Methods and systems for securing proofs of knowledge for privacy

• US 9,497,186 B2
• Filed: 08/11/2015
• Issued: 11/15/2016
• Est. Priority Date: 08/11/2014
• Status: Active Grant

• Current Assignee: Antique Books, Inc
• Original Assignee: Antique Books, Inc
• Inventors: Thibadeau, Robert H. Sr., Donnell, Justin D.
• Primary Examiner(s): LEWIS, LISA C
• Application Number:
  US14/823,739
• Publication Number:
  US 20160044021A1
• Time in Patent Office: 462 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 2212/1052 Security improvement
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

Embodiments described herein relate to securing the privacy of knowledge used to authenticate a user (i.e., Proof of Knowledge (PoK) test(s)). In some embodiments, a client device is operable to receive a first encryption key and encrypted test(s) from a PoK server. The client device also receives a second encryption key from a Relying Party (RP) server. The client device can decrypt the encrypted test(s) by using the first encryption key and the second encryption key to thereby render decrypted test(s). The client device is further operable to obtain answer(s) for the decrypted test(s), send a communication to the PoK server based on the answer(s), and receive a communication from the RP server that authorizes a user of the client device to access service(s) administered by the RP server.

Claims

1. A client device, comprising:

one or more processors; and

memory containing instructions executable by the one or more processors whereby the client device is operable to;

receive a first encryption key and user data comprising one or more encrypted tests from a Proof of Knowledge (PoK) server;

receive a second encryption key from a Relying Party (RP) server;

decrypt the one or more encrypted tests by using the first encryption key and the second encryption key to thereby render one or more decrypted tests;

obtain one or more answers for the one or more decrypted tests;

send a communication to the PoK server based on the one or more answers; and

receive a communication from the RP server that authorizes a user of the client device to access one or more services administered by the RP server.

2. The client device of claim 1 wherein, in order to decrypt the one or more encrypted tests, the client device is further operable to:

generate a third encryption key from the first encryption key and the second encryption key; and

decrypt the one or more encrypted tests by using the third encryption key to thereby render the one or more decrypted tests.

3. The client device of claim 2 wherein the client device is further operable to:

encrypt the one or more answers by using the third encryption key; and

wherein the communication sent to the PoK server comprises the one or more encrypted answers.

4. The client device of claim 2 wherein the client device is further operable to:

create a cryptographic hash for the one or more answers; and

wherein the communication sent to the PoK server comprises the cryptographic hash for the one or more answers.

5. The client device of claim 2 wherein, in order to generate the third encryption key, the client device is further operable to generate the third encryption key by performing one or more logical operations on the first encryption key and the second encryption key.

6. The client device of claim 5 wherein the one or more logical operations are selected from a group consisting of:

AND, OR, Exclusive OR (XOR), NOT, Not AND (NAND), Not OR (NOR), and Exclusive NOR (XNOR).

7. The client device of claim 2 wherein, in order to generate the third encryption key, the client device is further operable to generate the third encryption key by taking a split of the first encryption key and the second encryption key.

8. The client device of claim 7 wherein taking the split of the first encryption key and the second encryption key comprises performing an Exclusive OR (XOR) logical operation of the first encryption key and the second encryption key.

9. The client device of claim 1 wherein the user data is formed as an encrypted Binary Large Object (BLOB).

10. The client device of claim 9 wherein the encrypted BLOB comprises the one or more encrypted tests and one or more multimedia objects for the one or more encrypted tests.

11. The client device of claim 10 wherein the one or more multimedia objects comprise an image for a picture password PoK.

12. The client device of claim 10 wherein the one or more encrypted tests comprise one or more cognitive tests, the one or more cognitive tests comprising the one or more multimedia objects.