Methods and systems for client-enhanced challenge-response authentication
AssigneeSecureKey Technologies Inc.
InventorsIlyea Erlikhman, Dmitry Barinov
Life of this patent
Estimating the term…
Abstract
Methods, systems and apparatus for performing client-server authentication using a device authentication and optional user authentication approach. In a device authentication stage, the client is unlocked to provide access to a cryptographic key used for authentication. In a user authentication stage, the user provides a personal data credential used to generate an additional cryptographic key.
Claims22
A method of authenticating a computing device using a server, the method comprising:
- transmitting an unlock request to the server;
- receiving an unlock challenge from the server;
- generating an unlock response based on the unlock challenge;
- transmitting the unlock response to the server for validation by the server;
- obtaining a key decryption key from the server in response to validation of the unlock response by the server;
- using the key decryption key, decrypting an encrypted device key stored in a persistent memory of the computing device to obtain a device key in decrypted form;
- transmitting a device authentication request to the server;
- receiving a device authentication challenge from the server;
- and
- generating a device authentication response based on the device authentication challenge and the device key.
A method of authenticating a computing device at a server, the method comprising:
- receiving an unlock request from the computing device;
- generating and transmitting an unlock challenge to the computing device;
- receiving an unlock response based on the unlock challenge;
- validating the unlock response;
- when the unlock response is validated correctly, forwarding a key decryption key to the computing device;
- receiving a device authentication request from the computing device;
- generating and transmitting a device authentication challenge to the computing device;
- receiving a device authentication response based on the device authentication challenge;
- and
- validating the device authentication response.
A system for facilitating authentication using a virtual secure element, the system comprising:
- a computing device;
- and
- a server, the server comprising:
- a server memory;
- a server processor, the server processor configured to:
- receive an unlock request from the computing device;
- generate and transmit an unlock challenge to the computing device;
- receive an unlock response based on the unlock challenge;
- validate the unlock response;
- when the unlock response is validated correctly, forward a key decryption key to the computing device;
- receive a device authentication request from the computing device;
- generate and transmit a device authentication challenge to the computing device;
- receive a device authentication response based on the device authentication challenge;
- and
- validate the device authentication response;
- the computing device comprising:
- a device memory;
- and
- a device processor, the device processor configured to:
- transmit the unlock request to the server;
- receive the unlock challenge from the server;
- generate the unlock response based on the unlock challenge;
- transmit the unlock response to the server;
- obtain the key decryption key from the server;
- using the key decryption key, decrypt an encrypted device key stored in a persistent memory of the computing device to obtain a device key in decrypted form;
- transmit the device authentication request to the server;
- receive the device authentication challenge from the server;
- generate the device authentication response based on the device authentication challenge and the device key;
- and
- transmit the device authentication response to the server for validation.
Dependencies are inferred from the claim text.