Shared registration multi-factor authentication tokens

• US 8,769,655 B2
• Filed: 12/30/2010
• Issued: 07/01/2014
• Est. Priority Date: 12/30/2010
• Status: Active Grant

• Current Assignee: VeriSign, Inc.
• Original Assignee: VeriSign, Inc.
• Inventors: Gould, James, Smith, David, Pei, Mingliang
• Primary Examiner(s): Kim, Jung
• Assistant Examiner(s): NGUYEN, NGOC THACH D
• Application Number:
  US12/982,800
• Publication Number:
  US 20120174198A1
• Time in Patent Office: 1,279 Days
• Field of Search: 726/6, 726/9, 726/8, 709/223
• US Class Current: 726/9
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations

Abstract

A system and method for more efficiently establishing a chain of trust from a registrant to a registry. A registrant credential is associated with a Shared Registration command and is sent by a registrar to a registry. Upon successful validation, a token is generated and bound to a registrant identifier. The token is included along with the registrant identifier in subsequent discrete Shared Registration commands submitted to the registry on behalf of the registrant. The registrant thus needs to submit its credential only once for changes that require several discrete commands. Also, it is more efficient for the Shared Registration System to validate a token for a set of commands than to validate different registrant credential for each discrete command.

Claims

1. A method for authentication, the method comprising:

receiving a token create command that includes

a registrant credential identifier requested by a registrant for binding to a registry object, and

a registrant credential, wherein the registrant credential identifier identifies the registrant as being associated with the registrant credential;

obtaining an authentication token that includes the registrant credential identifier and a digital signature that attests the registrant credential is valid;

sending the authentication token;

receiving the authentication token and a transform command associated with the registry object, wherein the transform command includes one or more actions associated with the registry object;

validating the digital signature of the authentication token;

determining, by a processor, that the registrant credential identifier included in the authentication token corresponds to a credential identifier associated with the registry object; and

authorizing the transform command based upon validating the digital signature and determining that the registrant credential identifier included in the authentication token corresponds to the credential identifier.

2. The method of claim 1, wherein obtaining the authentication token comprises:

generating, by a registry, the authentication token.

3. The method of claim 1, wherein the authentication token is generated by a third party authentication service provider.

4. The method of claim 1, the method further comprising:

sending the registrant credential from the registry to an authentication service; and

receiving, from the authentication service, a validation response that indicates that the registrant credential has been successfully verified.

5. The method of claim 4, wherein the registrant credential includes an attribute that specifies the authentication service, the method further comprising:

selecting the authentication service from a plurality of authentication services based upon the attribute of the authentication token.

6. The method of claim 1, wherein the authentication token includes an expiration date.

7. The method of claim 6, the method further comprising:

validating that the expiration date of the authentication token has not passed.

8. The method of claim 7, the method further comprising:

authorizing the transform command based upon validating the expiration date of the authentication token.

9. A method for authentication, the method comprising:

receiving a transform command, associated with a registry object, and an authentication token,

wherein the transform command includes one or more actions, associated with the registry object; and

wherein an authentication token that includes the registrant credential identifier associated with

a registrant credential requested by a registrant for binding to a registry object, and

a digital signature that attests the registrant credential is valid;

validating the digital signature of the authentication token;

determining, by a processor, that the registrant credential identifier corresponds to a credential identifier associated with the registry object; and

authorizing the transform command based upon validating the digital signature and determining that registrant credential identifier corresponds to the registrant credential identifier associated with the registry object.

10. The method of claim 9, wherein the authentication token is generated by a third party authentication service using an authentication service private key and validating the digital signature of the authentication token is based upon an authentication service public key that corresponds to the private key.

11. The method of claim 9, wherein the authentication token includes a validation service attribute.

12. The method of claim 9, wherein the authentication token includes an expiration date.

13. The method of claim 11, the method further comprising:

validating that the expiration date of the authentication token has not passed.

14. A system for authentication, the system comprising:

a receiver device that receives a request to generate an authentication token with a registrant credential and a registrant credential identifier requested by a registrant for binding to a registry object, wherein the registrant credential identifier identifies a registrant as being associated with the registrant credential;

an authentication token generator that causes an authentication token to be created that includes the registrant credential identifier and a digital signature;

a transform command processor that receives a transform command and the authentication token wherein the transform command includes one or more actions, associated with a registry object;

a validation device that validates the digital signature of the authentication token and determines that the registrant credential identifier associated with the authentication token corresponds to a credential identifier associated with the registry object; and

an authorization device that authorizes the transform command processor to process the transform command based upon validating the digital signature and determining that the registrant credential identifier corresponds to the credential identifier.

15. The system of claim 14, wherein the authentication token generator is a third party authentication service.

16. The system of claim 14, wherein the authentication token generator is a registry object registry.

17. A non-transitory, computer-readable storage medium including a plurality of instructions that, when executed by a processor, causes the processor to:

receive a request for an authentication token, the request including a registrant credential and a registrant credential identifier requested by a registrant for binding to a registry object, wherein the registrant credential identifier identities a registrant as being associated with the registrant credential;

cause the authentication token to be obtained, the authentication token including the registrant credential identifier and a digital signature that attests the registrant credential is valid;

receive the authentication token and a transform command associated with a registry object, wherein the transform command includes one or more actions, associated with the registry object;

validate the digital signature of the authentication token;

determine that the registrant credential identifier within the authentication token corresponds to a credential identifier associated with the registry object; and

authorize the transform command based upon verifying the digital signature and determining that the registrant credential identifier corresponds to the credential identifier associated with the registry object.