Identity Verification Using Key Pairs

• US 20160013942A1
• Filed: 09/22/2015
• Published: 01/14/2016
• Est. Priority Date: 11/20/2013
• Status: Active Grant

• Current Assignee: Workday Incorporated
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Nocera, Andrew
• Granted Patent: US 9,893,891 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06F 2221/2117 User registration
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 9/006 involving public key infrastructure [PKI] trust models network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

User identity is verified as a user migrates among different devices. When the user migrates from a device to a different device, key pairs may be generated. If the key pairs validate, the user may be verified to the different device.

Claims

1. A method, comprising:

receiving, by a server, an electronic login request associated with a user of a first device;

generating, by the server, a first key pair in response to the electronic login request associated with the first device, the first key pair associated with an identity of the user;

receiving, by the server, an electronic user identification request associated with a second device, the electronic user identification request seeking verification of the identity purported to be the user accessing the second device using a second key pair;

retrieving, by the server, the first key pair; and

verifying, by the server, the identity of the user accessing the second device based on the first key pair.

2. The method of claim 1, further comprising sending the first key pair to a network address associated with the first device.

3. The method of claim 1, further comprising querying the first device for the first key pair.

4. The method of claim 1, further comprising receiving the second key pair.

5. The method of claim 1, further comprising comparing the first key pair to the second key pair.

6. The method of claim 1, further comprising determining a match between the first key pair and the second key pair.

7. The method of claim 1, further comprising determining a private key of the first key pair, the private key only accessible to the server.

8. A system, comprising:

a processor; and

a memory storing code that when executed causes the processor to perform operations, the operations comprising;

receiving an electronic login request associated with a user of a first device;

generating a first key pair in response to the electronic login request associated with the first device, the first key pair associated with an identity of the user;

receiving an electronic user identification request associated with a second device, the electronic user identification request seeking verification of the identity purported to be the user accessing the second device using a second key pair;

retrieving the first key pair; and

verifying the identity of the user accessing the second device based on the first key pair.

9. The system of claim 8, wherein the operations further comprise sending the first key pair to a network address associated with the first device.

10. The system of claim 8, wherein the operations further comprise querying the first device for the first key pair.

11. The system of claim 8, wherein the operations further comprise receiving the second key pair.

12. The system of claim 8, wherein the operations further comprise comparing the first key pair to the second key pair.

13. The system of claim 8, wherein the operations further comprise determining a match between the first key pair and the second key pair.

14. The system of claim 8, wherein the operations further comprise determining a private key of the first key pair, the private key only accessible to the system.

15. A memory device storing instructions that when executed cause a processor to perform operations, the operations comprising:

receiving an electronic login request associated with a user of a first device;

generating a first key pair in response to the electronic login request associated with the first device, the first key pair associated with an identity of the user;

receiving an electronic user identification request associated with a second device, the electronic user identification request seeking verification of the identity purported to be the user accessing the second device using a second key pair;

retrieving the first key pair; and

verifying the identity of the user accessing the second device based on the first key pair.

16. The memory device of claim 15, wherein the operations further comprise sending the first key pair to a network address associated with the first device.

17. The memory device of claim 15, wherein the operations further comprise querying the first device for the first key pair.

18. The memory device of claim 15, wherein the operations further comprise receiving the second key pair.

19. The memory device of claim 15, wherein the operations further comprise comparing the first key pair to the second key pair.

20. The memory device of claim 15, wherein the operations further comprise determining a match between the first key pair and the second key pair.