HK1108253A - Digital authentication over acoustic channel - Google Patents

Description

Digital authentication over an acoustic channel

Technical Field

The present invention relates generally to authentication, and more particularly to digitally authenticating an entity using sound.

Technical Field

With the growth of electronic commerce, the use of public communication infrastructures, such as the internet, to access various secure networks, systems and/or applications has also grown. For example, with digital authentication, a user may access a bank, a private network such as an intranet, a secure server or database, and/or other Virtual Private Network (VPN) via a public communication network (online or through an Automated Teller Machine (ATM)).

However, since a communication system that cannot make face-to-face contact is employed, the chance of fraudulent or illegal access is also increased. If the stolen identity falls into the hands of a lawbreaker, it can cause damage to the individual, organization, or other entity.

To prevent unauthorized access, various security mechanisms have been developed in the past to verify the identity of a user or entity, thereby granting access only to authorized entities. An access code generating device, such as a token, may implement a user authentication and access control technique. Here, a unique access code is periodically generated and displayed to the user. Typically, the access code is generated according to an algorithm based on the security information and the current time. The user then needs to enter the currently displayed access code to gain access.

In some systems, a password is also required for access. This type of system is known as two-factor authentication (two-factor authentication). Two-factor authentication is typically based on: for example, the user has a token; for example, the user knows the password. Since both pieces of information are used to authenticate a user, a system that performs two-factor authentication is less vulnerable to attack than single-factor authentication.

The token described above can prevent unauthorized access, but is cumbersome because the user must manually enter each access code during each access. Furthermore, errors are more likely to occur due to manual entry of the access code. In some systems, the user is required to enter the access code more than once during each access, which increases inconvenience and the probability of error. Furthermore, since the access code may be displayed on a time-based and continuous basis, the token may require constant computation, thereby reducing the battery life of the token.

Accordingly, there is a need for a more efficient, convenient, and/or secure way to implement a control access system using devices.

Disclosure of Invention

Embodiments disclosed herein address the above stated needs by providing a security method in a data processing system.

In one aspect, an apparatus for authentication, comprising: a storage medium to store an encryption key and a look-up table (LUT); a first processor coupled to the storage medium for generating an access code using the encryption key; a converter coupled to the processor for converting the access code into a plurality of tones encoded with the access code; an audio output unit for outputting the plurality of tones encoded with the access code for authentication; wherein the converter may include: a Binary Phase Shift Keying (BPSK) module to generate a plurality of parallel BPSK symbols; a second processor coupled to the BPSK module and the storage medium, and configured to convert the BPSK symbols into a plurality of tones using the LUT. Here, one of the first or second processors may repeat the BPSK symbols a selected number of times; the second processor then converts the repeated BPSK symbols into the plurality of tones.

In another embodiment, an apparatus for authentication may comprise: a storage medium to store an encryption key and a look-up table (LUT); a processor coupled to the storage medium and configured to generate an access code using the encryption key; a converter coupled to the processor for converting the access code into a plurality of tones encoded with the access code; an audio output unit for outputting the plurality of tones encoded with the access code for authentication; wherein the converter comprises: a Binary Phase Shift Keying (BPSK) module to generate a plurality of parallel BPSK symbols; wherein the processor converts the BPSK symbols into a plurality of tones using the LUT.

In another embodiment, a method for authentication may comprise: storing an encryption key and a look-up table (LUT); generating an access code using the encryption key; generating a plurality of parallel BPSK symbols based on the access code; using the LUT to convert the BPSK symbol into a plurality of tones encoded with the access code; outputting the plurality of tones encoded with the access code for authentication. The method may further comprise: repeating the BPSK symbols a selected number of times before converting the BPSK symbols. Here, the step of repeating the BPSK symbol may include: repeating a set of three BPSK symbols a selected number of times; wherein the step of converting the BPSK symbols may include: each set of three BPSK symbols is converted into a plurality of tones using the LUT.

In another embodiment, an apparatus for authentication may comprise: a module for storing an encryption key and a look-up table (LUT); means for generating an access code using the encryption key; means for generating a plurality of parallel BPSK symbols based on the access code; means for converting the BPSK symbols into a plurality of tones encoded with the access code using the LUT; an output module for outputting the plurality of tones encoded with the access code for authentication. The apparatus may also include means for repeating the BPSK symbols a selected number of times, wherein the means for converting the BPSK symbols converts the repeated BPSK symbols.

In another embodiment, an apparatus for authentication may comprise: a storage medium for storing an encryption key; a processor coupled to the storage medium and configured to generate an access code using the encryption key; a converter coupled to the processor for converting the access code into a plurality of tones encoded with the access code; an audio output unit coupled to the converter for outputting the plurality of tones encoded with the access code for authentication; wherein the converter may include: a Binary Phase Shift Keying (BPSK) module to generate a plurality of parallel repeated BPSK symbols based on the access code; an Inverse Fast Fourier Transform (IFFT) module coupled to the BPSK module to perform IFFT on the repeated BPSK symbols to generate code symbols; an upconverter coupled to the IFFT module to modulate the code symbols into a plurality of tones encoded with the access code.

In another embodiment, a method for authentication may comprise: storing the encryption key; generating an access code using the encryption key; generating a plurality of parallel Binary Phase Shift Keying (BPSK) symbols based on the access code; repeating the BPSK symbols a selected number of times before converting the BPSK symbols; performing Inverse Fast Fourier Transform (IFFT) on the repeated BPSK symbols to generate IFFT symbols; modulating the IFFT symbols into a plurality of tones encoded with the access code; outputting the plurality of tones encoded with the access code for authentication.

In another embodiment, an apparatus for authentication may comprise: means for storing an encryption key; means for generating an access code using the encryption key; means for generating a plurality of parallel Binary Phase Shift Keying (BPSK) symbols based on the access code; means for repeating the BPSK symbols a selected number of times before converting the BPSK symbols; means for performing an Inverse Fast Fourier Transform (IFFT) on the repeated BPSK symbols to generate IFFT symbols; means for modulating the IFFT symbols into a plurality of tones encoded with the access code; means for outputting the plurality of tones encoded with the access code for authentication.

In another embodiment, an apparatus for authentication may comprise: an audio input unit for receiving a plurality of tones encoded with an access code; a converter coupled to the audio input unit for recovering an access code from the plurality of tones encoded with the access code; wherein the converter comprises: a down converter for tuning the plurality of tones into IFFT symbols; a Fast Fourier Transform (FFT) module for generating a plurality of parallel BPSK symbols from the IFFT symbols; a BPSK module coupled to the processor and configured to convert the BPSK symbols into a coded interleaved bit stream of the access code; a deinterleaver coupled to the BPSk module to deinterleave the encoded interleaved bit stream; a decoding module coupled to the deinterleaver for recovering the access code from the encoded deinterleaved bit stream. The apparatus may further include: a storage medium for storing an encryption key; a processor coupled to the storage medium and the converter, for verifying the access code using the encryption key and granting access if the access code is validated. Further, the FFT module converts the plurality of tones into a plurality of repeated sets of BPSK symbols and generates a selected set of BPSK symbols; wherein the BPSK module converts the set of selected BPSK symbols.

In another embodiment, a method for verification may include: receiving a plurality of tones encoded with an access code; generating a plurality of parallel BPSK symbols from the plurality of tones; converting the BPSK symbols into a coded interleaved bit stream of the access code; deinterleaving the encoded interleaved bit stream; recovering the access code from the encoded and deinterleaved bit stream. Here, the step of performing the FFT includes: generating repeated BPSK symbols; wherein the method further comprises: generating a set of selected BPSK symbols from the repeated BPSK symbols; wherein the step of performing the BPSK comprises: the set of selected BPSK symbols is converted into a coded interleaved bit stream. Further, the step of performing the FFT includes: converting the IFFT symbols into a plurality of repeated sets of three BPSK symbols; wherein the step of generating the set of selected BPSK symbols comprises: three BPSK symbols are selected from the repeated sets of three BPSK symbols to generate the selected set of BPSK symbols. Alternatively, the step of performing the FFT comprises: converting the IFFT symbols into a plurality of repeated sets of three BPSK symbols; wherein the step of generating the set of selected BPSK symbols comprises: a repeated set of three BPSK symbols is selected to generate the selected set of BPSK symbols.

In another embodiment, an apparatus for authentication may comprise: means for receiving a plurality of tones encoded with an access code; means for generating a plurality of parallel BPSK symbols from the plurality of tones; means for converting the BPSK symbols into a coded interleaved bit stream of the access code; means for deinterleaving the encoded interleaved bit stream; means for recovering the access code from the encoded and deinterleaved bit streams.

Brief Description of Drawings

Various embodiments will hereinafter be described in conjunction with the appended drawings, wherein like designations denote like elements, and wherein:

FIG. 1 shows a system for digital authentication over an acoustic channel;

FIG. 2 illustrates an exemplary embodiment of a token;

FIG. 3 illustrates one exemplary embodiment of a validator;

FIG. 4 illustrates an exemplary method for digital authentication using an acoustic channel;

fig. 5A and 5B show examples of BPSK symbols;

FIG. 5C shows an example of a LUT;

FIG. 6 illustrates an exemplary method for digital authentication using an acoustic channel;

fig. 7A and 7B show original repeated sets of BPSK symbols and recovered repeated sets of BPSK symbols;

fig. 7C and 7D show examples of selected sets of BPSK symbols;

FIG. 8 illustrates an exemplary embodiment of a token;

FIG. 9 illustrates another exemplary method of digital authentication using an acoustic channel;

FIG. 10 illustrates an exemplary method for digital authentication using an acoustic channel;

11A-11D illustrate other exemplary systems for digital authentication over an acoustic channel;

FIG. 12 illustrates an exemplary embodiment of a receiver;

fig. 13 shows another embodiment of a receiver; and

fig. 14A and 14B illustrate an exemplary shell for a token.

Detailed Description

Generally, the disclosed embodiments use a voice channel to digitally authenticate a user or entity. In the following description, specific details are given to provide a thorough understanding of the embodiments. However, it will be understood by those skilled in the art that the embodiments may be practiced without these specific details. For example, circuits may be shown in block diagrams in order not to obscure the embodiments in unnecessary detail. In other instances, well-known circuits, structures and techniques may be shown in detail in order not to obscure the embodiments.

It is also noted that the embodiments may be described as a process which is depicted as a flowchart, a structure diagram, or a block diagram. Although a flowchart may describe the operations as a sequential process, many of the operations can be performed in parallel or concurrently. In addition, the order of the operations may be re-arranged. When the operation is completed, the process ends. A process may correspond to a method, a function, a procedure, a subroutine, a subprogram, etc. When a process corresponds to a function, its termination corresponds to the function returning to the calling function or the main function.

Further, as disclosed herein, the term "acoustic wave" refers to an acoustic or pressure wave or vibration traveling through a gas, liquid, or solid. Acoustic waves include ultrasonic waves, audio waves, and subsonic waves. The term "audio wave" refers to a sound wave frequency within the sound spectrum, approximately 20Hz to 20 kHz. The term "ultrasound" refers to acoustic frequencies above the acoustic spectrum. The term "subsonic" refers to a sonic frequency below the acoustic spectrum. The term "storage medium" refers to one or more devices for storing data, including Read Only Memory (ROM), Random Access Memory (RAM), magnetic disk storage media, optical storage media, flash memory, and/or other machine-readable media for storing information. The term "machine-readable medium" includes, but is not limited to portable or fixed storage devices, optical storage devices, wireless channels and various other devices capable of storing, containing or carrying instruction(s) and/or data. The term "tone" refers to a sonic carrier signal having a particular tone and vibration, which carries digital data. The term "plurality of tones" refers to three or more tones. The term "authentication" refers to the authentication of an entity, and the terms "authentication" and "verification" may be used interchangeably.

Fig. 1 illustrates an exemplary system 100 for digital authentication over an acoustic channel. In system 100, verifier device 110 controls access to secure networks, systems, and/or applications through a public communication infrastructure, such as the internet 120. Although accessible through a public communication facility other than the internet 120, for purposes of illustration, the system 100 will be described with reference to the internet 120.

For access over the internet 120, a device such as token 130 provides an access code to verifier device 110 through a Wireless Communication Device (WCD) 140. The access code is communicated from token 130 to WCD 140 over a voice channel. The access code is generated using an encryption key securely stored in token 130 and encoded into sound waves for communication. More specifically, the generated access code is encoded into a plurality of tones using multi-carrier modulation, and the access code is recovered from the plurality of tones using corresponding multi-carrier demodulation.

The user of token 130 may also provide user information, such as a username, to verifier device 110. Here, the user information may be encoded into sound waves and transmitted to WCD 140 along with the access code. Alternatively, user information may be entered directly into WCD 140. WCD 140 may then forward the access code and user information to verifier device 110 via internet 120 for authentication. In other embodiments, the user information may be an assigned identification number of the token 130. Therefore, the user does not have to input user information. The identification number is automatically encoded into a sound wave and transmitted to WCD 140 along with the access code. After granting access, WCD 140 may be used to communicate with a secure network or system.

To forward the access code and/or user information, WCD 140 may recover the access code and/or user information, if encoded, from the acoustic waves. WCD 140 may then forward the access code and/or user information to verifier device 110. Alternatively, the sound waves encoded with the access code and the sound waves encoded with the user information, if encoded, may be transmitted to verifier device 110. Verifier device 110 may then recover the access code and/or user information from the sound waves. Here, the access code and/or user information, or the sound waves encoded with the access code and/or user information, may be transmitted by any well-known communication technique that allows access to the internet 120 in the system 100.

Token 130 is typically a portable device that may be small enough to be carried in a pocket and/or attached to a key chain. Physical possession of the token 130 provides one aspect of the required authentication as physical possession of a key enables an individual to gain access through a locked door. Thus, token 130 serves as an authentication tool, and, in addition to communicating via sound waves, token 130 need not have conventional wireless communication capabilities to transmit an access code directly to verifier device 110 via internet 120 or other wireless and wired infrastructure. That is, in some embodiments, token 130 does not support wireless communication capabilities and does not include a wireless modem, network card, and/or other wireless link to a private or public communication infrastructure, such as internet 120. Therefore, WCD 140 transmits the access code over internet 120. However, it should be noted that in other embodiments, token 130 may be embedded in other devices, such as a wireless telephone or personal digital assistant. Further, although WCD 140 is shown as a personal desktop computer, it may be a variety of other computer devices such as, but not limited to: a laptop computer, PDA, home, office or vehicle wireless phone, or security device.

The access code is generated using an encryption key that is securely stored in the token 130. The encryption key may be placed in token 130 at the time of manufacture, which is unknown to the user. Here, two kinds of encryption keys can be used for digital authentication: symmetric cryptosystems and asymmetric cryptosystems. In a symmetric cryptosystem, the secret or symmetric key in token 130 is shared and placed in verifier device 110. Token 130 uses the key to generate a digital signature and sends the digital signature to verifier device 110 for authentication. Verifier device 110 verifies the digital signature based on the same key. In an asymmetric cryptographic system, a private key and a public key are generated for a user. The public key is shared with verifier device 110, while the private key is kept secret in token 130. A digital signature is generated with the private key and sent to verifier device 110. Verifier device 110 then verifies the digital signature based on the user's public key.

In the above description, the verifier device 110 verifies the encryption key corresponding to the user based on the user information transmitted together with the access code. Verifier device 110 may also be implemented as part of a secure network or system to be accessed by a user. Alternatively, verifier device 110 may be located outside of the secure network or system. Further, while fig. 1 shows one verifier device 110, it will be apparent to those skilled in the art that there may be more than one verifier device, each controlling access to one or more networks/systems.

Fig. 2 is a block diagram illustrating one exemplary embodiment of a token 300, and fig. 3 illustrates one exemplary embodiment of a verifier 300. Token 200 may include: a storage medium 210 for storing an encryption key and a look-up table (LUT); a processor 220 for generating an access code using the encryption key; a converter 230 for converting the access code into a plurality of tones encoded with the access code using the LUT; an audio output unit 240 for outputting the plurality of tones encoded with the access code for authentication. Verifier device 300 may include: a storage medium 310 for storing an encryption key; a processor 320 for generating an access code using the encryption key; an audio input unit 330 for receiving a plurality of tones encoded with an access code from a token; a converter 340 for recovering the access code from the plurality of tones. Based on the encryption key, the processor 320 verifies the user's access code.

More specifically, based on multicarrier modulation, an access code is converted to and from a plurality of tones. Thus, converter 230 modulates the access code into a multi-carrier signal and converter 340 demodulates the access code from the multi-carrier signal using a multi-carrier system. A multi-carrier system is described in co-pending U.S. application No.10/356,144 and co-pending U.S. application No.10/356,425. In multicarrier modulation, the data stream to be transmitted is divided into a plurality of interleaved bit streams. In this way, a plurality of parallel bit streams with very low bit rates is obtained. Each bit stream is then used to modulate multiple carriers and transmitted over different carrier signals. In general, carrier modulation involves encoding, interleaving, digital modulation, inverse fourier transform (IFFT) processing, and up-conversion of a data stream to be transmitted. Demodulation involves down-conversion, FFT processing, digital demodulation, de-interleaving, and decoding of the received data stream. However, in converters 230 and 340, LUTs are used to facilitate modulation, as described below.

Converter 230 of token 200 may include an encoding module 232, an interleaver 234, a Binary Phase Shift Keying (BPSK) module 236, and a processor 238. The converter 340 of the verifier device 300 may comprise a down-converter 341, an FFT module 343, a BPSK module 345, a deinterleaver 347 and a decoding module 349. BPSK is a well-known digital modulation technique that is easy to implement. BPSK, while not leading to the most efficient use of the available bandwidth, is not susceptible to noise. Thus, BPSK is used to convert code symbols into tones. However, modulation techniques other than BPSK may also be implemented in converters 230 and 340. Further, it should be noted that converter 230 shows a simplified multi-carrier modulator based on BPSK. More typical commercial multicarrier modulators may have additional components such as a preamble generator, a serial-to-parallel (S/P) converter, or a parallel-to-serial (P/S) converter. Also, while converter 340 shows a simplified multi-carrier demodulator corresponding to converter 230, a more typical commercial multi-carrier demodulator may also have additional components, such as a synchronization unit, an S/P converter, and a P/S converter.

Generally, the encoding module 232 is used to encode a bitstream or a bitstream of an access code. The encoded bit stream is then interleaved into interleaved bit streams or code symbols by interleaver 234. BPSK module 236 generates multiple parallel BPSK symbols from the code symbols. More specifically, the encoded bit stream is converted from serial to parallel into parallel code symbols. BPSK module 236 then maps the parallel code symbols into a plurality of parallel BPSK symbols. Here, the code symbols may be mapped to BPSK symbols and then converted from serial to parallel BPSK symbols, or the code symbols may be converted from serial to parallel and then mapped to BPSK symbols. Furthermore, the number of BPSK symbols corresponds to the number of tones available in the multi-carrier system. In some embodiments, the frequency range of the multi-carrier tones is approximately 1kHz to 3kHz, and the allowed bandwidth per carrier depends on the number of tones. For example, if the number of available tones is 64, a bandwidth of approximately 31.25Hz may be allowed per carrier. The multiple BPSK symbols generated as described above are converted into multiple tones using the LUT and converted from serial to parallel by processor 238. By implementing a LUT, BPSK symbols can be directly converted into multiple tones without IFFT processing and up-conversion. The detailed operation of the LUT will be described below in conjunction with fig. 5.

To recover the access code, the process performed by converter 340 is the reverse of the process performed by converter 230. That is, the down-converter 341 demodulates the multiple tones into multiple parallel IFFT symbols; the FFT module 343 performs FFT to generate multiple parallel BPSK symbols; BPSK module 345 converts the BPSK symbols into code symbols or a coded interleaved bit stream of access codes; a deinterleaver 347 deinterleaves the code symbols; the decoding module 349 recovers the access code from the encoded code symbols. More specifically, the down-converter 341 can demodulate the plurality of tones into a plurality of IFFT symbols; S/P carries on the serial-parallel conversion to IFFT symbol; FFT module 343 may perform FFT to generate multiple parallel BPSK symbols; BPSK module 345 may convert the BPSK symbols into a plurality of parallel code symbols; a deinterleaver 347 may deinterleave the code symbols into a coded bit stream; the P/S may parallel-to-serial convert the code symbols and then decode by the decoding module 349. Alternatively, the multiple tones may be: performing serial-parallel conversion; FFT processing into a plurality of parallel BPSK symbols; performing parallel-serial conversion; BPSK processing for deinterleaving. Still alternatively, the following may be performed for a plurality of tones: performing parallel-serial conversion; FFT processing into a plurality of parallel BPSK symbols; BPSK processing into a plurality of parallel code symbols; performing parallel-serial conversion; and (4) de-interleaving.

More typical token and verifier devices may have additional components in the translators 230 and 340. In some embodiments, token 200 may further comprise: an amplifier 260 for amplifying the plurality of tones from the converter 230; an actuator or actuator 270 for receiving a signal from a user to activate the authentication process. The actuator 260 may be, but is not limited to: a switch, a push button switch, a toggle switch, or a dial or voice activated device. Token 200 may also include a clock module 250 to generate time elements. In these cases, the processor 220 may generate the access code using the encryption key and the time element. Likewise, verifier device 300 may also include a clock module 350 for generating time elements. In these cases, the processor 320 may use the encryption key and the time element to generate the access code.

The clock modules 250 and 350 in the token 200 and verifier device 300 are synchronized to periodically generate a time element as needed, e.g., every minute, hour, day, or other selected increment. This authentication is commonly referred to as an authentication-based session because the access code changes with each time period. Further, storage media 210 and 310 may be a database of encryption keys corresponding to different users of a network, system, or application. Thus, the user information is sent to the verifier device 300, as described above, so that in the authentication process, the appropriate encryption key is used in the verifier device 300.

Fig. 4 illustrates an exemplary method 400 for transmitting an access code using a voice channel. For accessing a secure network, system, or application, processor 220 generates an access code using the encryption key (410). Thereafter, based on the access code, multiple parallel BPSK symbols are generated (420), and the BPSK symbols are converted into multiple tones encoded with the access code using the LUT (430). More specifically, a bitstream of the access code is encoded into an encoded bitstream. The encoded bit stream may be subjected to: performing serial-parallel conversion; interleaving a plurality of parallel code symbols; BPSK is mapped into a plurality of parallel BPSK symbols; using the LUT, the conversion is made into a plurality of tones. Alternatively, the encoded bitstream may be subjected to: interweaving; BPSK mapping; and then converted from serial to parallel into multiple parallel BPSK symbols for conversion into multiple tones. Still alternatively, the encoding bitstream may be subjected to: interleaved and then converted from serial to parallel into multiple parallel code symbols for BPSK processing. Here, the encryption key and the LUT may be stored in the storage medium 210, and the processor 238 may convert the BPSK symbols into the plurality of tones using the LUT stored in the storage medium 210. The plurality of tones encoded with the access code are then output for authentication (440).

More specifically, the LUT is calculated in advance to map the BPSK symbols to the designated tones. For example, each particular BPSK symbol sequence may be mapped, which corresponds to a different available tone. Thus, rather than performing an IFFT on a BPSK symbol and modulating the IFFT symbol, the LUT converts the BPSK symbol directly into multiple tones.

In some embodiments, to enhance access code recovery, the BPSK symbols are repeated a selected number of times before converting the BPSK symbols. The LUT may then be pre-computed to map multiple sets of BPSK symbols into multiple tones. Fig. 5A to 5C show examples of conversion from repeated BPSK symbols into corresponding tones. Assuming that the BPSK symbol sequence {01110010} is as shown in fig. 5A, a set of two BPSK symbols {01, 11, 00, 10} is repeated twice, resulting in repeated BPSK symbols {0101, 1111, 0000, 1010}, as shown in fig. 5B. These repeated BPSK symbols can be found in the LUT for conversion to corresponding tones. Fig. 5C shows an exemplary LUT that may be used to convert the sets of twice repeated BPSK symbols. Here, each of LUT entries 0000-. Based on the LUT, the repeated BPSK symbols will correspond to tones T6, T16, T1, T11.

It should be noted that the BPSK symbols shown in fig. 5A would correspond to tones T8, T3 if the BPSK symbols are not repeated. Furthermore, BPSK may be repeated more than twice if repeated. Further, more than two BPSK symbols may be grouped into a set of BPSK symbols, and the sets of BPSK symbols may be repeated a selected number of times for conversion into multiple tones. The LUT may also be adjusted based on the number of BPSK symbols in a group and the number of repetitions of the group. For example, a set of three BPSK symbols may be repeated three times. In this case, the LUT may have 512 entries, ranging from 000000000-. These repeated sets of three BPSK symbols may then be converted into tones using the LUT.

To further enhance the recovery of the access code, a reference tone with a reference phase may be added to the plurality of tones. Then, the reference tone is output together with the plurality of tones. In addition, the plurality of tones may be amplified and then output. Further, if a clock module is implemented, the processor 220 generates an access code using the encryption key and the time element. The access code may then be generated, converted and output from token 200 when a user inputs a command through actuator 270.

Fig. 6 illustrates an exemplary method 600 for verifying an access code using an acoustic channel. For authentication, a plurality of tones encoded with an access code are received (610) by the audio input module 330. The downconverter 341 downconverts or demodulates the multiple tones into multiple parallel IFFT symbols (620). FFT module 343 then performs an FFT to generate multiple parallel BPSK symbols (630). BPSK module 345 converts the BPSK symbols into coded bit streams or code symbols (640) which are then deinterleaved (650) by deinterleaver 347. More specifically, the following may be performed for a plurality of tones: demodulating; serial-to-parallel conversion into a plurality of parallel IFFT symbols; FFT processing into multiple parallel BPSK symbols; BPSK maps into a plurality of parallel code symbols; deinterleaved into coded code symbols. Alternatively, for a plurality of tones: demodulating; performing serial-parallel conversion; performing IFFT processing; then, the parallel-to-serial conversion is performed to BPSK symbols for deinterleaving. Still alternatively, for a plurality of tones: demodulating; performing serial-parallel conversion; FFT processing; BPSK mapping; and then converted to multiple parallel BPSK symbols for de-interleaving. Thereafter, the decoding module 349 recovers 660 the access code from the encoded code symbols. The processor 320 then verifies the access code using the encryption key (670), and if the access code is validated, access is granted (680). Here, the encryption key may be stored in the storage medium 310.

In method 600, if a BPSK symbol is repeated for conversion, multiple tones are demodulated and FFT processed resulting in repeated BPSK symbols. A selected set of BPSK symbols is then generated from the repeated BPSK symbols and converted into code symbols or a coded interleaved bit stream. Here, BPSK module 345 may generate the selected set of BPSK symbols from the repeated BPSK symbols and convert the selected set into code symbols. Fig. 7A to 7D show how the selected set of BPSK symbols is generated.

As shown, a set of two BPSK symbols is repeated twice to obtain the original BPSK symbols A1B1A2B2C1D1C2D2, which are then demodulated to a '1B' 1A '2B' 2C '1D' 1C '2D' 2. By selecting one of the two sets of repeated BPSK symbols, the selected BPSK symbol may be generated, as shown in fig. 7C. Alternatively, each BPSK symbol is selected from any one of the sets of repeated BPSK symbols, and the selected BPSK symbols may be generated, as shown in fig. 7D. Here, it should be noted that multiple tones may be converted into sets of more than two BPSK symbols. For example, multiple tones may be converted into repeated sets of three BPSK symbols. In this case, the selected set of BPSK symbols may be generated by selecting each BPSK symbol from the repeated sets of three BPSK symbols. Alternatively, the selected set of BPSK symbols may be generated by selecting a repeated set of three symbols.

In addition, if a reference tone having a reference phase is received, the plurality of tones are converted into a plurality of BPSK symbols using the reference tone. Further, if a clock module is implemented, the processor 320 verifies the access code using the encryption key and the time element.

If the processing power or speed of the token is limited, the LUT can use multiple tones to transmit the access code to greatly improve efficiency and performance. However, some embodiments may not implement and use LUTs. Fig. 8 shows another exemplary embodiment of a token 800 that does not use a LUT.

Token 800 includes: a storage medium 810 for storing an encryption key; a processor 820 for generating an access code using the encryption key; a converter 830 for converting the access code into a plurality of tones; an audio output unit 840 for outputting the plurality of tones encoded with the access code for authentication. In some embodiments, token 800 may include: amplifier 860, driver or actuator 870, and clock module 880 as implemented by amplifier 260, actuator 270, and clock module 280 of token 200.

In general, the components implemented by token 800 are the same as those in token 200. However, the modulation of converter 830 is not LUT-based. Thus, the LUT need not be stored in the storage medium 810. Further, the processing of converter 830 is based on using repeated BPSK symbols. More specifically, converter 830 of token 800 may include: an encoding module 83 for encoding a bitstream of the access code; an interleaver 833 for interleaving the coded bit stream; BPSK module 835 for converting the interleaved bit stream or code symbols into BPSK symbols and generating a selected number of sets of repeated BPSK symbols; an IFFT module 837 configured to perform IFFT on the repeated BPSK symbols; an up-converter 839 is used for modulating the IFFT symbols into a plurality of tones encoded with the access code.

Thus, the encoded bit stream is converted from serial to parallel and then mapped into multiple parallel BPSK symbols. A selected number of sets of repeated BPSK symbols are generated from each parallel BPSK symbol. That is, multiple parallel sets of repeated BPSK symbols are generated, corresponding to the multiple parallel BPSK symbols. Multiple repeated sets of BPSK symbols may then be IFFT processed and parallel-to-serial converted for output. Here, the code symbols may be mapped to BPSK symbols and then converted from serial to parallel BPSK symbols, or the code symbols may be converted from serial to parallel and then mapped to BPSK symbols.

Fig. 9 illustrates an exemplary method 900 corresponding to token 800 transmitting an access code over a voice channel. For accessing a secure network, system, or application, processor 820 generates an access code using the encryption key (910). Thereafter, based on the access code, multiple sets of parallel repeated BPSK symbols are generated (920), and IFFT transformation is performed to generate IFFT symbols (930). The IFFT symbols are then modulated 940 into a plurality of tones encoded with the access code, and the audio output unit 840 may output 980 the plurality of tones for authentication. Here, the encryption key may be stored in the storage medium 810.

More specifically, the bit stream of the access code may be encoded, serial-to-parallel converted, interleaved, and BPSK mapped into multiple parallel BPSK symbols. Each parallel BPSK symbol is repeated a selected number of times as shown in fig. 5A to 5C, thereby generating a plurality of sets of parallel repeated BPSK symbols for IFFT processing. Alternatively, the encoded bit stream may be interleaved, BPSK mapped, and then converted from serial to parallel into multiple parallel BPSK symbols for repetition. Still alternatively, the encoded bit stream may be interleaved and then converted from serial to parallel into multiple parallel code symbols for BPSK processing.

Further, as in token 200, a reference tone with a reference phase may be added to the plurality of tones. Then, the reference tone is output together with the plurality of tones. Further, a plurality of tones may be amplified and then output. In addition, if a clock module is implemented, the processor 820 generates an access code using the encryption key and the time element. The access code may then be generated, converted and output from token 800 when a user inputs a command through actuator 870.

Although the modulation of converter 830 is not based on the use of a LUT, verifier device 300 may perform the modulation and corresponding method 600, as shown in fig. 3 and 6. Accordingly, the converter 340 corresponding to the converter 830 may include: a down converter 341 for demodulating the plurality of tones into IFFT symbols; an FFT module 343 configured to perform FFT to generate repeated BPSK symbols; a BPSK module 345, configured to generate a set of selected BPSK symbols according to the repeated BPSK symbols, and convert the set of selected BPSK symbols into code symbols or an encoded interleaved bit stream of the access code; a deinterleaver 347 for deinterleaving the code symbols; a decoding module 349 for recovering the access code from the encoded and deinterleaved bit stream. Modulation techniques other than BPSK may also be implemented in converters 830 and 340 as in token 200.

Fig. 10 illustrates an exemplary method 1000 corresponding to the converter 830 verifying an access code using an acoustic channel. For authentication, a plurality of tones encoded with an access code are received by the audio input module 330 (1010). The downconverter 341 downconverts or demodulates the multiple tones into IFFT symbols (1020). FFT module 343 then performs an FFT to generate repeated BPSK symbols (1030), and thereafter generates a selected set of BPSK symbols from the repeated BPSK symbols (1040). Here, the selected set of BPSK symbols may be generated as shown in fig. 7A to 7D. BPSK module 345 converts the selected BPSK symbols into code symbols that encode the interleaved bit stream or access code (1050). Thereafter, the deinterleaver 347 deinterleaves the encoded interleaved bit stream (1060), and the decoding module 949 recovers the access code from the encoded deinterleaved bit stream (1070). Processor 320 verifies the access code using the encryption key stored in storage medium 910 (1080) and grants access if the access code is validated (1090).

As in the verifier device 300, if a reference tone having a reference phase is received, the plurality of tones are converted into IFFT symbols using the reference tone. Then, the reference tone is output together with the plurality of tones. In addition, if a clock module is implemented, the processor 320 verifies the access code using the encryption key and the time element.

As described above, the access code and/or password may be: encoding into a plurality of tones; transmission over public communication facilities such as the internet 120; recovering from the plurality of tones; authentication is performed to access secure networks, systems, and/or applications.

System 100 is only one example and there may be other systems that perform digital authentication over an acoustic channel. Fig. 11A to 11D show other exemplary digital authentication systems through a sound channel. In fig. 11A, a plurality of tones encoded with an access code may be output and transmitted from token 1110 to receiver device 1120. The access code is then forwarded from receiver device 1120 to verifier device 1130 via wireless or wired communication infrastructure 1140. In fig. 11B, a plurality of tones encoded with an access code are output from token 1110 and transmitted to receiver 1120 via wireless or wireline phone 1150. Thereafter, the access code is forwarded from receiver device 1120 to verifier device 1130 via wireless or wired communication infrastructure 1140. In fig. 11A and 11B, receiver device 1120 is remote from verifier device 1130. In some cases, receiver device 1120 may be remote from verifier device 1130 or part of verifier device 1130, as shown in FIG. 11C. In fig. 11C, token 1110 outputs the plurality of tones encoded with the access code directly to receiver/verifier device 1160. Alternatively, multiple tones encoded with the access code may be output from token 1110 via wireless or wireline phone 1150 and transmitted to receiver/verifier 1160.

Thus, the plurality of tones encoded with the access code may be forwarded from receiver device 1120 to verifier device 1130, and verifier device 1130 may recover the access code. In some embodiments, the access code may be recovered from the plurality of tones and then forwarded from receiver device 1120 to verifier device 1130 for authentication. Fig. 12 shows an example of a receiver 1200 corresponding to token 200, and fig. 13 shows an example of a receiver 1300 corresponding to token 800 for recovering an access code.

The receiver 1200 includes: a storage medium 1210 for storing a LUT corresponding to the LUT in the storage medium 210; an audio input unit 1220 for receiving a plurality of tones encoded with an access code from a token user; a converter 1230 for recovering the access code from the plurality of tones using the LUT. The converter 1230 may include: a processor 1232 configured to convert the plurality of tones into BPSK symbols using the LUT; a BPSK module for performing demodulation based on BPSK to convert the BPSK symbols into code symbols or a coded interleaved bit stream of access codes; a deinterleaver 1236 for deinterleaving the code symbols; a decoding module 1238 configured to recover the access code from the encoded code symbols.

Receiver 1300 includes: an audio input unit for receiving sound waves encoded with an access code from a token user; a converter 1320. The converter 1320 may include: a down converter 1321 for demodulating the plurality of tones into IFFT symbols; an FFT module 1323 configured to perform FFT to generate repeated BPSK symbols; a BPSK module 1325, configured to generate a set of selected BPSK symbols according to the repeated BPSK symbols, and convert the set of selected BPSK symbols into an encoded interleaved bit stream of the access code; a deinterleaver 1327 for deinterleaving the coded interleaved bit stream; a decoding module 1329 for recovering the access code from the encoded and deinterleaved bit stream.

Generally, the method corresponding to the receiver 1200 for recovering the access code also corresponds to the method described in fig. 6. However, the receiver 1200 does not verify the recovered access code and does not grant access based on the access code. Likewise, the method corresponding to the receiver 1300 for recovering the access code also corresponds to the method described in fig. 11. However, receiver 1300 does not verify the recovered access code and does not grant access based on the access code.

Thus, the access code and/or password may be encoded into and recovered from a plurality of tones. By entering the access code for authentication using the voice channel, a display or the constant computation required to display the access code is not required, thereby extending the battery life of the token. Furthermore, since the access code is not manually entered by the user, errors are less likely to occur, particularly in systems where the user needs to enter the access code more than once during each access. Furthermore, since standard speakers and/or microphones can be used, the system can be easily implemented without significant cost increases.

Finally, embodiments may be implemented by hardware, software, firmware, middleware, microcode, or any combination thereof. When implemented in software, firmware, middleware or microcode, the program code or code segments to perform the necessary tasks may be stored in a machine-readable medium such as storage media 210, 310, 810, 1210 or other storage media (not shown). A processor, such as processors 220, 230, 820 or other processors (not shown), may perform the necessary tasks. A code segment may represent a procedure, a function, a subprogram, a program, a routine, a subroutine, a module, a software package, a class, or any combination of instructions, data structures, or program expressions. A code segment may be coupled to another code segment or a hardware circuit by passing and/or receiving information, data, arguments, parameters, or memory contents. Information, arguments, parameters, data, etc. may be passed, forwarded, or transmitted via any suitable means including memory sharing, message passing, token passing, network transmission, etc.

Furthermore, it will be apparent to those skilled in the art that the elements of tokens 200 and 800 may be rearranged without affecting the operation of the token. Also, the components of the verifier device 300 and/or the receivers 1200, 1300 may be rearranged without affecting their operation. Furthermore, the components of the token 200, 800, verifier device 300 and/or receiver 1200, 1300 may be implemented together. For example, processor 238 may be implemented with processor 220 and processor 348 may be implemented with processor 320.

Further, in some embodiments, the token may be implemented with a display. The exemplary embodiment of the token shown in fig. 14A has a housing 1410 implemented with a display 1420, an actuator 1430, and an audio output unit 1440. Another exemplary embodiment of the token shown in fig. 18B has a receiving member 1450 implemented with a display 1460, an actuator 1470, an audio output unit 1480, and a hole 1480 through the receiving member 1450.

Accordingly, the foregoing embodiments are merely examples and are not to be construed as limiting the invention. The description of the embodiments is illustrative, and not limiting to the scope of the claims. Accordingly, the present disclosure may be readily applied to other types of apparatuses and various alternatives, modifications, and variations will be apparent to those skilled in the art.

Claims (30)

1. An apparatus for authentication, comprising:

a storage medium to store an encryption key and a look-up table (LUT);

a first processor coupled to the storage medium for generating an access code using the encryption key;

a converter coupled to the processor for converting the access code into a plurality of tones encoded with the access code; and

an audio output unit for outputting the plurality of tones encoded with the access code for authentication;

wherein the converter comprises:

a Binary Phase Shift Keying (BPSK) module to generate a plurality of parallel BPSK symbols; and

a second processor coupled to the BPSK module and the storage medium, and configured to convert the BPSK symbols into the plurality of tones using the LUT.

2. The apparatus of claim 1, wherein one of the first or second processors is further to repeat the BPSK symbols a selected number of times; and

wherein the second processor converts repeated BPSK symbols into the plurality of tones.

3. The apparatus of any preceding claim, further comprising:

a clock module coupled to the first processor for generating a time element; and

wherein the first processor generates the access code using the encryption key and a time element.

4. The apparatus of any preceding claim, further comprising:

an actuator coupled to the first processor for receiving a user command; and

wherein the first processor generates the access code upon receipt of the user command.

5. The apparatus of any preceding claim, further comprising:

a housing part for containing the storage medium, the first processor, the converter, and the audio output unit; and

a hole through the receiving member.

6. The apparatus of any preceding claim, further comprising:

and the display module is connected with the first processor and is used for displaying the access code.

7. The apparatus of any preceding claim, further comprising:

a user input for receiving a Personal Identification Number (PIN);

wherein the converter converts the PIN into a plurality of tones encoded with the PIN; and

wherein the audio output unit further outputs the plurality of tones encoded with the PIN for authentication.

8. An apparatus for authentication, comprising:

a storage medium to store an encryption key and a look-up table (LUT);

a processor coupled to the storage medium and configured to generate an access code using the encryption key;

a converter coupled to the processor for converting the access code into a plurality of tones encoded with the access code; and

an audio output unit for outputting the plurality of tones encoded with the access code for authentication;

wherein the converter comprises:

a Binary Phase Shift Keying (BPSK) module to generate a plurality of parallel BPSK symbols; and

wherein the processor converts the BPSK symbols into a plurality of tones using the LUT.

9. A method for authentication, comprising:

storing an encryption key and a look-up table (LUT);

generating an access code using the encryption key;

generating a plurality of parallel BPSK symbols based on the access code;

using the LUT to convert the BPSK symbol into a plurality of tones encoded with the access code; and

outputting the plurality of tones encoded with the access code for authentication.

10. The method of claim 9, comprising:

repeating the BPSK symbols a selected number of times before converting the BPSK symbols.

11. The method of claim 10, wherein repeating the BPSK symbols comprises: repeating a set of three BPSK symbols the selected number of times; and

wherein the step of converting the BPSK symbols comprises: converting each set of three BPSK symbols into the plurality of tones using the LUT.

12. The method of claim 9 or any one of claims 10-11 as dependent thereon, further comprising:

adding a reference tone having a reference phase to the plurality of tones; and

outputting the reference tone with the plurality of tones.

13. The method of claim 9 or any one of claims 10-12 as dependent thereon, further comprising generating a time element; and

wherein the step of generating the access code comprises: generating the access code using the encryption key and a time element.

14. The method of claim 9 or any one of claims 10-13 as dependent thereon, further comprising receiving a user command; and

wherein the step of generating the access code comprises: generating the access code upon receipt of the user command.

15. The method of claim 9 or any one of claims 10-14 as dependent thereon, further comprising:

receiving a Personal Identification Number (PIN);

converting the PIN into a plurality of tones encoded with the PIN; and

outputting the plurality of tones encoded with the PIN for authentication.

16. An apparatus for authentication, comprising:

a storage medium for storing an encryption key;

a processor coupled to the storage medium and configured to generate an access code using the encryption key;

a converter coupled to the processor for converting the access code into a plurality of tones encoded with the access code; and

an audio output unit coupled to the converter for outputting the plurality of tones encoded with the access code for authentication;

wherein the converter comprises:

a Binary Phase Shift Keying (BPSK) module to generate a plurality of parallel repeated BPSK symbols based on the access code;

an Inverse Fast Fourier Transform (IFFT) module coupled to the BPSK module to perform IFFT on the repeated BPSK symbols to generate code symbols; and

an upconverter coupled to the IFFT module to modulate the code symbols into a plurality of tones encoded with the access code.

17. A method for authentication, comprising:

storing the encryption key;

generating an access code using the encryption key;

generating a plurality of parallel Binary Phase Shift Keying (BPSK) symbols based on the access code;

repeating the BPSK symbols a selected number of times before converting the BPSK symbols;

performing Inverse Fast Fourier Transform (IFFT) on the repeated BPSK symbols to generate IFFT symbols;

modulating the IFFT symbols into a plurality of tones encoded with the access code; and

outputting the plurality of tones encoded with the access code for authentication.

18. The method of claim 17, wherein repeating the BPSK symbols comprises: repeating a set of three BPSK symbols the selected number of times; and

wherein the step of converting the BPSK symbols comprises: converting each set of three BPSK symbols into the plurality of tones using the LUT.

19. An apparatus for authentication, comprising:

an audio input unit for receiving a plurality of tones encoded with an access code;

a converter coupled to the audio input unit for recovering the access code from the plurality of tones encoded with the access code; and

wherein the converter comprises:

a down converter for tuning the plurality of tones into IFFT symbols;

a Fast Fourier Transform (FFT) module for generating a plurality of parallel BPSK symbols from the IFFT symbols;

a BPSK module coupled to the processor and configured to convert the BPSK symbols into a coded interleaved bit stream of the access code;

a deinterleaver, coupled to the BPSK module, for deinterleaving the encoded interleaved bit stream; and

a decoding module coupled to the deinterleaver for recovering the access code from the encoded deinterleaved bit stream.

20. The apparatus of claim 19, further comprising:

a storage medium for storing an encryption key;

a processor coupled to the storage medium and the converter, for verifying the access code using the encryption key and granting access if the access code is validated.

21. The apparatus of claim 20, wherein the audio input unit further receives a plurality of tones encoded with a Personal Identification Number (PIN);

wherein the converter further recovers the PIN from the plurality of tones encoded with the PIN; and

wherein if the access code and the PIN are validated, the processor also grants access.

22. The apparatus of claim 20 or claim 21 as dependent thereon, further comprising:

a clock module coupled to the first processor for generating a time element; and

wherein the processor verifies the access code using the encryption key and a time element.

23. The apparatus of claim 19 or any one of claims 20-22 as dependent thereon, wherein the FFT module converts the plurality of tones into repeated sets of BPSK symbols and generates a selected set of BPSK symbols; and

wherein the BPSK module converts the set of selected BPSK symbols.

24. A method for authentication, comprising:

receiving a plurality of tones encoded with an access code;

generating a plurality of parallel BPSK symbols from the plurality of tones;

converting the BPSK symbols into a coded interleaved bit stream of the access code;

deinterleaving the encoded interleaved bit stream; and

recovering the access code from the encoded and deinterleaved bit stream.

25. The method of claim 24, wherein the step of performing the FFT comprises: generating repeated BPSK symbols;

wherein the method further comprises: generating a set of selected BPSK symbols from the repeated BPSK symbols; and

wherein the step of performing BPSK comprises: the set of selected BPSK symbols is converted into a coded interleaved bit stream.

26. The method of claim 25, wherein the step of performing the FFT comprises: converting the IFFT symbols into a plurality of repeated sets of three BPSK symbols; and

wherein the step of generating the set of selected BPSK symbols comprises: three BPSK symbols are selected from the repeated sets of three BPSK symbols to generate the selected set of BPSK symbols.

27. The method of claim 25, wherein the step of performing the FFT comprises: converting the IFFT symbols into a plurality of repeated sets of three BPSK symbols; and

wherein the step of generating the set of selected BPSK symbols comprises: selecting one of the repeated sets of three BPSK symbols to generate the selected set of BPSK symbols.

28. The method of claim 24 or any one of claims 25-27 as dependent thereon, further comprising:

storing the encryption key;

verifying the access code with the encryption key; and

if the access code is validated, access is granted.

29. The method of claim 24 or any one of claims 25-28 as dependent thereon, further comprising:

receiving a plurality of tones encoded with a Personal Identification Number (PIN);

recovering the PIN from a plurality of tones encoded with the PIN; and

if the access code and the PIN are validated, access is granted.

30. The method of claim 24 or any one of claims 25-29 as dependent thereon, further comprising:

generating a time element; and

wherein the step of verifying the access code comprises: the access code is verified using the encryption key and a time element.