Securing a transaction performed from a non-secure terminal

Abstract

In a general aspect, a method for authenticating a user can include: receiving, from a secure processor, a software component configured to generate an image frame including information intelligible to the user, and input data of the software component, the software component can include a first input for receiving a first input data having two randomly-selected valid values, and invalid values. The transmitted input data can include the valid values of the first input data. The method can also include, performing a plurality of times: selecting one of the valid values of the first input data in the transmitted input data, executing the software component by applying the transmitted input data to inputs of the software component and the selected valid value to the first input of the software component. The execution of the software component generating the image frame can have pixels in a visible or invisible state, depending on the selected valid value and defining the information, displaying the image frame. The method can also include, acquiring, from the user, a response depending on the information in the displayed image frame, and transmitting the acquired response to the secure processor.

What is claimed is: 
     
         1 . A method for authenticating a user, the method comprising:
 receiving, from a secure processor, a software component configured to generate an image frame including information intelligible to the user, and a plurality of input data of the software component, the input data including a plurality of first input data each having two randomly-selected valid values and invalid values, the software component including a plurality of first inputs, each first input being configured to receive respectively the first input data, the received input data including the valid values of the first input data;   performing a plurality of times:
 selecting one of the valid values of each of the first input data in the received input data, 
 executing the software component by applying the received input data to inputs of the software component and the selected valid values to the first inputs of the software component, the execution of the software component generating the image frame which has pixels in a visible or invisible state, depending on the selected valid values of the first input data and forming an image of the user intelligible information, 
 displaying the image frame, and 
 acquiring, from the user, a response depending on the user intelligible information in the displayed image frame; and 
   transmitting the acquired response to the secure processor.   
     
     
         2 . The method of  claim 1 , wherein first valid values of the first input data used for generating and displaying a first image frame are selected as a function of a data provided by the secure processor, and second valid values of the first input data are selected as a function of the response acquired from the user from a previously displayed image frame, for generating and displaying another image frame. 
     
     
         3 . The method of  claim 1 , wherein the valid values of the first input data selected for generating and displaying the image frames at each successive executions of the software component, are randomly selected, and a signature of data defining each generated image frame is transmitted to the secure processor. 
     
     
         4 . The method of  claim 1 , wherein the software component is configured to generate the image frame, wherein the user intelligible information is displayed using random pixels having a probability lower than 100% to be visible in the image frame, such that the user intelligible information is machine non-visibly recognizable, the software component being executed a plurality of times to generate a plurality of image frames which are displayed at frame display rate such that the user intelligible information becomes intelligible to the user. 
     
     
         5 . The method of  claim 1 , wherein the user intelligible information:
 includes a plurality of labels of a keypad ordered as a function of the first input data, the response from the user including key positions of keys of the keypad selected by the user,   includes a plurality of labels of a keypad ordered as a function of the first input data, and one symbol belonging to a validation code, the response from the user including key positions of keys of the keypad selected by the user, or   specifies a biometric challenge, the response from the user including biometric data input by the user using a biometric sensor.   
     
     
         6 . The method of  claim 4 , wherein the software component is configured to provide, in response to a random selection of valid values of second input data, output data in one of two binary states with a probability set to a value between 12.5% and 87.5%. 
     
     
         7 . The method of  claim 1 , wherein the software component is configured to store a plurality of image frame configurations, which are selected by selecting valid values of the first input data. 
     
     
         8 . The method of  claim 1 , wherein the software component is configured to generate encrypted parts of an image frame, the generation of each image frame including:
 decrypting each generated encrypted image frame part using a decrypting mask, the decrypting mask being transmitted from the secure processor; and   inserting each decrypted image frame part in an image frame background to generate a respective image frame.   
     
     
         9 . The method of  claim 8 , further comprising:
 transmitting the response from the user to the secure processor; and   authenticating the user by the secure processor when the response corresponds to the information and to a secret data known to the user and included the secure processor.   
     
     
         10 . The method of  claim 1 , wherein the software component is encoded as a garbled circuit, the garbled circuit including circuit inputs, circuit outputs, logic gates and wires, each logic gate having two inputs and one output, each wire having a first end connected to one of the circuit inputs or to one of the logic gate outputs, and a second end connected to one of the logic gate inputs or to one of the circuit outputs, the garbled circuit being generated by selecting a valid data value for each binary state of each of the wires, and by computing, for one logic gate of the garbled circuit, truth table values as a function of each valid data value of each input of the logic gate, each valid data value of the output of the logic gate and a logic operation performed by the logic gate. 
     
     
         11 . A user terminal configured to:
 receive from a secure processor, a software component configured to generate an image frame including information intelligible to the user, and a plurality of input data of the software component, the input data including a plurality of first input data each having two randomly-selected valid values and invalid values, the software component including a plurality of first inputs configured to receive respectively the first input data, the received input data including the valid values of the first input data;   perform a plurality of times:
 selecting one of the valid values of each of the first input data in the received input data, 
 executing the software component by applying the received input data to inputs of the software component and the selected valid value to the first input of the software component, the execution of the software component generating the image frame which has pixels in a visible or invisible state, depending on the selected valid values of the first input data and forming an image of the user intelligible information, 
 displaying the image frame, 
 acquiring, from the user, a response depending on the user intelligible information in the displayed image frame; and 
   transmit the acquired response to the secure processor.   
     
     
         12 . The terminal of  claim 11 , configured to:
 select first valid values of the first input data as a function of a data provided by the secure processor, for generating and displaying a first image frame, and   select second valid values of the first input data, as a function of the response acquired from the user from a previously displayed image frame, for generating and displaying another image frame.   
     
     
         13 . The terminal of  claim 11 , further configured to:
 randomly select the valid values of the first input data used for generating and displaying the image frames at each successive executions of the software component; and   compute and transmit a signature of data defining each generated image frame to the secure processor.   
     
     
         14 . The terminal of  claim 11 , wherein the software component is configured to generate the image frame, wherein the user intelligible information is displayed using random pixels having a probability lower than 100% to be visible in the image frame, such that the user intelligible information is machine non-visibly recognizable, the software component being executed a plurality of times to generate a plurality of image frames which are displayed at frame display rate such that the user intelligible information becomes intelligible to the user. 
     
     
         15 . The terminal of  claim 11 , wherein the user intelligible information:
 includes a plurality of labels of a keypad ordered as a function of the first input data, the response from the user including key positions of keys of the keypad selected by the user,   includes a plurality of labels of a keypad ordered as a function of the first input data, and one symbol belonging to a validation code, the response from the user including key positions of keys of the keypad selected by the user, or   specifies a biometric challenge, the response from the user including biometric data input by the user using a biometric sensor.   
     
     
         16 . The terminal of  claim 14 , wherein the software component is configured to provide, in response to a random selection of valid values of second input data, output data in one of two binary states with a probability set to a value between 12.5% and 87.5%. 
     
     
         17 . The terminal of  claim 11 , wherein the software component is configured to store a plurality of image frame configurations, which are selected by selecting valid values of the first input data. 
     
     
         18 . The terminal of  claim 11 , wherein the software component is configured to generate encrypted parts of an image frame, the generation of each image frame further including:
 decrypting each generated encrypted image frame part using a decrypting mask, the decrypting mask being transmitted from the secure processor; and   inserting each decrypted image frame part in an image frame background to generate a respective image frame.   
     
     
         19 . The terminal of  claim 18 , further configured to transmit the response from the user to the secure processor, the user being authenticated by the secure processor when the response corresponds to the information and to a secret data known to the user and included the secure processor. 
     
     
         20 . The terminal of  claim 11 , wherein the software component is encoded as a garbled circuit, the garbled circuit including circuit inputs, circuit outputs, logic gates and wires, each logic gate having two inputs and one output, each wire having a first end connected to one of the circuit inputs or to one of the logic gate outputs, and a second end connected to one of the logic gate inputs or to one of the circuit outputs, the garbled circuit being generated by selecting a valid data value for each binary state of each of the wires, and by computing, for one logic gate of the garbled circuit, truth table values as a function of each valid data value of each input of the logic gate, each valid data value of the output of the logic gate and a logic operation performed by the logic gate. 
     
     
         21 . The terminal of  claim 11 , wherein the secure processor is a secure element connected to a main processor of the terminal. 
     
     
         22 . The terminal of  claim 11 , wherein the secure processor belongs to a remote server linked to the terminal through a data transmission network. 
     
     
         23 . A secure element connected to a processor of a terminal and configured to:
 transmit to the processor of the terminal, a software component configured to generate an image frame including information intelligible to a user of the terminal, and a plurality of input data of the software component, the input data including a plurality of first input data each having two randomly-selected valid values and invalid values, the software component including a plurality of first inputs, each first input being configured to receive respectively the first input data, the received input data including the valid values of the first input data, the software component being configured to be executed a plurality of times, with one of the valid values of each of the first input data in the received input data, the execution of the software component generating the image frame which has pixels in a visible or invisible state, depending on the selected valid values of the first input data and forming an image of the user intelligible information; and   receive a response acquired by the terminal from the user, the response depending on the user intelligible information in the generated image frame.   
     
     
         24 . A server linked to a terminal through a data transmission network and configured to:
 generate and transmit to the terminal, a software component configured to generate an image frame including information intelligible to a user of the terminal, and a plurality of input data of the software component, the input data including a plurality of first input data each having two randomly-selected valid values and invalid values, the software component including a plurality of first inputs, each first input being configured to receive respectively the first input data, the transmitted input data including the valid values of the first input data, the software component being configured to be executed a plurality of times, with one of the valid values of each of the first input data in the transmitted input data, the execution of the software component generating the image frame which has pixels in a visible or invisible state, depending on the selected valid values of the first input data and forming an image of the user intelligible information; and   receive a response acquired by the terminal from the user, the response depending on the user intelligible information in the generated image frame.   
     
     
         25 . A computer program product loadable into a computer memory and comprising code portions which, when carried out by a computer, configure the computer to:
 receive from a secure processor, a software component configured to generate an image frame including information intelligible to a user, and a plurality of input data of the software component, the input data including a plurality of first input data each having two randomly-selected valid values and invalid values, the software component including a plurality of first inputs configured to receive respectively the first input data, the received input data including the valid values of the first input data;   perform a plurality of times:
 selecting one of the valid values of each of the first input data in the received input data, 
 executing the software component by applying the received input data to inputs of the software component and the selected valid value to the first input of the software component, the execution of the software component generating the image frame which has pixels in a visible or invisible state, depending on the selected valid values of the first input data and forming an image of the user intelligible information, 
 displaying the image frame, 
 acquiring from the user a response depending on the user intelligible information in the displayed image frame; and 
   transmit the acquired response to the secure processor.