System and method for securing a credential via user and server verification

• US 8,689,290 B2
• Filed: 02/06/2012
• Issued: 04/01/2014
• Est. Priority Date: 12/31/2005
• Status: Active Grant

• Current Assignee: NXP B.V. (NXP Semiconductors NV)
• Original Assignee: Broadcom Corporation (Broadcom, Inc.)
• Inventors: Buer, Mark
• Primary Examiner(s): Song, Hosuk
• Application Number:
  US13/367,293
• Publication Number:
  US 20120137128A1
• Time in Patent Office: 785 Days
• Field of Search: 713/150, 713/156, 713168-173, 713/175, 713181-183, 713/185, 726 2- 5, 726 9- 10, 726 17- 21, 380/270, 705/50, 705 64- 67, 705 75- 76
• US Class Current: 726/2
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

Systems and methods for securing a credential generated by or stored in an authentication token during an attempt to access a service, application, or resource are provided. A secure processor receives a credential from an authentication token and securely stores the credential. The secure processor then verifies the identity of the individual attempting to use the authentication token and cryptographically verifies the identity of the server being accessed. The credential is only released for transmission to the server if both the identity of the individual and the identity of the server are successfully verified. Alternatively, a secure connection is established between the secure processor and the server being accessed and a secure connection is established between the secure processor and a computing device. The establishment of the secure connections verifies the identity of the server. After the secure connections are established, the identity of the user is verified.

Claims

1. A method for securing a credential during an attempt to access a network service, comprising:

receiving a credential from an authentication token at a secure processor using near field communication (NFC);

storing the credential in the secure processor;

authenticating an entity presenting the authentication token;

cryptographically authenticating a device associated with the network service; and

releasing the credential to the device if the entity is successfully authenticated and the device is successfully authenticated.

2. The method of claim 1, wherein receiving the credential includes:

receiving a transaction identifier from the authentication token at the secure processor wherein the transaction identifier includes a monotonically increasing value that corresponds to each transaction entered into by the authentication token.

3. The method of claim 1, wherein authenticating the entity includes:

receiving authentication data for the entity.

4. The method of claim 3, wherein the authentication data for the entity includes a password.

5. The method of claim 3, wherein the authentication data for the entity includes a shared secret.

6. The method of claim 3, wherein the authentication data for the entity includes a biometric template of an individual.

7. The method of claim 1, wherein the cryptographically authenticating includes:

receiving a message including a digital certificate of the device, wherein digital certificate includes a digital signature; and

authenticating the received digital certificate by authenticating the digital signature with a public key of the device.

8. The method of claim 1, wherein cryptographically authenticating includes:

transmitting a random value as a challenge to the device;

receiving a digital signature from the device, wherein the digital signature is a hash value encrypted using a private key of the device and the hash value includes a hash of a device identifier and the random value;

decrypting the digital signature with a public key of the device to obtain the hash value;

generating a hash value including a hash of the device identifier and the random value; and

comparing the decrypted hash value and the generated hash value.

9. The method of claim 1, wherein cryptographically authenticating includes:

transmitting a client hello message to the device, wherein the client hello message includes a listing of cryptographic algorithms supported by the secure processor;

receiving a server hello message in response to the client hello message, wherein the server hello message includes a selection of a cryptographic algorithm from the listing of cryptographic algorithms in the client hello message;

receiving a digital certificate from the device;

validating the digital certificate of the device; and

transmitting a client key exchange message to the device, wherein the client exchange message sets a premaster secret to be used for communication between the device and the secure processor.

10. A method for securing a credential during an attempt to access a network service, comprising:

establishing a secure connection between the secure processor and a computing device;

receiving, in the secure processor, a credential from an authentication token via near field communication (NFC);

receiving, in the secure processor, authentication data from the computing device via the secure connection; and

verifying, in the secure processor, the identity of an entity using the authentication data and cryptographically verifying a server hosting the network service prior to releasing the credential for transmission to the server.

11. The method of claim 10, wherein the receiving includes:

storing, in the secure processor, the credential received from the authentication token.

12. The method of claim 10, wherein the receiving of the credential includes:

receiving a transaction identifier from the authentication token that includes a monotonically increasing value that corresponds to each transaction entered into by the authentication token.

13. The method of claim 10, wherein the authentication data includes a password.

14. The method of claim 10, wherein the authentication data includes a shared secret.

15. The method of claim 10, wherein the authentication data includes a biometric template of the individual.

16. A system for securing a credential during an attempt to access a network service, comprising:

a secure processor configured to;

receive a credential from an authentication token using near field communication (NFC),

authenticate an entity associated with the authentication token;

cryptographically authenticate a server associated with the network service; and

release the credential to the server if the entity is successfully authenticated and the server is successfully authenticated; and

a secure memory configured to store the credential.

17. The system of claim 16, wherein the credential is a transaction identifier from the authentication token that includes a monotonically increasing value that corresponds to each transaction entered into by the authentication token.

18. The system of claim 16, wherein the secure processor is further configured to receive authentication data for the entity.

19. The system of claim 16, wherein the authentication data includes a password.

20. The system of claim 16, wherein the authentication data includes a biometric template of the an individual.