PROXY AUTHENTICATION NETWORK

• US 20110289314A1
• Filed: 08/03/2011
• Published: 11/24/2011
• Est. Priority Date: 06/13/2005
• Status: Active Grant

• Current Assignee: Iamsecureonline Incorporated
• Original Assignee: Iamsecureonline Incorporated
• Inventors: Whitcomb, Michael
• Granted Patent: US 8,856,891 B2
• Time in Patent Office: Days
• US Class Current: 713/155
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations network architectures or network communication protocols using hop-by-hop encryption H04L63/0464
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority

Abstract

A Proxy Authentication Network includes a server that stores credentials for subscribers, along with combinations of devices and locations from which individual subscribers want to be authenticated. Data is stored in storage: the storage can be selected by the subscriber. The data stored in the storage, which can be personally identifiable information, can be stored in an encrypted form. The key used to encrypt such data can be divided between the storage and server. In addition, third parties can store portions of the encrypting key. Subscribers can be authenticated using their credentials from recognized device/location combinations; out-of-band authentication supports authenticating subscribers from other locations. Once authenticated, a party can request that the encrypted data be released. The portions of the key are then assembled at the storage. The storage then decrypts the data, generates a new key, and re-encrypts the data for transmission to the requester.

Claims

1. A system for performing a transaction, comprising:

a first storage to store first personally identifiable information for a first subscriber, the first personally identifiable information not including a certificate, where the first storage is managed by a first party;

a second storage to store second personally identifiable information for a second subscriber, the second personally identifiable information not including a certificate;

a server storing a first credential for the first subscriber and a second credential for the second subscriber, neither the first credential nor the second credential including a certificate, where the server is managed by a second party that is different from the first party and the first credential and the second credential each have a state;

an authenticator to authenticate the first subscriber using the first credential and the second subscriber using the second credential; and

a receipt generator to generate a receipt that identifies the first subscriber and the second subscriber without providing the personally identifiable information about the first subscriber and the second subscriber.

2. A system according to claim 1, wherein the server stores a first list of combinations of devices and locations recognized by the server for authenticating the first subscriber and a second list of combinations of devices and locations recognized by the server for authenticating the second subscriber.

3. A system according to claim 1, wherein the authenticator supports out-of-band authentication of the first subscriber and the second subscriber.

4. A system according to claim 3, further comprising a manual out-of-band authenticator to manually authenticate the first subscriber using the first credential and the second subscriber using the second credential.

5. A system according to claim 1, further comprising a state setter to change the states of the first credential and the second credential.

6. A system according to claim 5, wherein the state setter is operative to change the state of the first credential to disable the first credential responsive to a request by the first subscriber.

7. A system according to claim 6, wherein the state setter is operative to change the state of the first credential to enable the first credential responsive to a request by the first subscriber.

8. A system according to claim 5, wherein the state setter is operative to set the states of the first credential and the second credential to “

in use”

after the first subscriber and the second subscriber are authenticated by the authenticator.

9. A system according to claim 5, wherein the state setter is operative to set the states of the first credential and the second credential to “

not in use”

after the transaction is completed.

10. A system according to claim 5, wherein the authenticator is operative to verify that the state of the first credential is “

not in use” and

the state of the second credential is “

not in use”

.

11. A system according to claim 1, wherein the first storage stores the first personally identifiable information as an encrypted data encrypted using a key.

12. A system according to claim 11, wherein:

the first storage stores a first portion of the key; and

the server stores a second portion of the key.

13. A system according to claim 12, wherein a trusted third party stores a third portion of the key, where the trust third party is different from both the first party and the second party.

14. A system according to claim 11, wherein the first storage includes:

a receiver to receive at least the second portion of the key from the server;

a key assembler to assemble the key from the first portion and the second portion;

a decrypter to decrypt the encrypted data;

a key generator to generate a new key based on the receipt and on other data;

an encrypter to encrypt the decrypted data using the new key; and

a transmitter to transmit the encrypted identity and the other data to a requester.

15. A system according to claim 14, wherein:

the receiver is operative to receive a third portion of the key from a trusted third party; and

the key assembler is operative to assemble the key from the first portion, the second portion, and the third portion.

16. A system according to claim 1, wherein the server includes the authenticator and the receipt generator.

17. A system according to claim 1, wherein the first storage includes the second storage.

18. A system according to claim 1, further comprising a third storage, the third storage including:

a third data for the first subscriber, the third data encrypted using a key;

a first portion of the key;

a receiver to receive at least a second portion of the key from the server;

a key assembler to assemble the key from the first portion and the second portion;

a decrypter to decrypt the encrypted data;

a key generator to generate a new key based on the receipt and on other data;

an encrypter to encrypt the decrypted data using the new key; and

a transmitter to transmit the encrypted identity and the other data to a requester.

19. A method for a first subscriber and a second subscriber to perform a transaction using a server, comprising:

registering the first subscriber;

registering the second subscriber;

receiving a first credential from the first subscriber, the first credential including a state and not including a certificate;

receiving a second credential from the second subscriber, the second credential including a state and not including a certificate;

authenticating the first subscriber using the first credential;

authenticating the second subscriber using the second credential; and

providing the first subscriber and the second subscriber with a receipt, the receipt identifying the first subscriber and the second subscriber without providing personally identifiable information about the first subscriber and the second subscriber.

20. A method according to claim 19, further comprising providing the first subscriber and the second subscriber with a communications channel.

21. A method according to claim 19, wherein authenticating the first subscriber includes verifying that the first credential is being provided from a device at a location, both the device and the location recognized by the server.

22. A method according to claim 21, wherein authenticating the first subscriber further includes:

performing an out-of-band authentication of the first subscriber if the device or location is not recognized by the server; and

automatically updating the server to recognize the device at the location for the first credential if the out-of-band authentication is successful.

23. A method according to claim 21, wherein authenticating the first subscriber further includes setting the state of the first credential to “

in use”

.

24. A method according to claim 23, further comprising setting the state of the first credential to “

not in use”

after a period of time.

25. A method according to claim 23, further comprising setting the state of the first credential to “

not in use”

responsive to completing the transaction.

26. A method according to claim 21, wherein authenticating the first subscriber further includes verifying that the state of the first credential is “

not in use”

.

27. A method according to claim 19, wherein registering the first subscriber includes:

storing data for the first subscriber in a storage selected by the first subscriber;

encrypting the data stored in the storage using a key; and

dividing the key among at least the storage and the server.

28. A method according to claim 27, wherein dividing the key includes dividing the key among at least the storage, the server, and a trusted third party, where the storage is managed by a first party, the server is managed by a second party, and the first party, the second party, and the trusted third party are all different from each other.

29. A method according to claim 27, further comprising providing the part of the key stored at the server to the storage responsive to a request from the first subscriber.

30. A method according to claim 29, wherein providing the part of the key stored at the server includes transmitting the part of the key stored at the server in a second receipt.

31. A method according to claim 19, wherein providing the first subscriber and the second subscriber with a receipt includes providing at least one additional party to the transaction with the receipt.

32. A method for releasing data stored in a storage encrypted by a key, comprising:

receiving a receipt of identity from a server;

receiving a first portion of the key from the server;

accessing a second portion of the key from the storage;

assembling the key from at least the first portion and the second portion;

decrypting the data;

generating a new key based in part on the receipt of identity from the server and in part on other data;

re-encrypting the data using the new key;

transmitting the re-encrypted data to a requester; and

transmitting the other data used in generating the new key to the requester.

33. A method according to claim 32, wherein:

receiving a receipt of identity includes receiving the receipt of identity from the server over a secure channel; and

receiving a first portion of the key includes receiving the first portion of the key from the server over the secure channel.

34. A method according to claim 32, wherein:

transmitting the re-encrypted data to a requester includes transmitting the re-encrypted data to the requester over a secure channel; and

transmitting the other data used in generating the new key includes transmitting the other data used in generating the new key to the requester over the secure channel.

35. A method according to claim 32, wherein:

the method further comprises receiving a third portion of the key from a trusted third party; and

assembling the key includes assembling the key from the first portion, the second portion, and the third portion.