WO2004056030A2 - Personalisierung von sicherheitsmoduln - Google Patents
Personalisierung von sicherheitsmoduln Download PDFInfo
- Publication number
- WO2004056030A2 WO2004056030A2 PCT/DE2003/003853 DE0303853W WO2004056030A2 WO 2004056030 A2 WO2004056030 A2 WO 2004056030A2 DE 0303853 W DE0303853 W DE 0303853W WO 2004056030 A2 WO2004056030 A2 WO 2004056030A2
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- key
- security module
- personalizer
- module
- connection
- Prior art date
Links
Classifications
-
- G—PHYSICS
- G07—CHECKING-DEVICES
- G07F—COIN-FREED OR LIKE APPARATUS
- G07F7/00—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus
- G07F7/08—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means
- G07F7/10—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means together with a coded signal, e.g. in the form of personal identification information, like personal identification number [PIN] or biometric data
- G07F7/1008—Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
- G06Q20/34—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using cards, e.g. integrated circuit [IC] cards or magnetic cards
- G06Q20/341—Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
- G06Q20/34—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using cards, e.g. integrated circuit [IC] cards or magnetic cards
- G06Q20/355—Personalisation of cards for use
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
- G06Q20/3821—Electronic credentials
- G06Q20/38215—Use of certificates or encrypted proofs of transaction rights
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
- G06Q20/409—Device specific authentication in transaction processing
- G06Q20/4097—Device specific authentication in transaction processing using mutual authentication between devices and transaction partners
-
- G—PHYSICS
- G07—CHECKING-DEVICES
- G07F—COIN-FREED OR LIKE APPARATUS
- G07F19/00—Complete banking systems; Coded card-freed arrangements adapted for dispensing or receiving monies or the like and posting such transactions to existing accounts, e.g. automatic teller machines
- G07F19/20—Automatic teller machines [ATMs]
-
- G—PHYSICS
- G07—CHECKING-DEVICES
- G07F—COIN-FREED OR LIKE APPARATUS
- G07F7/00—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus
- G07F7/08—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means
- G07F7/10—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means together with a coded signal, e.g. in the form of personal identification information, like personal identification number [PIN] or biometric data
- G07F7/1016—Devices or methods for securing the PIN and other transaction-data, e.g. by encryption
Definitions
- the invention relates to the personalization of cryptographic security modules.
- security modules which comprise a cryptographic processor and a key memory.
- the security module secures all messages from or to a central system by the security module cryptographically.
- the key store cannot be read from the outside, but can only be used for cryptographic operations, so that a key that has been transferred to the security module can no longer be compromised.
- This process is critical in terms of security. This applies in particular to the previously used symmetrical encryption, e.g. the DES process, in which the same key is used for encryption and decryption. Therefore, the manufacturer of the security module requires a lot of effort to secure the keys used against being spied on. In particular, the personalization must take place in access-secured rooms with special staff. If only a few master keys are used, a particularly high level of security is required. Custom programming requires a large amount of logistics and warehousing, including guarding the warehouse and transportation.
- US Pat. No. 6,442,690 B1 describes a personalization system for a cryptographic module.
- the cryptographic module is provided with a temporary key.
- For personalization it is first checked whether this provisional key is present and, if necessary, exchanged for a new one.
- the new keys are provided by the personalizer via a key management.
- the use of asymmetrical methods is also proposed, in which a key pair consisting of a public key and a secret key is used.
- the properties and advantages of asymmetrical methods over symmetrical methods are known from the relevant literature; their knowledge is assumed in the following without further ado.
- US Pat. No. 6,298,336 B1 describes a portable activation device for chip cards with a payment function, the chip cards being unusable for the intended applications up to the, cryptographically secured, activation.
- Patent specification DE 199 19 909 C2 describes a method in which a message can be signed with symmetrical encryption and transmitted in plain text without the location forming the signature having to have the secret key. This method is optionally used in one embodiment of the invention.
- the invention uses the knowledge that a portable personalization device, which is constructed similarly to a security module and in particular contains a protected key memory and a cryptographic processor operating with it, is a particularly advantageous handling of the method described by the invention allowed.
- a portable personalization device which is constructed similarly to a security module and in particular contains a protected key memory and a cryptographic processor operating with it, is a particularly advantageous handling of the method described by the invention allowed.
- chip cards in particular is of great advantage here since, together with mobile computers, they make a portable personalization device readily available. If such a personalization device is connected to the security module on site, this already provides a high degree of security that the correct security module is also personalized.
- a particular advantage is that the security module is already at the final location and therefore no further transport is required that can be secured by security.
- mutual authentication of the security module and personalizer is additionally provided, in which the security module is provisionally initialized by the manufacturer but not personalized. This initialization can be the same for all modules, except for serial numbers if necessary.
- the security module containing the secret key of a key pair for asymmetric encryption, the personalizer generating a certificate about the public key of the key pair and together with the public key of a central system sends to the security module.
- the security module uses this certificate and the public key to secure communication with a central system, especially in the banking sector.
- FIG. 1 the invention is shown schematically in context.
- An automated teller machine 10 contains a security module 12 and is via a network connection 24 of a network
- a personalizer 30 which has a chip card 32 with a cryptographic processor and secured key memory.
- the dashed line in FIG. 1 is intended to indicate that the personalizer 30 is only temporarily brought into the proximity of the security module 10 and is connected via the data connection 34.
- central system is used generically for communication remote sites connected to the security module in the operating state.
- the personalizer is preferably a mobile computer that is equipped with a chip card as a cryptographic unit.
- This chip card comprises a secured key memory and uses the keys stored there to carry out the required cryptographic methods using data which are transmitted via the chip card interface.
- the key store is secured to the extent that the protocol on the interface is completely monitored by the processor on the chip card and is designed in such a way that the secret keys from the key store are not transmitted via the interface; only their application to data is possible.
- the integrity of public keys is effected either by storage in the key store or storage of cryptographic hash values in the key store.
- a processor card in PCMCIA format or an external module connected via USB or Firewire can also be used.
- the personalizer has a communication interface with which a connection to the security module can be temporarily established.
- this is a serial connection according to V.24, whereby a cable with plugs is inserted temporarily and the connection is controlled by a user.
- Other data connections such as I 2 C, USB, Firewire etc. are also possible.
- Wireless connections via infrared or radio, such as IrDA or Bluetooth, can be used equally well; here there is no physical connection. Bluetooth has the additional advantage that encryption of the communication is built in, although the key management is left to the application. This is the case here anyway.
- Cable and infrared connections have the advantage that the operator can ensure quite well that the intended device is personalized if the connection leads directly to the security module to be personalized. This authentication may be sufficient for some purposes, so that the preferred cryptographic authentication described below can be omitted.
- the security module After delivery and before the start of personalization, the security module is in a personalization state that differs from the subsequent operating state.
- connection between the personalizer and the security module is preferably a cryptographically secured connection according to known methods, such as are known, for example, as TLS in connection with HTTPS. If the connection is established and available, then These procedures ensure that the subsequent communication cannot be intercepted or modified. As a rule, a random key is used for this, which is provided either according to the Diffie-Hellmann method without authentication or as part of an authentication, for example according to publication WO 91/14980.
- the security requirements for mutual authentication which must be determined depending on the application, thus determine the requirements for the authentication to be used.
- the aforementioned patent specification DE 199 19 909 C2 can also serve this purpose, according to which the manufacturer can insert a certificate into a security module without having the key for the verification.
- each security module has a random key, which is included in the accompanying documents or is transmitted independently via secure channels.
- Mutual authentication is then carried out using known challenge-response methods, for example in accordance with European patent EP 552392.
- the security module then sends the public key of a key pair, the private key of which is stored in its secure key memory is.
- This key pair also referred to below as module key, can already be generated during production, since the private key does not leave the security module and therefore cannot be compromised by the manufacturer.
- the key pair is preferably only generated as part of the personalization because then the influence of the manufacturer is less and thus his security measures are less complex.
- a modifier specified by the personalizer also referred to in the literature as 'salt', can also be transmitted, which influences the key pair generated.
- the security module now transmits the public key to the personalizer. This uses the secret key stored in itself of a further key pair, hereinafter referred to as the signing key, and thus signs the public module key received by the security module. Such a signature of a public key, with or without this signed public key, is referred to below as a certificate.
- the personalizer sends the certificate back over the existing secure connection to the security module, which stores the certificate permanently and securely against change for use in the operating state described below. As mentioned above, the integrity is ensured by means of the secure key store.
- the personalizer together with the certificate, also sends back a public key of a central system to which the security module is to be connected in the operating state in the future.
- This personal key is also preferably provided with a certificate by the personalizer, although the security module cannot check it until a secure public key of the personalizer is present in the security module.
- the third party therefore sends his public key together with another certificate. This can either be issued by the central system and can then be checked with the public key of the central system that is also transmitted.
- This circular certification should be seen more as a plausibility check because the personalizer can easily generate any key pair for the central system himself and then produce the necessary certificates.
- the solution is better in which the personalizer's public key is replaced by another key pair of the Manufacturer was signed, whereby the manufacturer has entered his public key in the security module during manufacture.
- the personalizer transfers the corresponding certificate to the security module.
- Authentication of the personalizer to the security module is then no longer necessary when establishing the connection, since the certificates transmitted by the personalizer are checked as part of the personalization.
- the fact that the public module key can then be read out without authorization is not critical according to the principle of asymmetrical encryption. The manufacturer only has to sign the customer's signing keys as required and enter their own public key in the security module.
- the public key of the manufacturer is preferably also exchanged.
- the security module then generates another key pair at the end of the manufacturing process, which is permanently retained and is used for the secure identification of the security module.
- the associated public key is signed by the manufacturer and the certificate is loaded into the security module.
- the security module can thus prove its identity by signing its serial number and other data specified by the personalizer, such as time stamps and random numbers, so that it can authenticate itself.
- Security module dismantled and the personalizer separated from the security module.
- the safety module thus changes to the normal operating state, in which another Personalization is not possible.
- a new personalization can be forced through a direct intervention in the security module (or also a command, however, which is protected against misuse, for example from the central system).
- this reset to the personalization state is associated with the security module deleting the key pair and forcing the generation of a new key pair as part of the subsequent personalization.
- a connection is now established between the security module and the central system, which is also secured by cryptographic means, in particular session keys.
- the security module sends the certificate issued by the personalizer together with its public key to the central system.
- the personalizer's public key was previously transmitted to the central system through an integrity-controlled connection. (For example, the chip card is personalized by the central system).
- the central system can use this to check whether the security module is authorized for the subsequent transactions and can, for example, reliably transmit that an authentic bank card for a certain account number is available for payment of an amount sent.
- the security module has received the public key of the central system from the personalizer, it is in turn ensured for the security module that the messages received from the central system, e.g. the order for the payment of an amount of money comes from an authorized central system.
- a symmetrical key can also be transmitted from the central system to the security module, which is then entered in the secure key memory and for a limited time for transactions based on previous ones symmetric cryptography based method is used.
- each personalization on the chip card is listed in a log. This ensures that the certificates issued can be traced at any time. If the chip card is compromised, an effective countermeasure is quickly available by blocking the associated public key in the central system.
- a security module that is not personalized by the invention does not have to be specially guarded during storage or transport, since it cannot be used without personalization. This means that the value of the module is not significantly above the manufacturing value and is also not customer-specific.
- the personalization device in the preferred embodiment can only be used with a chip card as the cryptography unit, only the chip card can be secured against misuse if the software is designed accordingly.
- a variant of the invention uses the existing data network, which is required anyway in the operating state, to connect the security module to the personalizer. This allows the personalizer to be operated securely and can also be integrated into the central system. In the latter case, the transmission of the public signing key from the signing system to the central system, which is to be protected against tampering, is simplified.
- a first solution is for an operator to enter a one-time transaction number via a temporary direct data connection, which is sent to the personalizer.
- This transaction number can be carried in security envelopes and can contain, for example, 16 or more characters.
- the connection to the security module does not need to be secured either, since the transaction number becomes worthless immediately after being entered.
- a simple keyboard with a simple serial interface that is temporarily connected to the security module is therefore sufficient. If the security module has a keyboard anyway, for example for diagnostic purposes, then this can be used to enter the transaction number.
- a mobile computer with one of the interfaces specified above is used for very long transaction numbers.
- the transaction numbers are then preferably stored on a chip card, although (encrypted) storage in the file system of the mobile computer is also possible.
- a mobile computer that provides secure identification.
- the mobile computer uses two data interfaces, one for local and one for long-distance connections.
- the above-mentioned devices come into consideration, via which the personalization is temporarily connected in the other variants. Either cellular connections or other network connections are possible for the long-distance connections. Routing of these connections via the local connection is also possible.
- the mobile computer can therefore also be a mobile phone.
- a variant of this mediated identification generates a random number in the mobile computer and, on the one hand, sends it via the local connection to the security module, which immediately forwards it to the personalizer. At the same time, the random number is sent directly to the personalizer via the remote connection.
- the caller number provided by the network operator will be sufficient to ensure the identity of the mobile phone.
- a secure HTTP connection with the TLS protocol is preferably used, and a chip card can also be used to secure the certificates used.
- the identifying random number can be generated by each of the three devices.
- the random number is preferably generated in the personalizer, which sends it to the security module, which sends it to the mobile computer, which sends it back to the personalizer. Only then will the personalization continue.
- the random number has the same function as the transaction number before; it is only formed when necessary. The quality is assured by education in the personalizer. Accordingly, the random number can also be formed in the security module.
- a mobile device is temporarily connected to the security module and secures the identity of the security module to be personalized to the personalizer.
- the security module is personalized in that the public key of a key pair generated in the security module is certified by a certifier.
- the certificate obtained in this way is stored in the security module and is characteristic of the subsequent operating state.
- Authentication to the certification server is based on a temporary data connection between the Security module and a mobile input unit used for this by an operator.
Landscapes
- Business, Economics & Management (AREA)
- Engineering & Computer Science (AREA)
- Physics & Mathematics (AREA)
- Accounting & Taxation (AREA)
- General Physics & Mathematics (AREA)
- Strategic Management (AREA)
- General Business, Economics & Management (AREA)
- Theoretical Computer Science (AREA)
- Finance (AREA)
- Computer Security & Cryptography (AREA)
- Microelectronics & Electronic Packaging (AREA)
- Computer Networks & Wireless Communication (AREA)
- Storage Device Security (AREA)
- Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)
Abstract
Description
Claims
Priority Applications (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US10/535,699 US20060156001A1 (en) | 2002-12-17 | 2003-11-20 | Personalisation of security modules |
EP03782103A EP1573688A2 (de) | 2002-12-17 | 2003-11-20 | Personalisierung von sicherheitsmoduln |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
DE10259270.5 | 2002-12-17 | ||
DE10259270A DE10259270A1 (de) | 2002-12-17 | 2002-12-17 | Personalisierung von Sicherheitsmoduln |
Publications (2)
Publication Number | Publication Date |
---|---|
WO2004056030A2 true WO2004056030A2 (de) | 2004-07-01 |
WO2004056030A3 WO2004056030A3 (de) | 2004-08-26 |
Family
ID=32519074
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/DE2003/003853 WO2004056030A2 (de) | 2002-12-17 | 2003-11-20 | Personalisierung von sicherheitsmoduln |
Country Status (4)
Country | Link |
---|---|
US (1) | US20060156001A1 (de) |
EP (1) | EP1573688A2 (de) |
DE (1) | DE10259270A1 (de) |
WO (1) | WO2004056030A2 (de) |
Cited By (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
EP1710760A1 (de) * | 2005-04-06 | 2006-10-11 | Scheidt & Bachmann GmbH | Gesicherte Freigabe von Einrichtungen |
Families Citing this family (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
GB0329039D0 (en) * | 2003-12-15 | 2004-01-14 | Ncipher Corp Ltd | Cryptographic security module method and apparatus |
DE102005025684B4 (de) * | 2005-02-02 | 2006-11-30 | Rohde & Schwarz Sit Gmbh | Verfahren zur Nachindividualisierung von bei mindestens einem Zulieferer gefertigten Neben-Geräten bzw.- Systemen durch den Hersteller |
DE102010030590A1 (de) * | 2010-06-28 | 2011-12-29 | Bundesdruckerei Gmbh | Verfahren zur Erzeugung eines Zertifikats |
CN111092734B (zh) * | 2019-12-19 | 2021-12-28 | 南京莱斯电子设备有限公司 | 一种基于自组网络通信的产品激活认证方法 |
Citations (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
EP0784256A1 (de) * | 1995-12-22 | 1997-07-16 | Intel Corporation | Verfahren und Vorrichtung zur Kryptographie mit offentlichem Schlüssel unter Verwendung einer sicheren Halbleiteranordnung |
US5781723A (en) * | 1996-06-03 | 1998-07-14 | Microsoft Corporation | System and method for self-identifying a portable information device to a computing unit |
EP1096446A2 (de) * | 1999-11-01 | 2001-05-02 | Citicorp Development Center, Inc. | Verfahren und System zur gesicherten Übertragung zwischen einem Selbstbedienungsterminal fur finanzielle Transaktionen und einer entfernten Bedienerschnittstelle |
US20020053022A1 (en) * | 2000-10-30 | 2002-05-02 | Ivi Checkmate Corp. | Security arrangement for exchange of encrypted information |
US20030088772A1 (en) * | 2001-11-02 | 2003-05-08 | Christian Gehrmann | Personal certification authority device |
Family Cites Families (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CA2315656C (en) * | 1997-12-19 | 2008-04-29 | Visa International Service Association | Card activation at point of distribution |
US6212280B1 (en) * | 1998-10-23 | 2001-04-03 | L3-Communications Corporation | Apparatus and methods for managing key material in heterogeneous cryptographic assets |
US6826690B1 (en) * | 1999-11-08 | 2004-11-30 | International Business Machines Corporation | Using device certificates for automated authentication of communicating devices |
-
2002
- 2002-12-17 DE DE10259270A patent/DE10259270A1/de not_active Withdrawn
-
2003
- 2003-11-20 EP EP03782103A patent/EP1573688A2/de not_active Withdrawn
- 2003-11-20 US US10/535,699 patent/US20060156001A1/en not_active Abandoned
- 2003-11-20 WO PCT/DE2003/003853 patent/WO2004056030A2/de not_active Application Discontinuation
Patent Citations (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
EP0784256A1 (de) * | 1995-12-22 | 1997-07-16 | Intel Corporation | Verfahren und Vorrichtung zur Kryptographie mit offentlichem Schlüssel unter Verwendung einer sicheren Halbleiteranordnung |
US5781723A (en) * | 1996-06-03 | 1998-07-14 | Microsoft Corporation | System and method for self-identifying a portable information device to a computing unit |
EP1096446A2 (de) * | 1999-11-01 | 2001-05-02 | Citicorp Development Center, Inc. | Verfahren und System zur gesicherten Übertragung zwischen einem Selbstbedienungsterminal fur finanzielle Transaktionen und einer entfernten Bedienerschnittstelle |
US20020053022A1 (en) * | 2000-10-30 | 2002-05-02 | Ivi Checkmate Corp. | Security arrangement for exchange of encrypted information |
US20030088772A1 (en) * | 2001-11-02 | 2003-05-08 | Christian Gehrmann | Personal certification authority device |
Cited By (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
EP1710760A1 (de) * | 2005-04-06 | 2006-10-11 | Scheidt & Bachmann GmbH | Gesicherte Freigabe von Einrichtungen |
EP1710760B1 (de) * | 2005-04-06 | 2013-11-27 | Scheidt & Bachmann GmbH | Gesicherte Freigabe von Einrichtungen |
Also Published As
Publication number | Publication date |
---|---|
DE10259270A1 (de) | 2004-07-15 |
US20060156001A1 (en) | 2006-07-13 |
WO2004056030A3 (de) | 2004-08-26 |
EP1573688A2 (de) | 2005-09-14 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
EP1872512B1 (de) | Verfahren zur schlüsselverwaltung für kryptographiemodule | |
DE102007000589B9 (de) | Verfahren zum Schutz einer Chipkarte gegen unberechtigte Benutzung, Chipkarte und Chipkarten-Terminal | |
EP2962439B1 (de) | Lesen eines attributs aus einem id-token | |
WO2013026875A1 (de) | Verfahren zur authentisierung eines telekommunikationsendgeräts umfassend ein identitätsmodul an einer servereinrichtung eines telekommunikationsnetzes, verwendung eines identitätsmoduls, identitätsmodul und computerprogramm | |
DE102011116489A1 (de) | Mobiles Endgerät, Transaktionsterminal und Verfahren zur Durchführung einer Transaktion an einem Transaktionsterminal mittels eines mobilen Endgeräts | |
EP2624223A2 (de) | Verfahren und Vorrichtung zur Zutrittskontrolle | |
EP3465513B1 (de) | Nutzerauthentifizierung mittels eines id-tokens | |
WO2004056030A2 (de) | Personalisierung von sicherheitsmoduln | |
EP2996299B1 (de) | Verfahren und Anordnung zur Autorisierung einer Aktion an einem Selbstbedienungssystem | |
EP2752785B1 (de) | Verfahren zur Personalisierung eines Secure Elements (SE) und Computersystem | |
DE10102779A1 (de) | Verfahren zur Autorisierung in Datenübertragungssystemen | |
WO2016071196A1 (de) | Verfahren zur änderung einer in einer chipkarte gespeicherten datenstruktur, signaturvorrichtung und elektronisches system | |
EP2383672B1 (de) | Einmalpasswort-Generator | |
EP2880810B1 (de) | Authentifizierung eines dokuments gegenüber einem lesegerät | |
EP2823598B1 (de) | Verfahren zur erstellung einer abgeleiteten instanz | |
EP3239911B1 (de) | Verfahren zur übertragung von vertraulichen nachrichten | |
WO2005055018A1 (de) | Verfahren und vorrichtung zur sicherung digitaler daten | |
EP2734984B1 (de) | Verfahren zum schutz eines chipkarten-terminals gegen unberechtigte benutzung | |
EP3361436A1 (de) | Verfahren zur freigabe einer transaktion | |
WO2018065091A1 (de) | Dynamisches bereitstellen einer prüfnummer | |
DE102005046353A1 (de) | Verfahren zur sicheren Übertragung wenigstens eines kryptographischen Produktionsschlüssels | |
EP1209846A1 (de) | Verfahren zum Sichern von Datenübertragungen sowie zugehörige Einheiten und zugehöriges Programm |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AK | Designated states |
Kind code of ref document: A2 Designated state(s): US |
|
AL | Designated countries for regional patents |
Kind code of ref document: A2 Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IT LU MC NL PT RO SE SI SK TR |
|
121 | Ep: the epo has been informed by wipo that ep was designated in this application | ||
DFPE | Request for preliminary examination filed prior to expiration of 19th month from priority date (pct application filed before 20040101) | ||
WWE | Wipo information: entry into national phase |
Ref document number: 2003782103 Country of ref document: EP |
|
ENP | Entry into the national phase |
Ref document number: 2006156001 Country of ref document: US Kind code of ref document: A1 |
|
WWE | Wipo information: entry into national phase |
Ref document number: 10535699 Country of ref document: US |
|
WWP | Wipo information: published in national office |
Ref document number: 2003782103 Country of ref document: EP |
|
WWP | Wipo information: published in national office |
Ref document number: 10535699 Country of ref document: US |
|
WWW | Wipo information: withdrawn in national office |
Ref document number: 2003782103 Country of ref document: EP |