Secure device registration for multi-factor authentication

• US 10,461,939 B2
• Filed: 02/08/2017
• Issued: 10/29/2019
• Est. Priority Date: 02/08/2017
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Inventors: Church, Dann M., Moerk, Michael, Collins, Doreen E., Pelkey, Joanne, Frantz, Jeff B.
• Primary Examiner(s): Tabor, Amare F
• Application Number:
  US15/427,290
• Publication Number:
  US 20180227128A1
• Time in Patent Office: 993 Days
• Field of Search: 713176
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

Provided is a process including: receiving a request from a first computing device to register another computing device; sending to the first computing device a registration code; receiving the registration code from a second computing device; sending an instruction to the designated application to send a value indicative of access to a cryptographic key; receiving from the designated application the value indicative of access to the cryptographic key; determining, based on the received value, that the received registration code was sent by the designated application and not another untrusted application.

Claims

1. A tangible, non-transitory, machine-readable medium storing instructions that when executed by one or more processors effectuate operations comprising:

receiving, via a network, a request from a first computing device to register another computing device;

as a supplemental factor in a multi-factor authentication protocol, or

as an embedded system authorized to access a distributed computing application;

after receiving the request, sending to the first computing device, via a network, a registration code to be entered in a designated application executing on another computing device to demonstrate possession of the other computing device to be registered;

after sending the registration code to the first computing device, receiving the registration code, via a network, from a second computing device;

sending an instruction to the designated application executing on the second computing device instructing the designated application to send a value indicative of access to a cryptographic key stored in memory of the second computing device,

wherein cryptographic key is stored in a location or format accessible to the designated application but not to other untrusted applications executing on the second computing device;

receiving, via the network, from the designated application executing on the second computing device, the value indicative of access to the cryptographic key;

determining, based on the received value and a reference value stored in memory that the received registration code was sent by the designated application and not another untrusted application executing on the second computing device; and

based on the determination, registering in memory the second computing device as the supplemental factor or as authorized to access the distributed computing application, wherein;

sending the instruction to the designated application executing on the second computing device comprises sending a push message, and

the operations comprise;

receiving, via a network, a registration of the second computing device to receive push messages, the push messages being deliverable to the second computing device without the second computing device sending a pull request for the messages with a network communication that indicates a network address of the second computing device and port of the network address through which the second computing device is prepared to receive messages; and

causing the network address of the second computing device to be ascertained before sending the push message based on the registration.

2. The medium of claim 1, wherein the determination is configured to impede brute force attacks on computing device registration by impairing an attacker'"'"'s ability to use an attacker-controlled script to submit candidate registration codes that happen to match a sent registration code in one of a plurality of concurrent device registrations sessions.

3. The medium of claim 1, wherein:

the designated application is a trusted native application executing on a mobile computing device;

the trusted native application is different from a general purpose mobile web browser;

the registration code;

is received in association with a message from the second computing device that identifies the second computing device as the other computing device for which registration is requested,

is input, before being received, to the trusted native application executing on the second computing device, and

is sent by the trusted native application executing on the second computing device;

receiving the request to register another computing device comprises receiving a request to designate possession of the other computing device as a second factor in a two-factor authentication protocol in which a password serves as a first factor;

the registration code is an 8-or-fewer character alphanumeric string;

the trusted native application is installed on the second computing device before receiving the registration code from the second computing device, wherein during installation or configuration of the native application, the second computing device registers the native application to receive push communications;

the instruction to the designated application executing on the second computing device instructing the designated application to send the value indicative of access to the cryptographic key is sent as a push communication without the second computing device sending a request for the message with a network address indicating where to send the instruction;

the value indicative of access to the cryptographic key is based on an asymmetric key encryption digital signature using the cryptographic key as a first key of the digital signature;

the second key is a different key of the asymmetric key encryption digital signature different from the first key; and

determining the received registration code was sent by the designated application comprises determining based on the second key that the asymmetric key encryption digital signature was signed by a computing device with access to the first key of the digital signature.

4. The medium of claim 1, the operations comprise:

wherein the message to the designated application executing on the second computing device is processes by an event handler of the designated application executing in a background process on the second computing device, such that the user is not alerted to the message or involved in sending the value indicative of access to the cryptographic key after sending the registration code via the second computing device.

5. The medium of claim 1, wherein:

the value indicative of access is an output that is cryptographically signed with a private key of the second computing device before being sent by the second computing device, the private key being inaccessible to applications other than the designated application;

the reference value is a public key corresponding to the private key; and

determining that the received registration code was sent by the designated application comprises;

verifying, with the public key, that the value is an output that was cryptographically signed with the private key.

6. The medium of claim 1, the instructions stored by the medium comprising instructions executed by the second computing device, wherein the instructions executed by the second computing device cause the second computing device to effectuate operations comprising:

presenting on a display of the second computing device, responsive to instructions of the designated application executed by the second computing device, a user interface with a user input to receive the registration code;

receiving, by the second computing device, via the user input of the user interface, the registration code;

receiving, by the designated application, the instruction to send the value indicative of access to the cryptographic key; and

in response to receiving the instruction to send the value, by the second computing device, accessing the cryptographic key or a cryptographic key in a cryptographic key chain including the cryptographic key.

7. The medium of claim 6, wherein:

the designated application is executed within a secure sandbox of the operating system of the second computing device, wherein the secure sandbox prevents other applications executing on the second computing device from accessing at least some aspects of program state of the designated application in memory of the second computing device, wherein the second computing device effectuates operations comprising;

assigning the designated application an application-specific identifier by an operating system of the second computing device;

determining that the designated application is permitted to access the cryptographic key based on the application-specific identifier by a kernel of the operating system of the second computing device.

8. The medium of claim 6, wherein:

the cryptographic key is accessed via a trusted execution environment of the second computing device, wherein the second computing device includes a plurality of processors, and wherein the trusted execution environment is executed by a different processor from one or more processors executing the designated application, and wherein the trusted execution environment is configured to;

encrypt the cryptographic key or a key in a cryptographic key chain including the cryptographic key with a key written during manufacturing of a computer chip including the processor executing the trusted execution environment;

after encrypting the cryptographic key or the key in the cryptographic key chain including the cryptographic key, storing a result of encrypting in encrypted form in memory that is not part of a memory address space accessible to other processors of the second computing device;

receiving an interrupt in a buffer of the trusted execution environment; and

in response to the interrupt, retrieving the cryptographic key or the key in the cryptographic key chain including the cryptographic key in encrypted form and descripting the cryptographic key or the key in the cryptographic key chain including the cryptographic key.

9. The medium of claim 6, the second computing device is caused to effectuate operations comprising:

calculating, with the second computing device, a hash value based on a bit sequence of stored computer code encoding at least part of the designated application;

determining, based on the hash value, that the designated application has not been modified so as to render the designated application untrusted.

10. The medium of claim 1, the operations comprising:

sending another registration code to a third computing device;

receiving the other registration code from a fourth computing device;

sending another instruction to the fourth computing device instructing the fourth computing device to send a value indicative of access to a cryptographic key;

determining, based on a response from the fourth computing device or an absence of a response, that the registration code was not sent by a trusted instance of the designated application executing on the fourth computing device; and

in response to determining that the registration code received from the fourth computing device was not sent by a trusted instance, determining to not register the fourth computing device.

11. The medium of claim 1, the operations comprising:

after receiving the registration code, determining that less than a threshold amount of registration code submissions have been received from the second computing device during a trailing duration of time.

12. The medium of claim 1, wherein:

the second computing device is an Internet-of-things appliance having an embedded system that communicates via a wireless local area network with other Internet-of-things appliances on the same wireless local area network.

13. The medium of claim 1, wherein:

sending an instruction to the designated application compress steps for push communication; and

determining that the received registration code was sent by the designated application comprises steps for authenticating a digital signature.

14. The medium of claim 1, the operations comprising:

registering the second computing device as the supplemental factor for the user account;

after registering the second computing device as the supplemental factor, receiving a request from the first computing device or a third computing device to authenticate the user as authorized to access resources associated with the user account;

receiving an authentication credential associated with the result to authenticate the user;

determining that the second computing device is designated as the supplemental factor;

sending an authentication code to either;

the first or third computing device, or

the second computing device;

receiving a value indicative of access to the authentication code from a different computing device than the computing device to which the authentication code was sent, wherein the authentication code is received from either;

the first or third computing device, or

the second computing device;

determining, based on receiving the value indicative of access to the authentication code, and based on receiving the authentication credential, to authenticate the user.

15. The medium of claim 14, the operations comprising:

in response to determining to authenticate the user, obtaining an access token string and a uniform resource identifier of an online resource for which the user seeks access;

sending the first or third computing device a redirect instruction that includes the access token appended to the uniform resource identifier to cause the first or third computing device to send the access token to a server providing access to the resource for which the user seeks access.

16. The medium of claim 15, the operations comprising:

providing access to the resource for which the user seeks access.

17. A method, comprising:

receiving, via a network, a request from a first computing device to register another computing device;

as a supplemental factor in a multi-factor authentication protocol, or

as an embedded system authorized to access a distributed computing application;

after receiving the request, sending to the first computing device, via a network, a registration code to be entered in a designated application executing on another computing device to demonstrate possession of the other computing device to be registered;

after sending the registration code to the first computing device, receiving the registration code, via a network, from a second computing device;

sending an instruction to the designated application executing on the second computing device instructing the designated application to send a value indicative of access to a cryptographic key stored in memory of the second computing device,

wherein cryptographic key is stored in a location or format accessible to the designated application but not to other untrusted applications executing on the second computing device;

receiving, via the network, from the designated application executing on the second computing device, the value indicative of access to the cryptographic key;

determining, based on the received value and a reference value stored in memory that the received registration code was sent by the designated application and not another untrusted application executing on the second computing device;

based on the determination, registering in memory the second computing device as the supplemental factor or as authorized to access the distributed computing application, wherein sending the instruction to the designated application executing on the second computing device comprises sending a push message;

receiving, via a network, a registration of the second computing device to receive push messages, the push messages being deliverable to the second computing device without the second computing device sending a pull request for the messages with a network communication that indicates a network address of the second computing device and port of the network address through which the second computing device is prepared to receive messages; and

causing the network address of the second computing device to be ascertained before sending the push message based on the registration.

18. The method of claim 17, comprising:

presenting on a display of the second computing device a user interface with a user input to receive the registration code;

receiving, by the second computing device, via the user input of the user interface, the registration code;

receiving, by the designated application, the instruction to send the value indicative of access to the cryptographic key; and

in response to receiving the instruction to send the value, by the second computing device, accessing the cryptographic key or a cryptographic key in a cryptographic key chain including the cryptographic key.

19. The method of claim 17, wherein:

the value indicative of access is an output that is cryptographically signed with a private key of the second computing device before being sent by the second computing device, the private key being inaccessible to applications other than the designated application;

the reference value is a public key corresponding to the private key; and

determining that the received registration code was sent by the designated application comprises;

verifying, with the public key, that the value is an output that was cryptographically signed with the private key.

20. The method of claim 17, comprising actions executed by the second computing device, comprising:

presenting on a display of the second computing device, responsive to instructions of the designated application executed by the second computing device, a user interface with a user input to receive the registration code;

receiving, by the second computing device, via the user input of the user interface, the registration code;

receiving, by the designated application, the instruction to send the value indicative of access to the cryptographic key; and

in response to receiving the instruction to send the value, by the second computing device, accessing the cryptographic key or a cryptographic key in a cryptographic key chain including the cryptographic key.