IDENTITY AUTHENTICATION USING CREDENTIALS

• US 20140281498A1
• Filed: 03/14/2013
• Published: 09/18/2014
• Est. Priority Date: 03/14/2013
• Status: Active Grant

• Current Assignee: Comcast Cable Communications LLC (Comcast Corporation)
• Original Assignee: Comcast Cable Communications LLC (Comcast Corporation)
• Inventors: Bransom, Kris, Zarcone, Christopher
• Granted Patent: US 9,787,669 B2
• Time in Patent Office: Days
• US Class Current: 713/156
• CPC Class Codes: H04L 2463/061 applying further key derivation, e.g. deriving traffic keys from a pair-wise master key cryptographic mechanisms or cryptographic arrangements for generation of secret information including derivation or calculation of cryptographic keys or passwords H04L9/0861
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3297 involving time stamps, e.g. generation of time stamps

Abstract

A method and system may allow for authenticating a computing device. A computing device may send an authentication request over a network to an authentication computing device. The authentication request may include a user name and a password. The user name may include a credential and the password may be a digitally signed version of the user name. The authentication computing device may authenticate the requesting computing device by decrypting the password and comparing the received user name to the decrypted password.

Claims

1. A method, comprising:

receiving, from a computing device, a user name and a password, the user name comprising a credential for the computing device and the password being encrypted, wherein the credential comprises a public key for the computing device;

extracting the credential from the user name;

decrypting the password based on the public key; and

authenticating the computing device based on the decrypted password.

2. The method of claim 1, wherein the encrypted password comprises the credential encrypted using a private key for the computing device.

3. The method of claim 1, wherein the credential comprises a digital certificate issued to the computing device from a trusted authority.

4. The method of claim 1, wherein the password comprises the user name that has been digitally signed by the computing device.

5. The method of claim 1, wherein the authenticating the computing device based on the decrypted password further comprises:

converting the received user name to a first format, wherein the first format corresponds with a format for the decrypted password;

comparing the converted user name to the decrypted password; and

authenticating the computing device if the converted user name matches the decrypted password.

6. The method of claim 5, wherein converting the received user name further comprises hashing the received user name.

7. The method of claim 1, wherein authenticating the computing device based on the decrypted password further comprises:

receiving, from the computing device, a time stamp;

verifying the received time stamp.

8. The method of claim 7, wherein verifying the received time stamp further comprises comparing the received time stamp to a time stamp previously stored in association with the computing device and verifying the received time stamp if the previously stored time stamp is chronologically previous in time to the received time stamp.

9. The method of claim 8, wherein verifying the received time stamp if the previously stored time stamp is chronologically previous in time to the received time stamp further comprises determining that a duration between the received time stamp and the previously stored time stamp is greater than a threshold.

10. A method, comprising:

receiving, from a computing device, a user name, a password, and a timestamp, the user name comprising a credential for the computing device and the password being encrypted, wherein the credential comprises a public key for the computing device;

extracting the credential from the user name;

decrypting the password based on the public key;

verifying the received time stamp.

authenticating the computing device based on the decrypted password.

11. The method of claim 10, wherein verifying the received time stamp further comprises comparing the received time stamp to a time stamp previously stored in association with the computing device and verifying the received time stamp if the previously stored time stamp is chronologically previous in time to the received time stamp.

12. The method of claim 11, wherein verifying the received time stamp if the previously stored time stamp is chronologically previous in time to the received time stamp further comprises determining that a duration between the received time stamp and the previously stored time stamp is greater than a threshold.

13. The method of claim 10, wherein the credential comprises a public key for the second computing device, the encrypted password has been encrypted using a private key for the second computing device, and decrypting the password comprises decrypting the password using the public key.

14. The method of claim 10, wherein the credential comprises a digital certificate issued to the second computing device from a trusted authority.

15. The method of claim 10, wherein authenticating the computing device based on the decrypted password further comprises:

converting the received user name to a first format, wherein the first format corresponds with a format for the decrypted password;

comparing the converted user name to the decrypted password; and

authenticating the computing device if the converted user name matches the decrypted password.

16. A method, comprising:

receiving, from a computing device, a user name and a password, the user name comprising a digital certificate for the computing device and the password being encrypted;

extracting the digital certificate from the user name;

decrypting the password based on the digital certificate;

converting the received user name to a first format, wherein the first format corresponds with a format for the decrypted password;

comparing the converted user name to the decrypted password; and

authenticating the computing device if the converted user name matches the decrypted password.

17. The method of claim 16, wherein the encrypted password has been encrypted using a private key for the second computing device, and decrypting the password comprises decrypting the password using a public key for the second computing device.

18. The method of claim 16, wherein authenticating the computing device based on the decrypted second authentication information further comprises:

receiving, from the computing device, a time stamp;

verifying the received time stamp.

19. The method of claim 18, wherein verifying the received time stamp further comprises comparing the received time stamp to a time stamp previously stored in association with the computing device and verifying the received time stamp if the previously stored time stamp is chronologically previous in time to the received time stamp.

20. The method of claim 19, wherein verifying the received time stamp if the previously stored time stamp is chronologically previous in time to the received time stamp further comprises determining that a duration between the received time stamp and the previously stored time stamp is greater than a threshold.