Authentication of PKI credential by use of a one time password and pin

• US 9,780,950 B1
• Filed: 06/14/2013
• Issued: 10/03/2017
• Est. Priority Date: 03/15/2013
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Dundas, Alan, Herskedal, Eirik
• Primary Examiner(s): Pham, Luu
• Assistant Examiner(s): Baum, Ronald
• Application Number:
  US13/918,269
• Time in Patent Office: 1,572 Days
• Field of Search: 713182
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 9/006 involving public key infrastructure [PKI] trust models network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/08 Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords network architectures or network communication protocols for supporting key management in a packet data network H04L63/06
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

A method and system for authenticating a credential via a one time password which includes receiving a user ID, a client ID, and the one time password from a client device, and then validating the one time password based on the user ID and the credential ID. Upon validating the one time password, a response is sent to the client device, and the response includes at least one of an authorization to access a private key stored on the client device or at least a portion of the private key.

Claims

1. A method comprising:

receiving at a server, prior to accessing a private key stored at a client device, a request to validate a one time password from the client device, wherein the request comprises a user identification (ID), a credential ID, the one time password, and a key ID of the private key, wherein the key ID is for identifying the private key out of a plurality of private keys associated with a user having the user ID and is different from the private key;

validating, by a processing device at the server, the one time password received from the client device based on the user ID and the credential ID within a time period corresponding to a validity of the one time password; and

in response to validating the one time password within the time period, sending a response from the server to the client device, the response comprising;

a portion of the private key that is stored at the server and corresponds to the key ID; and

an authorization to access another portion of the private key that corresponds to the key ID and a certificate associated with the client device, wherein the authorization to access the another portion of the private key further comprises an authorization for importation of the another portion of the private key from a separate hardware device different from the server and client device;

wherein the another portion of the private key and the certificate are stored locally in a secure container on the client device;

in response to the sending a response from the server to the client device, the client device is to access the another portion of the private key located in the secure container on the client device, wherein the accessing the another portion of the private key located in the secure container on the client device further comprises the client device importing the portion of the private key from the separate hardware device and storing the another portion of the private key in the secure container; and

accessing the another portion of the private key, accessing the portion of the private key that is stored at the server, and combining both private key portions to form the private key stored at the client device, in response to the importation of the another portion of the private key from the separate hardware device.

2. The method of claim 1, wherein the response comprises a cloud portion of the private key.

3. The method of claim 1 further comprising:

upon execution of an initial key generation function by the client device, receiving, by the server, a cloud portion of the private key.

4. A system comprising:

a memory; and

a processing device coupled to the memory to;

receive, at a server, prior to accessing a private key stored at a client device, a request to validate a one time password from a client device, wherein the request comprises a user ID, a credential ID, the one time password, and a key ID of the private key, wherein the key ID is for identifying the private key out of a plurality of private keys associated with a user having the user ID and is different from the private key;

validate, at the server, the one time password received from the client device based on the user ID and the credential ID within a time period corresponding to a validity of the one time password; and

in response to validating the one time password within the time period, sending a response from the server to the client device, the response comprising;

a portion of the private key that is stored at the server and corresponds to the key ID; and

an authorization to access another portion of the private key that corresponds to the key ID and a certificate associated with the client device, wherein the authorization to access the another portion of the private key further comprises an authorization for importation of the another portion of the private key from a separate hardware device different from the server and client device;

wherein the another portion of the private key and the certificate are stored locally in a secure container on the client device;

in response to the sending a response from the server to the client device, the client device is to access the another portion of the private key located in the secure container on the client device, wherein the accessing the another portion of the private key located in the secure container on the client device further comprises the client device importing the portion of the private key from the separate hardware device and storing the another portion of the private key in the secure container; and

accessing the another portion of the private key, accessing the portion of the private key that is stored at the server, and combining both private key portions to form the private key stored at the client device, in response to the importation of the another portion of the private key from the separate hardware device.

5. The system of claim 4, wherein the response comprises a cloud portion of the private key.

6. The system of claim 4, wherein the processing device is further to, upon execution of an initial key generation function by the client device, receive a cloud portion of the private key.

7. A non-transitory computer readable storage medium including instructions that, when executed by a processing device, cause the processing device to perform operations comprising:

receiving, at a server, prior to accessing a private key stored at a client device, a request to validate a one time password from a client device, wherein the request comprises a user ID, a credential ID, the one time password, and a key ID of the private key, wherein the key ID is for identifying the private key out of a plurality of private keys associated with a user having the user ID and is different from the private key;

validating, at the server, the one time password received from the client device based on the user ID and the credential ID within a time period corresponding to a validity of the one time password; and

in response to validating the one time password within the time period, sending a response from the server to the client device, the response comprising;

a portion of the private key that is stored at the server and corresponds to the key ID; and

an authorization to access another portion of the private key that corresponds to the key ID and a certificate associated with the client device, wherein the authorization to access the another portion of the private key further comprises an authorization for importation of the another portion of the private key from a separate hardware device different from the server and client device;

wherein the another portion of the private key and the certificate are stored locally in a secure container on the client device;

in response to the sending a response from the server to the client device, the client device is to access the another portion of the private key located in the secure container on the client device, wherein the accessing the another portion of the private key located in the secure container on the client device further comprises the client device importing the portion of the private key from the separate hardware device and storing the another portion of the private key in the secure container; and

accessing the another portion of the private key, accessing the portion of the private key that is stored at the server, and combining both private key portions to form the private key stored at the client device, in response to the importation of the another portion of the private key from the separate hardware device.

8. The non-transitory computer readable storage medium of claim 7, wherein the response comprises a cloud portion of the private key.

9. The non-transitory computer readable storage medium of claim 8, wherein the operations further comprise:

upon execution of an initial key generation function by the client device, receiving, by the server, a cloud portion of the private key.