MULTI-FACTOR AUTHENTICATION USING QUANTUM COMMUNICATION

• US 20150222619A1
• Filed: 08/16/2013
• Published: 08/06/2015
• Est. Priority Date: 08/30/2012
• Status: Active Grant

• Current Assignee: TRIAD National Security, LLC
• Original Assignee: Los Alamos National Security LLC (Government of the United States of America)
• Inventors: Hughes, Richard John, Peterson, Charles Glen, Nordholt, Jane E., Newell, Raymond Thorson, Thrasher, James T., Yard, Jon T., Somma, Rolando D.
• Granted Patent: US 9,887,976 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 9/0852 Quantum cryptography transmission systems employing electromagnetic waves other than radio waves, e.g. light, infrared H04B10/00; wavelength-division multiplex systems H04J14/02; WDM arrangements H04J14/03
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees

Abstract

Multi-factor authentication using quantum communication (“QC”) includes stages for enrollment and identification. For example, a user enrolls for multi-factor authentication that uses QC with a trusted authority. The trusted authority transmits device factor information associated with a user device (such as a hash function) and user factor information associated with the user (such as an encrypted version of a user password). The user device receives and stores the device factor information and user factor information. For multi-factor authentication that uses QC, the user device retrieves its stored device factor information and user factor information, then transmits the user factor information to the trusted authority, which also retrieves its stored device factor information. The user device and trusted authority use the device factor information and user factor information (more specifically, information such as a user password that is the basis of the user factor information) in multi-factor authentication that uses QC.

Claims

1. A user device adapted to perform a method of enrolling a user for multi-factor authentication that uses quantum communication with a computer system that implements a trusted authority, the method comprising, with the user device:

receiving device factor information associated with the user device;

receiving user factor information associated with the user; and

storing the device factor information and the user factor information in memory of the user device for use in multi-factor authentication with quantum communication.

2. The user device of claim 1 wherein the device factor information is information for a hash function, and wherein as part of the storing an indication of the hash function is stored in the memory of the user device.

3. The user device of claim 2 wherein the hash function is specified as a Toeplitz matrix, another hash function based at least in part on output of a random number generator, or a cryptographic hash function whose indication is key bits.

4. The user device of claim 1 wherein the user factor information is an encrypted version of a user password.

5. The user device of claim 1 wherein the method further comprises, with the user device:

receiving verification information; and

storing the verification information in the memory of the user device for use in authenticating the trusted authority.

6. The user device of claim 1 wherein the device factor information includes different device factor information for each of multiple actions, sites to be accessed, or domains to be accessed, and wherein the same user factor information is usable for each of the multiple actions, sites to be accessed, or domains to be accessed.

7. The user device of claim 6 wherein the different device factor information for each of multiple actions, sites to be accessed, or domains to be accessed is different hash function information for each of the multiple actions, sites to be accessed, or domains to be accessed, and wherein the user factor information is a user password.

8. The user device of claim 1 wherein the device factor information and the user factor information are received from the computer system that implements the trusted authority directly or over a network connection during enrollment.

9. A method of managing enrollment of a user for multi-factor authentication that uses quantum communication with a computer system that implements a trusted authority, the method comprising, with the computer system that implements the trusted authority:

transmitting, to a user device, device factor information associated with the user device;

transmitting, to the user device, user factor information associated with a user; and

storing the device factor information in memory of the computer system that implements the trusted authority for use in multi-factor authentication with quantum communication.

10. The method of claim 9 further comprising, with the computer system that implements the trusted authority:

receiving a user password; and

encrypting the user password to produce an encrypted version of the user password, wherein the user factor information is the encrypted version of the user password.

11. The method of claim 9 further comprising, with the computer system that implements the trusted authority:

determining verification information associated with digital signature keys of the trusted authority; and

transmitting the verification information.

12. The method of claim 9 wherein the device factor information is information for a hash function, wherein as part of the storing an indication of the hash function is stored in the memory of the computer system that implements the trusted authority, and wherein the device factor information and the user factor information are transmitted to the user device directly or over a network connection during enrollment.

13. A method of multi-factor authentication that uses quantum communication with a computer system that implements a trusted authority, the method comprising, with a user device:

retrieving, from memory of the user device, device factor information associated with the user device and user factor information associated with a user; and

using the device factor information and the user factor information in multi-factor authentication that uses quantum communication with the computer system that implements the trusted authority.

14. The method of claim 13 wherein the user factor information is an encrypted version of a user password, the method further comprising, with the user device:

receiving user input for the user password for use by the user device in the multi-factor authentication; and

as part of the multi-factor authentication, transmitting the encrypted version of the user password for use by the trusted authority to recover the user password.

15. The method of claim 13 wherein the multi-factor authentication includes:

transmitting pulses of photons;

receiving a message signed by the trusted authority;

retrieving verification information from the memory of the user device;

verifying the trusted authority using the verification information and the signed message.

16. The method of claim 13 wherein the device factor information is information for a hash function, and wherein the multi-factor authentication includes:

receiving information indicating measuring bases for quantum communication;

recovering the measuring bases using the hash function and a user password for the user factor information;

comparing the measuring bases to sending bases for the quantum communication; and

determining shared secret bits for the quantum communication.

17. The method of claim 16 wherein the recovering comprises:

applying the hash function to the user password; and

computing exclusive-OR of the information indicating measuring bases and results of applying the hash function to the user password.

18. The method of claim 13 wherein the multi-factor authentication further comprises:

exchanging information for two hash functions with the trusted authority;

applying the two hash functions, respectively, to shared secret bits resulting from quantum communication and a user password for the user factor information to produce a verification value;

transmitting the verification value; and

receiving an indication of success or failure of the multi-factor authentication.

19. A computer system that implements a trusted authority, wherein the computer system is adapted to perform a method of multi-factor authentication that uses quantum communication, the method comprising, with the computer system that implements the trusted authority:

receiving, from a user device, user factor information associated with a user;

retrieving, from memory of the computer system, device factor information associated with the user device; and

using the device factor information and the user factor information in multi-factor authentication that uses quantum communication with the user device.

20. The computer system of claim 19 wherein the user factor information is an encrypted version of a user password, the method further comprising, with the computer system:

recovering the user password from the encrypted version of the user password using a secret encryption key of the trusted authority.

21. The computer system of claim 19 wherein the multi-factor authentication includes:

receiving pulses of photons; and

transmitting a message signed by the trusted authority.

22. The computer system of claim 19 wherein the device factor information is information for a hash function, and wherein the multi-factor authentication includes:

applying the hash function to a user password for the user factor information;

obscuring measuring bases for quantum communication using results of applying the hash function to the user password;

transmitting the obscured measuring bases;

receiving an indication of which of the measuring bases match sending bases for the quantum communication; and

determining shared secret bits for the quantum communication.

23. The computer system of claim 22 wherein the obscuring comprises:

computing exclusive-OR of information indicating measuring bases and the results of applying the hash function to the user password.

24. The computer system of claim 19 wherein the multi-factor authentication further comprises:

exchanging information for two hash functions with the user device;

applying the two hash functions, respectively, to shared secret bits resulting from quantum communication and a user password for the user factor information to produce a comparison value;

receiving a verification value;

comparing the verification value to the comparison value; and

transmitting an indication of success or failure of the multi-factor authentication.

25. The computer system of claim 19 wherein functions of the trusted authority are distributed across two or more physical nodes using quantum secret sharing, and wherein the quantum communication with the user device includes quantum secret sharing between the user device and the two or more physical nodes constituting the trusted authority.