SESSION-BASED PUBLIC KEY INFRASTRUCTURE

• US 20080028206A1
• Filed: 12/28/2006
• Published: 01/31/2008
• Est. Priority Date: 12/28/2005
• Status: Active Grant

• Current Assignee: BCE Incorporated
• Original Assignee: BCE Incorporated
• Inventors: NASRALLAH, Elie, BELOHOUBEK, Milan, SICARD, Christopher
• Granted Patent: US 8,219,808 B2
• Time in Patent Office: Days
• US Class Current: 713/156
• CPC Class Codes: H04L 2209/42 Anonymization, e.g. involving pseudonyms
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A method and system for issuing anonymous, or user-independent, certificates for secure communication over a network, such as the Internet, to provide authentication and automated login to electronic services. A pool of user-independent certificates is generated. Once the user is identified, a user-independent roaming certificate is automatically transferred to the user'"'"'s computer for encryption of communications during a single session. Once the user completes the online session or transaction, the issued digital certificate and associated key material is released back to the pool of digital certificates and can be re-used.

Claims

1. A public key infrastructure (PKI) authentication system, comprising:

an anonymous identity store to store a pool of credential sets; and

an authentication application server to provide a credential set from the pool of credential sets, including an anonymous unique identifier, to a user application requesting access to an electronic service application, the authentication application server further providing a public key associated with the electronic service application to the user application.

2. The authentication system of claim 1, wherein the credential sets each comprise a user ID and a password.

3. The authentication system of claim 1, wherein the anonymous unique identifier is a common name.

4. The authentication system of claim 3, wherein the unique common name is contained within a distinguished name.

5. The authentication system of claim 1, wherein the credential sets are user-independent.

6. The authentication system of claim 1, wherein the credential sets are re-usable.

7. The authentication system of claim 1, further comprising a profile generation module to generate the pool of credential sets prior to the user attempting to access the electronic service application.

8. The authentication system of claim 1, wherein the authentication application server comprises a login component to request the credential set from the anonymous identity store and send the credential set to the user application.

9. The authentication system of claim 8, further comprising a service validation module to receive a service request from the user application, and to return a login application to the user application.

10. The authentication system of claim 9, wherein the user application is a web browser.

11. The authentication system of claim 10, wherein the login application is a Java applet.

12. The authentication system of claim 1, wherein the authentication application server comprises a certificate component to receive the electronic service application'"'"'s public key certificate from a PKI system and to send the electronic service application'"'"'s public key certificate to the user application.

13. The authentication system of claim 12, further comprising means to validate the electronic service application'"'"'s public key certificate.

14. The authentication system of claim 13, wherein the means to validate the electronic service application'"'"'s public key certificate uses a certificate revocation list.

15. The authentication system of claim 1, further comprising a logout component to release the credential set for re-use.

16. The authentication system of claim 15, wherein the logout component comprises means to release the credential set at the expiry of a session.

17. The authentication system of claim 1, further comprising means to provide a temporary public/private key pair, associated to the credential set, to the user application.

18. The authentication system of claim 17, wherein the temporary public/private key pair is provided in a roaming certificate.

19. A method of authenticating a user for access to an electronic service application, comprising:

providing a credential set, from a store of pre-generated credential sets, to a user application; and

providing both a temporary public/private key pair associated with the credential set and a public key associated with the electronic service application to the user application.

20. The method of claim 19, further comprising validating the user for access to the electronic service application.

21. The method of claim 20, wherein validating the user comprises validating an access code provided by the user.

22. The method of claim 19, wherein providing the credential set and providing the both the public/private key pair and the public key are transparent to the user.

23. The method of claim 19, wherein providing the credential set comprises requesting the credential set from an anonymous identity store;

receiving the credential set from the anonymous identity store; and

sending the credential set to the user application.

24. The method of claim 19, wherein providing the public key comprises accessing a certificate associated with the electronic service application;

validating the electronic service application'"'"'s certificate; and

sending the electronic service application'"'"'s certificate to the user application.

25. The method of claim 19, wherein providing the temporary public/private key pair associated with the credential set comprises providing a roaming certificate.

26. The method of claim 19, further comprising releasing the credential set for re-use at the expiry of a session.

27. The method of claim 19, further comprising generating the store of pre-generated credential sets.

28. The method of claim 27, wherein generating the store of pre-generated credential sets comprises generating the store of pre-generated credential sets prior to attempted user access of the electronic service application.

29. The method of claim 27, wherein generating the store of pre-generated credential sets comprises generating user-independent credential sets.

30. Use of the method of claim 19 for online voting, electronic polling, census-taking, electronic commerce transactions, or electronic banking.

31. A session-based public key infrastructure system, comprising:

a certificate authority to bind public keys to user-independent credential sets stored in an anonymous identity store;

a roaming server to provide a roaming certificate associated with one of the user-independent credential sets to a user application requesting access to an electronic service application; and

means to provide a public key, associated with the electronic service application, to the user application.

32. The system of claim 31, wherein the credential sets each comprise a user ID, a password and an anonymous unique identifier.

33. The system of claim 32, wherein the anonymous unique identifier is a common name.

34. The system of claim 31, wherein the credential sets are re-usable.

35. The system of claim 31, further comprising a profile generation module to generate the credential sets prior to the user attempting to access the electronic service application.

36. A method of transparently authenticating to an electronic service application, comprising:

sending an authentication request to an authentication system;

receiving a certificate credential set from the authentication system permitting retrieval of an associated roaming profile certificate;

receiving a public key associated with the electronic service application; and

sending a message including a unique anonymous identifier associated with the credential set to the electronic application server to permit the electronic application server to retrieve a public key associated with the roaming certificate.

37. The method of claim 36, wherein sending the authentication request comprises sending a login request.

38. The method of claim 36, further comprising sending a service request to the authentication system.

39. The method of claim 36, further comprising providing an access code to the electronic service application prior to sending the authentication request.

40. The method of claim 39, further comprising receiving a signed token from the electronic service application.

41. The method of claim 40, wherein the signed token includes a time stamp.

42. The method of claim 36, further comprising receiving an authentication confirmation, from the electronic service application, in response to successful decryption of the message with the public key associated with the roaming certificate.

43. A web browser implementing the method of transparently authenticating to an electronic service application, comprising:

sending an authentication request to an authentication system;

receiving a certificate credential set from the authentication system permitting retrieval of an associated roaming profile certificate;

receiving a public key associated with the electronic service application; and

sending a message including a unique anonymous identifier associated with the credential set to the electronic application server to permit the electronic application server to retrieve a public key associated with the roaming certificate.