SYSTEM AND METHOD FOR DELEGATING TRUST TO A NEW AUTHENTICATOR

• US 20140289509A1
• Filed: 03/18/2014
• Published: 09/25/2014
• Est. Priority Date: 03/22/2013
• Status: Active Grant

• Current Assignee: Nok Nok Labs Incorporated
• Original Assignee: Nok Nok Labs Incorporated
• Inventors: Baghdasaryan, Davit
• Granted Patent: US 10,268,811 B2
• Time in Patent Office: Days
• US Class Current: 713/155
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06Q 20/204 comprising interface for record bearing medium or carrier for electronic funds transfer or payment credit
• CPC Class Codes: G06Q 20/3224 Transactions dependent on location of M-devices
• CPC Class Codes: G06Q 20/3274 using a pictured code, e.g. barcode or QR-code, being displayed on the M-device
• CPC Class Codes: G06Q 20/3278 RFID or NFC payments by means of M-devices
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: G06Q 20/42 Confirmation, e.g. check or permission by the legal debtor of payment
• CPC Class Codes: G06Q 20/425 using two different networks, one for transaction and one for security confirmation
• CPC Class Codes: G07F 19/20 Automatic teller machines [ATMs]
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/0819 Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) network architectures or network communication protocols for key distribution in a packet data network H04L63/062
• CPC Class Codes: H04L 9/0822 : using key encryption key
• CPC Class Codes: H04L 9/0841 : involving Diffie-Hellman or related key agreement protocols
• CPC Class Codes: H04L 9/3231 : Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3247 : involving digital signatures
• CPC Class Codes: H04L 9/3297 : involving time stamps, e.g. generation of time stamps
• CPC Class Codes: H04W 12/06 : Authentication
• CPC Class Codes: H04W 12/065 : Continuous authentication

Abstract

A system, apparatus, method, and machine readable medium are described for delegating trust to a new client device or a new authenticator on a trusted device. For example, one embodiment of a method comprises: implementing a series of trust delegation operations to transfer registration data associated with one or more trusted authenticators on a trusted client device to one or more new authenticators on a new client device or on the trusted client device.

Claims

1. A method for delegating trust comprising:

implementing a series of trust delegation operations to transfer registration data associated with one or more trusted authenticators on a trusted client device to one or more new authenticators on a new client device or on the trusted client device.

2. The method as in claim 1 wherein the series of trust delegation operations comprises:

communicating with the trusted device to determine a number (N) of keys or key pairs contained in the registration data.

3. The method as in claim 2 further comprising:

generating N keys or key pairs; and

providing the N keys or one of each of the N key pairs to the trusted device or to a trust delegation module executed on the trusted device.

4. The method as in claim 3 further comprising:

signing each of the N keys using a key corresponding to a relying party to be associated with each of the N keys.

5. The method as in claim 4 further comprising:

generating a timestamp and inserting the timestamp into the signature(s) generated by signing each of the N keys.

6. The method as in claim 5 further comprising:

transferring each of the signatures and registration data associated with each relying party to the new client device or the new authenticator on the trusted client device.

7. The method as in claim 6 further comprising:

integrating the registration data and signatures within a local secure database.

8. The method as in claim 7 further comprising:

establishing a connection with a first relying party;

identifying the registration data, one of the N keys, and the corresponding signature in the local secure database; and

performing one or more verification transactions with the relying party using the registration data, key, and signature.

9. The method as in claim 8 wherein at least one of the verification transactions comprises reading the timestamp(s) and determining whether the timestamp is sufficiently new to allow the trust delegation.

10. The method as in claim 9 wherein the verification transactions include transmitting a response to the relying party comprising an attestation over one of the N keys, the signature, and a new a signature generated with the one of the N keys.

11. The method as in claim 10 wherein the attestation over one of the N keys comprises a signature generated over the one of the N keys.

12. The method as in claim 10 wherein the new signature is generated over a challenge sent by the relying party.

13. The method as in claim 10 wherein the response further includes an identification code usable by the relying party to identify locate a trusted key associated with the trusted device.

14. The method as in claim 13 further comprising:

verifying the signature at the relying party using the trusted key.

15. The method as in claim 14 wherein the trusted key comprises a public key associated with the trusted device or trusted authenticator.

16. A system comprising:

one or more trusted authenticators; and

a trust delegation module implementing a series of trust delegation operations to transfer registration data associated with the one or more trusted authenticators on a trusted client device to one or more new authenticators on a new client device or on the trusted client device.

17. The system as in claim 16 wherein the series of trust delegation operations comprises communicating with the trusted device to determine a number (N) of keys or key pairs contained in the registration data.

18. The system as in claim 17 further comprising:

key generation logic generating N keys or key pairs; and

logic to provide the N keys or one of each of the N key pairs to the trusted device or to a trust delegation module executed on the trusted device.

19. The system as in claim 18 further comprising:

a trust delegation module on the trusted device signing each of the N keys using a key corresponding to a relying party to be associated with each of the N keys.

20. The system as in claim 19 further comprising:

the trust delegation module on the trusted device transferring each of the signatures and registration data associated with each relying party to the new client device or the new authenticator on the trusted client device.

21. The system as in claim 20 further comprising:

the trust delegation module integrating the registration data and signatures within a local secure database.

22. The system as in claim 21 wherein the trust delegation module performs the additional operations of:

establishing a connection with a first relying party;

identifying the registration data, one of the N keys, and the corresponding signature in the local secure database; and

performing one or more verification transactions with the relying party using the registration data, key, and signature.

23. The system as in claim 22 wherein the verification transactions include transmitting a response to the relying party comprising an attestation over one of the N keys, the signature, and a new a signature generated with the one of the N keys.

24. The system as in claim 23 wherein the attestation over one of the N keys comprises a signature generated over the one of the N keys.

25. The system as in claim 23 wherein the new signature is generated over a challenge sent by the relying party.

26. The system as in claim 23 wherein the response further includes an identification code usable by the relying party to identify locate a trusted key associated with the trusted device.

27. The system as in claim 26 further comprising:

verification logic to verify the signature at the relying party using the trusted key.

28. The system as in claim 27 wherein the trusted key comprises a public key associated with the trusted device or trusted authenticator.