USOO8477940B2

(12) United States Patent (10) Patent No.: US 8.477,940 B2

Narendra et al. (45) Date of Patent: *Jul. 2, 2013

(54) SYMMETRICCRYPTOGRAPHY WITH USER 36. R 23. Wang CC

AUTHENTICATION 6,609,654 B1 8/2003 Anderson et al.
6,636,833 B1 10/2003 Flitcroft et al.
(75) Inventors: Siva G. Narendra, Portland, OR (US); 6,687,375 B1 2/2004 Matyas et al.
Prabhakar Tadepalli, Bangalore (IN); 6,705,520 B1 3/2004 Pitroda et al.
Thomas N. Spitzer, Portland, OR (US) 6,769,607 B1
6,805,288 B2
8/2004 Pitroda et al.
10/2004 Routhenstein et al.
6,836,843 B2 12/2004 Seroussi et al.
(73) Assignee: Tyfone, Inc., Portland, OR (US) 6,845,453 B2 1/2005 Scheidt et al.
- 6,845,908 B2 1/2005 Morita et al.
(*) Notice: Subject to any disclaimer, the term of this 6,848,050 B1 1/2005 Merman et al.
patent is extended or adjusted under 35 6,857,566 B2 2/2005 Wankmueller
U.S.C. 154(b) by 1931 days. 6,871,278 B1 3/2005 Sciupac
6,886,096 B2 4/2005 Appenzeller et al.
This patent is Subject to a terminal dis- 6,901,145 B1 5/2005 Bohannon et al.
claimer. 6,908,030 B2 6/2005 Rajasekaran et al.
7,502,928 B2 * 3/2009 Suzuoki et al. ............... T13,166
(21) Appl. No.: 11/182,099
y x- - - 9
7,805,615 B2 9/2010 Narendra et al.
(Continued)
(22) Filed: Jul. 15, 2005 FOREIGN PATENT DOCUMENTS
(65) Prior Publication Data GB 2390705 1, 2004
WO OO3656.6 A1 6, 2000
US 2007/OO144O7 A1 Jan. 18, 2007 (Continued)
(51) Int. Cl. OTHER PUBLICATIONS
(52) He to (2006.01) PCT/US2006/027980, Written Opinion, Mailed Dec. 27, 2006, 13.
USPC .......................................................... 380/270 (Continued)
(58) Field of Classification Search
USPC .......................................................... 380.277 Primary Examiner — Michael S McNally
See application file for complete search history. Assistant Examiner — Daniel Hoang
(74) Attorney, Agent, or Firm — Dana LeMoine; LeMoine
(56) References Cited Patent Services, PLLC
U.S. PATENT DOCUMENTS (57) ABSTRACT
5,585,787 A 12/1996 Wallerstein A device uses a user authentication factor to generate a sym
363 A E. Shun metric key for use in Symmetric cryptography. The user
6,035.398 A 3, 2000 E. authentication factor is encrypted and stored for authentica
6.219,439 B1 4/2001 Burger tion during decryption.
6,315,195 B1 1 1/2001 Ramachandran
6,330,674 B1 12/2001 Angelo et al. 37 Claims, 4 Drawing Sheets
20

User Authentication
Factor - UAF
e.g., PIN, Password, fingerprint,
voiceprint, retinal scan,
hardware ID, etc.

Generate Symmetric Key. This

key is mathematically related to
UAF. Without UAF the
symmetrickey cannot be
240 generated.

Non-encrypted
data
(Plaintext)

Encrypted data,
Encryption process Encrypted UAF
 US 8,477,940 B2
Page 2

U.S. PATENT DOCUMENTS 2005, 0116026 A1 6/2005 Burger et al.

2005, 0121512 A1 6/2005 Wankmueller
2001/0001876 A1 5, 2001 Morgan et al. 2005/O127164 A1 6/2005 Wankmueller
2001/OOO7132 A1 T/2001 Regev
2001/OO34718 A1 10, 2001 Shaked et al. FOREIGN PATENT DOCUMENTS
2002fOO39063 A1 4, 2002 Ritter
2002, 0096570 A1 T/2002 Wong et al. WO WO-03029942 A2 4? 2003
2002.0099665 A1 T/2002 Burger et al. WO WO-03081519 A2 10/2003
2002/0152391 A1 * 10, 2002 Willins et al. ................. T13, 186 WO 200701 1991 A2 1/2007
2002fO180584 A1 12, 2002 McGregor et al. WO WO-200701 1992 A1 1/2007
2002fO1845.09 A1 12, 2002 Scheidt et al. OTHER PUBLICATIONS
2002fO186845 A1 12, 2002 Dutta et al.
2003/00284.81 A1 2, 2003 Flitcroft et al. Menezes, et al., “Handbook of Applied Cryptography.” 1997, CC
2003/0061168 A1 3, 2003 Routhenstein
2003/0O81785 A1 * 5/2003 Boneh et al. .................. 38O,277 Press LLC, 330-331, 386-389, 394–395, 551-553.
2003/022O876 A1 11, 2003 Burger et al. Uludag, U. “Multimedia Content Protection via Biometrics-based
2004/0044896 A1 3, 2004 Kelley et al. Encryption'. Multimedia and Expo, 2003, Proceedings 2003 Inter
2004/0050930 A1 3, 2004 Rowe national Conference, vol. 3, (Jul. 2003), 237-240.
2004/O133787 A1 T/2004 Doughty et al. “PCT Search Report, PCT/US2006/027979, (Jul 17, 2006), 1-13.
2004/O139329 A1 * 7/2004 Abdallah et al. .............. T13, 182 U.S. Appl. No. 1 1/182,920 Office Action Mailed Feb. 3, 2009, 12
2005.0005135 A1 1/2005 Chen et al. pageS.
2005.0006462 A1 1/2005 Rouille et al. U.S. Appl. No. 1 1/182,920 Office Action Mailed Nov. 9, 2009, 14
2005, OO15596 A1 1/2005 Bowers pageS.
2005/0O29349 A1 2, 2005 McGregor et al. U.S. Appl. No. 1 1/182,920 Office Action Mailed Aug. 25, 2010, 14
2005/OO38736 A1 2, 2005 Saunders pageS.
2005, OO44044 A1 2, 2005 Burger U.S. Appl. No. 1 1/182,920 Office Action Mailed Apr. 8, 2011, 14
2005, OOSO367 A1 3, 2005 Burger et al. pageS.
2005/0060586 A1 3, 2005 Burger et al. U.S. Appl. No. 1 1/182,920 Office Action Mailed Feb. 14, 2012, 5
2005/OO77349 A1 4, 2005 Bonalle pageS.
2005, 0108096 A1 5/2005 Burger et al.
2005.0109838 A1 5/2005 Linlor * cited by examiner
U.S. Patent Jul. 2, 2013 Sheet 1 of 4 US 8,477,940 B2

104

FIG. I.
U.S. Patent Jul. 2, 2013 Sheet 2 of 4 US 8,477,940 B2

210

User Authentication
Factor - UAF
e.g., PIN, Password, fingerprint,
voiceprint, retinal Scan,
hardware ID, etc.

Generate Symmetric Key. This

key is mathematically related to
UAF. Without UAF the
symmetric key cannot be
generated.

Non-encrypted
data
(Plain text)

Encrypted data,
Encryption process Encrypted UAF
250

200

FIG. 2
U.S. Patent Jul. 2, 2013 Sheet 3 of 4 US 8,477,940 B2

310 360

User Authentication Generate Symmetric Key.

9 This key is mathematically
Factor - UAF related to UAF. If UAF and
e.g., PIN, Password, fingerprint, UAF are identical, the
s generated key will be same
voiceprint, retinal scan, as that was used to encrypt
hardware ID, etc. UAF.

320
Encryption
260
Encrypted Encrypted UAF
- E.
Encrypted data, <GD No
Encrypted UAF Yes

Encrypted 340
Data
350

Decryption
process

Non-encrypted
data 240
(Plain text)

300

FIG. 3
U.S. Patent Jul. 2, 2013 Sheet 4 of 4 US 8,477,940 B2

UAF COLLECTION
COMPONENT
WRELESS
INTERFACE
BIOMETRIC
COLLECTION
UNIQUEID
SYMMETRIC
CRYPTOGRAPHY
ENGINE

PROCESSOR
SYMMETRICKEY
GENERATION
COMPONENT

450 DECRYPTION
STORAGE PROCESS
COMPONENT COMPONENT

ENCRYPTION
PROCESS
COMPONENT

400

FIG. 4
 US 8,477,940 B2
1. 2
SYMMETRC CRYPTOGRAPHY WITH USER be mobile. For example, mobile electronic device 100 may be
AUTHENTICATION a personal digital assistant (PDA), a Smartphone, a mobile
phone, a handheld computer, or any other device capable of
FIELD operating as described herein. FIG. 1 also shows secondary
electronic device 120. Secondary electronic device 120 is
The present invention relates generally to secure data stor shown as a key fob separate from mobile electronic device
age, and more specifically to the use of symmetric cryptog 100 in FIG. 1, but this is not a limitation of the present
raphy for secure data storage. invention. For example, secondary electronic device 120 may
be a card that attaches to, and detaches from, mobile elec
BACKGROUND 10 tronic device 100. Accordingly, secondary electronic device
120 may be separate from, or separable from, mobile elec
Cryptography may be used to limit access to data. For tronic device 100.
example, sensitive data in computers or networks may be Mobile electronic device 100 is shown including controls
encrypted to block access by unauthorized users. Cryptogra 106, fingerprint scanner 108, voice input 104, and retinal
phy may be utilized to securely store information or to 15 scanner 102. Fingerprint scanner 108, voice input 104, and
securely share information. retinal scanner 102 are examples of biometric information
Different types of cryptography are in use today. Examples collection devices capable of collecting biometric informa
include symmetric cryptography and asymmetric cryptogra tion to authenticate a user of mobile device 100. Controls 106
phy. In symmetric cryptography, encryption and decryption represent an input device capable of accepting other types of
are performed with the same “key.” Symmetric cryptography user authentication information, such as a password or per
is sometimes also referred to as Secret key cryptography, sonal identification number (PIN).
because the key cannot be disclosed for the data to remain Biometric information, passwords, and PINs are examples
secure. Triple-DES cryptography is an example of symmetric of user authentication factors (UAF) useful to authenticate a
cryptography. user to mobile electronic device 100. For example, access to
Asymmetric cryptography uses two keys: an encryption 25 mobile device 100 or features of mobile electronic device 100
key, and a decryption key, where the encryption key is derived may be limited to users that satisfy certain requirements with
from the decryption key using a one-way function. In asym respect to matching UAFs.
metric cryptography, the encryption key (also referred to as Other types of information may also be used as user
the public key) can be disclosed since it can only encrypt and authentication factors. For example, UAFs may include
not decrypt data. The decryption key (also referred to as the 30 unique identifiers (IDs) related to hardware devices such as
private key) cannot be disclosed for the data to remain secure. mobile electronic device 100 or secondary electronic device
Examples of asymmetric cryptography include Rivest 120. In some embodiments of the present invention, user
Shamir-Adleman (RSA) and elliptic curve cryptography. authentication is performed using a combination of UAFs.
For example, a unique ID may be combined with biometric
BRIEF DESCRIPTION OF THE DRAWINGS 35 information to authenticate a user to mobile electronic device
100. Unique IDs may be received by mobile electronic device
FIG.1 shows a mobile electronic device inaccordance with 100 in many ways. For example, a unique ID may be provided
various embodiments of the present invention; by secondary electronic device 120 using a wireless interface,
FIGS. 2 and 3 show flow diagrams in accordance with or by physical contact between mobile electronic device 100
various embodiments of the present invention; and 40 and secondary electronic device 120. Also for example, a
FIG. 4 shows a computer system in accordance with vari unique ID may be provided by an internal subsystem within
ous embodiments of the present invention. mobile electronic device 100, such as a hard disk drive, a
memory Subsystem, or a processor.
DESCRIPTION OF EMBODIMENTS Mobile electronic device 100 may provide secure data
45 storage or secure data transfer using symmetric cryptography
In the following detailed description, reference is made to that utilizes UAFs. For example, a symmetric key may be
the accompanying drawings that show, by way of illustration, generated from a mathematical representation of one or more
various embodiments of an invention. These embodiments UAFS, and the symmetric key may be used for encryption.
are described in sufficient detail to enable those skilled in the Decryption may be performed only after a matching UAF is
art to practice the invention. It is to be understood that the 50 provided and the symmetrickey is again generated. Symmet
various embodiments of the invention, although different, are ric cryptography embodiments are described in further detail
not necessarily mutually exclusive. For example, a particular below with reference to later figures.
feature, structure, or characteristic described in connection Mobile electronic device 100 may include a mechanism to
with one embodiment may be implemented within other allow mobile electronic device 100 to communicate with a
embodiments without departing from the spirit and scope of 55 wired or wireless network. For example, mobile electronic
the invention. In addition, it is to be understood that the device 100 may include circuitry to communicate with a
location or arrangement of individual elements within each cellular phone network. Note that in these embodiments,
disclosed embodiment may be modified without departing mobile electronic device 100 may or may not be a phone. For
from the spirit and scope of the invention. The following example, mobile electronic device 100 may be a cellular
detailed description is, therefore, not to be taken in a limiting 60 telephone having symmetric cryptography capabilities. Also
sense, and the scope of the present invention is defined only for example, mobile electronic device 100 may be a non
by the appended claims, appropriately interpreted, along with telephonic device that has cellular network connectivity.
the full range of equivalents to which the claims are entitled. Examples include personal digital assistants, and handheld
In the drawings, like numerals refer to the same or similar devices dedicated to secure data storage or secure data
functionality throughout the several views. 65 exchange. Further, mobile electronic device 100 may be a
FIG.1 shows a mobile electronic device. Mobile electronic non-telephonic device having wired or wireless connectivity
device 100 may be any type of electronic device considered to to a network other than a cellular network, and in some
 US 8,477,940 B2
3 4
embodiments, mobile electronic device 100 may be a device print and also presenta secondary electronic device that trans
without network connectivity. Examples include, but are not mits a unique hardware ID. The fingerprint and the hardware
limited to: Blackberry devices available from Research in ID may together be considered a UAF". The collection of
Motion (RIM), music players such as MP3 players, cameras, UAF" may be performed with biometric sensors such as those
and the like. shown on mobile electronic device 100 (FIG. 1). Further, the
In some embodiments, mobile electronic device 100 is an collection of UAF" may be performed over a wired or wireless
example of a “wearable' device that is capable of securely interface.
storing or exchanging data. For example, in some embodi The encrypted data and encrypted UAF are shown stored at
ments, mobile electronic device 100 may have the form factor 260 as a product of the various actions shown in FIG. 2. At
of a wristwatch. Some embodiments of the present invention 10 360, a symmetric key is generated from UAF". If UAF and
may have other wearable form factors. For example, a wear UAF" are identical, then the user providing UAF" should be
able mobile electronic device may be worn in such a manner granted access to the encrypted data. At 320, the collected
that it contacts human skin, or it may be worn on clothing. UAF" is encrypted using the symmetric key generated at 360,
Any wearable intelligent electronic device may be employed and the result is compared with the encrypted UAF stored at
without departing from the scope of the present invention. 15 260. If there is no match, then data access is denied at 340. If
FIG. 2 shows a flow diagram in accordance with various there is a match (signifying that UAF and UAF" are equal),
embodiments of the present invention. Diagram 200 repre then the decryption process at 350 uses the symmetric key to
sents data flow and actions that may be performed when decrypt the data, and the result is the non-encrypted data 240.
encrypting data in accordance with various embodiments of Using symmetric encryption embodiments represented by
the present invention. The various actions represented in FIG. FIG. 2, once the encryption process is completed, the data
2 may be performed by a mobile electronic device such as stored does not include the symmetric key needed to decrypt
mobile electronic device 100 (FIG. 1), although this is not a the data. Using symmetric decryption embodiments repre
limitation of the present invention. For example, the various sented by FIG. 3, the stored data cannot be decrypted unless
actions in FIG. 2 may be performed by a non-mobile com and until the UAF" is authenticated to be correct. The UAF
puting device Such as a desktop computer, workstation, or 25 Verification process generates a symmetric key from the col
mainframe computer. lected UAF, and the encrypted data can only be decrypted if a
Block 210 represents the collection of one or more user valid UAF is provided.
authentication factors (UAFs). As shown in block 210, a UAF As described above, the user authentication factor (UAF)
may be biometric information, a password or PIN, a hardware can include one or more of biometric factors identifying an
ID, or any combination. For example, a user may provide a 30 individual, passwords or PINs identifying a privileged person
fingerprint and also present a secondary electronic device that or class of persons, or hardware device specific IDs that
transmits a unique hardware ID. The fingerprint and the hard identify the presence or proximity of a particular piece of
ware ID may together be considered a UAF. The collection of equipment. In some embodiments, the UAF used to generate
UAF may be performed with biometric sensors such as those the symmetric key is formed by combining biometric infor
shown on mobile electronic device 100 (FIG. 1). Further, the 35 mation with one or more hardware IDs. In these embodi
collection of UAF may be performed over a wired or wireless ments, a valid user may only access encrypted data when a
interface. particular piece of hardware is present. For example, a hard
At 220, a symmetric key is generated from the UAF. Any ware ID from secondary device 120 (FIG. 1) may be com
functional relationship may be used to relate the symmetric bined with a user's fingerprint to form a UAF used to generate
key to the UAF. For example, if the generation of the key uses 40 a symmetric key. Also for example, a hardware ID from
one or more prime numbers, prime number generation or within mobile electronic device 100 (FIG. 1) may be com
selection may be a function of the UAF. Further, in some bined with a biometric factor collected by one or more of the
embodiments, the symmetric key may be set equal to a various biometric collection components shown in FIG. 1.
numerical representation of the UAF. Without the UAF, the FIG. 4 shows a computer system in accordance with vari
symmetric key cannot be generated. 45 ous embodiments of the present invention. Computer system
The encryption process at 250 encrypts data 240 and the 400 may be a mobile electronic device such as mobile elec
UAF using the symmetric key generated at 220. The tronic device 100 (FIG. 1), or may be a non-mobile device
encrypted data and encrypted UAF are stored 260. The sym Such as a desktop computer, workstation, server, or main
metric key is not stored. frame. Computer system 400 includes processor 460, user
FIG. 3 shows a flow diagram in accordance with various 50 authentication factor (UAF) collection component 410, sym
embodiments of the present invention. Diagram 300 repre metric cryptography engine 430, and storage component 450.
sents data flow and actions that may be performed when UAF collection component 410 includes one or more com
decrypting data in accordance with various embodiments of ponents capable of collecting user authentication factors. For
the present invention. The various actions represented in FIG. example, UAF collection component 410 may include wire
3 may be performed by a mobile electronic device such as 55 less interface 412 to communicate with other electronic
mobile electronic device 100 (FIG. 1), although this is not a devices to receive user authentication factors. Any type of
limitation of the present invention. For example, the various UAF information may be received over wireless interface
actions in FIG.3 may be performed by a non-mobile com 412. For example, wireless interface 412 may communicate
puting device Such as a desktop computer, workstation, or with a secondary wireless device Such as a mobile phone or
mainframe computer. 60 key fob having a unique ID that is used as a UAF. Also for
Block 310 represents the collection of one or more user example, wireless interface 412 may communicate with other
authentication factors (UAFs). The UAF in block 310 is col computer systems that provide one or more UAFs.
lected for the decryption of data and is referred to as UAF" to Biometric collection component 414 may include one or
distinguish it from the UAF collected when the data is more interfaces to collect biometric information of a user. For
encrypted (FIG. 2). As shown in block 310, a UAF" may be 65 example, biometric collection component 414 may include a
biometric information, a password or PIN, a hardware ID, or fingerprint Scanner, a retinal scanner, a voice recorder, or the
any combination. For example, a user may provide a finger like. Unique ID 416 may be collected by UAF collection
 US 8,477,940 B2
5 6
component 410 in many different ways. For example, one or skilled in the art readily understand. Such modifications and
more subsystems within computer system 400 may provide a variations are considered to be within the scope of the inven
unique hardware ID for use as a UAF. Further, unique ID 416 tion and the appended claims.
may be provided by a hardware device that is separate from,
or separable from, computer system 400. What is claimed is:
UAF collection component 410 may be implemented in 1. A method for encrypting data in a mobile electronic
hardware, Software, or any combination. For example, wire device comprising:
less interface 412 may include a network interface card (NIC) receiving, at the mobile electronic device, at least one user
that includes a processing device and firmware. Further, bio authentication factor to authenticate a user to the mobile
metric collection component 414 may include hardware to 10
electronic device;
provide a physical interface to a person, and may also include
a device driver to be executed by processor 460. User authen generating, by the mobile electronic device, a symmetric
tication factors collected by UAF collection component 410 key as a function of the at least one user authentication
may be utilized to generate symmetric keys in a symmetric factor; and
cryptography engine. For example, UAF collection compo 15 encrypting, by the mobile electronic device, the at least one
nent may provide the UAF referenced in FIG. 2 and the UAF" user authentication factor using the symmetric key to
referenced in FIG. 3. produce an encrypted at least one user authentication
Symmetric cryptography engine 430 includes symmetric factor.
key generation component 432, decryption process compo 2. The method of claim 1 wherein the at least one user
nent 436, and encryption process component 438. The vari authentication factor includes a unique ID for a hardware
ous components of symmetric cryptography engine 430 may device.
be implemented in hardware, Software or any combination. 3. The method of claim 2 wherein the hardware device
For example, the various components may be implemented in comprises a hardware device physically separate from an
software that is executed by processor 460. In these embodi apparatus performing the method.
ments, the various components of symmetric cryptography 25 4. The method of claim 2 wherein the hardware device
engine 430 may be embodied as instructions on a machine comprises a hardware device physically separable from an
readable medium Such as a memory device, hard disk drive, or apparatus performing the method.
other storage medium. 5. The method of claim 1 wherein the at least one user
In some embodiments, symmetric key generation compo authentication factor includes a biometric factor.
nent 432 generates a symmetric key from a user authentica 30 6. The method of claim 1 wherein the at least one user
tion factor. For example, symmetric key generation compo authentication factor includes a unique ID for a hardware
nent 432 may perform actions shown at 220 in FIG.2 or at 360 device and a biometric factor.
in FIG. 3. In some embodiments, decryption process compo 7. The method of claim 1 further comprising:
nent 436 utilizes a symmetric key to decrypt encrypted data. storing the encrypted at least one user authentication factor.
For example, decryption process component 436 may per 35 8. A method for decrypting data in a mobile electronic
form actions shown at 350 in FIG. 3. Also in some embodi device comprising:
ments, encryption process component 438 utilizes a symmet receiving, at the mobile electronic device, at least one user
ric key to encrypt data. For example, encryption process authentication factor to authenticate a user to the mobile
component 438 may perform actions shown at 250 in FIG. 2. electronic device;
Storage component 450 may be any type of storage com 40 generating, by the mobile electronic device, a symmetric
ponent capable of storing encrypted data and encrypted key as a function of the at least one user authentication
UAFs. For example, storage component 450 may be a factor; and
memory Such as a static random access memory (SRAM), encrypting, by the mobile electronic device, the at least one
dynamic random access memory (DRAM), or FLASH user authentication factor using the symmetric key to
memory. Also for example, storage component 450 may be a 45 produce a result, and comparing the result with a stored
hard disk, floppy disk, CDROM storage, or any other type of encrypted user authentication factor.
storage. Storage component 450 may also include a machine 9. The method of claim 8 wherein the at least one user
readable medium that includes instructions that when authentication factor includes a unique ID for a hardware
accessed result in processor 460 performing actions. For device.
example, storage component 450 may have instructions to 50 10. The method of claim 9 wherein the hardware device
implement the various components of symmetric cryptogra comprises a hardware device physically separate from an
phy engine 430. apparatus performing the method.
Processor 460 represents a processor capable of commu 11. The method of claim 9 wherein the hardware device
nicating with the other blocks shown incomputer system 400. comprises a hardware device physically separable from an
For example, processor 460 may be a microprocessor, a digi 55 apparatus performing the method.
tal signal processor (DSP), a microcontroller, or the like. 12. The method of claim 8 wherein the at least one user
Further, processor 460 may beformed from state machines or authentication factor includes a biometric factor.
other sequential logic. In operation, processor 460 may read 13. The method of claim 8 wherein the at least one user
instructions and/or data from storage component 450, sym authentication factor includes a unique ID for a hardware
metric cryptography engine 430, or UAF collection compo 60 device and a biometric factor.
nent 410. For example, processor 460 may execute program 14. A mobile device with a machine accessible non-tran
instructions that implement symmetric cryptography engine sitory medium having instructions stored thereon that when
430. accessed result in the mobile device performing:
Although the present invention has been described in con receiving at least one user authentication factor to authen
junction with certain embodiments, it is to be understood that 65 ticate a user to the mobile device;
modifications and variations may be resorted to without generating a symmetric key as a function of the at least one
departing from the spirit and Scope of the invention as those user authentication factor; and
 US 8,477,940 B2
7 8
encrypting the at least one user authentication factor using an encryption process component to encrypt data and the at
the symmetric key to produce an encrypted at least one least one user authentication factor using the symmetric
user authentication factor. key; and
15. The mobile device of claim 14 wherein the at least one a decryption process component to decrypt encrypted data
user authentication factor includes a unique ID for a hardware using the symmetric key.
device. 27. The computer system of claim 26 further comprising a
16. The mobile device of claim 15 wherein the hardware
storage component to store encrypted data and an encrypted
user authentication factor.
device comprises a hardware device physically separate from 28. The computer system of claim 26 wherein the user
the machine performing the method. 10 authentication factor collection component is configured to
17. The mobile device of claim 15 wherein the hardware receive a unique ID for a hardware device as a user authenti
device comprises a hardware device physically separable cation factor.
from the machine performing the method. 29. The computer system of claim 28 wherein the hardware
18. The mobile device of claim 14 wherein the at least one device comprises a hardware device physically separable
user authentication factor includes a biometric factor. 15
from the computer system.
19. The mobile device of claim 14 wherein the at least one 30. The computer system of claim 26 wherein the user
user authentication factor includes a unique ID for a hardware authentication factor collection component is configured to
device and a biometric factor. receive a biometric factor as a user authentication factor.
20. A mobile device with a machine accessible non-tran 31. The computer system of claim 26 wherein the user
sitory medium having instructions stored thereon that when authentication factor collection component is configured to
accessed result in the mobile device performing: receive a unique ID for a hardware device and a biometric
factor as user authentication factors.
receiving at least one user authentication factor to authen 32. A mobile device comprising:
ticate a user to the mobile device:
generating a symmetric key as a function of the at least one means for collecting at least one user authentication factor
user authentication factor; and to authenticate a user to the mobile device:
encrypting the at least one user authentication factor using means for generating a symmetric key as a function of the
the symmetric key to produce a result, and comparing at least one user authentication factor;
the result with a stored encrypted user authentication means for encrypting the at least one user authentication
factor. factor using the symmetric key:
21. The mobile device of claim 20 wherein the at least one 30
means for encrypting data using the symmetric key; and
user authentication factor includes a unique ID for a hardware means for decrypting data using the symmetric key.
device. 33. A handheld device to store encrypted data, comprising:
22. The mobile device of claim 21 wherein the hardware a biometric collection device to collect a biometric user
device comprises a hardware device physically separate from authentication factor to authenticate a user to the hand
the machine performing the method. held device; and
23. The mobile device of claim 21 wherein the hardware
35 a symmetric cryptography engine to generate a symmetric
device comprises a hardware device physically separable key as a function of the biometric user authentication
from the machine performing the method. factor, and to encrypt the biometric user authentication
24. The mobile device of claim 20 wherein the at least one factor using the symmetric key.
user authentication factor includes a biometric factor. 34. The handheld device of claim 33 wherein the biometric
40
25. The mobile device of claim 20 wherein the at least one collection device comprises a fingerprint collection device.
35. The handheld device of claim 33 wherein the biometric
user authentication factor includes a unique ID for a hardware collection device comprises a retinal scanner.
device and a biometric factor.
26. A computer system for storing and accessing encrypted 36. The handheld device of claim 33 further comprising a
data, comprising: 45
wireless interface to receive a unique ID from a wireless
device.
a user authentication factor collection component to 37. The handheld device of claim 36 wherein the symmet
receive at least one user authentication factor to authen
ticate a user to the computer system; ric cryptography engine is configured to generate the sym
a symmetric key generation component to generate a sym metric key from the unique ID and the biometric user authen
tication factor.
metric key as a function of the at least one user authen
tication factor;