Cryptomathic Ltd.

Cryptomathic A/s

Other

Cambridge Silicon Radio Limited

Cryptite LLC

Peter Landrock

Jonathan Roshan Tuliani

Torben Pryds Pedersen

Guillaume Forget

Mike Bond

Kerry Dennis Brown

Ronald P Knapp

Michael Keith Bond

Dan Quirke

Jan Ulrik Kjaersgaard

Jonathani Roshan Tuliani

Matthew Landrock

Broadly speaking, embodiments of the present invention provide systems and methods to provide a solution to the SIM swap attack problem for users that possess smartphones. In particular, the systems and methods require an online banking customer to authenticate a transaction using a combined one-time password (OTP) formed of a remotely generated OTP (generated remote to the smartphone) and a locally generated OTP (generated on the smartphone).

System and method for enabling secure authentication

The invention provides systems and method for securely inputting user data from a user into a mobile device and also for generating user data to be input by a user into a mobile device. For example, there is provided a mobile device case for securely inputting user data from a user into a mobile device, the case comprising: a microcontroller, a communication module for communicating with the mobile device and a user interface to enable the user to input the user data. The microcontroller is preferably configured to receive the user data which is input by a user via the user interface, process said user data to create processed data and communicate said processed data to said mobile device. Alternatively, the microcontroller is configured to receive a request to generate the user data; generate said user data and display said user data on the user interface.

Secure mobile user interface

There is described a validation and authentication system and method for authenticating and validating messages. The system comprises a data store storing one or more digital fingerprints associated with user imaging devices. There is also a communication module configured to: receive a message M; receive a request for validation and authentication and receive an image Pof the message M captured using a user imaging device. The system comprises an image validation module for analysing the received image Pusing one or more image processing techniques to determine if the image is valid and authentic. If the received image Pis determined to be authentic and valid, the image validation module generates a response to the request.

Method and system for encryption

A method for validating a signature request for a first message M, comprising: receiving, a validation challenge (VC) from a signature creation device (SCD), the VC created by the SCD, in response to receiving the signature request and message M from a user, using a second message M' which is based on message M and a secret shared between the SCD and user, the VC generated by encrypting message M&#x2032; using the secret; generating, the message M&#x2032; from the VC by decrypting the VC using the secret; displaying the message M&#x2032; to the user; receiving confirmation from the user that the displayed message M&#x2032; corresponds to the message M; generating, a validation code confirming the signature request to create a signature; and outputting the code to the SCD, to cause the SCD to generate the signature for the user for message M based on successfully verifying the code.

System and method for encryption

A method and system for generating a signature for a user are described. The system comprises a signature server, an initial transaction device for a user and a validation device for a user. The initial transaction device is configured to display a first message M and send a request to the signature server to create a signature for said first message M. The signature server is configured to generate a validation challenge using a second message M' which is based on said first message M&#x2032; and a first secret shared between said user and said signature server and send said validation challenge to the validation device. The validation device is configured to regenerate said second message M&#x2032; using said first shared secret, display said second message M&#x2032;, receive user confirmation that the displayed second message M&#x2032; corresponds to said first message M, generate a validation code confirming the request to create a signature; and send said validation code to said signature server. Thereafter, said signature server generates the signature for the user for the first message M.

A data certification system and method for signing electronic data with a digital signature in which a central server comprises a signature server and an authentication server. The signature server securely stores the private cryptographic keys of a number of users. The user contacts the central server using a workstation through the secure tunnel which is set up for the purpose. The user supplies a password or other token based on information previously supplied to the user by the authentication server through a separate authentication channel. The authentication server provides the signature server with a derived version of the same information through a permanent secure tunnel between the servers, which is compared with the one supplied by the user. If they match, data received from the user is signed with the user's private key.

Data certification method and system

A transaction security process includes authentication and identification parts for pushing an encrypted colorgram for user authentication and persona descriptors for user identification from a transaction server to a first personal trusted device. A decryption of the colorgram is displayed on the first personal trusted device. An image is captured by a second personal trusted device. An encryption of the image captured from the second personal trusted device is uploaded to the transaction server. The persona descriptors are used to build a composite rendering for identification of the first user to the second user. The second user clicks 'OK' if they recognize the composite drawing as a reasonable persona of the first user.

Mobile transaction methods and devices with three-dimensional colorgram tokens

This invention is generally concerned with methods, apparatus and computer program code for a computationally asymmetric hash function, in particular for use with symmetric cryptographic algorithms. We describe a method of determining a computationally asymmetric hash function value, the method including: receiving input data to be hashed; computing an asymmetric value from said input data, said asymmetric value being computable by two methods, a first method employing at least one first parameter and a second method employing at least one second parameter, computation of said asymmetric value by said second method being faster than by said first method; and determining a computationally asymmetric hash function value using said asymmetric value. We also describe methods of providing a computationally asymmetric electronic signature from a symmetric cryptographic signature.

Computationally asymmetric cryptographic systems

A security system includes a software application running in a user's smartphone and a separately carried visual key that the user can image at will with the smartphone's camera. An effective visual key would typically comprise digital data encoded in a series of colored cells arranged in a colorgram. Such digital data is treated as a what-you-have security factor, and is concatenated with other security factors so users can authenticate themselves to websites, internet services, and even within the smartphone device itself or its applications. In one aspect, when users authenticate themselves to a server, the server returns a short-term supply of one-time-passwords or account numbers for use in secure access and financial transactions on other systems.

Encoded colorgram for mobile device security

Apparatus for certifying electronic data supplied by a user receives data to be signed, supplied by the user from a source device, at a certifying apparatus including at least a signature server providing a signing function. An encrypted password is received at that server from the source device via a first communication path, the password being generated by an authentication system providing an authentication function separate from the signing function and the password being transmitted to the source device via a second communication path, the signature server and the authentication system have different communication paths with the source device. A version of the encrypted password is communicated between the signature server and the authentication system via a third communication path, different to the first and second paths, for authenticating the user. A result of the authenticating of the user is determined at the signature server by the communication between the authentication system and the signature server, that result being determined by verification of the version of the encrypted password, that verification being performed without the signature server verifying the actual plaintext password. The data to be signed is signed using elements of information secure to the signature server if the result of the authentication indicates that the user is authenticated. The signed data from the certifying apparatus is then passed to a recipient device so that the elements of secure information certify that the data supplier is the user. A method of certifying the data is also disclosed.

Data certification method and apparatus

A communication device having a private key and configured to implement an elliptic curve security mechanism for successful operation of which it: (a) receives a first value from another device, (b) computes a second value as the scalar multiplication of the first value with its private key and (c) returns that second value for use by the other device; the mechanism being such that the first value defines a pair of coordinates representing a first point and the second value defines a pair of coordinates representing a second point and being such that the first value is valid only if it lies on an elliptic curve of predefined form; the device being configured to implement the mechanism by the steps of: receiving data as the first value; making a first evaluation as to whether the first value is a singular point with respect to the elliptic curve; computing the second value as the scalar multiplication of the first value with the private key; making a second evaluation as to whether the second value lies on the elliptic curve; and returning the second value only if the first evaluation is false and the second evaluation is true.

Protecting against security attack

An apparatus and method for signing electronic data with a digital signature in which a central server comprises a signature server () and an authentication server (). The signature server () securely stores the private cryptographic keys of a number of users (). The user () contacts the central server using a workstation () through a secure channel which is setup for the purpose. The user () supplies a password or other token (), based on information previously supplied to the user by the authentication server () through a separate authentication channel. The authentication server provides the signature server with a derived version of the same information through a permanent secure channel between the servers, which is compared with the one supplied by the user (). If they match, data received from the user () is signed with the user's private key.

A method of issuing an electronic negotiable document (END) comprising: creating as data an END and storing this in a tamper-resistant document carrier, the document carrier containing a unique public-secret key pair for signing and verifying and a unique document carrier identifier; signing the unique document-carrier identifier, the END and an END identifier using the secret key of the public-secret key pair and storing the result in the document carrier.

Electronic negotiable documents

A method of distributing the public key of an asymmetric key pair with a private key and the public key from a mobile station to a key managing computer, the method include the steps of: communicating a password (OTP) from the key managing () computer to the mobile station () of a registered user () by a secure channel () to thereby provide a shared secret; at the mobile station and at the key managing computer, generating a first code (MAC) and a second node (MACT), respectively, based on the same predefined generation method, which codes (MAC; MACT) are generated from the password (OTP); by the mobile station (), transmitting the public key and the first code (MAC) to the key managing computer (); at the key managing computer (), receiving the public key and the first code (MAC) from the mobile station (); checking the authenticity of the registered user () based on comparing the first code (MAC) and the second code (MACT).

Growing community of inventors

Cambridge, United Kingdom

Peter Landrock