelligible to the user, and input data of the software component, the software component can include a first input for receiving a first input data having two randomly-selected valid values, and invalid values. The transmitted input data can include the valid values of the first input data. The method can also include, performing a plurality of times: selecting one of the valid values of the first input data in the transmitted input data, executing the software component by applying the transmitted input data to inputs of the software component and the selected valid value to the first input of the software component. The execution of the software component generating the image frame can have pixels in a visible or invisible state, depending on the selected valid value and defining the information, displaying the image frame. The method can also include, acquiring, from the user, a response depending on the information in the displayed image frame, and transmitting the acquired response to the secure processor.
This application is a continuation of PCT Application No. PCT/EP2017/077895, filed Oct. 31, 2017, which claims the benefit of European Application No. 16196945.6, filed Nov. 20, 2016, European Application No, 16196947.2, filed Nov. 2, 2016, European Application No. 16196950.6, filed Nov. 2, 2016 European Application No. 16196957.1, filed Nov. 2, 2016, European Application No. 17172856.1 filed May 24, 2017 and European Application No. 17195479.5 filed Oct. 9, 2017, the disclosures of which are all incorporated by reference herein in their entireties.
TECHNICAL FIELDThe present disclosure relates to methods and devices for securely authenticating a user from a non-secure terminal, such as for executing a secure transaction involving such a non-secure terminal and a remote server, based on such a user authentication.
BACKGROUNDIt would be desirable to execute transactions, for instance e-commerce transactions or fund transfer, initiated from mobile terminals such as smartphones, personal computers, digital tablets, or the like, or any other connected device including devices belonging to the Internet of Things (IoT). However, this raises security problems, notably because “malicious software” or “malware” may be executed by a processor (CPU) of the terminal. The malware may be able to access all or a part of the memories accessible by the processor, and thus may be maliciously configured to spy on any transactions executed by the terminal and to recover any secret data manipulated during these transactions for transmission over the network.
To ensure the security of such transactions, it has already been proposed to entrust cryptographic computations to a dedicated secure element, such as the processor of a UICC (“Universal Integrated Circuit Card”) card, e.g. a SIM (subscriber identification module) card with which cell phones are generally equipped. In order to be able to execute one or more payment applications, the secure processor should be able to store as many secret cryptographic keys as there are payment applications. However, loading an application into the memory of a secure processor is a complex operation that should be highly secure. Specifically, it involves external parties such as Trusted Service Managers. Since SIM cards are issued by cell phone operators, the latter may refuse to have such applications installed in the card. Furthermore, in the event of theft, or during maintenance of the telephone, the processor of the SIM card may be hacked by a hacker seeking to discover the secret keys stored in its memory.
In addition, accessing the secure functions installed in the processor of a SIM card generally entails inputting a secret code (PIN code) by means of a keypad or a touch-sensitive surface connected to the processor of the terminal. In a classical configuration, the secret code input by the user necessarily passes through the processor of the terminal. Malware executed by the processor of the terminal can therefore access this secret code.
The patent application WO2012/107698 filed by the Applicant discloses a method using a graphic processor of a terminal as a secure element to perform transaction. Such a method can include establishing a secure communication link between the graphic processor of the terminal and an authentication server, and displaying a virtual keypad with keys arranged in a random order. The image of the keypad is displayed using visual cryptography, by successively displaying complementary frames in which the labels of the keys are not intelligible, the complementary frames being combined into an intelligible image by the visual system of the user thanks to the retinal remanence thereof. In this way, even if a malicious program running on the processor of the terminal is able to access the positions of the keys touched by the user during input of a secret code, it cannot, by taking a succession of screenshots, determine which labels correspond to the touched keys.
However, this method requires important calculation resources that are not available in all portable devices such as all of the existing smartphones on the market.
To secure transactions performed using a terminal connected to a web site, it has been proposed to use a single-use secret code which is transmitted to the user each time a transaction is validated. According to a first solution the single-use secret code is transmitted to the user via a distinct communication channel, e.g. via a phone link or SMS (Short Message Service), the user being required to input the received secret code on the terminal to validate the transaction. Another known solution provides an additional hardware device to each of the users, this device generating the single-use secret code after an authentication of the user by means of credentials such as a password or biometric data. These solutions are burdensome for the users who do not always have nearby a phone or mobile or wireless network coverage, or this hardware device, when they are required to validate a transaction. The solution requiring an additional hardware device is costly for the banking organizations. In addition, the solution using a secret code transmitted by SMS does not provide sufficient high security level since it has already been subjected to successful attacks.
Therefore, it may be desirable to propose a method for securing a sensitive operation performed using a non-secure terminal, such as a transaction, e.g. a payment transaction, or a user authentication, or more generally an operation with protection against tampering. It may also be desirable to protect secret data input by users and transaction data transiting through such a non-secure terminal. Further, it may be desirable to make the proposed method compatible with all existing terminals, even with terminals of low computation power.
SUMMARYA method is disclosed for authenticating a user, the method comprising: receiving from a secure processor, a software component configured to generate an image frame including information intelligible to the user, and input data of the software component, the software component comprising a first input configured to receive a first input data having two randomly-selected valid values, and invalid values, the transmitted input data comprising the valid values of the first input data; performing several times: selecting one of the valid values of the first input data in the transmitted input data, executing the software component by applying the transmitted input data to inputs of the software component and the selected valid value to the first input of the software component, the execution of the software component generating the image frame which has pixels in a visible or invisible state, depending on the selected valid value of the first input and defining the information, displaying the image frame, acquiring from the user a response depending on the information in the displayed image frame; and transmitting the acquired responses to the secure processor.
According to an embodiment, a first a valid value of the first input data used for displaying a first image frame is selected as a function of a data provided by the secure processor, and one of the valid values of the first input data used for displaying a another image frame is selected as a function of the response acquired from the user from a previously displayed image frame.
According to an embodiment, the valid value of the first input data used for displaying the image frames generated by successive executions of the software component, is randomly selected and a signature of data defining each generated image frame is transmitted to the secure processor.
According to an embodiment, the software component is configured to generate an image frame wherein the information is displayed using random pixels having a probability lower than 100% to be visible in the image frame, the software component being executed a plurality of times to generate a plurality of image frames which are displayed at frame display rate such that the information becomes intelligible to the user.
According to an embodiment, the information: comprises a series of labels of a keypad ordered as a function of the first input data, the response from the user comprising key positions of keys of the keypad selected by the user, or comprises a series of labels of a keypad ordered as a function of the first input data, and one symbol belonging to a validation code, the response from the user comprising key positions of keys of the keypad selected by the user, or specifies a biometric challenge, the response from the user comprising biometric data inputted by the user using a biometric sensor.
According to an embodiment, the software component is configured to provide the output data in one of the two binary states with a probability comprised between 12.5% and 87.5% or set to 50%, in response to the random selection.
According to an embodiment, the software component is configured to store several image frame configurations which are selected by selecting values of input data of the software component.
According to an embodiment, the software component is configured to generate encrypted parts of an image frame, the method further comprising: executing the software component; decrypting each generated encrypted image frame parts, using a decrypting mask which is transmitted from the secure processor; inserting each decrypted image frame parts in an image frame background to generate an image frame; and displaying the generated image frame.
According to an embodiment, the method further comprises: acquiring a response from the user in relation with the displayed information; transmitting the response to the secure element; and authenticating the user by the secure element when the response corresponds to the information and to a secret data shared by the user and the secure element.
According to an embodiment, the software component is encoded as a garbled circuit comprising circuit inputs, circuit outputs, logic gates and wires, each logic gate having two inputs and one output, each wire having a first end connected to one of the circuit inputs or to one of the logic gate outputs and a second end connected to one of the logic gate inputs or to one of the circuit outputs, the garbled circuit being generated by selecting a valid data for each binary state of each of the wires, and by computing for one logic gate of the garbled circuit, truth table values as a function of each valid data of each input of the logic gate, each valid data of the output of the logic gate and a logic operation performed by the logic gate.
Embodiments may also relate to a user terminal configured to: receive from a secure processor, a software component configured to generate an image frame including information intelligible to the user, and inputs data of the software component, the software component comprising a first input configured to receive a first input data having two randomly-selected valid values, and invalid values, the transmitted input data comprising the valid values of the first input data; perform several times: selecting one of the valid values of the first input data in the transmitted input data, executing the software component by applying the transmitted input data to inputs of the software component and the selected valid value to the first input of the software component, the execution of the software component generating the image frame which has pixels in a visible or invisible state, depending on the selected valid value and defining the information, displaying the image frame, acquiring from the user a response depending on the information in the displayed image frame; and transmit the acquired responses to the secure processor.
According to an embodiment, the terminal is further configured to execute the operations performed by a terminal in the method as previously disclosed.
According to an embodiment, the secure processor is a secure element connected to a main processor of the terminal.
According to an embodiment, the secure processor belongs to a remote server linked to the terminal through a data transmission network.
Embodiments may also relate to a secure element configured to execute the operations performed by a secure processor in the method as previously disclosed, wherein the secure element is connected to a main processor of a terminal.
Embodiments may also relate to a server configured to execute the operations performed by a secure processor in the method as previously disclosed, the server being linked to the terminal through a data transmission network.
Embodiments may also relate to a computer program product loadable into a computer memory and comprising code portions which, when carried out by a computer, configure the computer to carry out the method as previously disclosed.
Examples of the method and/or device may be better understood with reference to the following drawings and description. Non-limiting and non-exhaustive descriptions are described with the following drawings.
In the figures, like referenced signs may refer to like parts throughout the different figures unless otherwise specified.
In the following, the term “secure” is employed according to its plain meaning to those of ordinary skill in the art and encompasses, in different embodiments, security arising from techniques such as encryption, or other types of software or hardware control used to isolate information from the public or to protect it against unauthorized access or operation. The expressions “secure communication” and “secure communication link” refer to communications that are encrypted using public/private key pairs, or symmetrical key encryption with keys shared between communicating points. “Secured communications” can also involve virtual private networks, and other methods and techniques used to establish authenticated and encrypted communications between the communicating points.
According to an embodiment, an authentication server ASRV is configured to implement a method for authenticating a user during transactions involving an application or service provider server SSRV and a user terminal UT, based on a two-factor authentication scheme.
The terminal UT can further comprise a secure element SE, such as a secure processor that can be standalone or embedded into a smartcard UICC. The secure processor SE can be for example a SIM (“Subscriber Identity Module”) card, or a USIM (“Universal Subscriber Identity Module”), providing an access to a cellular network. The secure processor SE can include an NFC (“Near Field Communication”) circuit to communicate with a contactless reader. The NFC circuit can be embedded into a SIM card (SIM-NFC) or UICC, or in a SoC (“System on Chip”) circuit, or in an external memory card, for example an “SD card”. The circuits NIT can include a mobile telecommunication circuit giving access to a mobile cellular network and/or to the Internet network, through the cellular network, and/or a wireless communication circuit (Wi-Fi, Bluetooth®, or any other radio frequency or wireless communication methodology), and/or any other wired or wireless connection circuit that can be linked to a data transmission network such as Internet.
In steps S4 and S5, the authentication server ASRV generates a single-use link token LTK (dedicated to registration of the user identified in step S2) and transmits it to the server SSRV in response to the registration request RGRQ. The link token LTK establishes a link between the received user identifier UID and the service identifier SID. The link token LTK has a time-limited validity that may be fixed to a value between several minutes out several hours. Instep S6, the server SSRV receives the link token LTK and transmits it to the terminal OT. In step S7, the terminal OT displays the link token LTK.
In step S8, the user downloads and/or installs an application APP dedicated to user authentication in a user terminal UT to be used for authentication and involving the authentication server ASRV. The terminal UT may be the terminal OT or another terminal (a mobile phone, a smartphone, a smartwatch, a personal computer, a payment terminal and a digital tablet, or any equipment having communication and man-machine interface capabilities). Steps S9 to S13 are performed at a first execution of the application APP. In step S9, the application APP generates a unique device identifier DID of the terminal UT. Then, the user is invited to choose a password PC and to input the link token LTK received and displayed in steps S6, S7. In steps S10 and S11, the user inputs a password PC and the link token LTK. The link token LTK may be displayed in the form of an optical code, such as a QR code, and captured on the display screen of the terminal OT by the application APP using the camera of the terminal UT. In step S12, the application APP transmits a registration message ERP to the authentication server ASRV, this message containing the device identifier DID, the password PC and the link token LTK. In step S13, the server ASRV checks the validity of the received link token LTK. A link token may be considered invalid, when its validity period has elapsed, or when it has been already used once or a predefined number of times to identify a device. If the link token is valid, the server ASRV stores the device identifier DID and the password PC in a user database UDB in step S14. In step S15, the server ASRV transmits a message RP in response to the request RGRQ to the service provider server SSRV. The message RP contains the user identifier UID and a status of the registration depending on the validity check of the link token performed in step S13.
If the check performed in step S13 succeeds, the user terminal UT is regularly registered by the server ASRV and thus it can be used as a second authentication factor associated with the user, the authentication of the user by the service provider server SSRV being considered as a first authentication of the user.
In step S22, the authentication server ASRV receives the request ARQ, and generates a unique transaction identifier TID. The authentication server ASRV further searches the database UDB for device identifiers DID corresponding to the user identifier UID, and generates a transaction validation code CC, preferably of single-use, and a distinct dedicated software component GC for each of the user terminals UT corresponding to the devices identifiers DID found in the database UDB. Since the software component GC is designed to display the validation code CC, it is specific to this code. In step S23, the server ASRV sends to the terminal UT structure and content data GCD defining the software component GC and including input data of the software component in an encrypted form, a final mask IMSK to be applied to image frame parts generated by the software component circuit, and a cryptographic data GCK to be used to execute the software component. In step S24, the server ASRV sends an acknowledge message ACK to the server SSRV, this message containing the user identifier UID and the transaction identifier TID. In step S25, the application APP executed by the terminal UT receives the data GCD, IMSK, GCK related to the software component GC and transmitted in step S23, and sends an acknowledge message AKM to the server ASRV. If the application APP is not currently running on the terminal UT, the reception of the data related to the software component may trigger the execution of the application APP. In step S26, the server ASRV sends to the terminal UT a request RGC to execute the software component GC. In step S27, the reception of the notification RGC triggers the execution by the application APP of the software component GC which generates an image frame showing, for example, a keypad having keys, the message MSG and one or more digits of the single-use transaction validation code CC having, for example two or more digits.
According to an embodiment, the keys of the keypad are arranged in a randomly selected layout in the displayed frames, and each time the user presses a key of the displayed keypad in step S28, a new keypad layout is selected and the user terminal UT displays the keypad having the newly selected layout.
According to an embodiment, the first displayed keypad has a layout known from the server ASRV, and each new displayed keypad has a layout which is selected as a function of the position in the keypad of the previous key pressed by the user and a number of previously keys pressed by the user. According to an embodiment, only one digit of the validation code CC is displayed at the same time in the images generated by the software component, and when the user enters the first digit of the validation code, the first digit is replaced in the generated images by the second digit of the validation code.
According to an embodiment, the value of the first displayed digit of the validation code CC is computed as a function of the key previously selected by the user for inputting the last digit of the password PC. In addition, the value of second displayed digit of the validation code CC can be computed as a function of the key previously selected by the user for inputting the first digit of the validation code. The digits of the displayed validation code CC may be also computed as a function of the number of keys previously pressed by the user when the user types the password PC and the validation code CC.
In step S28, the user of the terminal UT inputs one digit of the password PC or the displayed digit of the validation code CC. In the example of a smartphone, the user uses the displayed keypad, and touches corresponding positions POSi of the keys of the displayed keypad. The steps S27 and S28 are executed again until all digits of the password PC and of the validation code CC are entered by the user. In step S29, the application APP transmits the sequence of positions POSi selected by the user with the device identifier DID to the server ASRV. In step S30, the server ASRV determines the password PC1 and the code CC1 corresponding to the positions POSi typed by the user. To this purpose, the server ASRV knows the keypad used to input the first position POS1, and can determine the subsequent displayed keypad layouts generated by the software component GC, and thus can determine the keys labels corresponding to the positions POSi, and consequently the values of the password and validation code typed by the user. In step S31, the server ASRV checks the compliance of the entered password PC1 and validation code CC1 with the ones (PC, CC) stored in the database UDB in association with the device identifier DID. For security reasons, the database UDB may only store a hash value HPC instead of a clear value of the password PC entered in step S10, the verification operation of the password PC being performed by applying a hash function to the typed password PC1 and by comparing the result of the hash function with the hash value HPC of the password PC stored in the database UDB. In step S32, the server ASRV transmits to the service provider server SSRV using the address SURL, an authentication response containing the user identifier UID and the result of the verifications performed in step S31. In this way, the user corresponding to the identifier UID is authenticated and the transaction TID may be validated only when the typed password PC1 and validation code CC1 match the password PC stored in the database UDB and the validation code CC corresponding to the software component GC sent by the server ASRV to the user terminal UT in step S23.
In one embodiment, the input of the password PC in step S10 is performed by executing twice the steps S27 to S30 using two different software components to get two passwords from the user. After each execution of steps S27 to S30, the validation code CC1 is checked and the password PC1 entered by the user is validated by the server ASRV only if the validation code CC1 entered by the user is the same as the validation code CC displayed by the user terminal UT executing one software component GC. After two successful executions of steps S27 to S30, each providing a validated password PC1, the validated passwords PC1 entered during the first and second execution of the steps S27 to S30 are compared, and if they are identical, the password PC1 is stored in the database UDB to assign it to the user terminal UT. In addition, steps S11 to S15 are executed only once the password PC1 entered by the user is stored in the database UDB. In this way, only the positions POSi typed by the user are transmitted from the user terminal UT to the server ASRV. Therefore, a malware installed in the terminal UT or a man-in-the-middle attack between the server ASRV and the user terminal UT cannot discover the typed codes PC and CC without executing the software component. If this happens, the hacker performing the attack sends a message ARP to the server ASRV (as in step S29). Thus the server ASRV can receive two messages ARP for a same transaction or from the same user terminal UT, one from the authenticated user and one from the hacker, and can device to invalidate the transaction or raise a flag or perform any other specific action related to this event.
According to an embodiment, the message ARP is transmitted by the user to the server ASRV (step S29) by another transmission channel.
The operation of checking the received link token in step S13 can be performed by comparing the received link token LTK with the token stored in step S4 in the table LNK. The received link token is retrieved in a record of the table LNK in relation with a user identifier UID having a device corresponding to the device identifier DID received by the server ASRV in step S12, and according to the table DEV. If not the case, the received link token is considered as invalid and the user terminal UT is not registered in the table DEV.
Instead of being performed by the application APP, the steps S22, S25, S27 and S29 may be performed within or by a web browser installed in the terminal UT, the steps S25, S27 and S29 being performed by a script executed by the web browser, such as a script written in JavaScript®, and transmitted for instance in a web page by the server ASRV. In an embodiment, those transmissions may be encrypted, to enhance security level.
In the example of
The software component GC is arranged in layers of parallel logical gates that can be processed at the same time, so that the software component can be executed by parallel processing.
According to an embodiment, to generate image frames FRM as shown in
Each of the gates XGj performs a logical XOR operation with an input INi of the software component. Each of the outputs SGj of the circuit PLS is connected to an input of all gates XGj of the circuit SGCj. Each gate XGj also receives one of the input values INc1-INcp and provides one pixel value PXj1-PXjp to the output of the circuit GC.
Each of the circuits FPCb comprises one logic gate XGb performing a logical XOR operation per pixel PXb controlled by the software component GC and distinct from a segment pixel in the image frames FRM. Each of the gates XGb in the circuit layer L2 receives two input values INb1, INb2 of the software component GC and provides one pixel value PXb. The number of input values INb, INc can be limited to a value around the square root of the number of pixels PXb, PXj controlled by the software component GC.
Of course, the digits can also be controlled and/or arranged (e.g. with more segments) to display other signs than numbers such as alphabetic characters or more generally symbols including ASCII characters.
In the example of the software component GC of
The interconnection matrix XM2 defines which pixel generated by the software component belongs to a segment SG. According to one embodiment, the position, orientation and shape of each segment SG are varied by one or several pixels, depending on the display resolution of the user terminal, from one software component to another. This provision makes it more difficult to perform a machine optical recognition of the displayed symbols.
It may be observed that the term “segment” as used herein designates a set of pixels that are controlled by a same one of the segment values SGj in output of the circuit PLS. The set of pixels forming a segment is not necessarily formed of adjacent pixels, but can comprise groups of adjacent pixels as the segments forming a key label KYL. In addition, the pixels forming a segment are all visible or all invisible in one displayed image frame FRM.
According to a simplified example, s is equal to one (1), such that a single read signal RD is applied to all the memory cells MCij of the memory plane MC.
According to another example, the read signal inputs RDk of the circuit GC can be combined together by logic gates which output read signals applied to the memory cells MCij. Therefore, the number s of read signals RDk provided to the Boolean circuit can be greater than the number (2n×m) of memory cells MCij in the memory plane MP.
According to another example, the circuit PLS may comprise another decoding circuit that can be the same circuit as the circuit ADC, and the number s of input data RDk can be set equal to n (i.e. the number of input data ADl), such that each set of n input data ADl corresponds to a set of n input data RDk. This another decoding circuit generates active read signals that are provided to the memory cells MCij selected by one of the signals SLi.
Other types of logic gates can be used instead of AND gates for the memory cells MCij. In one example, the memory cells can include a logic NAND gate with the input of the read signal RD inverted or not depending on the binary data stored by the memory cell. In another example, the memory cells can also include a logic OR or NOR gate with the input of the read signal RD inverted or not depending on the binary data stored by the memory cell. The output value of a memory MCij cell can be also at 0 for storing a 1, provided that the output of the memory cell is connected to an inverted input of the corresponding circuit OGj. The memory cells can also have their selection signal input SL inverted.
In addition, all the memory cells Mij in the memory plane MP do not have necessarily the same types such as the ones disclosed in
In the example of
Each of the circuits AGi may have the structure as disclosed in
a unique software component identifier GCID,
a number set DIM comprising a number d of input values INb, INc, a number n of input values ADl, a number s of input values RDk, a number z of output values PXi, PXj of the circuit GC, a number g1 of gates MCij, XGb, XGj and gates Gin the circuits AGi, OGj, a number g2 of all these gates excluding the XOR gates XGb, XGj, a number w of wires in the circuit, and a number y of circuit layers of parallel logic gates LRk, L2 in the circuit GC,
an input data table INLB comprising all values of the inputs INb, INc of the circuit GC, for example numbered from 1 to d, as specified for the execution of the software component,
an input data table ADLB comprising all values of the input data ADl of the software component GC, numbered from 1 to n, for the execution of the software component,
an input data table RDLB comprising all values of the input data RDk of the software component GC, numbered from 1 to s, for the execution of the software component,
a gate wire table GTW defining two input wires numbers IN1, IN2, an output wire number ON and a type identifier GTYP of each logic gate (logic gates of AGi and OGj, XGb, and XGj) of the software component GC, the gates of the circuit being numbered from 1 to g1, and
a gate truth table GTT comprising four values OV00, OV01, OV10, OV11 for each of the logic gates of the software component GC.
In the example of
According to an embodiment, the input values INb, ADl, RDk, INc and the output values PXb, PXj of the garbled circuit GC, and of the logic gates G of the circuits AGi and OGj, and of the gates MCij, XGi, XGj, each representing a binary logical state 0 or 1, are defined by numbers of several bits, for example 64 or 128 bits. In this way, each input and output within the garbled circuit GC has only two valid values, and all the other possible values, when considering the size in bits of these values, are invalid. When the software component GC is generated, the two valid values of each input ADl, RDk, INb, INc of the software component are randomly chosen, provided that the least significant bit of the two valid values are different, these least significant bits being used to select one value in the truth table of the logic gate when computing the output values of the logic gates, and to determine the logical states of the outputs of the circuit GC.
The truth table GTT[i] of each of the logic gates G of the circuits AGi, OGj and MCij comprises four values OV00, OV01, OV10, OV11, each corresponding to a combination (0, 0), (0, 1), (1, 0), (1, 1) of binary input values corresponding to the input values of the logic gate. The topology of the software component GC may be defined in the table GTW, by numbering each wire of the software component, i.e. each input wire of the software component from 1 to INN(=d+s+n+y) and each output of the logic gates from (INN+1) to (INN+g1), and by associating to each logic gate of the software component GC one record of the table GTW comprising two wire numbers IN1, IN2 to the two inputs of the gate and one wire number ON to the output of the gate. The wire numbers of the outputs of the software component GC are numbered from (INN+g1−z+1) to (INN+g1).
According to an embodiment, the tables ADLB, RDLB contain respectively both valid values ADlV1, ADlV2 of each of the input values ADl, and both valid values RDkV1, RDkV2 of each of the input values RDk, corresponding to the logical states 0 and 1. Each value RDkV1, RDkV2 can be equal with a same probability to either one or the other of the two valid values of the input value RDk corresponding respectively to the states 0 and 1. In a similar way, each value ADlV1, ADlV2 may be equal with a same probability to either one or the other of the two valid values of the input value ADl corresponding respectively to the states 0 and 1.
The XOR gates XGb, XGj can be executed either by using a truth table which is encoded in the table GTT, or by applying XOR operations to each pairs of bits of same rank in the input values of the gate. In the latter case, the field GTYP of the table GTW defines whether the gate is a XOR gate or another gate, and the table GTT comprises one record for each gate distinct from an XOR gate.
According to an embodiment, each value in the tables INLB, ADLB, RDLB, GTT is encoded by a 128-bit word, and each record of the table GTW is encoded on a 64-bit word, the wire numbers IN1, IN2, ON being encoded on 21-bit words. The table GTW can be transmitted from the server ASRV to the terminal UT in a compressed form, for example using the gzip compression scheme.
According to an embodiment, the order of the logic gates in the gate tables GTW, and GTT can be defined randomly, provided that the table records GTW[i] and GTT[i] at the index i refer to the same gate.
The module GCM comprises a switching module SWC, a software component interpreter GCI, an XOR masking circuit XRG and a pixel mapping module MPF. The switching module SWC receives the structure and content data GCD defining the software component GC to be executed, and loads the data to be processed by the next execution of the software component GC in an input data structure GCDI. Thus, the switching module SWC transmits the data DIM, INLB, SGLB, NBGL, GTW, GTT and GCK without modification to the structure GCDI.
According to an embodiment, the switching module SWC performs switching operations SW1k, SW2l to select one or the other of the two valid values RDkV1, RDkV2 of each input value RDk, and one or the other of the two valid values ADlV1, ADlV2 of each input value ADl. Each switching function SW1k is controlled by a respective bit NB1k of a number NB1 having s bits, s being the number of the input values RDk to be input to the software component GC. Each switching function SW2l is controlled by a respective bit NB21 of a number NB2 having n bits, n being the number of the input values ADl to be input to the software component GC. The numbers NB1, NB2 are provided by a selection function SEL. Each switching operation SW1k, SW2l provides for each of the input values RDk, ADl a value RDkVq1, ADlVq2 which is stored in the structure GCDI. As a result of the selection of one of the two valid values RDkV1, RDkV2 of the input values RDk and the selection of one of the two valid values ADlV1, ADlV2 of the input values ADl, one keypad layout is selected among 2n predefined keypad layouts, a keypad having the selected layout being then generated.
The function SEL may receive first numbers NB1, NB2 from the server ARSV to display a first image frame showing a keypad having a first key layout. Each time the user selects a key of the displayed keypad, the function SEL may compute the numbers NB1, NB2 from the previous key selected by the user in the displayed keypad, and/or from the number of keys previously selected by the user from the first execution of the software component GC. The numbers NB1, NB2 are computed modulo s and n, respectively.
In another embodiment, the server ASRV may transmit to the terminal UT all the numbers NB1, NB2 to be used to display a sequence of keypads having different key layouts.
The module GCI is a dedicated interpreting module configured to successively execute each of the logic gates of each circuit layer, as defined by the data in the input data structure GCDI, starting with the first circuit layer. To this purpose, the interpreting module GCI can use a wire table receiving the value of each wire of the software component GC, written in the table at an index corresponding to the wire number of the wire value. The wire table is first loaded with the input values INb, INc, RDkVq1, ADlVq2 of the software component, written in the table at indexes (between 1 and INN=d+s+n+y) corresponding to wire numbers assigned to the input values. Then the computed output value of each executed logic gate is written in the wire table at an index corresponding to the wire number of the output of the executed logic gate. At the end of the software component execution, the wire table comprises the values of the outputs of the software component GC at indexes from (INN+g1−z+1) to (INN+g1).
The output value of each logic gate can be computed by applying a non-reversible function applied to both input values of the gate and to one value selected in the truth table of the gate, as a function of the least significant bit of each of the two input values:
OV=PF1(IN1,IN2,GG) (1)
where IN1 and IN2 represent the input values of the gate, GG=GTT[IN1{0}//IN2{0}], IN1{0} and IN2{0} represent the least significant bit of the input values IN1, IN2, “//” represents the bit concatenation operator, GTT represents the four-element truth table of the gate, and PF1 represents the non-reversible function.
According to an embodiment, the function PF1 can use an encryption function such as AES (Advanced Encryption Standard) using an encryption key assigned to the software component. In this case, the encryption key GCK can be stored in the structure and content data GCD of the software component GC. For example, the output value OV of a logic gate can be computed as follows:
OV=AES(GCK,K)⊕K⊕GG (2)
with K=CF(IN1, IN2)⊕T, “⊕” represents the Exclusive OR (XOR) operator, T represents a number assigned to logic gate, for example the number of the logic gate, and can also depend on the values of the inputs IN1, IN2, CF represents a combination function, and AES(GCK, K) represents an encrypted value of K by the AES encryption algorithm using the encryption key GCK. The combination function can be an XOR operation or an operation in the form:
CF(IN1,IN2)=SH(IN1,a)⊕SH(IN2,b), (3)
SH(X, a) representing a left shift operation of X by a number of bits.
The least significant bit of each output data PXv (PXb, PXj1-PXjp) of the software component GC provided by the module GCI is considered as a pixel value PXv. The module XRG combines the least significant bit of each output value PXv provided by the software component GC with a respective mask bit value MKv belonging to an image mask IMSK provided in the structure and content data GCD. The combination operation used can be an XOR operation XRv which provides a pixel value PX′v for each output data PXv. The respective least significant bits of the output values PXv of the software component GV may represent white noise since the output values of the software component including the least significant bit thereof are randomly chosen. Thus the image parts generated by the software component are in an encrypted form, and are decrypted using the image mask IMSK.
The image mask IMSK comprises the message MSG, such that when combined with the pixels PXv provided by the software component GC, the message MSG becomes intelligible and may be combined with segments SG of the validation code CC. The image mask IMSK can also be configured to make visible the pixels PX′v of a digit segment SG corresponding to a keypad layout defined by the selected values RDkVq1, ADlVq2. A segment SG can be set always visible by fixing the corresponding segment value SGj to the binary state 0 (segment configured to be invisible) and by setting to 1 the corresponding pixels MKv in the mask IMSK. Another way to configure a segment always visible (or invisible) is to configure the circuit PLS such that it provides always a visible (or invisible, respectively) segment value SGj for all possible values of RDk and ADl.
Segments SG or pixels PXv are invisible or visible in one of the generated image frames FRM when they are displayed, respectively, with a background color of the image frame, or with a color different from the background color. The background color is defined by the color of the pixels around the considered segment SG, and may vary as a function of the position of the segment within the image frame FRM. In another embodiment, the segments are displayed on a background image. Each pixel of an invisible segment is displayed with the color of the corresponding pixel in the background image which is located below the segment pixel.
According to one embodiment, the final mask IMSK is transmitted to the terminal UT in step S23 using another communication channel, for higher security.
The interconnection matrices XML XM2 define where the pixels PX′v corresponding to the input values of the software component GC are displayed in the generated image frames FRM. The input values INb, INc of the software component GC define in relation with the image mask IMSK if the corresponding pixel PX′v in output of the software component GC is visible or invisible. The respective binary states of the input values INb, INc of the software component GC can be randomly selected at the time the software component is generated, the image mask IMSK being then generated as a function of the 2n keypad layouts and the architecture of the software component GC and more particularly as a function of the interconnection matrices XML XM2.
The mapping module MPF inserts groups of pixels values PX′v provided by the module XRG, at suitable positions into a background image frame BCKF to generate one of the image frames FRM to be displayed. In particular, the module XRG provides a group of pixels PX′v which forms the banner frame BNF as shown in
According to another embodiment, the unmasking operation performed by the module XRG could be combined with the generated image frames FRM, i.e. after the image mapping operation performed by the mapping module MPF. Therefore the mask IMSK may have the size of the background image frame BCKF or the image frames FRM.
According to an embodiment, the software component GC is received at step 23 with the first numbers NB1, NB2 to be used for selecting the input values RDkVq1, ADlVq2 (k=1, . . . s and l=1, . . . n). Hence, the server ASRV which generated the software component knows the corresponding first keypad layout. Then each time the user selects a key of the keypad, the terminal UT (the module GCM) computes new numbers NB1, NB2 to select and display a keypad KYP having another key layout. If the user presses the erase key “C”, the keypad layout may be not changed or the previously displayed keypad may be displayed again, using the corresponding numbers NB1, NB2.
Each time the user selects a key of the keypad, the numbers NB1, NB2 may be computed and updated as a function of a number attributed to the last key selected by the user, this number being attributed to the key as a function of its position in the keypad. In addition, the computation of the numbers NB1, NB2 may be performed as a function of number of times the user selects a key with the currently executed software component. In addition or alternatively, the computation of the numbers NB1, NB2 may be performed as a function of the previous values of the numbers NB1, NB2. The updated values of the numbers NB1 and NB2 are performed respectively modulo s and n. The module GCM may manage the usage of the erase key “C”, such that the positions POSi sent to the server ASRV at step S29 comprise only the positions validated by the user. In this case, the module GCM commands the display of the keypad that was displayed when the user selected the wrong key pressed just before the erase key, by using the corresponding numbers NB1, NB2.
According to another embodiment, all positions of the keypad selected by the user are sent by the terminal UT to the server ARSV, and the updating of numbers NB1, NB2 also takes into account the selection(s) of the erase key “C” by the user. As the server knows the first values of the numbers NB1, NB2, the updating function of these numbers and the positions POSi typed by the user, it can compute the sequence of numbers NB1, NB2 used by the terminal UT, and determine the sequence of keypad layouts displayed by the terminal, the password and validation code numbers PC, CC typed by the user being determined from each position POSi and the corresponding keypad layout. The cancel key “C” may be managed either to delete the last typed digit or all the previously typed digits. The effect of the cancel key “C” can be shown to the user by erasing one or all dots in the display zone FBD.
According to an embodiment, the digits of the validation code CC are displayed only when the user is requested to type this code, for example after the user typed the password PC. The sequence of numbers NB1, NB2 computed by the module GCM may be such that the segments displaying one digit of the validation code become visible after the user typed the password PC, e.g. after four validated key selections by the user, if the password comprises four digits.
According to an embodiment, the validation code CC can be defined in the structure and data of the software component GC, such that it is independent from the previous keys typed by the user.
According to another embodiment, the validation code CC can be defined as a function of the last key or all the keys previously typed (and possibly validated) by the user to enter the password PC. In this way, if the password PC entered by the user is wrong, the displayed validation code CC is also wrong, and the user cannot enter the right validation code CC expected by the server ASRV. For this purpose, the segments forming a digit of the validation code CC can be formed using the circuit part PLS as the segments forming the key labels KYL.
According to another embodiment, the first numbers NB1, NB2 or all the sequence of numbers NB1, NB2 to be used to select the keypad layouts and the digits of the validation code are randomly selected, and data representative of the displayed image frames are sent by the terminal UT to the server ASRV, these data enabling the server to determine the sequence of displayed keypad layouts and digits of the validation code.
The transmission of the two valid values of the inputs data RDk, ADl in the structure and content data GCD of the software component GC, enables introduction of randomness in the execution and output data of the software component at a very low cost. In contrast, a software component producing random output data can introduce a random generator in the software component, which cannot be obviously realized using the garbled circuit technique, without adding complexity to the garbled circuit, and thus without increasing the size of the structure and content data GCD defining the software component. In addition, the transmission of the two valid values RDkV1, RDkV2 of the input data RDk, and the two valid values ADlV1, ADlV2 of the input data ADl does not reduce the security of the introduction of the password PC and validation code CC, since the correspondence between each input value RDkV1, RDkV2, ADlV1, ADlV2 and a binary value 0 or 1 thereof cannot be established easily.
According to an embodiment, the input of a password may be not requested to authenticate the user, only the displayed validation code CC being requested to the user. In this case, the first displayed image frame shows the first digit of the validation code CC, and each of the subsequent displayed image frames shows one of the other digits of the validation code.
According to one embodiment, each time the terminal UT has to perform a new authentication, a new software component GC displaying a keypad KYP with different key layouts and displaying a different validation code CC is executed in step S27.
According to an embodiment, in order to avoid the transmission of one software component GC (in step S23), each time the user terminal is used to perform a new authentication, several alternative software components (defined by the structure and content data GCD) can be downloaded in the terminal UT in one time, and the terminal UT selects a non-already executed software component each time it has to perform a new authentication. As an example, several software components are downloaded with the application APP when the latter is downloaded and installed in a user terminal UT. Then, when one or several software components are used, a new set of software components can be downloaded from the server ASRV to the terminal UT, for example when the terminal has an efficient network connection.
According to an embodiment, several alternative software components are stored in the terminal UT in an encrypted form, and each time the terminal UT executes a new software component, the server ASRV sends a corresponding decryption key to the user terminal.
According to an embodiment, only a part of each of the software components is downloaded into the terminal UT. The downloaded part of each software component can include the data GCID, DIM, NBGL, GTW with or without the table RNLB. Each time the terminal UT has to perform a new authentication, the server ASRV only transmits to the terminal the data INLB, SGLB, GCK and IMSK, in step S23. Then, the terminal UT transmits the identifier GCID of the software component used for authentication to the server ASRV, for example in step S25 or S29. When the server ASRV receives a software component identifier GCID from a user terminal UT, it checks in the database UDB that the received identifier GCID corresponds with a next unexecuted or valid software component previously transmitted to the terminal UT. If the received identifier does not correspond with a next unexecuted or valid software component previously transmitted to the terminal UT, the server ASRV invalidates the user authentication and the corresponding transaction. The server ASRV may also invalidate a previous transaction performed with the same software component (corresponding to the same identifier GCID).
According to an embodiment, the server ASRV can assign a validity indicator (for example in the table GCP of
According to an embodiment, to prevent the keypad layout from being acquired using a screenshot function of the terminal UT, only a part of the visible segments in each key KY is displayed in each image frame generated by the software component. To this purpose, each visible segment to be displayed is present in an image frame FRM generated by the software component with a probability lower than 100%, for example equal to 50%.
The bottom part of
According to an embodiment, visible and invisible segments of each digit KYL, DL to be displayed appear in the frames FRM with respective probabilities such that the displayed digits are intelligible for the human visual system, thanks to the persistence of the latter. For example, the generated software components are configured to display the invisible segments with a probability of 0 to 15%, and the visible segments with a probability of 50 to 100%. The visible segments forming a key label KYL or a digit of the validation code CC can be displayed with respective probabilities comprised between 50 and 100%, and the invisible segments in a key label or a digit of the validation code CC can be displayed with respective probabilities comprised between 0 and 15%. The display probabilities of the segments forming the digits of the key labels and the validation code CC can be adjusted as a function of the frame display frequency, such that the labels of the displayed digits remain intelligible for the human visual system.
The displayed keypad KYP may not need to have a validation key “V”, the validation of the typed codes being performed when the user inputs the last digit of the password PC and validation code CC to be typed. For example, if the password PC comprises four digits and the validation code CC two digits, the execution of the software component can be ended when the user inputs six digits.
According to an embodiment, the table RNLB contains both valid values RNjV1, RNjV2 of each of the input values RNj corresponding to the logical states 0 and 1. Each value RNjV1, RNjV2 can be equal with a same probability to either one or the other of the two valid values of the random value RNj corresponding respectively to the states 0 and 1.
The module GCM1 differs from the module GCM in that it comprises a modified switching module SWC1. The module SWC1 differs from the module SWC in that it performs additional switching operations SWi to select one or the other of the two valid values RNjV1, RNjV2 of each random input value RNj. Each switching function SWj is controlled by a respective bit RNBj of a random number RNBj having 2n bits, generated by a random number generation function implemented in the function SEL, and which generates a random number of 2n bits at a rate defined by the signal SNC. Each switching operation SWj provides for each of the random input values RNj a randomly selected value RNiVq3 which is stored in the structure GCDI. As a result of the selection of one of the two valid values RNjV1, RNjV2 of the random input values RNj (the visible segments SG to be displayed corresponding to a data SGj output by the circuit PLS set to the state one), the output of the corresponding AND gate BGj is set to state either 0 or 1, depending on the logical state of the selected random value RNjVq3. As a consequence, the visible segments SGj appear in each frame FRM with a probability equal to the probability of the random input value RNj to be set to state 1. If the number RNB is a true random number, this probability is equal to 50%.
The image mask IMSK can be configured to make visible the pixels PXv of a digit segment SG corresponding to a segment value SGj fixed to the binary state 0 (segment configured to be invisible). In this way, the segment is always visible (with a probability of 100%) in the generated image frames FRM. Another way to configure a segment always visible or invisible is to attribute a same value to the two random values RNjV1, RNjV2 corresponding to the related segment value SGj, in the transmitted structure and content data GCD1.
The transmission of the two valid values of the random inputs RNj, in the structure and content data GCD1 of the software component GC1, enables introduction of randomness in the execution and output data of the software component GC1.
These probabilities or others can be obtained using other combinations of logic gates combining the three segment values SGj1, SGj2, SGj3 and the three random input values RNj1, RNj2, RNj3.
Other probability values can be reached by the software component, by increasing the number of inputs for one segment, and thus by increasing the number of AND gates in the first circuit layer L1 and the number of combining OR gates in following circuit layers.
According to one embodiment, the visible segments are displayed with a probability decreasing as a function of the experience level of the user. At first authentications, performed from a first installation of the application APP, the visible segments SG can be displayed in the image frames FRM with high probabilities, e.g. between 75% and 100%. As the experience level of the user grows, these probabilities can be progressively reduced and finally set to randomly-selected values for example between 12.5% and 50%.
Instead of displaying a keypad with a variable key layout, the software component GC and corresponding mask IMSK may be configured to display a biometric challenge, requesting the user to input a response using a sensor that may be used for instance as a biometric sensor. The sensor may be a camera, a fingerprint sensor or a microphone (or an iris sensor, a heart rate monitor, a glucose monitor, a blood pressure sensor, . . . ). In this case, the user may be invited in step S10 to introduce in the terminal UT requested biometric data RBD using one or more sensors of the terminal UT (and/or one or more sensors securely associated with the terminal), for example according to displayed instructions. According to examples, the user can be instructed to enter fingerprints of several or all of his fingers using a fingerprint sensor, and/or to pick up pictures of his face (e.g. left, front, right pictures), using a camera (a conventional imaging camera, or any other type of camera such as thermal or infrared camera), and/or voice recordings by saying a list of words, letters, or figures displayed by the terminal UT, using a microphone. In step S12, the biometric data entered by the user are transmitted to the server ARSV and stored in the user database UDB. When the software component is executed at step S27, the user introduces the requested biometric data corresponding to the biometric challenge in the image frames displayed by the software component (step S28). In step S29, the biometric data introduced by the user are transmitted to the server ARSV. In steps S30, S31, the server ASRV compares the received biometric data with those stored in the user database UDB and corresponding to the user.
According to an embodiment, each time the user inputs an image and validates it, a new image frame FRM is generated using different values of the input data ADl, RDk, selected by new values of numbers NB1, NB2.
According to another embodiment, to prevent the displayed numbers ND from being acquired using a screenshot function of the terminal UT, the numbers ND are displayed using segments SG, for example seven segments, and only a part of the segments forming each displayed number ND is displayed in each image frame generated by the software component GC1. To this purpose, each visible segment SG to be displayed is present in an image frame FRM generated by the software component GC1 with a probability lower than 100%, for example equal to 50%. Thanks to the persistence property of the human visual system, the latter combines the image frames successively displayed by the terminal UT. Thus the displayed numbers ND become intelligible to the user, but cannot be captured in an efficient way using a screenshot function.
In another embodiment, the biometric challenge is for instance “Say the words <number1>, <number2> and <number3>” or “Pronounce the letters <number1> and <number2> of the <number3> word”.
According to an embodiment, each time the user inputs a response in the examples of
According to an embodiment, only a part of the segments forming each displayed number is displayed in each displayed image frame generated by the software component GC. To this purpose, each visible segment SG to be displayed is present in an image frame FRM generated by the software component GC with a probability lower than 100%, for example equal to 50%.
When the user is authenticated on the basis of a biometric challenge (
In the embodiments using garbled circuits, the generation of a software component, performed by the server ASRV in step S22, comprises generating random values representing the binary states 0 and 1 of the input bits and of the output bits of the logic gates of the software component, some of the logic gate outputs corresponding to outputs of the garbled circuit. The generation of a software component further comprises randomly selecting the interconnection matrices XM1, XM2, i.e. randomly selecting the links between the inputs of the software component and the inputs of the logic gates of the software component, and between the outputs of some logic gates and the inputs of other logic gates (definition of the table GTW). The generation of a software component further comprises defining the truth tables GTT of the logic gates of the software component, and encrypting each value of these truth tables using an encryption key. According to an example, each four values G (=GTT[IN1{0} I/IN2{0}]) of the truth table of a logic gate of the software component GC can be computed as follows:
G=PF2(IN1,IN2,OV) (4)
for each possible combination of the valid values of the inputs IN1, IN2 and the output OV, when considering the binary states corresponding to the valid values of IN1, IN2 and OV, and the logic operation performed by the logic gate, PF2 representing a non-reversible function. According to the example defined by equation (2), each four values G of the truth table of a logic gate can be computed as follows:
G=AES(GCK,K)⊕K⊕OV (5)
with K=CF(IN1, IN2)⊕T.
As a consequence, it is very difficult to determine the binary states of the input and output values and the function of the logic gates of the software component. Therefore, the functioning of the software component GC cannot be easily determined. In addition, the software component can process only the two valid values of each input of the circuit, among a huge number of invalid values. Therefore, it is not possible to apply any values to the inputs of the software component. For more details on garbled circuits, reference may be made to the document “Foundations of Garbled Circuits”, Mihir Bellare, Viet Tung Hoang, Phillip Rogaway, dated Oct. 1, 2012.
A hacker or a malware program executed by the terminal UT may be able to get the password PC input by the user in step S10. However, the knowledge of this password is not sufficient for the hacker to be authenticated in steps S21 to S32 since the typed positions POSi correspond to the keypad KYP and validation code CC displayed by the execution of the software component GC transmitted to the terminal UT in step S23. The hacker or malware has a very short time to get the keypad key layout by analyzing the displayed image frames FRM or by executing or analyzing the software component.
When the server ASRV generates the software component GC, it can be decided to use another bit rank in the values of the wires of the software component for defining the corresponding binary state of these values. The bits at the selected bit rank in the input values a logic gate AGi are used to select a data in the truth table GTT of the logic gate, and the bits at the selected bit rank in the output values PXi of the software component GC are extracted and applied to the module XRG.
The illustrations described herein are intended to provide a general understanding of the structure of various embodiments. These illustrations are not intended to serve as a complete description of all of the elements and features of apparatus, processors and systems that utilizes the structures or methods described therein. Many other embodiments or combinations thereof may be apparent to those of ordinary skills in the art upon reviewing the disclosure by combining the disclosed embodiments. Other embodiments may be utilized and derived from the disclosure, such that structural and logical substitutions and changes may be made without departing from the scope of the disclosure.
The methods disclosed herein may be totally or partially implemented by software programs executable by the main processor HP (CPU) of the user terminal UT, and/or at least partially by the graphic processor GP of the user terminal UT.
Further, the methods disclosed herein are not limited to displaying sensitive information such as a keypad with a randomly selected layout and a validation code. Indeed, the object of such a display is to check that the user knows a secret data shared with the server ASRV and perceives information presented by the terminal in a way perceptible only by a human. Alternative challenge-response schemes can be implemented in other embodiments. According to an embodiment, the displayed message MSG may request the user to input a combination such as the sum or the multiplication of the digits of the displayed validation code CC.
In addition to this or in another embodiment, the generated frames may comprise differences with a previously generated frame.
According to another embodiment, the flickering or blinking of segments may be controlled directly in/by the graphic processor, by setting pixel intensity, additive or subtractive pixel color, pixel refresh rate, or pixel flickering parameters of the graphic processor.
According to embodiments, the display screen DSP may be separated from the user terminal UT. For example, the display screen may be the one of a smartwatch, a smart glass or a virtual reality or an augmented reality headset, and the user terminal may be a smartphone, a tablet or a laptop/desktop computer. In some embodiments, the communication link between the display and the user terminal may be wireless. For example, the communication link may be a one or a combination of Bluetooth®, Wi-Fi, or any other radio frequency or wireless communication technology.
According to some embodiments, the biometric sensor is separated from (e.g. not part of) the user terminal UT. In addition, the biometric data BIOD may be acquired using various sensors used separately or in combination. In the example of a heart-rate monitor, a smartwatch may provide the biometric sensor and the display to be used to display the biometric challenge. In another embodiment, a glucose monitor wore separately may be used. Also, in other embodiments, a heart-rate monitor may be combined with a thermal imaging camera. In some embodiments, the communication link between the biometric sensor(s) and the user terminal may be wireless. In some embodiments, some if not all communication links may use secure protocols.
The challenge can be transmitted to the user using other means than by displaying it on a display screen. For instance, the challenge can be transmitted to the user by audio means using an audio cryptographic algorithm such as described in “Simple Audio Cryptography”, by Yusuf Adriansyah, dated Apr. 29, 2010. According to this algorithm, an original audio sequence is decomposed into a number of source audio sequences of the same length as the original audio sequence, in a way such that the original audio sequence can be reconstructed only by simultaneously playing all the source audio sequences generated by the decomposition, and such that it is very difficult to reconstruct the original audio sequence if any one of the source audio sequence is missing. Provision may be made to play two source audio sequences simultaneously, one via the terminal UT and the other via other means such as a portable device having a memory storing a source audio sequence and a headphone playing the stored source audio sequence without a microphone of the terminal hearing it. If the user hears an intelligible audio message by playing the two source audio sequences simultaneously, it means that the source audio sequence played by the portable device complements the source audio sequence.
According to another embodiment, the user records his fingerprints in step S10. In step S27, the software component GC displayed a message requesting the user to input one or two particular fingerprints, for example the thumb print and the ring finger print. This message is displayed using segments, as the digits representing the key labels KYL and validation code CC. In step S28, the user inputs the requested fingerprints, and at the verification steps S30 and S31, the server ASRV compares the input fingerprints with the one it stored after step S10. Here, the shared secret data are the fingerprints and the information to be perceived by the user is the designation of the requested fingers.
Further, the methods disclosed herein are not limited to authenticating a user in view of validating a transaction. The methods disclosed herein may be applied to securely transmit secret or sensible information to or from a user, or more generally to securely perform a sensitive operation in a non-secure environment.
Further, the methods disclosed herein are not limited to a method comprising displaying image frames and introduction of secret data (PC, CC) using a single user terminal. The methods disclosed herein may be applied to securely authenticate a user on another connected device, the frame images being displayed on the user terminal or on a remote display such as a smartwatch, virtual or augmented reality glasses or lenses, or projected on a surface or in the form of a 3D image, or any IoT (Internet of Things) device having a display function or the like. Similarly, the biometric data may be input in another device connected to the user terminal. Similarly, the secret data may be input in another device connected to the user terminal or using voice or gesture. Therefore, the words “user terminal” may designate a single device or a set of devices including a terminal without a display, an IoT device, a smart home terminal, and any input terminal that allows the user to enter data.
The user terminal UT may be controlled by voice or gesture. Voice command may be translated to command. Each recognized command being equivalent to one of the positions POSi. The keypad may be replaced by any other representations such as the ones using a gesture, following a geometric figure or tracing links between dots. Further, the input terminal may be a 3D input terminal with which the user may interact by 3D gestures in the air. Therefore the positions POSi may be 3D coordinate positions in space.
In other embodiments, the display may be any display including for example an ATM, a vending machine, a TV, a public display, a projected display, a virtual display a 3D display or a hologram. In other embodiments, the terminal may be any input equipment including for example a touch screen, a game accessory, a gesture acquisition system, a voice or sound command system.
In other embodiments, the images frames FRM are generated without applying the mask IMSK, and are displayed separately from the mask IMSK using two display devices, one of the two display devices being transparent, such as a display device in the form of eye lenses, the displayed images becoming intelligible to the user when they are superimposed with the displayed mask IMSK, the displayed white pixels of the mask being transparent and the displayed black pixels of the mask being opaque.
Further, the methods disclosed herein, introducing randomization in the execution of the software component protected against tampering and reverse-engineering, are not limited to generate blinking pixel in an image or an image frame. More generally, these methods can be used in any application in which a random state is used in a sensitive software function, protected against reverse-engineering and tampering, the software function receiving input data and providing output data. For example, these methods can be applied to protection of data without using encryption or decryption keys which are exposed to key theft. In this example, the software component is configured to provide a part of the protected data as a function of a set of random input data, each random input data having two possible values. Each combination of the random input values applied to the software component is used to compute a respective part of the protected data. The number of combinations of the random input values defines the number of data parts that can be computed by executing the software component. As an example, the data to be protected can be images, and the data parts of such images can be pixel values of an image or color component values of the image pixels, the execution of the software component providing a pixel value or a part thereof and a position of the pixel in the image (see “Secure Image Datasets in Cloud Computing”, X. Arogya Presskila, P. Sobana Sumi, in International Journal of Advanced Research in Computer Science and Software Engineering, Vol. 4, Issue 3, March 2014). The parts of the data to be protected that are each computed by one execution of the software component applied to one combination of the input values can be as small as desired. For instance, the software component can be configured to provide by one execution a point of a Gaussian curve or a value that is used to compute a histogram, the data part value corresponding to the highest value computed by the software component or to the value having the highest occurrence number in the histogram. Only a part of the protected data can be made accessible when only a part of the two alternative values of the input data of the software component is provided, only one value being provided for the other input data of the software component.
Further, the methods disclosed herein are not limited to an implementation involving an authentication server. Other implementations can involve a secure element within the user terminal, such as the secure processor SE shown in
According to an embodiment, the secure element SE in
Further, the methods disclosed herein are not limited to garbled circuits comprising gates having only two inputs and one output. Other types of gates with three or more inputs and one or more outputs or receiving data having more than two valid states may be implemented using truth tables having more than four lines. Therefore, the randomness obtained by transmitting and selecting one of the possible values RNiV1 and RNiV2 of the input RNi, may also be obtained by transmitting and randomly selecting one value among three or more valid values of an input of the garbled circuit.
Further, the methods disclosed herein are not limited to an implementation of the software component by a garbled circuit. Other implementations of the software component such as including obfuscated programs can be used to hide parts of the program loaded in the main processor of the terminal UT, and/or to prevent sensitive parts of the program from being unveiled or modified by unauthorized persons. Methods of obfuscating programs are disclosed for example in the documents “Obfuscating Circuits via Composite-Order Graded Encoding” Benny Applebaumy, Zvika Brakerskiz, IACR-TCC 12 Jan. 2015, and “How to Obfuscate Programs Directly”, Joe Zimmerman, IACR, 30 Sep. 2014.
More generally, the conception of a garbled circuit can be performed by translating a program written in language such as C or C++ into a circuit design language such as VHDL or Verilog to obtain a logic or Boolean circuit comprising logic gates.
Further, the methods disclosed herein are not limited to the use of a software component protected against tampering and reverse-engineering, such as generated using obfuscation or garbled circuit methods. As an example of such an application, the methods disclosed herein may be used to perform operations that do not utilize a high security level, such as for data privacy protection, including video games (e.g. management of available virtual lives) or medical eye testing.
Further, the methods disclosed herein are not limited to an implementation involving a mask such the image mask IMSK to decrypt output values of the software component. Other implementations can generate and execute a software component directly outputting the pixels values to be displayed. In addition, the message MSG can be directly provided in the output pixel values. In addition the mask can be transmitted separately from the software component or the structure and content data thereof, e.g. via different transmission means, optionally after the execution of the software component, totally or in several parts.
Further, the methods disclosed herein can be implemented with a user terminal UT that only comprises a hardware keypad, the displayed frames FRM being displayed just to assign other key labels to the physical keypad. Thus, instead to touch positions of the display screen to input the positions POSi, the user activates hardware keys of the keypad in correspondence with the assigned labels shown in the displayed frames FRM.
The term pixel, as used herein for a standard display screen, may be understood as coordinates, either 2D coordinates for a 2D display or 3D coordinates for a 3D or stereo display or for a projected display or the like.
Further, the disclosure and the illustrations are to be considered as illustrative rather than restrictive, and the appended claims are intended to cover all such modifications, enhancements and other embodiments, or combinations thereof, which fall within the true spirit and scope of the description. Therefore, the scope of the following claims is to be determined by the broadest permissible interpretation of the claims and their equivalents, and shall not be restricted or limited by the foregoing description.
Claims
1. A method for authenticating a user, the method comprising:
- receiving, from a secure processor, a software component configured to generate an image frame including information intelligible to the user, and a plurality of input data of the software component, the input data including a plurality of first input data each having two randomly-selected valid values and invalid values, the software component including a plurality of first inputs, each first input being configured to receive respectively the first input data, the received input data including the valid values of the first input data;
- performing a plurality of times: selecting one of the valid values of each of the first input data in the received input data, executing the software component by applying the received input data to inputs of the software component and the selected valid values to the first inputs of the software component, the execution of the software component generating the image frame which has pixels in a visible or invisible state, depending on the selected valid values of the first input data and forming an image of the user intelligible information, displaying the image frame, and acquiring, from the user, a response depending on the user intelligible information in the displayed image frame; and
- transmitting the acquired response to the secure processor.
2. The method of claim 1, wherein first valid values of the first input data used for generating and displaying a first image frame are selected as a function of a data provided by the secure processor, and second valid values of the first input data are selected as a function of the response acquired from the user from a previously displayed image frame, for generating and displaying another image frame.
3. The method of claim 1, wherein the valid values of the first input data selected for generating and displaying the image frames at each successive executions of the software component, are randomly selected, and a signature of data defining each generated image frame is transmitted to the secure processor.
4. The method of claim 1, wherein the software component is configured to generate the image frame, wherein the user intelligible information is displayed using random pixels having a probability lower than 100% to be visible in the image frame, such that the user intelligible information is machine non-visibly recognizable, the software component being executed a plurality of times to generate a plurality of image frames which are displayed at frame display rate such that the user intelligible information becomes intelligible to the user.
5. The method of claim 1, wherein the user intelligible information:
- includes a plurality of labels of a keypad ordered as a function of the first input data, the response from the user including key positions of keys of the keypad selected by the user,
- includes a plurality of labels of a keypad ordered as a function of the first input data, and one symbol belonging to a validation code, the response from the user including key positions of keys of the keypad selected by the user, or
- specifies a biometric challenge, the response from the user including biometric data input by the user using a biometric sensor.
6. The method of claim 4, wherein the software component is configured to provide, in response to a random selection of valid values of second input data, output data in one of two binary states with a probability set to a value between 12.5% and 87.5%.
7. The method of claim 1, wherein the software component is configured to store a plurality of image frame configurations, which are selected by selecting valid values of the first input data.
8. The method of claim 1, wherein the software component is configured to generate encrypted parts of an image frame, the generation of each image frame including:
- decrypting each generated encrypted image frame part using a decrypting mask, the decrypting mask being transmitted from the secure processor; and
- inserting each decrypted image frame part in an image frame background to generate a respective image frame.
9. The method of claim 8, further comprising:
- transmitting the response from the user to the secure processor; and
- authenticating the user by the secure processor when the response corresponds to the information and to a secret data known to the user and included the secure processor.
10. The method of claim 1, wherein the software component is encoded as a garbled circuit, the garbled circuit including circuit inputs, circuit outputs, logic gates and wires, each logic gate having two inputs and one output, each wire having a first end connected to one of the circuit inputs or to one of the logic gate outputs, and a second end connected to one of the logic gate inputs or to one of the circuit outputs, the garbled circuit being generated by selecting a valid data value for each binary state of each of the wires, and by computing, for one logic gate of the garbled circuit, truth table values as a function of each valid data value of each input of the logic gate, each valid data value of the output of the logic gate and a logic operation performed by the logic gate.
11. A user terminal configured to:
- receive from a secure processor, a software component configured to generate an image frame including information intelligible to the user, and a plurality of input data of the software component, the input data including a plurality of first input data each having two randomly-selected valid values and invalid values, the software component including a plurality of first inputs configured to receive respectively the first input data, the received input data including the valid values of the first input data;
- perform a plurality of times: selecting one of the valid values of each of the first input data in the received input data, executing the software component by applying the received input data to inputs of the software component and the selected valid value to the first input of the software component, the execution of the software component generating the image frame which has pixels in a visible or invisible state, depending on the selected valid values of the first input data and forming an image of the user intelligible information, displaying the image frame, acquiring, from the user, a response depending on the user intelligible information in the displayed image frame; and
- transmit the acquired response to the secure processor.
12. The terminal of claim 11, configured to:
- select first valid values of the first input data as a function of a data provided by the secure processor, for generating and displaying a first image frame, and
- select second valid values of the first input data, as a function of the response acquired from the user from a previously displayed image frame, for generating and displaying another image frame.
13. The terminal of claim 11, further configured to:
- randomly select the valid values of the first input data used for generating and displaying the image frames at each successive executions of the software component; and
- compute and transmit a signature of data defining each generated image frame to the secure processor.
14. The terminal of claim 11, wherein the software component is configured to generate the image frame, wherein the user intelligible information is displayed using random pixels having a probability lower than 100% to be visible in the image frame, such that the user intelligible information is machine non-visibly recognizable, the software component being executed a plurality of times to generate a plurality of image frames which are displayed at frame display rate such that the user intelligible information becomes intelligible to the user.
15. The terminal of claim 11, wherein the user intelligible information:
- includes a plurality of labels of a keypad ordered as a function of the first input data, the response from the user including key positions of keys of the keypad selected by the user,
- includes a plurality of labels of a keypad ordered as a function of the first input data, and one symbol belonging to a validation code, the response from the user including key positions of keys of the keypad selected by the user, or
- specifies a biometric challenge, the response from the user including biometric data input by the user using a biometric sensor.
16. The terminal of claim 14, wherein the software component is configured to provide, in response to a random selection of valid values of second input data, output data in one of two binary states with a probability set to a value between 12.5% and 87.5%.
17. The terminal of claim 11, wherein the software component is configured to store a plurality of image frame configurations, which are selected by selecting valid values of the first input data.
18. The terminal of claim 11, wherein the software component is configured to generate encrypted parts of an image frame, the generation of each image frame further including:
- decrypting each generated encrypted image frame part using a decrypting mask, the decrypting mask being transmitted from the secure processor; and
- inserting each decrypted image frame part in an image frame background to generate a respective image frame.
19. The terminal of claim 18, further configured to transmit the response from the user to the secure processor, the user being authenticated by the secure processor when the response corresponds to the information and to a secret data known to the user and included the secure processor.
20. The terminal of claim 11, wherein the software component is encoded as a garbled circuit, the garbled circuit including circuit inputs, circuit outputs, logic gates and wires, each logic gate having two inputs and one output, each wire having a first end connected to one of the circuit inputs or to one of the logic gate outputs, and a second end connected to one of the logic gate inputs or to one of the circuit outputs, the garbled circuit being generated by selecting a valid data value for each binary state of each of the wires, and by computing, for one logic gate of the garbled circuit, truth table values as a function of each valid data value of each input of the logic gate, each valid data value of the output of the logic gate and a logic operation performed by the logic gate.
21. The terminal of claim 11, wherein the secure processor is a secure element connected to a main processor of the terminal.
22. The terminal of claim 11, wherein the secure processor belongs to a remote server linked to the terminal through a data transmission network.
23. A secure element connected to a processor of a terminal and configured to:
- transmit to the processor of the terminal, a software component configured to generate an image frame including information intelligible to a user of the terminal, and a plurality of input data of the software component, the input data including a plurality of first input data each having two randomly-selected valid values and invalid values, the software component including a plurality of first inputs, each first input being configured to receive respectively the first input data, the received input data including the valid values of the first input data, the software component being configured to be executed a plurality of times, with one of the valid values of each of the first input data in the received input data, the execution of the software component generating the image frame which has pixels in a visible or invisible state, depending on the selected valid values of the first input data and forming an image of the user intelligible information; and
- receive a response acquired by the terminal from the user, the response depending on the user intelligible information in the generated image frame.
24. A server linked to a terminal through a data transmission network and configured to:
- generate and transmit to the terminal, a software component configured to generate an image frame including information intelligible to a user of the terminal, and a plurality of input data of the software component, the input data including a plurality of first input data each having two randomly-selected valid values and invalid values, the software component including a plurality of first inputs, each first input being configured to receive respectively the first input data, the transmitted input data including the valid values of the first input data, the software component being configured to be executed a plurality of times, with one of the valid values of each of the first input data in the transmitted input data, the execution of the software component generating the image frame which has pixels in a visible or invisible state, depending on the selected valid values of the first input data and forming an image of the user intelligible information; and
- receive a response acquired by the terminal from the user, the response depending on the user intelligible information in the generated image frame.
25. A computer program product loadable into a computer memory and comprising code portions which, when carried out by a computer, configure the computer to:
- receive from a secure processor, a software component configured to generate an image frame including information intelligible to a user, and a plurality of input data of the software component, the input data including a plurality of first input data each having two randomly-selected valid values and invalid values, the software component including a plurality of first inputs configured to receive respectively the first input data, the received input data including the valid values of the first input data;
- perform a plurality of times: selecting one of the valid values of each of the first input data in the received input data, executing the software component by applying the received input data to inputs of the software component and the selected valid value to the first input of the software component, the execution of the software component generating the image frame which has pixels in a visible or invisible state, depending on the selected valid values of the first input data and forming an image of the user intelligible information, displaying the image frame, acquiring from the user a response depending on the user intelligible information in the displayed image frame; and
- transmit the acquired response to the secure processor.
Type: Application
Filed: Apr 29, 2019
Publication Date: Aug 22, 2019
Inventors: Guillaume Pitel (L'Hay Les Roses), Jean-Luc Leleu (Paris)
Application Number: 16/398,066
