Encryption and authentication systems and methods

• US 8,893,264 B2
• Filed: 03/29/2013
• Issued: 11/18/2014
• Est. Priority Date: 03/05/2001
• Status: Active Grant

• Current Assignee: Kioba Processing, LLC (IP Investments Group LLC)
• Original Assignee: Bolique Applications Ltd LLC (Intellectual Ventures LLC)
• Inventors: Suominen, Edwin A.
• Primary Examiner(s): Dinh, Minh
• Application Number:
  US13/853,799
• Publication Number:
  US 20130239208A1
• Time in Patent Office: 599 Days
• Field of Search: None
• US Class Current: 726/19
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

Methods, apparatus, and systems are disclosed for, among other things, secure passphrase handling for computing devices. In one respect, a method is provided. The method includes receiving a plurality of passphrase elements from an input device. The method also includes performing a sequence of secure delay processing operations, each operation generating a delayed output value from an initial value. The passphrase is verified upon completion of the sequence of secure delay processing operations. Further, initial values of respective secure delay processing operations are based on respective passphrase elements and, for each secure delay processing operation after a first secure delay processing operation, a delayed output value from at least one other secure delay processing operations.

Claims

1. A method of receiving user input of a passphrase on a computing device, the method comprising:

receiving, by the computing device, a plurality of passphrase elements from an input device; and

performing, by the computing device, a sequence of secure delay processing operations, each operation generating a delayed output value from an initial value, said performing of the sequence of secure delay processing operations beginning before all of the plurality of passphrase elements have been received from the input device,

wherein the passphrase is verified upon completion of the sequence of secure delay processing operations, and

wherein initial values of respective secure delay processing operations are based on;

respective passphrase elements, and

for each secure delay processing operation after a first secure delay processing operation, a delayed output value from at least one other secure delay processing operation.

2. The method of claim 1, wherein the plurality of passphrase elements comprises alphanumeric characters.

3. The method of claim 2, wherein the plurality of passphrase elements further comprises one or more space characters.

4. The method of claim 1, wherein receiving the plurality of passphrase elements comprises receiving keystrokes via a keyboard.

5. The method of claim 1, wherein receiving the plurality of passphrase elements comprises receiving selections of graphical indicia.

6. The method of claim 1, wherein the secure delay processing operations include:

performing a plurality of hash operations to generate the delayed output, wherein each hash operation produces a hash code and wherein each hash operation subsequent to an initial hash operation performs a hash on the hash code of a preceding hash operation.

7. The method of claim 6, further comprising computing a sub-hash from the delayed output by performing a sub-hash operation on the delayed output.

8. The method of claim 7, further comprising:

repeating said receiving and performing for a plurality of iterations; and

transmitting the sub-hash of each iteration to the input device, the sub-hash formatted for visual display by the input device, wherein the initial hash operation for each successive iteration performs a hash on the hash code on the delayed output of a previous iteration, whereby the sub-hashes are visually comparable as they are computed.

9. The method of claim 1, wherein the delayed output value comprises a value which is computationally infeasible to predict for a specified quantity of computing resources, and wherein the delayed output value comprises a value which is deterministic based on the initial value.

10. A secure computing device comprising:

a receiver configured to receive a plurality of passphrase elements from an input device; and

a processor configured to perform a sequence of secure delay processing operations comprising, in response to receiving from a user of the input device each individual passphrase element of the plurality of passphrase elements, generating a delayed output value from an initial value,

wherein the passphrase is verified upon completion of the sequence of secure delay processing operations, and

wherein initial values of respective secure delay processing operations are based on;

respective passphrase elements, and

for each secure delay processing operation after a first secure delay processing operation, a delayed output value from at least one other secure delay processing operation.

11. The device of claim 10, wherein the plurality of passphrase elements comprises alphanumeric characters.

12. The device of claim 11, wherein the plurality of passphrase elements further comprises one or more space characters.

13. The device of claim 10, wherein receiving the plurality of passphrase elements comprises receiving keystrokes via a keyboard.

14. The device of claim 10, wherein receiving the plurality of passphrase elements comprises receiving selections of graphical indicia.

15. The device of claim 10, wherein the secure delay processing operations include:

performing a plurality of hash operations to generate the delayed output, wherein each hash operation produces a hash code and wherein each hash operation subsequent to an initial hash operation performs a hash on the hash code of a preceding hash operation.

16. The device of claim 15, further comprising computing a sub-hash from the delayed output by performing a sub-hash operation on the delayed output.

17. The device of claim 16, further comprising:

repeating said receiving and performing for a plurality of iterations; and

transmitting the sub-hash of each iteration to the input device, the sub-hash formatted for visual display by the input device, wherein the initial hash operation for each successive iteration performs a hash on the hash code on the delayed output of a previous iteration, whereby the sub-hashes are visually comparable as they are computed.

18. The device of claim 10, wherein the delayed output value comprises a value which is computationally infeasible to predict for a specified quantity of computing resources, and wherein the delayed output value comprises a value which is deterministic based on the initial value.

19. A non-transitory computer-readable storage medium including instructions executable by a processor of a device, the instructions causing the device to:

receive a plurality of passphrase elements from an input device; and

perform a sequence of secure delay processing operations, each operation generating a delayed output value from an initial value, said performing of the sequence of secure delay processing operations beginning in response to receipt of a first passphrase element of the plurality of passphrase elements from the input device;

wherein the passphrase is verified upon completion of the sequence of secure delay processing operations, and

wherein initial values of respective secure delay processing operations are based on;

respective passphrase elements, and

for each secure delay processing operation after a first secure delay processing operation, a delayed output value from at least one other secure delay processing operation.