Token Based Multi-protocol Authentication System and Methods

• US 20070255951A1
• Filed: 11/19/2006
• Published: 11/01/2007
• Est. Priority Date: 11/21/2005
• Status: Abandoned Application

• Current Assignee: Amiram Grynberg
• Original Assignee: Amiram Grynberg
• Inventors: Grynberg, Amiram
• Application Number:
  US11/561,396
• Publication Number:
  US 20070255951A1
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: H04L 2209/42 Anonymization, e.g. involving pseudonyms
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

A Token based, multi-Server and multi-protocol authentication system comprising a plurality of Servers employing potentially a plurality of Proof protocols each requiring a Proof of Token presence before accepting login request from a possessor of said Token and a plurality of Token apparatus capable of communicating with said Servers and storing at least a first private key accessible only to Token, whereby said first key is associated with a Manufacturer Certificate; and whereby each Token is capable of executing a plurality of Proof of possession protocols such that for each Server of the plurality of Servers there is at least one protocol common to Token and Server.

Claims

1. An authentication system comprising:

a. A plurality of Servers employing a plurality of Proof protocols each requiring a Proof of Token presence before accepting login request from a possessor of said Token;

b. A Token apparatus, capable of communicating with said Servers, comprising;

i. A first private key accessible only to Token and associated with a Manufacturer Certificate required for executing an enrollment protocol of Token to Server;

ii. Processing means capable of selectively executing a plurality of Proof of possession protocols, such that for each Server of the plurality of Servers there is at least one protocol common to Token and Server;

iii. Storage means for securely storing a collection of data elements, each such element corresponding to a particular Server and wherein said data element is required for producing a Proof of possession acceptable to said Server;

iv. Selection means for selecting a data element required for executing a Proof of possession protocol corresponding to a particular Server.

2. The system of claim 1 further including a Host device communicative with Token wherein protocols are executed collaboratively by Token and by a Host, wherein operations involving non secret data are carried out by Host while at least one operation, involving secret data, is carried out by Token.

3. The system of claim 1 wherein said Token renders Proof of possession on display means attached to Token and a User communicates said Proof to Server.

4. The system of claim 1 further comprising a multiplicity of Manufacturer Certificates, each selectively required for executing an enrollment protocol of Token to particular Server.

5. The system of claim 1 wherein selection means use user accessible input selector.

6. The system of claim 1 wherein selection means are speech detection and recognition means responsive to user commands.

7. A method for generating a plurality of digital certificates guarantying compliance of a Token comprising the steps of:

a. Storing within Token a first private key and a first public key during manufacturing process;

a. Generating by Token an asymmetric second private key and a matching second public key;

b. Computing by Token a digital signature to said second public key whereby said signature is encrypted by said first private key;

c. Submitting a certificate request containing at least said signature, first public key and second public key to CA;

d. Verifying at CA that first public key is registered with manufacturer;

e. Receiving at Token from CA a Manufacturer Certificate certifying said second public key.

8. The method of claim 7 wherein first public key is replaced by first MC and the step of verifying at CA is replaced by:

a. Verifying at CA that first MC is valid.

9. A method for transferring a first MC from first Token to second Token comprising the steps of:

a. Establishing a trust for second Token by First Token based on MC of second Token;

b. Deleting first private key from permanent storage at first Token;

c. Communicating encrypted first private key and associated first MC to second Token;

d. Storing first private key and associated first MC at second Token.

10. The method of claim 9 wherein establishing a trust also involves asserting that second Token knows a shared secret required to access first Token.