ENHANCED SECURITY FOR REGISTRATION OF AUTHENTICATION DEVICES

• US 20170048218A1
• Filed: 05/02/2014
• Published: 02/16/2017
• Est. Priority Date: 05/02/2014
• Status: Active Grant

• Current Assignee: Nok Nok Labs Incorporated
• Original Assignee: Nok Nok Labs Incorporated
• Inventors: Lindemann, Rolf
• Granted Patent: US 9,577,999 B1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06Q 20/12 specially adapted for electronic shopping systems
• CPC Class Codes: G06Q 20/3823 combining multiple encryption tools for a transaction
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 69/14 Multichannel or multilink protocols
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A system, apparatus, method, and machine readable medium are described for enhanced security during registration. For example, one embodiment of a method comprises: receiving a request at a relying party to register an authenticator; sending a code from the user to the relying party through an authenticated out-of-band communication channel; and verifying the identity of the user using the code and responsively registering the authenticator in response to a positive verification.

Claims

1. A method comprising:

receiving a request at a relying party from a user to register an authenticator;

sending a code from the user to the relying party through an authenticated out-of-band communication channel; and

verifying the identity of the user using the code and responsively registering the authenticator with the relying party in response to a positive verification.

2. The method as in claim 1 wherein the verifying the code further comprises:

performing a secure transaction confirmation operation including displaying the code in a secure display of the user'"'"'s authenticator and asking the user to send the code displayed on the secure display over the authenticated out-of-band communication channel.

3. The method as in claim 1 wherein the code is a secret code generated by the user'"'"'s authenticator.

4. The method as in claim 1 further comprising:

in response to the request to register the authenticator, generating a public key associated with the authenticator and transmitting the public key to the relying party.

5. The method as in claim 4 further comprising:

generating the code by performing a hash operation on the public key.

6. The method as in claim 5 wherein the hash operation comprises an SHA-256, SHA-1, or SHA-3 hash operation.

7. The method as in claim 1 wherein the out-of-band communication channel comprises postal mail, electronic mail, or a short message service (SMS) message.

8. The method as in claim 2 wherein performing a secure transaction confirmation operation further comprises:

displaying an identification code related to an account of the user associated with the relying party.

9. The method as in claim 1 wherein the code is extracted from an electronic message authenticated/signed using an electronic identification certificate of the user.

10. The method as in claim 2 wherein content displayed within the secure display is protected by generating a hash over the content and providing the resulting hash value to the relying party, the relying party confirming the validity of the content by validating the hash value.

11. A method comprising:

receiving at a relying party a request from a user to register an authenticator;

generating a code by the authenticator;

securely providing the code to the user;

sending the code to the relying party from the user over an authenticated out-of-band communication channel; and

verifying the identity of the user using the code and responsively registering the authenticator in response to a positive verification.

12. The method as in claim 11 wherein securely providing the code to the user comprises:

performing a secure transaction confirmation operation including displaying the code in a secure display of the user'"'"'s authenticator.

13. The method as in claim 11 further comprising:

in response to the request to register the authenticator, generating a public key associated with the authenticator and transmitting the public key to the relying party.

14. The method as in claim 13 further comprising:

generating the code by performing a hash operation on the public key.

15. The method as in claim 14 wherein the hash operation comprises an SHA-256, SHA-1, or SHA-3 hash operation.

16. The method as in claim 11 wherein the out-of-band communication channel comprises postal mail, electronic mail, or a short message service (SMS) message.

17. The method as in claim 12 wherein performing a secure transaction confirmation operation further comprises:

displaying an identification code related to an account of the user associated with the relying party.

18. The method as in claim 11 wherein the code is extracted from an electronic message authenticated/signed by the electronic identification certificate of the user.

19. The method as in claim 12 wherein content displayed within the secure display is protected by generating a hash over the content and providing the resulting hash value to the relying party, the relying party confirming the validity of the content by validating the hash value.

20. A method comprising:

receiving a request at a relying party from a user to register an authenticator, the request including identification information identifying existing credentials of the user;

creating an authentication object at a client of the user, the authentication object including a signature generated using a private key associated with the existing credentials of the user; and

verifying the signature at the relying party and responsively registering the authenticator in response to a positive verification.

21. The method as in claim 20 further comprising:

generating a public/private key pair associated with the authenticator; and

sending the public key to the relying party.

22. The method as in claim 21 wherein the authentication object comprises an identification code associated with the user'"'"'s account at the relying party, a hash of the public key generated with the private key, and the signature generated with the private key.

23. The method as in claim 22 wherein verifying the signature comprises comparing the public key hash extracted from the object with the hash value computed on the public key received during registration from the user.