UBIQUITOUS WEBTOKEN

• US 20110145897A1
• Filed: 12/14/2009
• Published: 06/16/2011
• Est. Priority Date: 12/14/2009
• Status: Active Grant

• Current Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Inventors: TYREE, David S.
• Granted Patent: US 8,341,710 B2
• Time in Patent Office: Days
• US Class Current: 726/6
• CPC Class Codes: G06F 21/42 using separate channels for security data
• CPC Class Codes: G06F 2221/2117 User registration
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user
• CPC Class Codes: H04L 2209/42 Anonymization, e.g. involving pseudonyms
• CPC Class Codes: H04L 9/0866 involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority

Abstract

A first device receives, from a second device, a first request to set up an account, where the first request includes a shared key and information associated with the second device, where the shared key is calculated based on a private key, of a private key/public key pair, and information regarding an identity selection, from user identity information, associated with a user of the second device; and store the shared key in a memory. The first device receives, from the second device, a second request to log in to the account, where the second request includes a first webtoken and information associated with the second device, where the first webtoken is calculated based on the shared key and a first time interval; retrieves the shared key; generates a second webtoken based on the shared key and a second time interval; performs an authentication operation by comparing the first webtoken and the second webtoken; and permits the second device to access the account when the first webtoken matches the second webtoken.

Claims

1. A method, comprising

receiving, by at least one device and from a user device, a first request to set up an account;

receiving, by the at least one device, a shared key, where the shared key is generated based on a private key, of a private key/public key pair corresponding to the user device, information associated with the at least one device, and information regarding an identity selection, from a plurality of user identity information, associated with a user of the user device;

storing, by the at least one device, the shared key in a memory;

receiving, by the at least one device and from the user device, a second request to log in to the account, where the second request includes a first webtoken generated based on the shared key and a first time interval at which the first webtoken is generated;

retrieving, by the at least one device and in response to the second request, the shared key stored in the memory;

generating, by the at least one device, a second webtoken based on the shared key, retrieved from the memory, and a second time interval at which the second webtoken is generated;

comparing, by the at least one device, the second webtoken and the first webtoken;

authenticating, by the at least one device, the user device when the second webtoken matches the first webtoken; and

permitting, by the at least one device, the user device access to the account based on the authentication.

2. The method of claim 1, where generating the second webtoken includes using a cryptographic secure hashing algorithm to calculate the second webtoken based on the shared key and the second time interval, where the second time interval includes a time-of-day clock value and a clock error set for the cryptographic secure hashing algorithm.

3. The method of claim 2, where generating the second webtoken, using the cryptographic secure hashing algorithm, renders derivation, of the shared key, cryptographically infeasible.

4. The method of claim 1, further comprising generating the shared key using a cryptographic public key infrastructure signature algorithm based on the private key, the information associated with the at least one device, and the information regarding the identity selection.

5. The method of claim 4, where generating the shared key, using of the cryptographic public key infrastructure signature algorithm, renders derivation of the private key, of the private key/public key pair, cryptographically infeasible.

6. The method of claim 1, where the information associated with the at least one device includes a domain name associated with the at least one device, and where the information regarding the identity selection includes a numeric value associated with the identity selection from the plurality of user identity information.

7. The method of claim 1, where the shared key is time-invariant and the first webtoken and the second webtoken are time-variant.

8. The method of claim 1, where the information regarding the identity selection includes a numeric value that is based on particular identity information, selected by the user of the user device, from the plurality of user identity information.

9. The method of claim 1, where the first request further includes first information associated with the user device, the method further comprising:

retrieving second information associated with the user device;

comparing the first information and the second information; and

further authenticating the user device when the first information matches the second information.

10. The method of claim 1, further comprising:

generating a third webtoken based on the shared key and a third time interval at which the third webtoken is generated;

sending an identity verification request to another device, where the identity verification request includes the third webtoken, the information associated with the at least one device, and information associated with the user device; and

receiving, from the other device, the identity verification and particular identity information associated with the user of the user device, where the identity verification indicates that the third webtoken corresponds to the particular identity information associated with the user of the user device.

11. A system comprising:

one or more first devices, where at least one of the one or more first devices connects to a second device,

the one or more first devices are to;

receive, from the second device, a first request to set up an account, where the first request includes a shared key and information associated with the second device, where the shared key is calculated based on a private key, of a private key/public key pair, and information regarding an identity selection, from a plurality of user identity information, associated with a user of the second device,

store the shared key in a memory,

receive, from the second device, a second request to log in to the account, where the second request includes a first webtoken and information associated with the second device, where the first webtoken is calculated based on the shared key and a first time interval at which the first webtoken is calculated,

retrieve the shared key, from the memory, in response to the second request,

generate a second webtoken based on the shared key, retrieved from the memory, and a second time interval at which the second webtoken is calculated,

perform an authentication operation by comparing the first webtoken and the second webtoken, and

permit the second device to access the account when the first webtoken matches the second webtoken.

12. The system of claim 11, where at least one of the one or more first devices connects to a third device,

where the one or more first devices are further to:

generate a third webtoken based on the shared key and a third time interval at which the third webtoken is generated,

send, to the third device, an identity verification request that includes the third webtoken, information associated with the one or more first devices, and the information associated with the second device, and

receive, from the third device, an identity verification message that includes identity information associated with the user of the second device, where the identity information is determined based on the information regarding the identity selection.

13. The system of claim 11, where the shared key is unique to a particular website and is further calculated based on a domain name associated with the particular website.

14. The system of claim 11, where the one or more first devices are further to:

store user information associated with the second device,

retrieve, in response to the second request, the stored information, and

perform an additional authentication operation by comparing the stored information and the information associated with second device that is received in the second request.

15. The system of claim 11, where the shared key is calculated using a cryptographic algorithm based on the private key, of the private key/public key pair, a domain name of a particular website, and the information regarding the identity selection, where the cryptographic algorithm renders derivation, of the private key, cryptographically infeasible.

16. The system of claim 11, where the one or more first devices are to:

generate the second webtoken using a cryptographic algorithm based on the shared key and the second time interval, where the cryptographic algorithm renders derivation, of the shared key, cryptographically infeasible.

17. A system comprising:

a first device connected to a user device and a second device,

the first server device is to;

receive, from the user device, a shared key, information associated with the user device, and permission indicators associated with user identity information,

receive, from the second device, a request for an identity verification, where the request includes a first webtoken, information associated with the second device, and information associated with the user device,

retrieve, in response to the request, the shared key and the permission indicators,

generate a second webtoken based on the shared key and a time interval at which the second webtoken is generated,

perform an authentication operation by comparing the first webtoken and the second webtoken,

retrieve identity information, associated with the user of the user device, based on the permission indicators when the first webtoken matches the second webtoken, and

send, to the second device, an identity verification message that includes the retrieved identity information.

18. The system of claim 17, where the first device is further to:

receive, from the user device, a request to register the user device, where the request, to register the user device, includes information associated with the user device and user identity information associated with a user of the user device,

generate, in response to the request, a private key/public key pair corresponding to the user device, and

send a registration message to the user device that includes the private key/public key pair, where the shared key is generated based on the private key/public key pair.

19. The system of claim 18, where the shared key is time-invariant and the first webtoken and the second webtoken are time-variant.

20. The system of claim 18, where the permission indicators identify personal information, selected by a user of the user device, from the user identity information, where the user selects, via the permission indicators, the personal information to be revealed to the second device.