Method and system for user and group authentication with pseudo-anonymity over a public network

• US 20030014631A1
• Filed: 07/16/2001
• Published: 01/16/2003
• Est. Priority Date: 07/16/2001
• Status: Abandoned Application

• Current Assignee: Wave Systems Corporation
• Original Assignee: Wave Systems Corporation
• Inventors: Sprague, Steven
• Application Number:
  US09/906,375
• Publication Number:
  US 20030014631A1
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

A method of authorizing anonymous access to content by an individual user or a member of an authorized group of users is provided. The method includes receiving a request for access from a user having a persona identifier. Next, a challenge message is generated that includes, at least in part, the persona identifier and verification data, such as pseudo random data. The challenge message is provided to a persona server, which operates as an authentication agent that generates an authentication object extractable only by an individual user or group member. Upon receiving an authentication object from the persona server. The user retrieves decryption data from the persona server. The authentication object is forwarded to the user. If the persona user is authentic, the authentication object packaging is stripped by secure hardware at the user computer using the data from the persona server and the verification data is extracted. Upon receiving and confirming the verification data from the user, the content provider grants the user access to the selected content.

Claims

1. A method for a user of a computer to access content anonymously from a third party content provider computer comprising:

registering a persona having a persona identifier with a persona server to generate an access record;

requesting access to content from the content provider using the persona identifier;

the content provider generating a challenge message including, at least in part, the persona identifier and data uniquely verifiable by the content provider, and submitting the challenge message to the persona server;

the persona server associating the persona identifier with the access record and generating an authentication object including the data uniquely verifiable by the content provider enveloped in a manner extractable only by an authorized user of the persona;

the user computer receiving the authentication object;

the user computer retrieving data from the access record;

the user computer extracting the data uniquely verifiable by the content provider using the data from the access record; and

the user computer submitting the extracted data to the content provider for authentication.

2. The method for a user of a computer to access content anonymously according to claim 1, wherein the user is a member of a group of authorized users and the persona identifier is associated with the group.

3. The method for a user of a computer to access content anonymously according to claim 1, wherein the data uniquely verifiable by the content provider is pseudo-random data generated by the content provider computer.

4. The method for a user of a computer to access content anonymously according to claim 1, wherein the user can register a plurality of persona identifiers with the persona server.

5. A method for a content provider to authorize anonymous user access to content on a computer network comprising:

receiving a request for access from a user computer having a persona identifier;

generating a challenge message including, at least in part, the persona identifier and verification data;

submitting the challenge message to a persona server;

receiving an authentication object from the persona server and forwarding the authentication object to the user computer, the authentication object including the verification data enveloped such that it is accessible only by an authorized user of the persona identifier;

receiving the verification data from the user computer; and

granting access to the user computer if the verification data is correct.

6. The method of authorizing anonymous access to content according to claim 5, wherein the verification data is pseudo-random data generated in response to the request for access.

7. The method of authorizing anonymous access to content according to claim 5, wherein the user extracts the verification data from the authentication object using data retrieved from the persona server.

8. The method of authorizing anonymous access to content according to claim 5, wherein the user is a member of a group of users.

9. The method of authorizing anonymous access to content according to claim 5, wherein the user has a plurality of persona identifiers.

10. A method of providing authentication data for a user of a persona to access content anonymously comprising:

creating an access record based at least in part on a persona identifier and associating the persona identifier with substantially unique encryption data;

receiving a challenge message from a content provider computer including the persona identifier and verification data;

enveloping at least the verification data in accordance with the encryption data in the access record associated with the persona identifier to generate an authentication object; and

providing the authentication object to at least one of the content provider and the persona user.

11. The method of providing authentication data for a user of a persona according to claim 10, wherein the authentication object is passed to the content provider and from the content provider to the persona user.

12. The method of providing authentication data for a user of a persona according to claim 10, wherein the authentication object is passed to the persona user.

14. The system for authenticating a user of an anonymous persona according to claim 13, wherein the persona server comprises:

an authentication server operatively coupled to the public network;

a digital rights management server operatively coupled to the authentication server; and

an account management server operatively coupled to the authentication server, to the digital rights management server and to the public network.

15. The system for authenticating a user of an anonymous persona according to claim 13, wherein the plurality of client computers include secure hardware for storing the at least one persona identifier.

16. The system for authenticating a user of an anonymous persona according to claim 15, wherein the secure hardware is a SURF hardware device.

13. A system for authenticating a user of an anonymous persona prior to granting access rights on a public network comprising:

a plurality of client computers operatively coupled to the public network, the client computers storing at least one persona identifier;

a persona server operatively coupled to the public network, the persona server maintaining a database of access records associated with a plurality of persona identifiers, the access records associating each persona identifier with corresponding decryption data;

at least one content provider computer operatively coupled to the public network, in response to a request for access from one of the plurality of client computers using a persona identifier, the content provider computer generating a challenge message including the persona identifier and verification data associated with the request for access, the content provider computer submitting the challenge message to the persona server, the persona server receiving the challenge message and generating an authentication object including the verification data encrypted based on the access record associated with the persona identifier, the authentication object is presented to the client computer requesting access which, if authentic, retrieves data from the access record, decrypts the authentication object and returns the verification data to the content provider computer to establish user authentication.