Multi-factor authentication system

• US 7,373,515 B2
• Filed: 10/09/2001
• Issued: 05/13/2008
• Est. Priority Date: 10/09/2001
• Status: Expired due to Term

• Current Assignee: Karetek Holdings LLC (IP Edge LLC)
• Original Assignee: Wireless Key Identification Systems Incorporated
• Inventors: Shoemaker, Eric, Owen, William N.
• Primary Examiner(s): Peeso, Thomas R
• Application Number:
  US10/491,949
• Publication Number:
  US 20040187018A1
• Time in Patent Office: 2,408 Days
• Field of Search: 713/182, 713/184, 713/193
• US Class Current: 713/182
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/42 using separate channels for security data
• CPC Class Codes: G06F 21/43 wireless channels
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

A suspect user (110) seeks access to a network resource from an access authority (150) utilizing a passcode received from an authentication authority (130). Initially, an ID of a device is bound with a PIN, the device ID is bound with a private key of the device, and the device ID is bound with a user ID that has been previously bound with a password of an authorized user. The device ID is bound with the user ID by authenticating the user ID using the password. Thereafter, the suspect user communicates the device ID and the PIN from the device over an ancillary communications network (112); the authentication authority responds back over the ancillary communications network with a passcode encrypted with the public key of the device; and the suspect user decrypts and communicates over a communications network (114) the passcode with the user ID to the access authority.

Claims

1. In a system wherein both a PIN of a user authorized to access a network resource and a first key of an asymmetric key pair of the authorized user are maintained in association with a first primary identification by an authentication authority such that each of the PIN and the first key are retrievable based on the first primary identification, a method performed by the authentication authority whereby the authorized user gains access to the network resource from an access authority with a passcode, the method comprising the steps of:

(a) receiving the first primary identification and a suspect PIN from a suspect user;

(b) authenticating the first primary identification by considering at least one authentication factor, including comparing the suspect PIN with the PIN of the authorized user maintained in association with the first primary identification by the authentication authority; and

(c) following a successful authentication of the first primary identification,

(i) generating the passcode,

(ii) encrypting the passcode using the first key of the asymmetric key pair of the authorized user, and

(iii) communicating the encrypted passcode to the suspect user for subsequent decryption and presentation to the access authority.

2. Computer-readable medium having computer-executable instructions that perform a method comprising the steps of:

(a) maintaining a PIN of an authorized user of a network resource and a first key of an asymmetric key pair of the authorized user in association with a primary identification such that each of the PIN and the first key are retrievable based on the primary identification;

(b) retrieving the PIN of the authorized user based on the primary identification received over an ancillary communications network and comparing the retrieved PIN with a suspect PIN also received over the ancillary communications network with the primary identification;

(c) generating a passcode and encrypting the passcode using the first key of the asymmetric key pair of the authorized user for communicating back over the ancillary communications network;

(d) maintaining the passcode in association with a secondary identification such that the passcode is retrievable based on the secondary identification; and

(e) retrieving the generated passcode based on the secondary identification that is received and comparing the retrieved passcode with a suspect passcode also received with the secondary identification.

3. In a system wherein both a PIN of a user authorized to access a network resource and a first key of an asymmetric key pair generally unique to a personal communications device of the authorized user are maintained by an authentication authority in association with an identifier such that each of the PIN and the first key are retrievable based on the identifier, a method performed by the authentication authority whereby the authorized user gains access to the network resource from an access authority, the method comprising the steps of:

(a) with respect to a suspect user seeking to gain access to the network resource from the access authority, receiving a challenge request from the access authority in association with an identifier;

(b) in response to the challenge request, communicating a challenge to the access authority;

(c) receiving from the access authority a challenge response and the identifier; and

(d) authenticating the identifier by comparing the challenge response to a function of,

(i) the challenge;

(ii) the PIN maintained by the authentication authority in association with the identifier; and

(iii) the first key maintained by the authentication authority in association with the identifier.

4. A method for gaining access by a user to a network resource, comprising the steps of:

(a) communicating a PIN and a first primary identification over an ancillary communications network to an authentication authority;

(b) receiving an encrypted passcode over the ancillary communications network from the authentication authority;

(c) decrypting the passcode using a key of an asymmetric key pair; and

(d) communicating the passcode and a user ID over a communications network to an access authority.

5. Computer-readable medium having computer-executable instructions that perform a method comprising the steps of:

(a) generating an asymmetric key pair generally unique to a domain ID;

(b) communicating a first key of the asymmetric key pair in association with a device ID to an authentication authority over an ancillary communications network;

(c) receiving a PIN from a user through user-input of the device;

(d) communicating the PIN and a first primary identification over the ancillary communications network to the authentication authority;

(e) receiving an encrypted passcode over the ancillary communications network from the authentication authority;

(f) decrypting the passcode using the second key of the asymmetric key pair; and

(g) displaying the passcode to the user.

6. The computer-readable medium of claim 5, wherein the first primary identification comprises the device ID and the domain ID.

7. The computer-readable medium of claim 5, wherein the method includes the further steps of:

(a) generating a second asymmetric key pair generally unique to a second domain ID;

(b) communicating a first key of the second asymmetric key pair in association with the device ID to the authentication authority over the ancillary communications network;

(c) receiving a second PIN from a user through user-input of the device;

(d) communicating the second PIN and a second primary identification over the ancillary communications network to the authentication authority;

(e) receiving an encrypted second passcode over the ancillary communications network from the authentication authority;

(f) decrypting the second passcode using the second key of the second asymmetric key pair; and

(g) displaying the second passcode to the user.

8. The computer-readable medium of claim 7, wherein the second primary identification comprises the device ID and the second domain ID.

9. Computer-readable medium having computer-executable instructions that perform a method comprising the steps of, during registration of an authorized user with respect to a network resource:

(a) generating a first asymmetric key pair generally unique to a domain ID;

(b) communicating a first key of the first asymmetric key pair in association with a device ID of a device to an authentication authority over an ancillary communications network;

(c) receiving a first key of an asymmetric key pair of the authentication authority over the ancillary communications network;

(d) receiving a PIN from a user through user-input of the device;

(e) encrypting the PIN using the fist key of the asymmetric key pair of the authentication authority;

(f) communicating the encrypted PIN over the ancillary communications network to the authentication authority in association with the device ID;

(g) receiving an encrypted registration code over the ancillary communications network from the authentication authority;

(h) decrypting the registration code using the second key of the first asymmetric key pair; and

(i) displaying the registration code to the user.

10. The computer-readable medium of claim 9, wherein the method further comprises the steps of, following registration of the authorized user:

(a) receiving a suspect PIN from a suspect user through the user-input of the device;

(b) communicating the suspect PIN and a first primary identification over the ancillary communications network to the authentication authority;

(c) receiving an encrypted passcode over the ancillary communications network from the authentication authority;

(d) decrypting the passcode using the second key of the first asymmetric key pair; and

(e) displaying the passcode to the suspect user.

11. The computer-readable medium of claim 10, wherein the first primary identification comprises the device ID and the domain ID.

12. The computer-readable medium of claim 9, wherein the method further comprises the steps of, during registration of the authorized user with respect to a second network resource:

(a) generating a second asymmetric key pair generally unique to a second domain ID;

(b) communicating a first key of the second asymmetric key pair in association with the device ID to the authentication authority over the ancillary communications network;

(c) receiving a first key of a second asymmetric key pair of the authentication authority over the ancillary communications network;

(d) receiving a second PIN from the user through user-input of the device;

(e) encrypting the second PIN using the fist key of the second asymmetric key pair of the authentication authority;

(f) communicating the encrypted PIN over the ancillary communications network to the authentication authority in association with the device ID;

(g) receiving an encrypted second registration code over the ancillary communications network from the authentication authority;

(h) decrypting the second registration code using the second key of the second asymmetric key pair; and

(i) displaying the second registration code to the user.

13. The computer-readable medium of claim 12, wherein the method further comprises the steps of, following registration of the authorized user with respect to the second network resource:

(a) receiving a suspect second PIN through the user-input of the device;

(b) communicating the suspect second PIN and a second primary identification over the ancillary communications network to the authentication authority;

(c) receiving an encrypted second passcode over the ancillary communications network from the authentication authority;

(d) decrypting the second passcode using the second key of the second asymmetric key pair; and

(e) displaying the second passcode.

14. The computer-readable medium of claim 12, wherein the second primary identification comprises the device ID and the second domain ID.

15. The computer-readable medium of claim 9, wherein the method further comprises the steps of,

(a) during registration of the authorized user, receiving a first key of a secondary asymmetric key pair of the authentication authority over the ancillary communications network;

and

(b) after registration of the authorized user,

(i) receiving a challenge from an access authority from which access to the network resource is sought;

(ii) receiving a suspect PIN from a suspect user through the user-input of the device;

(iii) calculating a challenge response as a function of the challenge, the suspect PIN, and the first key of the secondary key pair of the authentication authority; and

(iv) displaying the challenge response to the suspect user.

16. The method of claim 15, wherein the challenge is received through the user-input of the device.

17. The method of claim 15, wherein the function comprises hashing the challenge, suspect PIN, and first key of the secondary key pair of the authentication authority.

18. A method for registering for access by an authorized user with respect to a network resource, comprising the steps of:

(a) generating a first asymmetric key pair generally unique to a device of the authorized user;

(b) communicating in association with a device ID of the device to an authentication authority over an ancillary communications network both a first key of the first asymmetric key pair and a PIN of the authorized user;

(c) receiving an encrypted registration code over the ancillary communications network from the authentication authority;

(d) decrypting the registration code using the second key of the first asymmetric key pair of the device; and

(e) communicating the registration code to an access authority over a communications network in association with a user ID that identifies the authorized user to the access authority.

19. A system in which an authorized user is registered with an authentication authority for later authenticating of a suspect user seeking to gain access from an access authority to a network resource, comprising the steps of:

(a) generating within a device of the authorized user a first asymmetric key pair of the authorized user that is generally unique to the device, and

(b) communicating with the device a first key of the first asymmetric key pair in association with a device ID of the device to the authentication authority over an ancillary communications network;

(c) by the authentication authority,

(i) receiving and maintaining the first key in association with the device ID, and

(ii) communicating to the device of the authorized user over the ancillary communications network a first key of a first key asymmetric key pair of the authentication authority that is unique to a domain ID;

(d) by the authorized user,

(i) encrypting with the device using the fist key of the asymmetric key pair of the authentication authority a PIN of the authorized user that is entered into the device, and

(ii) communicating the encrypted PIN in association with the device ID to the authentication authority over the ancillary communications network;

(e) by the authentication authority,

(i) decrypting the PIN and maintaining the PIN in association with the device ID and the domain ID,

(ii) encrypting using the first key associated with the device ID a registration code, and

(iii) communicating the registration code to the device of the authorized user over the ancillary communications network;

(f) by the authorized user,

(i) decrypting within the device the encrypted registration code using the second key of the first asymmetric key pair of the authorized user, and

(ii) communicating over a communications network the registration code to an access authority in association with a user ID identifying the authorized user to the access authority; and

(g) comparing the registration code received with the user ID with the registration code encrypted and sent to the authorized user.

20. A method of granting access to a suspect user seeking to access a network resource, comprising the steps of:

(a) first,

(i) maintaining credentials of the authorized user such that the credentials are retrievable based on the user ID,

(ii) receiving a user ID, registration code, and suspect credentials,

(iii) comparing the suspect credentials with the credentials maintained in association with the user ID, and

(iv) upon a successful authentication of the user ID by matching the suspect credentials with the maintained credentials, communicating the user ID and registration code to an authentication authority; and

(b) thereafter, granting access to the network resource to a suspect user upon,

(i) receiving a user ID and passcode from the suspect user,

(ii) communicating the user ID and passcode to the authentication authority, and

(iii) receiving an indication of a successful passcode comparison by the authentication authority.

21. A method of upgrading a single-factor authentication system to a multi-factor authentication system wherein a suspect user seeks access to a network resource, the single-factor authentication system including the binding of a user ID with credentials of an authorized user, the method comprising the steps of:

(a) initially,

(i) binding a device ID of a device with a PIN,

(ii) binding the device ID with a private key of the device, and

(iii) binding the device ID with the user ID, including authenticating the user ID with the credentials; and

(b) thereafter,

(i) authenticating the device ID including, as part thereof, communicating from the device the device ID and the PIN over an ancillary communications network,

(ii) authenticating the device including, as part thereof, communicating to the device a passcode encrypted with the public key corresponding to the device private key and decrypting the passcode using the device private key, and

(iii) communicating the unencrypted passcode over a communications network with the user ID.