Derivative seeds

• US 8,370,638 B2
• Filed: 02/17/2006
• Issued: 02/05/2013
• Est. Priority Date: 02/18/2005
• Status: Active Grant

• Current Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Original Assignee: EMC Corporation (Dell Technologies Inc.)
• Inventors: Duane, William, Hamel, Jeffrey
• Primary Examiner(s): Orgad, Edan
• Assistant Examiner(s): Baum, Ronald
• Application Number:
  US11/357,724
• Publication Number:
  US 20070174614A1
• Time in Patent Office: 2,545 Days
• Field of Search: 713/185
• US Class Current: 713/185
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G07C 9/21 having a variable access code
• CPC Class Codes: H04L 9/0833 involving conference or group key network architectures or network communication protocols for key management in group communication in a packet data network H04L63/065
• CPC Class Codes: H04L 9/0866 involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
• CPC Class Codes: H04L 9/0869 involving random numbers or seeds
• CPC Class Codes: H04L 9/0877 using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807

Abstract

A method of generating authentication seeds for a plurality of users, the method involving: based on a single master seed, generating a plurality of derivative seeds, each one for a corresponding different one of a plurality of users; and distributing the plurality of derivative seeds to a verifier for use in individually authenticating each of the plurality of users to that verifier, wherein generating each one of the plurality of derivative seeds involves mathematically combining the master seed and a unique identifier identifying the corresponding user.

Claims

1. A method for use in a network in which a user having a user device that stores a master seed authenticates through a client-side device to another entity on the network, the client side device being located between the user device and the other entity, the method comprising:

in the other entity, receiving from the client-side device a unique identifier identifying the client-side device;

in the other entity, mathematically combining a secret with the unique identifier for the client device to generate a derivative seed, wherein the secret is derived from the master seed;

sending the derivative seed from the other entity to the client-side device; and

in the client-side device;

receiving the derivative seed; and

after receiving the derivative seed, disconnecting the client-side device from the network;

wherein the method further comprises, in the user device;

receiving the unique identifier for the client-side device;

mathematically combining the at least the unique identifier for the client device with the secret to generate the derivative seed; and

using the derivative seed to authenticate the user device to the client-side device while the client-side device is disconnected from the network, the client-side device being unable to communicate with the other entity while the client-side device is disconnected from the network.

2. The method of claim 1, wherein the client-side device is a portable computer and the user device is a hardware token.

3. The method of claim 1, wherein the secret is a master seed.

4. The method of claim 1, wherein the secret is a derived seed that is generated by mathematically combining a master seed with one or more other identifiers.

5. The method of claim 1 wherein the method further comprises:

sending a unique identifier for the other entity from the other entity to a key server;

in response to sending the unique identifier for the other entity from the other entity to the key server, receiving, at the other entity, the secret from the key server, the secret representing a cryptographic combination of the unique identifier for the other entity with a master seed stored on the key server;

sending the unique identifier for the other entity from the other entity to the client-side device; and

receiving, at the user device, the unique identifier for the other entity from the client-side device.

6. The method of claim 5 wherein mathematically combining at least the unique identifier for the client device with the secret to generate the derivative seed includes cryptographically combining, at the user device, the master seed with the unique identifier for the other entity to generate the secret.

7. A method performed by a client-side device on a network in which a user authenticates through the client-side device to another entity on the network, the method comprising:

sending to the other entity of the network a unique identifier identifying the client-side device;

receiving from the other entity a derivative seed, wherein the derivative seed was generated by mathematically combining a secret with the unique identifier for the client-side device, wherein the secret is based on a master seed;

disconnecting from the network, the client-side device being unable to communicate with the other entity while the client-side device is disconnected from the network;

to authenticate a user, sending the unique identifier for the client-side device to a user device;

after sending the unique identifier for the client-side device to the user device, while the client-side device is disconnected from the network, receiving information from the user device indicating that user device possesses the derivative seed; and

determining that the user is authenticated to the other entity in response to receiving the information from the user device indicating that user device possesses the derivative seed.

8. The method of claim 7, wherein prior to the step of receiving information from the user device indicating that user device possesses the derivative seed, the user device generating an authentication code in response to the derivative seed, and wherein the information from the user device is the authentication code.

9. The method of claim 7, wherein the secret is mathematically computed from the master seed.

10. The method of claim 7 wherein the secret represents a cryptographic combination of a unique identifier for the other entity with the master seed, the master seed being stored on a key server but not on the other entity or the client-side device.

11. The method of claim 7 wherein the client-side device is a portable computer and the user device is a hardware token.