Digital authentication over acoustic channel

Field of invention for digital authentication through voice channel

[0001] The present invention generally relates to authentication, and more particularly to digital authentication of entities using voice.

technical background

[0002] With the growth of e-commerce, the use of public communication infrastructure such as the Internet to access various secure networks, systems, and/or applications is also increasing. For example, through digital authentication, users can access banks, private networks such as intranets, secure servers or databases, and/or other virtual private networks (VPNs) via public communication networks (online or through ATMs).

[0003] However, due to the adoption of a communication system in which face-to-face contact is not possible, opportunities for fraud or illegal access have also increased. If the stolen identity falls into the hands of criminals, it will cause damage to individuals, organizations, or other entities.

[0004] In order to prevent illegal access, various security mechanisms for verifying the identity of users or entities have been developed in the past, so that access is only permitted to authorized entities. Access code generation devices such as tokens can implement a user authentication and access control technology. Here, a unique access code is periodically generated and displayed to the user. Usually, the access code is generated according to an algorithm based on security information and the current time. Then, the user needs to enter the currently displayed access code to access it.

[0005] In some systems, a password is also required for access. This type of system is called two-factor authentication (two-factor authentication)_oTwo-factor authentication is usually based on: for example, the user has a token; for example, the user knows the password. Since both pieces of information are used to authenticate users, compared with single-factor authentication, systems that perform two-factor authentication are less vulnerable to attacks.

[0006] The token described above can prevent unauthorized access, but it is troublesome because the user must manually enter each access code during each access. In addition, since the access code is manually entered, it is easier to make mistakes. In some systems, the user needs to enter the access code more than once during each visit, which increases the inconvenience and the probability of error. In addition, since the access code can be displayed continuously based on time, the token may require constant calculation, thereby reducing the battery life of the token.

[0007] Therefore, there is a need for a more efficient, more convenient and/or more secure way to use devices to implement a control access system.

Summary of the invention

[0008] The embodiments disclosed herein solve the aforementioned needs by providing a security method in a data processing system.

[0009] In one aspect, an apparatus for authentication includes: a storage medium for storing an encryption key and a look-up table (LUT); a first processor connected to the storage medium for using all The encryption key is used to generate an access code; a converter connected to the processor is used to convert the access code into a plurality of tones encoded with the access code; an audio input unit is used to input The access code encodes multiple tones for authentication; wherein, the converter may include: a binary phase shift keying (BPSK) module for generating multiple parallel BPSK symbols; and the BPSK module and the The second processor connected to the storage medium is configured to use the LUT to convert the BPSK symbol into a plurality of tones. Here, one of the first or second processor may repeat the BPSK symbol for a selected number of times; then, the second processor converts the repeated BPSK symbol into the plurality of tones.

[0010] In another embodiment, a device for authentication may include: a storage medium for storing encryption keys and

CN 101061663 Β

Look-up table (LUT); a processor connected to the storage medium for using the encryption key to generate an access code; a converter connected to the processor for converting the access code into a user The multiple tones encoded by the access code; an audio input unit for outputting multiple tones encoded with the access code for authentication; wherein, the converter includes: a binary phase shift keying (BPSK) module, Used to generate multiple parallel BPSK symbols; wherein the processor uses the LUT to convert the BPSK symbols into multiple tones.

[0011] In another embodiment, a method for authentication may include: storing an encryption key and a look-up table (LUT); using the encryption key to generate an access code; based on the access code, generating multiple A parallel BPSK symbol; using the LUT, the BPSK symbol is converted into multiple tones encoded with the access code; and multiple tones encoded with the access code are output for authentication. The method may further include: before converting the BPSK symbol, repeating the BPSK symbol a selected number of times. Here, the step of repeating the BPSK symbol may include: repeating a group of three BPSK symbols for selected times; wherein the step of converting the BPSK symbol may include: using the LUT to convert each group of three BPSK symbols into multiple Tones.

[0012] In another embodiment, an apparatus for authentication may include: a module for storing an encryption key and a look-up table (LUT); a module for using the encryption key to generate an access code; A module for generating multiple parallel BPSK symbols based on the access code; a module for using the LUT to convert the BPSK symbols into multiple tones encoded with the access code; an output module for input The access code encodes multiple tones for authentication. The device may further include a module for repeating the BPSK symbol a selected number of times, wherein the module for converting the BPSK symbol converts the repeated BPSK symbol.

[0013] In another embodiment, a device for authentication may include: a storage medium for storing an encryption key; and a processor connected to the storage medium for using the encryption key to generate Access code; a converter connected to the processor, used to convert the access code into a plurality of tones encoded with the access code; an audio input unit connected to the converter, used to output The access code encodes multiple tones for authentication; wherein, the converter may include: a binary phase shift keying (BPSK) module for generating multiple parallel repeated BPSK symbols based on the access code; and The inverse fast Fourier transform (IFFT) module connected to the BPSK module is used to perform IFFT on repeated BPSK symbols to generate code symbols; an up-converter connected to the IFFT module is used to modulate the code symbols into The multiple tones encoded by the access code.

[0014] In another embodiment, a method for authentication may include: storing an encryption key; using the encryption key to generate an access code; based on the access code, generating multiple parallel binary phase shifts Keying (BPSK) symbols; before converting the BPSK symbols, repeat the BPSK symbols a selected number of times; perform inverse fast Fourier transform (IFFT) on the repeated BPSK symbols to generate IFFT symbols; modulate the IFFT symbols Into multiple tones encoded with the access code; output the multiple tones encoded with the access code for authentication.

[0015] In another embodiment, an apparatus for authentication may include: a module for storing an encryption key; a module for generating an access code using the encryption key; and a module for generating an access code based on the access A module for generating multiple parallel binary phase shift keying (BPSK) symbols; a module for repeating the BPSK symbol a selected number of times before converting the BPSK symbol; a module for performing inverse fast Fourier transform on the repeated BPSK symbol (IFFT) to generate IFFT symbols; a module for modulating the IFFT symbols into multiple tones encoded with the access code; a module for outputting multiple tones encoded with the access code for authentication Module.

[0016] In another embodiment, an apparatus for verification may include: an audio input unit for receiving a plurality of tones encoded with an access code; a converter connected to the audio input unit for receiving Multiple tones encoded with access codes

CN 101061663 Β

Restore the access code; wherein, the converter includes: a down-converter for demodulating the plurality of tones into IFFT symbols; a fast Fourier transform (FFT) module for generating according to the IFFT symbols A plurality of parallel BPSK symbols; a BPSK module connected to the processor, used to convert the BPSK symbols into the coded interleaved bit stream of the access code; a de-interleaver connected to the BPSk module, used to convert The coded and interleaved bitstream is deinterleaved; a decoding module connected to the deinterleaver is used to recover the access code from the coded and deinterleaved bitstream. The device may further include: a storage medium for storing an encryption key; a processor connected to the storage medium and the converter, for verifying the access code using the encryption key, and if verified If the access code is issued, the access is granted. In addition, the FFT module converts the multiple tones into multiple sets of repeated BPSK symbols, and generates a set of selected BPSK symbols; wherein, the BPSK module converts the set of selected BPSK symbols.

[0017] In another embodiment, a method for verification may include: receiving a plurality of tones encoded with an access code; generating a plurality of parallel BPSK symbols according to the plurality of tones; and converting the BPSK symbols The coded interleaved bit stream is converted into the access code; the coded interleaved bit stream is deinterleaved; the access code is recovered from the coded deinterleaved bit stream. Here, the step of performing FFT includes: generating repeated BPSK symbols; wherein, the method further includes: generating a set of selected BPSK symbols according to the repeated BPSK symbols; wherein, the step of performing BPSK includes: The selected BPSK symbol is converted into a coded interleaved bit stream. In addition, the step of performing FFT includes: converting the IFFT symbols into multiple sets of repeated sets of three BPSK symbols; wherein the step of generating the selected set of BPSK symbols includes: selecting three BPSK symbols from the sets of repeated three BPSK symbols To generate the group of selected BPSK symbols. Alternatively, the step of performing the FFT includes: converting the IFFT symbols into multiple sets of repeated three BPSK symbols; wherein the step of generating the selected set of BPSK symbols includes: selecting a set of repeated three BPSK symbols to generate the The group selects the BPSK symbol.

[0018] In another embodiment, an apparatus for verification may include: a module for receiving a plurality of tones encoded with an access code; a module for generating a plurality of parallel BPSK symbols according to the plurality of tones A module for converting the BPSK symbol into the coded interleaved bitstream of the access code; a module for deinterleaving the coded interleaved bitstream; used to recover from the coded deinterleaved bitstream The module of the access code.

[0019] Brief Description of the Drawings

[0020] The various embodiments will be described in detail below with reference to the accompanying drawings. In these drawings, the same reference numerals refer to the same components, in which:

[0021] FIG. 1 shows a system for digital authentication through a voice channel;

[0022] FIG. 2 shows an exemplary embodiment of a token;

[0023] FIG. 3 shows an exemplary embodiment of the verification machine;

[0024] FIG. 4 shows an exemplary method of digital authentication using a voice channel;

[0025] FIGS. 5A and 5B show examples of BPSK symbols;

[0026] FIG. 5C shows an example of a LUT;

[0027] FIG. 6 shows an exemplary method of digital verification using a voice channel;

[0028] FIGS. 7A and 7B show the original repeated BPSK symbol group and the restored repeated BPSK symbol group;

[0029] FIGS. 7C and 7D show examples of selected BPSK symbol groups;

[0030] FIG. 8 shows an exemplary embodiment of a token;

[0031] FIG. 9 shows another exemplary method of digital authentication using a voice channel;

[0032] FIG. 10 shows an exemplary method of digital verification using a voice channel;

[0033] FIGS. 11A to 11D show other exemplary systems for digital authentication through a voice channel;

CN 101061663 Β

[0034] FIG. 12 shows an exemplary embodiment of a receiver;

[0035] FIG. 13 shows another embodiment of the receiver; and

[0036] FIGS. 14A and 14B show an exemplary housing of the token.

Detailed ways

[0037] Generally, the disclosed embodiments use a voice channel to perform digital authentication on users or entities. In the following description, specific details are given to facilitate a thorough understanding of these embodiments. However, those skilled in the art should understand that these embodiments may also be implemented without these specific details. For example, the circuits may be given in block diagram form so as not to obscure the embodiments with unnecessary details. However, in other examples, in order to better explain these embodiments, well-known circuits, structures, and technologies can be given in detail.

[0038] It should also be noted that these embodiments may be described as processes represented by flowcharts, structural diagrams, or block diagrams. Although the flowchart can describe multiple operations as a sequential process, many of them can be executed in parallel or simultaneously. In addition, the order of operations can be rearranged. When the operation is complete, the process ends. Procedures can correspond to methods, functions, procedures, subroutines, subroutines, and so on. When the process corresponds to a function, its end corresponds to the function returning to the calling function or the main function. [0039] In addition, as disclosed herein, the term "sonic wave" refers to an acoustic wave or pressure wave or vibration traveling through a gas, liquid, or solid. Sound waves include ultrasonic waves, audio waves and subsonic waves. The term "audio wave" refers to the frequency of the sound wave within the sound spectrum, approximately 20 Hz to 20 kHz. The term "ultrasonic wave" refers to the frequency of the sound wave higher than the sound spectrum. The term "subsonic wave" refers to the frequency of sound waves below the sound spectrum. The term "storage medium" means one or more devices used to store data, including read-only memory (ROM), random access memory (RAM), magnetic disk storage media, optical storage media, flash memory and/or Other machine-readable media. The term "machine-readable medium" includes, but is not limited to, portable or fixed storage devices, optical storage devices, wireless channels, and various other devices, which can store, contain, or carry instructions and/ Or data. The term "tone" refers to an acoustic carrier signal with a specific tone and vibration, which carries digital data. The term "multiple tones" refers to three or more tones. The term "authentication" refers to the authentication of an entity, and the terms "authentication" and "verification" can be used interchangeably.

[0040] FIG. 1 shows an exemplary system 100 for digital authentication through a voice channel. In the system 100, the verifier device 110 controls access to a secure network, system, and/or application through a public communication infrastructure such as the Internet 120. Although it can be accessed through public communication facilities other than the Internet 120, for illustrative purposes, the system 100 will be described with reference to the Internet 120.

[0041] In order to access through the Internet 120, a device such as a token 130 provides an access code to the verifier device 110 through a wireless communication device (WCD) 140. The access code is transmitted from the token 130 to the WCD 140 through the voice channel. The encryption key stored securely in the token 130 is used to generate an access code and encode it into a sound wave for communication. More specifically, multi-carrier modulation is used to encode the generated access code into multiple tones, and corresponding multi-carrier demodulation is used to recover the access code from the multiple tones.

[0042] The user of the token 130 may also provide user information, such as a user name, to the verifier device 110. Here, user information can be encoded into sound waves and transmitted to WCD 140 along with the access code. Alternatively, the user information can also be directly entered into WCD 140. Then, the WCD 140 can forward the access code and user information to the verification machine 110 via the Internet 120 for authentication. In other embodiments, the user information may be the assigned identification number of the token 130. Therefore, the user does not have to input user information. The identification number is automatically encoded into a sound wave and transmitted to WCD 140 together with the access code. After access is granted, WCD 140 can be used to communicate with secure networks or systems.

CN 101061663 Β

[0043] In order to forward the access code and/or user information, the WCD 140 can recover the access code and/or user information from the sound wave, if it is encoded. Then, the WCD 140 may forward the access code and/or user information to the verifier device 110. Alternatively, the sound wave encoded with the access code and the sound wave encoded with the user information, if they are encoded, can be transmitted to the authenticator device 110. Thus, the authenticator device 110 can recover the access code and/or user information from the sound wave. Here, the access code and/or user information, or the sound wave encoded with the access code and/or user information, can be transmitted through any known communication technology that allows access to the Internet 120 in the system 100.

[0044] The token 130 is usually a portable device and may be small enough to be carried in a pocket and/or attached to a key fob. The physical possession of the token 130 provides an aspect of the required verification, just as the physical possession of a key enables an individual to achieve access through a locked door. Therefore, the token 130 is used as an authentication tool, and, in addition to communicating through sound waves, the token 130 does not need to have traditional wireless communication capabilities in order to directly send to the verifier device 110 via the Internet 120 or other wireless and wired infrastructure. Access code. That is, in some embodiments, the token 130 does not support wireless communication capabilities, and does not include wireless modems, network cards, and/or other wireless links, leading to private or public communication infrastructure, such as the Internet 120. Therefore, the WCD 140 sends the access code via the Internet 120. However, it should be noted that in other embodiments, the token 130 may also be embedded in other devices, such as wireless phones or personal digital assistants. In addition, although the WCD 140 is shown as a personal desktop computer, it can be a variety of other computer devices, such as, but not limited to: laptop computers, PDAs, home, office, or vehicle wireless phones, or security devices.

[0045] The access code is generated using an encryption key, and the encryption key is securely stored in the token 130. The encryption key can be put into the token 130 at the time of manufacture, which is unknown to the user. Here, two encryption keys can be used for digital authentication: symmetric cryptography and asymmetric cryptography. In a symmetric cryptographic system, the secret key or symmetric key in the token 130 is shared and placed in the verifier device 110. The token 130 uses the key to generate a digital signature, and sends the digital signature to the verifier device 110 for authentication. The verifier device 110 verifies the digital signature based on the same key. In an asymmetric cryptographic system, a private key and a public key are generated for the user. The public key is shared with the verifier device 110, and the private key is kept secret in the token 130. The private key is used to generate a digital signature and send it to the verifier device 110. Then, the verifier device 110 verifies the digital signature based on the user's public key.

[0046] In the above description, the verifier device 110 verifies the encryption key corresponding to the user based on the user information sent together with the access code. The verifier device 110 can also be implemented as a part of a secure network or system to be accessed by the user. Alternatively, the verifier device 110 may be located outside a secure network or system. In addition, although FIG. 1 shows one verifier device 110, it is obvious to those skilled in the art that there can be more than one verifier device, and each device controls access to one or more networks/systems. .

[0047] The block diagram of FIG. 2 shows an exemplary embodiment of the token 300, and FIG. 3 shows an exemplary embodiment of the verification machine 300. The token 200 may include: a storage medium 210 for storing an encryption key and a look-up table (LUT); a processor 220 for using the encryption key to generate an access code; a converter 230 for using the LUT to convert the access code Converted into multiple tones encoded with an access code; the audio input unit 240 is used to output multiple tones encoded with an access code for verification. The verifier device 300 may include: a storage medium 310 for storing an encryption key; a processor 320 for using the encryption key to generate an access code; and an audio input unit 330 for receiving a multiple code encoded with the access code from the token. Tones; converter 340, used to recover the access code from multiple tones. Based on the encryption key, the processor 320 verifies the user's access code.

[0048] More specifically, based on multi-carrier modulation, the access code is converted into and from multiple tones. Therefore, the converter 230 modulates the access code into a multi-carrier signal, and the converter 340 uses the multi-carrier system to demodulate the access code from the multi-carrier signal. Co-pending U.S. application No. 10/356, 144 and co-pending U.S. application

CN 101061663 Β

No. 10/356, 425 describes a multi-carrier system. In multi-carrier modulation, the data stream to be transmitted is divided into multiple interleaved bit streams. In this way, multiple parallel bit streams with very low bit rates are obtained. Then, each bit stream is used to modulate multiple carriers and transmitted through different carrier signals. Generally, carrier modulation involves encoding, interleaving, digital modulation, inverse Fourier transform (IFFT) processing, and up-conversion of the data stream to be transmitted. Demodulation involves down-conversion, FFT processing, digital demodulation, de-interleaving and decoding of the received data stream. However, in converters 230 and 340, LUTs are used to facilitate modulation, as described below.

[0049] The converter 230 of the token 200 may include an encoding module 232, an interleaver 234, a binary phase shift keying (BPSK) module 236, and a processor 238. The converter 340 of the verifier device 300 may include a down converter 341, an FFT module 343, a BPSK module 345, a deinterleaver 347, and a decoding module 349. BPSK is a well-known digital modulation technique that is easy to implement. Although BPSK does not lead to the most efficient use of available bandwidth, it is not susceptible to noise. Therefore, BPSK is used to convert code symbols into tones. However, in converters 230 and 340, modulation techniques other than BPSK can also be implemented. In addition, it should be noted that the converter 230 shows a simplified multi-carrier modulator based on BPSK. More typical commercial multi-carrier modulators may have additional components, such as a preamble generator, serial-to-parallel (S/P) converter, or parallel-to-serial (P/S) converter. Similarly, the converter 340 shows a simplified multi-carrier demodulator corresponding to the converter 230. A more typical commercial multi-carrier demodulator may also have additional components, such as a synchronization unit, an S/P converter, and a P/P converter. S converter.

[0050] Generally, the encoding module 232 is used to encode a bit stream or a bit stream of an access code. Then, the interleaver 234 interleaves the encoded bit stream to interleave the bit stream or code symbols. The BPSK module 236 generates multiple parallel BPSK symbols according to the code symbols. More specifically, the coded bit stream is serial-parallel converted into parallel code symbols. Then, the BPSK module 236 maps the parallel code symbols into multiple parallel BPSK symbols. Here, the code symbols can be mapped into BPSK symbols and then serial-to-parallel converted into BPSK symbols, or the code symbols can be serial-to-parallel converted and then mapped into BPSK symbols. In addition, the number of BPSK symbols corresponds to the number of tones available in a multi-carrier system. In some embodiments, the frequency range of multi-carrier tones is approximately 1 kHz to 3 kHz, and the allowable bandwidth of each carrier depends on the number of tones. For example, if the number of available tones is 64, each carrier may allow a bandwidth of approximately 31.25 Hz. The processor 238 uses the LUT to convert the multiple BPSK symbols generated above into multiple tones, and performs serial-to-parallel conversion on them. By implementing LUT, BPSK symbols can be directly converted into multiple tones without IFFT processing and up-conversion. The detailed operation of the LUT will be described below in conjunction with FIG. 5.

[0051] In order to recover the access code, the process performed by the converter 340 is opposite to the process performed by the converter 230. That is, the down-converter 341 demodulates multiple tones into multiple parallel IFFT symbols; the FFT module 343 performs FFT to generate multiple parallel BPSK symbols; the BPSK module 345 converts the BPSK symbols into code symbols or access codes. The bit stream is interleaved; the deinterleaver 347 deinterleaves the code symbols; the decoding module 349 recovers the access code from the encoded code symbols. More specifically, the down converter 341 can demodulate multiple tones into multiple IFFT symbols; S/P performs serial-to-parallel conversion on the IFFT symbols; the FFT module 343 can perform FFT to generate multiple parallel BPSK symbols; BPSK The module 345 can convert the BPSK symbols into multiple parallel code symbols; the deinterleaver 347 can deinterleave the code symbols into an encoded bit stream; the P/S can perform parallel-to-serial conversion on the code symbols, and then decode the code symbols by the decoding module 349. Alternatively, multiple tones can be subjected to: serial-to-parallel conversion; FFT processing into multiple parallel BPSK symbols; parallel-to-serial conversion; BPSK processing to perform de-interleaving. Alternatively, multiple tones can be converted: parallel-to-serial conversion; FFT processed into multiple parallel BPSK symbols; BPSK processed into multiple parallel code symbols; parallel-serial conversion; de-interleaving.

[0052] In converters 230 and 340, more typical token and verifier devices may have additional components. In some embodiments, the token 200 may further include: an amplifier 260 for amplifying multiple tones from the converter 230;

CN 101061663 Β

The exciter or actuator 270 is used to receive a signal from the user to activate the authentication process. The actuator 260 may be, but is not limited to: a switch, a button switch, a toggle switch, or a dial or voice activation device. The token 200 may also include a clock module 250 for generating time elements. In these situations, the processor 220 may use the encryption key and the time element to generate the access code. Similarly, the verification machine device 300 may also include a clock module 350 for generating time elements. In these situations, the processor 320 may use the encryption key and the time element to generate the access code.

[0053] The token 200 and the clock modules 250 and 350 in the validator device 300 are synchronized to periodically generate a time element as needed, for example, every minute, every hour, every day, or other selected increments. This type of authentication is often referred to as an authentication-based session because the access code changes with each time period. In addition, the storage media 210 and 310 may be a database of encryption keys, corresponding to different users of the network, system, or application. Therefore, the user information is sent to the verifier device 300, as described above, so that an appropriate encryption key is used in the verifier 300 during the authentication process.

[0054] FIG. 4 shows an exemplary method 400 for transmitting an access code using a voice channel. For accessing a secure network, system or application, the processor 220 uses the encryption key to generate an access code (410). Thereafter, based on the access code, multiple parallel BPSK symbols are generated (420), and then, using the LUT, these BPSK symbols are converted into multiple tones encoded with the access code (430). More specifically, the bit stream of the access code is encoded into an encoded bit stream. The coded bit stream can be: serial-to-parallel conversion; interleaved into multiple parallel code symbols; BPSK mapped into multiple parallel BPSK symbols; using LUT, converted into multiple tones. Alternatively, the coded bit stream can be interleaved; BPSK mapping; and then serial-to-parallel converted into multiple parallel BPSK symbols to convert into multiple tones. Alternatively, the coded bit stream can be interleaved, and then serial-to-parallel converted into multiple parallel code symbols for BPSK processing. Here, the encryption key and the LUT may be stored in the storage medium 210, and the processor 238 may use the LUT stored in the storage medium 210 to convert the BPSK symbol into multiple tones. Then, input multiple tones encoded with the access code for authentication (440).

[0055] More specifically, the LUT is pre-calculated to map the BPSK symbol into a designated tone. For example, each specific sequence of BPSK symbols can be mapped, the latter corresponding to a different available tone. Therefore, instead of performing IFFT on the BPSK symbol and modulating the IFFT symbol, the LUT directly converts the BPSK symbol into multiple tones.

[0056] In some embodiments, in order to enhance the recovery of the access code, the BPSK symbols are repeated a selected number of times before the BPSK symbols are converted. Then, the LUT can be pre-calculated to map multiple sets of BPSK symbols into multiple tones. Figures 5A to 5C show examples of conversion from repeated BPSK symbols to corresponding tones. Assuming the BPSK symbol sequence {01110010} as shown in Figure 5A, repeat a set of two BPSK symbols {01,11,00,10} twice to obtain repeated BPSK symbols {0101, 1111,0000, 1010}, as shown in Figure 5B Shown. These repeated BPSK symbols can be found in the LUT and converted into corresponding tones. Figure 5C shows an exemplary LUT that can be used to convert these groups of BPSK symbols that are repeated twice. Here, each of the LUT entries 0000-111 1 corresponds to one of the tones T1 to T16. Based on this LUT, these repeated BPSK symbols will correspond to the tones {T6, T16, Tb T11}.

[0057] It should be noted that if the BPSK symbol is not repeated, the BPSK symbol shown in FIG. 5A will correspond to the tone {T8, T3}. In addition, if it is repeated, BPSK can be repeated two or more times. In addition, more than two BPSK symbols can be grouped into one group of BPSK symbols, and multiple groups of BPSK symbols can be repeated selected times to convert into multiple tones. According to the number of grouped BPSK symbols in a group and the number of repetitions of the group, the LUT can also be adjusted. For example, a set of three BPSK symbols can be repeated three times. In this case, the LUT can have 512 entries in the range of 000000000-111111111. Then, the LUT can be used to convert these groups of repeated three BPSK symbols into tones.

[0058] In order to further enhance the recovery of the access code, a reference tone with a reference phase may be added to the plurality of tones. Then, input the reference tone and multiple tones together. In addition, you can amplify multiple tones, and then input multiple

CN 101061663 Β

tone. In addition, if the clock module is implemented, the processor 220 uses the encryption key and the time element to generate the access code. Then, when the user inputs a command through the actuator 270, an access code can be generated, converted, and input from the token 200.

[0059] FIG. 6 shows an exemplary method 600 for verifying an access code using a voice channel. For verification, a plurality of tones encoded with an access code is received through the audio input module 330 (610). Downconverter 341 downconverts or demodulates multiple tones into multiple parallel IFFT symbols (620). Then, the FFT module 343 performs FFT to generate multiple parallel BPSK symbols (630). The BPSK module 345 converts the BPSK symbol into an encoded bit stream or code symbol (640), Then, deinterleaving is performed by the deinterleaver 347 (650). More specifically, multiple tones can be demodulated; serial-parallel converted into multiple parallel IFFT symbols; FFT processed into multiple parallel BPSK symbols; BPSK mapped into multiple parallel code symbols; de-interleaved into encoding Code symbol. Alternatively, multiple tones can be demodulated; serial-to-parallel conversion; IFFT processing; then, parallel-to-serial conversion into BPSK symbols for de-interleaving. Alternatively, multiple tones can be demodulated; serial-to-parallel conversion; FFT processing; BPSK mapping; and then parallel-to-serial conversion into multiple parallel BPSK symbols for de-interleaving. Thereafter, the decoding module 349 recovers the access code from the encoded code symbol (660). Then, the processor 320 uses the encryption key to verify the access code (670), and if the access code is verified, the access is granted (680). Here, the encryption key may be stored in the storage medium 310.

[0060] In the method 600, if BPSK symbols are repeated for conversion, demodulation and FFT processing are performed on multiple tones to obtain repeated BPSK symbols. Then, according to the repeated BPSK symbols, a group of selected BPSK symbols is generated, and the group of selected BPSK symbols is converted into code symbols or coded interleaved bit stream. Here, the BPSK module 345 can generate the selected group of BPSK symbols according to the repeated BPSK symbols, and convert the selected group into code symbols. Figures 7A to 7D show how to generate the selected set of BPSK symbols.

[0061] As shown in the figure, a group of two BPSK symbols are repeated twice to obtain the original BPSK symbol A1B1A2B2C1D1C2D2, and then demodulate it into A'IB' 1A' 2B' 2C' ID' 1C' 2D' 2 . By selecting one of these two sets of repeated BPSK symbols, the selected BPSK symbol can be generated, as shown in FIG. 7C. Or, by selecting each BPSK symbol from any group of repeated BPSK symbols, the selected BPSK symbol can be generated, as shown in FIG. 7D. Here, it should be noted that multiple tones can be converted into multiple sets of more than two BPSK symbols. For example, multiple tones can be converted into multiple sets of repeated three BPSK symbols. In this case, by selecting each BPSK symbol from the three repeated BPSK symbols of these groups, the selected BPSK symbol of the group can be generated. Or, by selecting a group of repeated three symbols, the selected group of BPSK symbols can be generated.

[0062] In addition, if a reference tone with a reference phase is received, the reference tone is used to convert multiple tones into multiple BPSK symbols. In addition, if the clock module is implemented, the processor 320 uses the encryption key and the time element to verify the access code.

[0063] If the processing power or speed of the token is limited, the LUT can use multiple tones to send the access code to greatly improve efficiency and performance. However, some embodiments may not implement and use LUTs. FIG. 8 shows another exemplary embodiment of a token 800 that does not use a LUT.

[0064] The token 800 includes: a storage medium 810 for storing an encryption key; a processor 820 for using the encryption key to generate an access code; a converter 830 for converting the access code into multiple tones; audio The input unit 840 is used to input multiple tones encoded with access codes for verification. In some embodiments, the token 800 may include an amplifier 860, an exciter or actuator 870, and a clock module 880, just as implemented by the amplifier 260, actuator 270, and clock module 280 of the token 200.

[0065] Generally, the components implemented by the token 800 are the same as the components in the token 200. However, the modulation of the converter 830 is not based on LUTo, therefore, it is not necessary to store the LUT in the storage medium 810. In addition, the processing of the converter 830 is based on the use of repeated BPSK symbols. More specifically, the converter 830 of the token 800 may include: an encoding module 83 for encoding the bit stream of the access code; an interleaver 833 for interleaving the encoded bit stream; and a BPSK module 835 for converting The interleaved bit stream or code symbols are converted into BPSK symbols, and a selected number of groups of repeated BPSK symbols are generated; IFFT module 837, used to perform IFFT on the repeated BPSK symbols; upconverter 839, used to modulate the IFFT symbols for access Multiple tones of code encoding.

[0066] Therefore, the coded bit stream is serial-to-parallel converted, and then mapped into multiple parallel BPSK symbols. According to each parallel BPSK symbol, a selected number of groups of repeated BPSK symbols are generated. That is, multiple sets of parallel repeated BPSK symbols are generated, corresponding to multiple parallel BPSK symbols. Then, multiple groups of repeated BPSK symbols can be subjected to IFFT processing and parallel-to-serial conversion for output. Here, the code symbols can be mapped into BPSK symbols and then serial-to-parallel converted into BPSK symbols, or the code symbols can be serial-to-parallel converted and then mapped into BPSK symbols.

[0067] FIG. 9 shows an exemplary method 900 corresponding to the token 800 sending an access code through a voice channel. For accessing a secure network, system or application, the processor 820 uses the encryption key to generate an access code (910). Thereafter, based on the access code, multiple groups of parallel repeated BPSK symbols are generated (920), and IFFT transformation is performed to generate IFFT symbols (930). Then, the IFFT symbol is modulated into multiple tones encoded with access codes (940), and the audio output unit 840 can output multiple tones for authentication (980). Here, the encryption key may be stored in the storage medium 810.

[0068] More specifically, the bit stream of the access code can be encoded, serial-to-parallel converted, interleaved, and BPSK mapped into multiple parallel BPSK symbols. Each parallel BPSK symbol is repeated a selected number of times, as shown in FIGS. 5A to 5C, thereby generating multiple groups of parallel repeated BPSK symbols for IFFT processing. Alternatively, the coded bit stream can be interleaved, BPSK mapped, and then serial-to-parallel converted into multiple parallel BPSK symbols for repetition. Or alternatively, the coded bit stream can be interleaved, and then serial-to-parallel converted into multiple parallel code symbols for BPSK processing.

[0069] In addition, as in the token 200, a reference tone having a reference phase may be added to a plurality of tones. Then, the reference tone and multiple tones are output together. In addition, you can amplify multiple tones, and then input multiple tones. In addition, if the clock module is implemented, the processor 820 uses the encryption key and the time element to generate an access code. Then, when the user inputs a command through the actuator 870, an access code can be generated, converted, and input from the token 800.

[0070] Although the modulation of the converter 830 is not based on the use of LUTs, the verifier device 300 can perform the modulation and the corresponding method 600, as shown in FIGS. 3 and 6. Therefore, the converter 340 corresponding to the converter 830 may include: a down converter 341 for demodulating multiple tones into IFFT symbols; an FFT module 343 for performing FFT to generate repeated BPSK symbols; and a BPSK module 345, used to generate a group of selected BPSK symbols according to the repeated BPSK symbols, and convert the selected group of BPSK symbols into code symbols or access codes encoding interleaved bit stream; de-interleaver 347, used to convert the code The symbols are de-interleaved; the decoding module 349 is used to recover the access code from the coded and de-interleaved bit stream. As in the token 200, modulation techniques other than BPSK can also be implemented in converters 830 and 340.

[0071] FIG. 10 shows an exemplary method 1000, corresponding to the converter 830 using a voice channel to verify an access code. For verification, a plurality of tones encoded with an access code are received through the audio input module 330 (1010). The down-converter 341 down-converts or demodulates the multiple tones into IFFT symbols (1020). Then, the FFT module 343 performs FFT to generate repeated BPSK symbols (1030), and then, based on the repeated BPSK symbols, generates a group of selected BPSK symbols (1040). Here, the group of selected BPSK symbols can be generated, as shown in Figures 7A to 7D. The BPSK module 345 converts the selected BPSK symbols into code symbols of the coded interleaved bit stream or access code (1050). Thereafter, the deinterleaver 347 changes the coded interleaving ratio

CN 101061663 Β

The special stream is de-interleaved (1060), and the decoding module 949 recovers the access code (1070) from the coded and de-interleaved bit stream. The processor 320 uses the encryption key stored in the storage medium 910 to verify the access code (1080), and if the access code is verified, the access is granted (1090).

[0072] As in the verifier device 300, if a reference tone with a reference phase is received, the reference tone is used to convert multiple tones into IFFT symbols. Then, input the reference tone and multiple tones together. In addition, if the clock module is implemented, the processor 320 uses the encryption key and the time element to verify the access code.

[0073] As mentioned above, the access code and/or password can be: encoded into multiple tones; transmitted through public communication facilities such as the Internet 120; recovered from multiple tones; verified to access a secure network, System and/or application.

[0074] The system 100 is just an example, and there may be other digital authentication systems through a voice channel. 11A to 11D show other exemplary digital authentication systems through the voice channel. In FIG. 11A, a plurality of tones encoded with an access code can be input and transmitted from the token 1110 to the receiver device 1120. Then, the access code is forwarded from the receiver device 1120 to the authenticator device 1130 through the wireless or wired communication infrastructure device 1140. In FIG. 11B, a plurality of tones encoded with an access code are input from the token 1110, and transmitted to the receiver 1120 through the wireless or wired telephone 1150. Thereafter, the access code is forwarded from the receiver device 1120 to the authenticator device 1130 through the wireless or wired communication infrastructure device 1140. In FIGS. 11A and 11B, the receiver device 1120 is far away from the verifier device 1130. In some cases, the receiver device 1120 may be far away from the verifier device 1130, or be a part of the verifier device 1130, as shown in FIG. 11C. In FIG. 11C, the token 1110 directly inputs the multiple tones encoded with the access code to the receiver/verifier device 1160. Alternatively, multiple tones encoded with an access code may be output from the token 1110 through a wireless or wired telephone 1150, and transmitted to the receiver/verifier 1160.

[0075] Therefore, multiple tones encoded with the access code can be forwarded from the receiver device 1120 to the authenticator device 1130, and the authenticator device 1130 can recover the access code. In some embodiments, the access code can be recovered from multiple tones first, and then the recovered access code is forwarded from the receiver device 1120 to the verifier device 1130 for authentication. FIG. 12 shows an example of the receiver 1200 corresponding to the token 200, and FIG. 13 shows an example of the receiver 1300 corresponding to the token 800, which is used to recover the access code.

[0076] The receiver 1200 includes: a storage medium 1210 for storing a LUT corresponding to the LUT in the storage medium 210; an audio input unit 1220 for receiving a plurality of tones encoded with an access code from the token user; and a converter 1230, used to use LUT to recover access codes from multiple tones. The converter 1230 may include: a processor 1232 for using LUT to convert multiple tones into BPSK symbols; a BPSK module for performing demodulation based on BPSK, thereby converting BPSK symbols into code symbols or coding interleaving of access codes Bit stream; de-interleaver 1236, used to de-interleave code symbols; decoding module 1238, used to recover the access code from the encoded code symbols.

[0077] The receiver 1300 includes: an audio input unit for receiving a sound wave encoded with an access code from a token user; and a converter 1320. The converter 1320 may include: a down-converter 1321, used to demodulate multiple tones into IFFT symbols; an FFT module 1323, used to perform FFT to generate repeated BPSK symbols; BPSK module 1325, used to generate repeated BPSK symbols , Generate a group of selected BPSK symbols, and convert the selected BPSK symbols of the group into the coded interleaved bit stream of the access code; the deinterleaver 1327 is used to de-interleave the coded interleaved bit stream; the decoding module 1329 uses To recover the access code from the coded and de-interleaved bit stream.

[0078] Generally, the method corresponding to the receiver 1200 for recovering the access code also corresponds to the method described in FIG. 6. However, the receiver 1200 does not verify the restored access code, and does not authorize access based on the access code. same,

CN 101061663 Β

The method corresponding to the receiver 1300 for recovering the access code also corresponds to the method described in FIG. 11. However, the receiver 1300 does not verify the restored access code, and does not authorize access based on the access code.

[0079] Therefore, it is possible to encode the access code and/or password into multiple tones and recover from them. By using the voice channel to input the access code for authentication, a display or constant calculation required to display the access code is not required, thereby extending the battery life of the token. In addition, since the access code is not manually entered by the user, errors are not prone to occur, especially in systems where the user needs to enter the access code more than once during each visit. In addition, since standard speakers and/or microphones can be used, the system can be easily implemented without significant cost increase.

[0080] Finally, the embodiments can be implemented by hardware, software, firmware, middleware, microcode, or any combination thereof. When implemented by software, firmware, middleware or microcode, the program code or code segment to perform the necessary tasks can be stored in a machine-readable medium, such as storage medium 210, 310, 810, 1210 or other storage medium (not shown) ). Processors, such as processors 220, 230.820 or other processors (not shown), can perform necessary tasks. The code segment may represent a procedure, function, subroutine, program, routine, subroutine, module, software package, class, or any combination of instructions, data structures, or program expressions. A code segment can be connected to another code segment or hardware circuit by transmitting and/or receiving information, data, arguments, parameters, or memory content. Information, arguments, parameters, data, etc. can be transferred, forwarded or transmitted in any suitable way, including memory sharing, message transfer, tag transfer, network transfer, etc.

[0081] In addition, it is obvious to those skilled in the art that the components of the tokens 200 and 800 can be rearranged without affecting the operation of the tokens. Likewise, the components of the verifier device 300 and/or the receivers 1200, 1300 can be rearranged without affecting its operation. In addition, the components of the token 200, 800, the authenticator device 300, and/or the receiver 1200, 1300 may be implemented together. For example, the processor 238 and the processor 220 may be implemented together, and the processor 348 and the processor 320 may be implemented together.

[0082] In addition, in some embodiments, a display may be used to implement the token. An exemplary embodiment of the token shown in FIG. 14A has a receiving part 1410, which is implemented with a display 1420, an actuator 1430, and an audio output unit 1440. Another exemplary embodiment of the token shown in FIG. 18B has a receiving part 1450, which is implemented by a display 1460, an actuator 1470, an audio input unit 1480, and a hole 1480 passing through the receiving part 1450.

[0083] Therefore, the foregoing embodiments are only examples and should not be construed as limiting the present invention. The description of these embodiments is illustrative, and does not limit the protection scope of the claims. Therefore, the content of this application can be easily applied to other types of devices, and various substitutions, modifications and changes are obvious to those skilled in the art.

CN 101061663 Β