Back to results
US 12,763,943 B2Granted
Method for authenticating an end-user account, method for single authenticating within a cluster of HSM, and method for implementing access control
AssigneeThales Dis Cpl USA, Inc.
InventorThinh Nguyen
Life of this patent
Estimating the term…
Abstract
The present invention provides a method for authenticating an end-user account associated with at least one cryptographic key stored in the form of a PKA object within a HSM, wherein the method comprises the following steps: creating a PKA object comprising authentication data, PKA-based user object, this authentication data at least comprising the log-in credentials of the end-user account, receiving, by the HSM, log-in credentials of the end-user account for retrieving and instantiating the PKA-based user object at session level, and authenticating, by the HSM, the PKA-based user object using a PKCS #11.
Claims18
A method for operating a Hardware Security Module (HSM) for authenticating an end-user to at least one resource, comprising:
- creating a Per-Key Authorization-based (PKA-based) user object, wherein the PKA-based user object is a PKA-based object that contains an authentication data required to access a cryptographic key stored by the PKA-based object, wherein the PKA-based user object comprising authentication data including log-in credentials of an end-user account and a symmetric cryptographic key associated with the end-user account accessible for performing cryptographic operations by the PKA-based user object by authentication to the PKA-based user object using the log-in credentials;
- in a setup phase:
- creating at least one PKA-based resource object, which is a PKA-based object, comprising:
- generating an authentication data identifier;
- encrypting the authentication data identifier with the symmetric cryptographic key included in the PKA-based user object to determine encrypted authentication data identifier;
- and
- storing the encrypted authentication data identifier as an encrypted credential;
- in an access phase:
- receiving, by the HSM, the log-in credentials of the end-user account for retrieving the PKA-based user object containing the log-in credentials from an external database;
- and
- authenticating, by the HSM, access to the PKA-based resource object by:
- authenticating the PKA-based user object using a Public-Key Cryptographic Standard #11 to use the symmetric cryptographic key based on access permissions for the at least one PKA-based user object;
- upon successful authentication to the PKA-based user object;
- accessing, by the PKA-based user object, the symmetric cryptographic key;
- decrypting, by the PKA-based user object, the encrypted credential using the symmetric cryptographic key to determine the authentication data identifier;
- authenticating, by the PKA-based resource object, the authentication data identifier;
- and
- allowing access to the PKA-based resource object based on authenticating the authentication data identifier to determine an authenticated state of the PKA-based user object;
- serializing, by the HSM, the PKA-based user object with the authenticated state of the PKA-based user object to determine a serial of the PKA-based user object;
- encrypting said serial of the PKA-based user object, by the HSM, with the symmetric cryptographic key specific to each PKA-based user object or a derived form thereof shared among all PKA-based user objects to determine an encrypted serial of the PKA-based user object;
- propagating, by the HSM, the encrypted serial of the PKA-based user object through a secure communication channel;
- receiving, by at least a second HSM, the encrypted serial of the PKA-based user object;
- decrypting the encrypted serial of the PKA-based user object, by the at least second HSM, with the symmetric cryptographic key;
- and
- automatically authenticating, by the at least second HSM, the PKA-based user object without providing the login credential of the end user account to access resource from the at least second HSM thereby transferring the authenticated state of the PKA-based user object between different HSM.
22 more elements
A method for single authentication of an end-user account within a cluster of Hardware Security Modules (HSMs) connected to each other through a secure communication channel, wherein the end-user account is represented by a Per-Key Authorization-based (PKA-based) user object, which is a PKA object that contains an authentication data required to access a cryptographic key stored by the PKA-based object, wherein the authentication data corresponds to a user, the method comprising the following steps:
- authenticating, by a first HSM of the cluster of HSMs, the PKA-based user object by:
- in a setup phase:
- creating the PKA-based user object, comprising the authentication data corresponding to the user including log-in credentials of the end-user account and a symmetric cryptographic key associated with the end-user account accessible for performing cryptographic operations by the PKA-based user object by authentication to the PKA-based user object using the log-in credentials;
- creating at least one PKA-based resource object, which is a PKA-based object, comprising:
- generating an authentication data identifier;
- encrypting the authentication data identifier with the symmetric cryptographic key included in the PKA-based user object to determine encrypted authentication data identifier;
- storing the encrypted authentication data identifier as an encrypted credential;
- in an access phase:
- receiving, by the first HSM, the log-in credentials of the end-user account for retrieving the PKA-based user object containing the log-in credentials from an external database;
- and
- authenticating, by the first HSM, access to the PKA-based user object using a Public-Key Cryptographic Standard #11 to use the symmetric cryptographic key based on access permissions for the at least one PKA-based user object and upon successful authentication to the PKA-based user object:
- accessing, by the PKA-based user object, the symmetric cryptographic key;
- decrypting, by the PKA-based user object, the encrypted credential using the symmetric cryptographic key to determine the authentication data identifier;
- authenticating, by the PKA-based resource object, the authentication data identifier;
- and
- allowing access to the PKA-based resource object based on authenticating the authentication data identifier thereby setting an authenticated state of the PKA-based user object;
- serializing, by the first HSM, the PKA-based user object with the authenticated state of the PKA-based user object to determine a serial of the PKA-based user object;
- encrypting said serial of the PKA-based user object, by the first HSM, with the symmetric cryptographic key specific to each PKA-based user object or a derived form thereof shared among all PKA-based user objects within the cluster of HSMS to determine an encrypted serial of the PKA-based user object;
- propagating, by the first HSM, the encrypted serial of the PKA-based user object through the secure communication channel;
- receiving, by at least a second HSM of the cluster, the encrypted serial of the PKA-based user object;
- decrypting the encrypted serial of the PKA-based user object, by the at least second HSM, with the symmetric cryptographic key;
- and
- automatically authenticating, by the at least second HSM, the PKA-based user object without providing the login credential of the end user account to access resource from the at least second HSM thereby transferring authenticated state of the PKA-based user object between different HSM of the cluster of HSMs.
20 more elements
A method for implementing access control to at least one cryptographic key stored within a Hardware Security Module (HSM) by an end-user account, wherein the method comprises:
- creating a Per-Key Authorization-based (PKA-based) user object, wherein the PKA-based user object is a PKA-based object that contains an authentication data required to access a cryptographic key stored by the PKA-based object, wherein the PKA-based user object comprising authentication data including log-in credentials of an end-user account and a symmetric cryptographic key associated with the end-user account accessible for performing cryptographic operations by the PKA-based user object by authentication to the PKA-based user object using the log-in credentials;
- in a setup phase:
- creating at least one PKA-based resource object, which is a PKA-based object, comprising:
- generating an authentication data identifie;
- encrypting the authentication data identifier with the symmetric cryptographic key included in the PKA-based user object to determine encrypted authentication data identifier;
- storing the encrypted authentication data identifier as an encrypted credential;
- in an access phase:
- receiving, by the HSM, the log-in credentials of the end-user account for retrieving the PKA-based user object containing the log-in credentials from an external database;
- and
- authenticating, by the HSM, access to the PKA-based resource object by:
- authenticating to the PKA-based user object using a Public-Key Cryptographic Standard #11 to use the symmetric cryptographic key based on access permissions set for the at least one PKA-based user object;
- upon successful authentication to the PKA-based user object;
- accessing, by the PKA-based user object, the symmetric cryptographic key;
- decrypting, by the PKA-based user object, the encrypted credential using the symmetric cryptographic key to determine the authentication data identifier;
- authenticating, by the PKA-based resource object, the authentication data identifier;
- and
- allowing access to the PKA-based resource object to determine an authenticated state of the PKA-based user object;
- serializing, by the HSM, the PKA-based user object with the authenticated state of the PKA-based user object to determine a serial of the PKA-based user object;
- encrypting said serial of the PKA-based user object, by the HSM, with the symmetric cryptographic key specific to each PKA-based user object or a derived form thereof shared among all PKA-based user objects to determine an encrypted serial of the PKA-based user object;
- propagating, by the HSM, the encrypted serial of the PKA-based user object through a secure communication channel;
- receiving, by at least a second HSM, the encrypted serial of the PKA-based user object;
- decrypting the encrypted serial of the PKA-based user object, by the at least second HSM, with the symmetric cryptographic key;
- and
- automatically authenticating, by the at least second HSM, the PKA-based user object without providing the login credential of the end user account to access resource from the at least second HSM thereby transferring the authenticated state of the PKA-based user object between different HSM.
21 more elements
Dependencies are inferred from the claim text.