Asymmetric key pair having a kiosk mode

• US 7,599,493 B2
• Filed: 02/14/2005
• Issued: 10/06/2009
• Est. Priority Date: 02/14/2005
• Status: Active Grant

• Current Assignee: Vmware LLC (Broadcom, Inc.)
• Original Assignee: TriCipher, Inc. (Broadcom, Inc.)
• Inventors: Ganesan, Ravi, Schoppert, Brett Jason, Sandhu, Ravinderpal Singh, deSa, Colin Joseph, Bellare, Mihir
• Primary Examiner(s): Simitoski; Michael J
• Assistant Examiner(s): Schmidt; Kari L
• Application Number:
  US11/056,114
• Publication Number:
  US 20060182276A1
• Time in Patent Office: 1,695 Days
• Field of Search: 726 3- 7, 380277-286, 380/44, 713/155
• US Class Current: 380/44
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

Techniques for providing different levels of access based upon a same authentication factor are provided. A first message is received that is transformed with a first portion of a split private key, the first portion based upon a user password and another factor, and the split private key associated with an asymmetric key pair having a public key and the split private key. The user is authenticated for a first level of network access based upon the received first message being transformed with the first portion. A second message is received that is transformed with a second portion of the split private key, the second portion based upon the password only and not combinable with the first portion to complete the split private key. The user is authenticated for a second level of network access different that the first level based upon the received second message being transformed with the second portion.

Claims

1. An article of manufacture for providing different levels of access based upon a same authentication factor, comprising,

computer readable storage media:

and computer programming stored on the storage media, wherein the stored computer programming is configured to be readable by one or more computers and thereby cause the one or more computers to operate so as to;

receive a first message transformed with a first portion of a split private key, the first portion based upon a user password and another factor, different than the user password, with both factors being under the control of the user, and the split private key associated with an asymmetric key pair having a public key and the split private key;

authenticate the user for a first level of network access based upon the received first message being transformed with the first portion;

receive a second message transformed with a second portion of the split private key, the second portion based upon the user password only and not combinable with the first portion to complete the split private key; and

authenticate the user for a second level of network access different that the first level based upon the received second message being transformed with the second portion.

2. The article of manufacture of claim 1, wherein:

if authenticated for the first level of access, first information is available to the user; and

if authenticated for the second level access, second information is available to the user.

3. The article of manufacture of claim 2, wherein the second information is only a portion of the first information.

4. The article of manufacture of claim 1, wherein:

the first message is received from a first network station;

the other factor is stored at the first network station; and

the second message is received from a second network station at which the other factor is not stored.

5. The article of manufacture of claim 1, wherein the stored computer programming is further configured to thereby cause the one or more computers to operate so as to:

generate an asymmetric key pair having a private key and a public key;

split the private key, based upon the password only, into a second set of multiple private portions including the second private portion.

6. The article of manufacture of claim 1, wherein the stored computer programming is further configured to thereby cause the one or more computers to operate so as to:

transform the received first message with a third portion of the split private key, the public key of the asymmetric key pair, and at least one other public key to determine that the received first message is transformed with the first portion; and

transform the received second message with only a fourth portion of the split private key and the public key of the asymmetric key pair to determine that the received first message is transformed with the second portion.

7. The article of manufacture of claim 1, wherein the first portion is generated by cryptographically combining the user password and the other factor.

8. The article of manufacture of claim 1, wherein:

the asymmetric key pair is a first asymmetric key pair;

the first portion is based three factors;

a first factor is the user password;

a second factor is a private key of a second asymmetric key pair; and

a third factor is a private key of a third asymmetric key pair.

9. The article of manufacture of claim 8, wherein:

the password is not stored in a persistent state;

the private key of the second asymmetric key pair is stored in a first location; and

the private key of the third asymmetric key pair is stored in a second location different than the first location.

10. A system for providing different levels of access based upon a same authentication factor, comprising:

a communications interface configured to receive i) a first message transformed with a first portion of a split private key, the first portion based upon a user password and another factor, different than the user password, with both factors being under the control of the user, and the split private key associated with an asymmetric key pair having a public key and the split private key, and ii) a second message transformed with a second portion of the split private key, the second portion based upon the user password only and not combinable with the first portion to complete the split private key; and

a processor configured to i) authenticate the user for a first level of network access based upon the received first message being transformed with the first portion, and ii) authenticate the user for a second level of network access different that the first level based upon the received second message being transformed with the second portion.

11. The system of claim 10, wherein:

if authenticated for the first level of access, first information is available to the user; and

if authenticated for the second level of access, second information is available to the user.

12. The system of claim 11, wherein the second information is only a portion of the first information.

13. The system of claim 10, wherein:

the first message is received from a first network station;

the other factor is stored at the first network station; and

the second message is received from a second network station at which the other factor is not stored.

14. The system of claim 11, wherein the processor is a first processor, and further comprising:

a second processor configured to i) generate an asymmetric key pair having a private key and a public key, ii) split the private key, based upon the password and the other factor, into a first set of multiple private portions including the first private portion, and iii) split the private key, based upon the password only, into a second set of multiple private portions including the second private portion.

15. The system of claim 10, wherein the processor is further configured to i) transform the received first message with a third portion of the split private key, the public key of the asymmetric key pair, and at least one other public key to determine that the received first message is transformed with the first portion, and ii) transform the received second message with only a fourth portion of the split private key and the public key of the asymmetric key pair to determine that the received first message is transformed with the second portion.

16. The system of claim 10, wherein the first portion is generated by cryptographically combining the user password and the other factor.

17. The system of claim 10 wherein:

the asymmetric key pair is a first asymmetric key pair;

the first portion is based three factors;

a first factor is the user password;

a second factor is a private key of a second asymmetric key pair; and

a third factor is a private key of a third asymmetric key pair.

18. The system of claim 17, wherein:

the password is not stored in a persistent state;

the private key of the second asymmetric key pair is stored in a first location; and

the private key of the third asymmetric key pair is stored in a second location different than the first location.