Apparatus and method for implementing composite authenticators

• US 10,798,087 B2
• Filed: 01/26/2018
• Issued: 10/06/2020
• Est. Priority Date: 10/29/2013
• Status: Active Grant

• Current Assignee: Nok Nok Labs Incorporated
• Original Assignee: Nok Nok Labs Incorporated
• Inventors: Lindemann, Rolf, Baghdasaryan, Davit
• Primary Examiner(s): Lagor, Alexander
• Assistant Examiner(s): Lane, Gregory A
• Application Number:
  US15/881,522
• Publication Number:
  US 20180234410A1
• Time in Patent Office: 984 Days
• Field of Search: 713158
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 9/006 involving public key infrastructure [PKI] trust models network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3265 using certificate chains, trees or paths; Hierarchical trust model

Abstract

A system, apparatus, method, and machine readable medium are described for implementing a composite authenticator. For example, an apparatus in accordance with one embodiment comprises: an authenticator for authenticating a user of the apparatus with a relying party, the authenticator comprising a plurality of authentication components; and component authentication logic to attest to the model and/or integrity of at least one authentication component to one or more of the other authentication components prior to allowing the authentication components to form the authenticator.

Claims

1. A client device comprising:

one or more authenticators for authenticating a user of the client device with a relying party, each authenticator comprising a plurality of authentication components including at least one hardware authentication component, each of the authentication components within the client device performing a different function within a context of the authenticator within which it is used; and

component authentication logic on the client device to attest to a model or integrity of at least one of the plurality of authentication components to one or more of the other authentication components prior to allowing the authentication components to be combined on the client device to form the authenticator, wherein different combinations of authentication components are combined to form different authenticators, at least some of the authentication components are shared between authenticators, and each of the different authentication components is identified by the relying party using a unique authenticator attestation ID (AAID) code.

2. The client device as in claim 1, wherein to register with the relying party a first authenticator including a plurality of authenticator components, the component authentication logic on the client device sends a registration message to the relying party, the registration message comprising the AAID of each of the plurality of authenticator components of the first authenticator.

3. The client device as in claim 2, wherein the registration message further comprises a plurality of signatures, each of the signatures including an attestation key for a respective one of the plurality of authenticator components of the first authenticator.

4. The client device as in claim 1 wherein the authentication components include a user verification component to authenticate the user and an authentication kernel component to establish secure communication with the relying party.

5. The client device as in claim 1 wherein the authentication components include a display component to securely display information for the user and an authentication kernel component to establish secure communication with the relying party.

6. The client device as in claim 1 wherein one of the authentication components comprises a first authentication component and a second authentication component and wherein attesting to the model and/or integrity of the first authentication component to the second authentication component comprises the operations of:

receiving a challenge from the second authentication component;

generating a signature or message authentication code (MAC) over the challenge using a key of the first authentication component; and

verifying the signature or MAC by the second authentication component.

7. The client device as in claim 6 wherein the key comprises a private key and wherein the second authentication component uses a corresponding public key and the challenge to verify the signature.

8. The client device as in claim 1 wherein the challenge comprises a randomly generated nonce.

9. The client device as in claim 1 wherein the at least one authentication component includes a component authentication key (CAK) pair managed by the component authentication logic, the CAK pair to be used to attest to the model and/or integrity of the at least one authentication component.

10. The client device as in claim 9 wherein each authentication component of the plurality of authentication components includes a CAK pair managed by the component authentication logic, the CAK pair of each authentication component to be used to attest to the model and/or integrity of each of the other authentication components.

11. The client device as in claim 1 wherein the authenticator comprises a first authenticator, the client device further comprising a second authenticator sharing at least one of the plurality of authentication components with the first authenticator.

12. The client device as in claim 11 wherein the authentication components include a user verification component to authenticate the user, a display component to securely display information for the user and an authentication kernel component to establish secure communication with the relying party, wherein at least the authentication kernel component is shared between the first and second authenticators.

13. The client device as in claim 1 wherein at least one of the authentication components is implemented as a trusted application executed within a trusted execution environment (TEE) on the client device.

14. The client device as in claim 13 wherein at least one of the components is implemented as a Secure Element (SE) defined within the client device.

15. The client device as in claim 14 wherein at least one of the components is implemented using a Trusted User Interface.

16. The client device as in claim 1 wherein attesting to the model and/or integrity of the at least one authentication component is performed using a direct anonymous attestation (DAA) scheme.

17. The client device as in claim 1 wherein to attest to the model or integrity of the at least one of the plurality of authentication components to one or more other authentication components further comprises:

checking a revocation status of a certificate containing at least one authentication component'"'"'s public keys.

18. The client device as in claim 1 wherein the relying party comprises a cloud service.

19. The client device as in claim 1 further comprising:

a client application and/or browser to establish remote communication with the relying party, wherein the authenticator authenticates the user of the client device with the relying party using the remote communication established via the client application and/or browser.

20. The client device as in claim 6 wherein the MAC is a hash-based message authentication code (HMAC), and wherein the HMAC is computed using a symmetric key (SK) shared between the first and second authentication components.