Proxy service for two-factor authentication
AssigneeAmazon Technologies, Inc.
InventorBenjamin Philip Grubin
Life of this patent
Estimating the term…
Abstract
The present disclosure relates to two-factor authentication with a Hardware Security Module (HSM). In response to a login attempt, the HSM indicates that two-factor authentication is required. To generate the second authentication factor, a management console is accessed using credentials. The management console generates the second authentication factor and provides the second authentication factor to the client. The client then provides the second authentication factor to the HSM to complete the two-factor authentication operations.
Claims20
A computer-implemented method, comprising:
- obtaining an indication to use multi-factor authentication for a user to log in to a hardware security module (HSM) hosted by a computing resource service provider;
- generating an asymmetric key pair associated with the user;
- causing the HSM to obtain a public key of the asymmetric key pair usable to verify a response for the multi-factor authentication;
- and
- responsive to an interface associated with the computing resource service provider obtaining a set of credentials of the user to log in the HSM, provide the HSM with the response, where the response is generated based at least in part on a challenge and a private key of the asymmetric key pair.
A system, comprising:
- one or more processors;
- and
- memory that stores computer-executable instructions that are executable by the one or more processors to cause the system to allow a client device of a user to gain access to a hardware security module (HSM) hosted by a first service using multi-factor authentication, by at least:
- causing a second service to generate a private key and a public key, where the private key is usable to generate a response based at least in part on signing a challenge issued by the HSM to perform the multi-factor authentication;
- and
- causing the HSM to obtain the public key, where the public key is usable to verify the response sent to the HSM.
A non-transitory computer-readable storage medium storing thereon executable instructions that, as a result of being executed by one or more processors of a computer system, cause the computer system to:
- in response to a first request from a user, generate a cryptographic key to perform multi-factor authentication to log in to a cryptographic device;
- in response to a second request from the user to login to the cryptographic device, generate a response based at least in part on a challenge obtained from the cryptographic device and the cryptographic key;
- and
- provide the response to the cryptographic device as part of the login to the cryptographic device.
Dependencies are inferred from the claim text.