Nxp B.v.

Hans De Jong

Peter Thueringer

Bruce Murray

Paul Hubmer

Heike Neumann

Susanne Stern

Christine Van Vredendaal

Marc Vauclair

Pim Theo Tuyls

Jan Rene Brands

Stefan Lemsitzer

Maarten Vertregt

Mathias Wagner

Denis Noel

Pieter Janssens

Peter Bukovjan

Frans J List

Frank Zachariasse

Tvrtko Barbaric

Ad Arts

Arjan Mels

A data processing system and a method are provided for recognizing a scanned biometric characteristic in the data processing system. The data processing system includes a biometric sensor, a rich execution environment (REE), and a secure element (SE). In one embodiment, during an enrollment operation, a random challenge is applied to scanned data to produce a biometric template that is stored. During subsequent validation operations, the SE determines if user data includes evidence of the random challenge before providing access to a secure application. Evidence of the random challenge indicates the user data was provided by the biometric sensor. In another embodiment, the sensor data is split between the REE and the SE and partially processed in the SE. The described embodiments prevent a replay attack from being conducted in communications between the REE and the SE.

Biometric system

A security device provisioning hub, including: a memory; and a processor configured to: receive a first secret token from a device manufacturer, wherein the first secret token is associated with a first service; receive a second secret token from a customer device having a security chip; verify that the first secret token and the second secret token are the same; and provide to the customer device access credentials to the first service.

Certificate provisioning and customer binding mechanisms using device group identification token

Biometric system and method for recognizing a biometric characteristic in the biometric system

Articles and methods for transaction irregularity detection are disclosed. In one example, the article discloses: a memory including a record of a last-reported security-device transaction with the security-device, and including a last-reported transaction counter value associated with the last-reported security-device transaction; a previous device identifier; a record of the previous security-device transaction with the security-device, and including the previous device identifier associated with the previous security-device transaction; a record of a current security-device transaction with the security-device, and including a currently-reported transaction counter value associated with the current security-device transaction; and a back-end device tagging the previous device with fraud if the current transaction counter value differs from the last-reported transaction counter value by other than an increment. In one example, the method discloses: a transaction irregularity detection process based on the article.

Article and method for transaction irregularity detection

A method is provided for authenticating an IC device. The method includes provisioning an integrated circuit (IC) device with a unique identification number (UID). The IC device is configured to calculate a device-specific key (DSK) using the UID. The UID is used with a secure application separate from the IC device to calculate the DSK. The DSK calculated by the IC device is the same as the DSK calculated by the secure application. The UID and the DSK calculated by the secure application is provided to a provider of an online service. The provider of the online service is enabled to authenticate the IC device using the UID and the DSK calculated with the secure application in response to the IC device contacting the online service. The provider may authenticate the device using a standard cryptographic challenge-response protocol. If the IC device has knowledge of a particular DSK, then the IC device is a legitimate authorized device.

Method for authenticating an integrated circuit device

Reader () for determining the validity of a connection to a transponder (), designed to measure a response time of a transponder () and to authenticate the transponder () in two separate steps. Transponder () for determining the validity of a connection to a reader (), wherein the transponder () is designed to provide information for response time measurement to said reader () and to provide information for authentication to said reader () in two separate steps, wherein at least a part of data used for the authentication is included in a communication message transmitted between the reader () and the transponder () during the measuring of the response time.

Decoupling of measuring the response time of a transponder and its authentication

The exemplary embodiments of the invention realize an efficient prevention of massive infiltration of cloned RFID transponders into existing and new RFID systems. Furthermore, reader devices used for authentication of RFID transponders do not need to be on-line and do not need to be equipped with a Security Authentication Module (SAM). This simplifies authentication procedures and reduces costs. According to an exemplary embodiment of the invention a transponder-specific originality signature is stored by a transponder manufacturer on the transponder. The transponder-specific originality signature may, for example, be stored in the non-volatile memory (EEPROM) of the transponder during the fabrication of the transponder. This transponder-specific originality signature can be checked at any time in a convenient way, which provides an indication of originality of said transponder.

Production method, RFID transponder, authentication method, reader device and computer program product

Transponder () having stored a fixed identification number, which expands said identification number with a random number, encrypts said expanded number with a key, and sends it to a reader () on its request. Reader (), which on request receives an encrypted number from a transponder (), decrypts a received encrypted number with a key, which was also used by the transponder (), and extracts a fixed identification number associated with the transponder ().

System of providing a fixed identification of a transponder while keeping privacy and avoiding tracking

Transponder (), comprising a storage unit () having stored a number of different applications, a processing unit () which, on request of a reader (), is adapted to generate a response interpretable using an encryption scheme known by both the transponder () and the reader () so that the reader () is capable of determining whether an application is supported by the transponder () by analyzing the response using the encryption scheme, and a transmission unit () adapted to send the response to said reader ().

Reader and transponder for obscuring the applications supported by a reader and/or a transponder and method thereof

The invention provides a secure and efficient resource management system and a corresponding method for managing resources of a product that is put on the market by a licensor via a distribution chain. In particular, the number of keys needed for managing said resources can be reduced. At the time that the product is released to the market the exact licensing conditions of the product need not be known yet. The licensing conditions and the associated configuration of resources of the product are managed via a second key which is provided to a licensee. The licensee, however, has no knowledge of the first key and the derivation function which generates said second key based on the first key. Therefore, it is ensured that the licensee cannot claim more resources of the product than the licensor allows.

Resource management system and corresponding method

It is described a method for providing an electronic key within an integrated circuit () including both a volatile memory () and a non-volatile memory (). The described comprises starting up the integrated circuit (), reading the logical state of predetermined data storage cells () assigned to the volatile memory (), which data storage cells () are characterized that with a plurality of start up procedures they respectively adopt the same logical state, and generating an electronic key by using the logical state of the predetermined data storage cells (). Preferably, the predetermined data storage cells () are randomly distributed within the volatile memory (). It is further described an integrated circuit () for providing an electronic key. The integrated circuit () comprises a volatile memory () comprising predetermined data storage cells (), which are characterized that with a plurality of start up procedures they respectively adopt the same logical state, and a non-volatile memory () having information stored upon regarding the predetermined data storage cells (). Thereby, the electronic key is defined by the corresponding logical states of the predetermined data storage cells ().

Growing community of inventors

Eindhoven, Netherlands

Hans De Jong