JPWO2021094125A5

JPWO2021094125A5 -

Info

Publication number: JPWO2021094125A5
Application number: JP2022553216A
Authority: JP
Publication date: 2024-03-11
Anticipated expiration: 2040-11-03

Claims

a communication interface circuit that communicates with the server ;
A cryptographic device comprising a processor circuit ,
the processor circuit has a normal mode and a secure mode;
When the processor circuit is in the secure mode , data and code are isolated from the normal mode ;
the data includes at least a first private key and a secret ;
the first private key corresponds to a first public key,
the secret is shared with the user;
when the processor circuit is in the normal mode, first software is executed ;
when the processor circuit is in the normal mode, the first software receives an encrypted message and an encrypted authentication tag from the server ;
the encrypted message and the encrypted authentication tag are encrypted with the first public key ;
when the processor circuit is in the normal mode, the first software forwards the encrypted message and the encrypted authentication tag to second software;
when the processor circuit is in the secure mode, the second software is executed;
when the processor circuit is in the secure mode, the second software decrypts the encrypted message and the encrypted authentication tag with the first private key ;
the first private key is stored within the secure mode data;
When the processor circuit is in the secure mode, the second software controls the shared message to indicate to the user that the encrypted message is being displayed by software running in the secure mode. displaying a secret, and the encrypted message and the decrypted authentication tag;
A cryptographic device, wherein legacy software receives the decrypted authentication tag from the user through an input interface of the cryptographic device.

the cryptographic device authenticates to the server ;
the legacy software sends an authentication message to the server ;
The cryptographic device of claim 1 , wherein the authentication message is responsive to the decrypted authentication tag to authenticate the cryptographic device to the server .

the encrypted message and the encrypted authentication tag are part of a larger message;
The cryptographic device of claim 1 , wherein the second software obtains a response to the message from the user.

The cryptographic device of claim 1, wherein boot code of the cryptographic device receives the shared secret from the user during an initialization boot sequence.

the display is operated from the first frame buffer ;
the first frame buffer is accessible from the normal mode;
the display is operated from a second frame buffer ;
The cryptographic device of claim 1 , wherein the second frame buffer is accessible from the secure mode rather than the normal mode .

the SMS message includes the encrypted authentication tag;
the first software intercepts the SMS message ;
the first software forwards the SMS message to the second software ;
The cryptographic device of claim 1 , wherein the second software provides the decrypted authentication tag to the user.

the second software generates the first public key and the first private key ;
the second software stores the first private key within the secure mode data ;
the second software sends the first public key to the first software;
the first software sends the first public key to the server ;
the first software displays the first public key and the shared secret ;
The cryptographic device of claim 1 , wherein the first public key is displayed in an optically readable format .

2. The cryptographic device of claim 1 , wherein the first software and/or the second software receive further authentication factors from the user before completing authentication to the server.

the first software sends a transaction request to the server;
The cryptographic device of claim 1, wherein the first software receives the encrypted authentication tag in response to the transaction request.

10. The cryptographic device of claim 9, wherein the message depends on the request.

the cryptographic device comprises a visual indicator ;
The cryptographic device of claim 1 , wherein the visual indicator indicates whether content of the display originated from the secure mode .

2. The cryptographic device of claim 1 , wherein at least a portion of software running in normal mode is unable to overwrite the message when it is displayed on a display .

2. The cryptographic device of claim 1 , wherein at least a portion of software running in normal mode is prevented from screen capturing the message.

the first software receives the encrypted message ;
the encrypted message is signed;
the signed message is signed with a second private key ;
the second private key belongs to the server;
the second software verifies the signature of the signed message using a second public key ;
The cryptographic device of claim 1, wherein the second public key corresponds to the second private key of the server .

executing the first software in a normal mode of the processor circuit ;
the processor circuit has the normal mode and the secure mode;
When the processor circuit is in the secure mode, data and code are isolated from the normal mode ;
the data includes at least a first private key and a secret ;
the secret is shared with a user;
executing the first software in the normal mode ;
receiving an encrypted message and an encrypted authentication tag from a server , the steps comprising :
the encrypted message and the encrypted authentication tag are encrypted with a first public key ;
receiving , the first public key corresponding to the first private key ;
and forwarding the encrypted message and encrypted authentication tag to a second software; running the first software in the normal mode ;
executing the second software in the secure mode ,
decrypting the encrypted message and the encrypted authentication tag with the first private key, the first private key being stored within the secure mode data; the step of
displaying the shared secret as well as the encrypted message and the decrypted authentication tag to indicate to the user that the encrypted message is being displayed by software running in a secure mode; executing the second software in the secure mode , the legacy software receiving and displaying the decrypted authentication tag from the user through an input interface ; A cryptographic method.

When executed by a processor system,
executing the first software in a normal mode of the processor circuit;
the processor circuit has the normal mode and the secure mode;
When the processor circuit is in the secure mode, data and code are isolated from the normal mode;
the data includes at least a first private key and a secret;
the secret is shared with a user;
Executing the first software in the normal mode,
receiving an encrypted message and an encrypted authentication tag from a server, the method comprising:
the encrypted message and the encrypted authentication tag are encrypted with a first public key;
receiving, the first public key corresponding to the first private key;
forwarding the encrypted message and the encrypted authentication tag to second software;
executing the first software in the normal mode, having
executing the second software in the secure mode,
decrypting the encrypted message and the encrypted authentication tag with the first private key, the first private key being stored within the secure mode data; to do and
displaying the shared secret as well as the encrypted message and the decrypted authentication tag to indicate to the user that the encrypted message is being displayed by software running in a secure mode; the legacy software receiving and displaying the decrypted authentication tag from the user through an input interface;
executing the second software in the secure mode, having
A non-transitory computer-readable medium comprising computer-executable instructions that cause the processor system to perform operations having the following steps :

further comprising the step of authenticating to the server,
the legacy software sends an authentication message to the server;
16. The method of claim 15, wherein the authentication message is responsive to the decrypted authentication tag to authenticate a cryptographic device to the server.

the encrypted message and the encrypted authentication tag are part of a larger message;
16. The method of claim 15, wherein the second software obtains a response to the message from the user.

16. The method of claim 15, wherein boot code of a cryptographic device receives the shared secret from the user during an initialization boot sequence.

the second software generates the first public key and the first private key;
the second software stores the first private key within the secure mode data;
the second software sends the first public key to the first software;
the first software sends the first public key to the server, or the first software displays the first public key and the shared secret;
16. The method of claim 15, wherein the first public key is displayed in an optically readable format.