System And Method Of Non-Centralized Zero Knowledge Authentication For A Computer Network

• US 20110072265A1
• Filed: 11/22/2010
• Published: 03/24/2011
• Est. Priority Date: 10/16/2002
• Status: Abandoned Application

• Current Assignee: TVIIM LLC
• Original Assignee: TVIIM LLC
• Inventors: Hammond, Frank J. II, Ricotta, Frank J. JR., Carlander, Steven J.
• Application Number:
  US12/951,792
• Publication Number:
  US 20110072265A1
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/3218 using proof of knowledge, e.g. Fiat-Shamir, GQ, Schnorr, ornon-interactive zero-knowledge proofs
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

Zero-knowledge authentication proves identity without revealing information about a secret that is used to prove that identity. An authentication agent performs authentication of a prover agent without knowledge or transfer of the secret. A non-centralized zero-knowledge authentication system contains multiple authentication agents, for access by multiple computers seeking access on a computer network through local prover agents. Once authenticated, those multiple computers may also implement authentication agents. The secret may periodically expire by publishing a new encrypted secret by a trusted source, thwarting attempts to factor or guess information about the secret.

Claims

1. A method of non-centralized zero-knowledge authentication for a computer network, comprising steps of:

establishing a first computer having a first authentication agent and a first prover agent on the computer network;

detecting a first authentication request over the computer network from a second computer having a second prover agent;

authenticating the second prover agent through a zero-knowledge identification protocol; and

promoting the second computer with a second authentication agent to perform authentication for the computer network.

2. The method of claim 1, further comprising periodically generating and distributing a new secret to the first and second authentication agents.

3. The method of claim 1, further comprising:

detecting a second authentication request over the computer network from a third computer having a third prover agent;

authenticating the third prover agent through a zero-knowledge identification protocol with the second authentication agent; and

promoting the third computer with a third authentication agent to perform authentication for the computer network.

4. The method of claim 1, further comprising periodically publishing encrypted numbers for the zero-knowledge identification protocol, including the steps of:

generating first and second large prime numbers;

calculating a product of the first and second large prime numbers;

generating a secret to have a value relatively prime to the product, greater than zero and less than the product;

encrypting the product;

encrypting the secret; and

publishing encrypted values of the secret and product.

5. A system of non-centralized zero-knowledge authentication for a computer network, comprising:

two or more computers establishing the computer network, each of the computers containing an authentication agent, secret and prover agent; and

a requesting computer having a prover agent, for requesting access to the computer network,

wherein the prover agent of the requesting computer and one of the authentication agents of the two or more computers engaging in a zero-knowledge authentication protocol, and wherein the requesting computer operates with an authentication agent on the computer network when the requesting computer is authenticated through the zero-knowledge authentication protocol.

6. The system of claim 5, further comprising a trusted source for periodically generating a new secret for the authentication agents of computers on the network.

7. The system of claim 5, the requesting computer comprising a cell phone.

8. The system of claim 7, wherein the cell phone is authenticated without transmitting the secret to or from the cell phone.

9. A software product comprising instructions, stored on computer-readable media, wherein the instructions, when executed by a computer, perform steps for non-centralized zero-knowledge authentication for a computer network, comprising:

instructions for establishing a first computer having a first authentication agent and a first prover agent on the computer network;

instructions for detecting a first authentication request over the computer network from a second computer having a second prover agent;

instructions for authenticating the second prover agent through a zero-knowledge identification protocol; and

instructions for promoting the second computer with a second authentication agent to perform authentication for the computer network.