Method for distributed trust authentication

• US 10,116,453 B2
• Filed: 02/27/2018
• Issued: 10/30/2018
• Est. Priority Date: 03/31/2015
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Duo Security Incorporated (Cisco Systems, Inc.)
• Inventors: Oberheide, Jon, Song, Dug, Goodman, Adam
• Primary Examiner(s): Gracia, Gary S
• Application Number:
  US15/906,237
• Publication Number:
  US 20180234251A1
• Time in Patent Office: 245 Days
• Field of Search: None
• CPC Class Codes: G06F 21/40 by quorum, i.e. whereby two or more security principals are required
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/0863 involving passwords or one-time passwords network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

A method for distributed trust authentication of one or more users attempting to access one or more service providers operating on a network includes performing primary authentication of a user using a first authentication factor, generating a first partial digital signature for a first authentication response to the primary authentication, performing secondary authentication of the user using a second authentication factor, generating a second partial digital signature for the second authentication response to the secondary authentication, combining the first and second partial digital signatures to form a composite digital signature, and validating the composite digital signature.

Claims

1. A method for distributed trust authentication, the method comprising:

at a service provider;

using a common private cryptographic key of a public/private cryptographic key pair to generate a first private key share and a second private key share;

distributing, via one or more communications networks, each of the first private key share and the second private key share to an identity provider and a remote multi-factor authentication service, respectively; and

distributing a public cryptographic key of the public/private cryptographic key pair to one of the identity provider and the remote multi-factor authentication service, wherein whichever one of the identity provider and the remote multi-factor authentication service that has the public cryptographic key performs a validation of a combined digital signature;

identifying an attempt, by a user operating a computing device, to authenticate to the service provider;

validating the combined digital signature for authenticating the user, wherein;

the combined digital signature is formed by a combination of a first digital signature and a second digital signature,

the first digital signature being generated using the first private key share in response to a successful primary authentication of the user;

the second digital signature being generated using the second private key share in response to a successful secondary authentication of the user,

the first private key share and the second private key share being generated using the common private cryptographic key of the public/private cryptographic key pair;

wherein validating the combined digital signature includes using the public cryptographic key of the public/private cryptographic key pair to validate the combined digital signature; and

authenticating the user to the service provider based on the validation of the combined digital signature.

2. The method of claim 1, wherein

validating the combined digital signature includes validating each of the first digital signature and the second digital signature of the combined digital signature using the public cryptographic key of the public/private cryptographic key pair.

3. The method of claim 1, wherein

a primary authentication of the user is performed by an identity provider.

4. The method of claim 1, wherein a secondary authentication of the user is performed by a multi-factor authentication service, wherein

at the multi-factor authentication service:

using the common private cryptographic key of the public/private cryptographic key pair to generate the first private key share and the second private key share;

distributing, via one or more communications networks, one of the first private key share and the second private key share to the identity provider; and

distributing the public cryptographic key of the public/private cryptographic key pair to the service provider, wherein the service provider performs the validation of the combined digital signature.

5. The method of claim 4, wherein:

the multi-factor authentication service comprises a two-factor authentication service that performs the secondary authentication of the user only after an indication of a successful primary authentication of the user is provided by the identity provider.

6. The method of claim 1, wherein:

the first digital signature is received at the computing device of the user from a primary authenticator of the user;

the second digital signature is received at the computing device of the user from a secondary authenticator of the user, wherein the first digital signature and the second digital signature are transformed into the combined digital signature by the computing device of the user, and

transmitting by the computing device of the user, via the one or more communication networks, the combined digital signature to the service provider for performing the validation of the combined digital signature.

7. The method of claim 6, further comprising:

transmitting a secondary authentication request from the primary authenticator to the secondary authenticator in response to the successful primary authentication of the user,

wherein performing the secondary authentication comprises performing the secondary authentication only after receiving the secondary authentication request.

8. The method of claim 1, wherein:

the first digital signature is received at the service provider from a primary authenticator of the user; and

the second digital signature is received at the service provider from a secondary authenticator of the user, wherein the first digital signature and the second digital signature are transformed into the combined digital signature by the service provider.

9. The method of claim 1, wherein:

the first digital signature is received at the multi-factor authentication service from a primary authenticator of the user;

the first digital signature and the second digital signature are transformed into the combined digital signature by the multi-factor authentication service, and

transmitting by the multi-factor authentication service, via the one or more communication networks, the combined digital signature to the service provider for performing the validation of the combined digital signature.

10. The method of claim 1, wherein:

generating the second digital signature by the secondary authenticator comprises generating the second digital signature in response to both of the successful primary authentication and the successful secondary authentication of the user.

11. The method of claim 1, wherein:

the primary authentication of the user is performed using an authentication method that is different from an authentication method used in the secondary authentication of the user.

12. The method of claim 1, wherein:

providing the user with authenticated access to the service provider includes providing a restricted scope of access to the service provider when only one of the first digital signature and the second digital signature of the combined digital signature is successfully validated using the public cryptographic key.