Giesecke & Devrient Gmbh

Giesecke+devrient Mobile Security Gmbh

Gao Gesellschaft Fur Automation Und Organisation Mbh

Gisela Meister

Jan Eichholz

Dirk Wacker

Klaus Finkenzeller

Dieter Weiss

Florian Gawlas

Robert M&uuml;ller

Daniel Ciesinger

Hubertus Grobbel

Albert M&ouml;dl

Markus Sauermann

Henning Daum

Nigol Martin

Jens Urmann

Thomas Aichberger

Bruno Struif

Katharina Wallhausser

Dirk Scheuermann

Albert Pichlmaier

Hans Aschauer

A method for securing a transaction in a reputation system includes the following steps: authenticating a user vis-&#xe0;-vis an end device by means of an electronic proof of identity for releasing authentication data for the digital identity that are stored on the end device, and authenticating the digital pseudonym assigned to the user vis-&#xe0;-vis the reputation system by means of the end device while employing the stored authentication data pertaining to the digital pseudonym. The electronic proof of identity can be present as an electronic identity card in the form of a portable data carrier.

Reputation system and method

The invention creates a method for loading an electronic amount of money represented as a random number sequence to a portable data carrier, with a conversion of the random number currency to the data carrier currency, and a disbursement of one or several money unit(s) from a portable data carrier, with a conversion of the data carrier currency to the random number currency.

Loading and disbursement of an electronic amount of money

The invention creates a method for the contactless readout of an electronic identification document by means of a terminal, wherein in a data reading step encrypted identification data from a data memory are transmitted to the terminal, and in a key reading step the data key with which the identification data can be decrypted is transmitted to the terminal, and in the terminal the identification data are decrypted with the data key. The data reading step is carried out employing a long-range radio connection, and the key reading step is carried out employing a short-range radio connection.

Method for reading an identification document in a contactless manner

There is provided a method for creating an authentication entity derived from an original data carrier, wherein the original data carrier has a key pair that is individual to the original data carrier and comprises a public key and a secret key of the original data carrier, and a certificate for the public key of the original data carrier. The method comprises the following steps: deriving a secret key for the derived authentication entity from the secret key of the original data carrier by the original data carrier; forming derivation data for the derived authentication entity; transferring authentication data to the derived authentication entity, wherein the authentication data have the derivation data, the certificate of the public key of the original data carrier as well as a derived key pair which comprises the derived secret key and the public key of the original data carrier.

Method for creating a derived entity of an original data carrier

The invention relates to a method for activating a portable data carrier () in which a first portable data carrier () is supplied in an inactive state to a user, after the user has requested the first data carrier () with the aid of a second portable data carrier () from a central instance, whereby the first and the second data carrier () have access to authentication data for mutual authentication. In the method according to the invention a communication connection is set up between the first and the second data carrier (), via which the first and the second data carrier () mutually authenticate each other on the basis of the authentication data and establish a cryptographically secured end-to-end connection. Via this end-to-end connection then the second data carrier () activates the first data carrier () by transmitting activation data to the first data carrier ().

Method and system for activating a portable data carrier

A method and a system for secure transfer of an application from a server (S) into a reading device unit () with authentication of a user with a data carrier unit (), the server (S) making available the application, wherein, between the data carrier unit () and the server (S), a first cryptographically secured channel (K) is set up based on first cryptographic information (A), and between a security module () of the reading device unit () and the server (S) a second cryptographically secured channel (K) is set up based on second cryptographic information (B). The application is transferred from the server to the reading device unit via the second cryptographically secured channel (K).

Method for secure transfer of an application from a server into a reading device unit

In a cryptographic method between a portable data carrier and a terminal device there are employed a public data-carrier key and a secret data-carrier key of the data carrier as well as a public terminal key and a secret terminal key of the terminal device. The data carrier employs as a public data-carrier key a static public key. As a secret data-carrier key the data carrier employs a secret key that is derived from a secret basic key associated with the public data-carrier key. Within the framework of the method, the terminal device checks an authentication parameter associated with the data carrier and different from the data-carrier keys.

Cryptographic method

A system for recognizing the presence of a second portable data carrier by a first portable data carrier, wherein the data carriers have respectively a contactless interface with an antenna and an electronic circuit for storing and/or processing data. An RFID reading device supplies the data carriers with energy and for the respective communication of the data carriers with the reading device. In the first and the second data carrier there is respectively provided a further communication device, via which an additional, direct communication channel, independent of the field of the reading device, is made available between the first and the second data carrier, to thereby check the immediate presence of the second data carrier in the field of the reading device by the first data carrier.

System and method for the presence recognition of a second portable data carrier by a first portable data carrier

A method for authenticating a portable data carrier () to a terminal device by the following steps: In the data carrier () a public session key (PK) is derived (S) from a public key individual to the data carrier (PK) which has in its turn been derived (TS; S) from a public group key (PK). Further, a secret session key (SK) is derived (S) from a secret key individual to the data carrier (SK) which has in turn been derived (TS) from a secret group key (SK). Subsequently, a secret communication key (KK) is agreed on (S) between the data carrier () and the terminal device. Finally, the terminal verifies (S) the public session key (PK) of the data carrier ().

Method for authenticating a portable data carrier

In a method for establishing a secure communication channel between a portable data carrier () and a terminal on the basis of an asymmetric cryptosystem, a value (X; Y; V; W) derived from a public key (PKD; PKT) of the cryptosystem is displayed on a display device () of the data carrier ().

Method for establishing a secure communication channel

A method and system for challenge-response authentication are provided. Challenge data are transferred within an anti-collision loop from a reading device to a transponder by means of one or more commands of an anti-collision method, with the one or more commands serving to determine transponder identification data. In the one or more commands respective challenge data are contained in a data field that is used for specifying transponder identification data, wherein it is indicated to the transponder by a parameter value in the at least one of the one or more commands that the data field of the one or more commands contains challenge data instead of transponder date. The transponder recognizes with the help of the parameter value that in the received one or more commands challenge data are contained. The transponder processes the transferred challenge data based on the challenge response authentication.

Method for challenge response authentication between a reading device and a transponder using contactless data transmission

A method for authenticating a portable data carrier () to a terminal device employs a public key (PKG) and a secret key (SK) of the data carrier () as well as a public session key (PK) and a secret session key (SK) of the terminal device. The data carrier () employs as a public key a public group key (PKG). As a secret key the data carrier () employs a key (SK) that has been derived from a secret group key (SKG) associated with the public group key (PKG).

A method for effecting a secure electronic transaction on a terminal using a portable data carrier is proposed. According to the method a user () first authenticates himself vis-&#xe0;-vis the portable data carrier (). The portable data carrier () at the same time produces quality information about how authentication was done. The authentication is confirmed to the terminal (). Then the portable data carrier () performs a security-establishing operation within the transaction, for example the creation of a digital signature. It attaches the quality information to the result of the security-establishing operation.

Method for carrying out a secure electronic transaction using a portable data support

A method for installing a file system () in a portable data carrier () comprises the steps of reading in specification data (SD) that at least partly describe the file system () at the semantic level, interpreting the read-in specification data (SD) by means of a processor core () of the data carrier (), and installing the file system () in accordance with the interpreted specification data (SD) in a memory () of the data carrier (). A computer-readable data carrier () and a device () for initializing and/or personalizing a portable data carrier () are equipped for storing specification data (SD) and/or transferring them into a portable data carrier () in accordance with the invention. The invention makes available a technique for installing a file system () in a data carrier () that reduces the hitherto strong dependency between the file format used and internal aspects of the operating system of the data carrier ().

Installing a file system in a data carrier

A method and an apparatus for testing a biometric feature wherein a set value of the biometric feature is stored in a data carrier in the form of one or more data records. For testing the biometric feature, measured values representing an instantaneous value of the biometric feature are first determined and made available in a terminal. The data carrier transmits to the terminal at least a subset of first reference values depending on the data record or data records for the set value. The terminal links data derived from the measured values with the subset of first reference values and transmits the result of the link to the data carrier. The data carrier tests the result of the link and determines therefrom whether the biometric feature is authentic.

Growing community of inventors

Munich, Germany

Gisela Meister