Back to results
US 2022/0070009 A1Published application
Authentication system with reduced attack surface
AssigneeKoninklijke Philips N.V.
InventorSebastiaan Jacobus Antonius DE HOOGH
Life of this patent
Estimating the term…
Abstract
Some embodiments are directed to an authentication system (100; 101; 102) for computing an authentication token for a service provider to authenticate a user system to the service provider, the authentication system comprising a processor configured to jointly blind with a user system an encrypted user identity and to compute an encrypted identity for the service provider from the blinded encrypted user identity.
Claims11
An authentication system comprising
- a storage,
- wherein the storage is arranged to store a first share (PPau;
- gr) of an encrypted user identity (U),
- wherein a user system is arranged to store a second share of the encrypted user identity (PPbu;
- hrU);
- a communication interface circuit,
- wherein the communication interface circuit is configured to communicate at least with the user system,
- wherein the communication interface circuit is configured to receive a first share of a challenge (he),
- wherein the first share of the challenge corresponds to a challenge (e),
- wherein the challenge (e) is generated by the service provider,
- wherein the user system is arranged to receive a second share of the challenge (e);
- and
- a processor circuit,
- wherein the processor circuit is configured to blind the encrypted user identity for the challenge (e) in conjunction with the user system,
- wherein the blinded encrypted user identity (BPPu;
- (PPu)e;
- [(PPau)e,(PPbu)e]) is computed from multiple private inputs,
- wherein the authentication system is arranged to provide as private inputs the first share (PPau) of the encrypted user identity and the first share of the challenge (he),
- wherein the user system is arranged to provide as private inputs the second share of the encrypted user identity (PPbu) and the second share of the challenge,
- wherein the joint blinding is a multi-party computation,
- wherein the authentication system is arranged to obtain the blinded encrypted user identity,
- wherein the processor circuit is configured to compute an encrypted identity for the service provider from the blinded encrypted user identity, wherein the blinded encrypted user identity is decryptable using a private key of the service provider and the challenge (e).
19 more elements
A user system comprising a first user device and a second user device,
- wherein the first user device comprises a first communication interface circuit,
- wherein the first communication circuit is arranged to communicate with the service provider and the authentication system,
- wherein the first user device is arranged to receive the blinded challenge (he),
- wherein the first user device is arranged to forward the blinded challenge to the authentication system,
- wherein the first user device is arranged to receive the encrypted identity,
- wherein the second user device comprises:
- a storage, wherein the storage is arranged to store the second share of the encrypted user identity (PPbu);
- and
- a second communication interface circuit,
- wherein the second communication interface is arranged to communicate with the service provider and the authentication system,
- wherein the second user device is arranged to receive the unblinded challenge (e) wherein the second user device is arranged, at least in part, to blind the encrypted identity.
8 more elements
A helper server comprising:
- a storage,
- wherein the storage is arranged to store a first share (PPau;
- gr) of an encrypted user identity (U),
- wherein a user system is arranged to store a second share of the encrypted user identity (PPbu;
- hrU);
- a communication interface circuit,
- wherein the communication interface circuit is configured to communicate at least with the user system,
- wherein the communication interface circuit is configured to receive a blinded challenge (he;
- ge) corresponding to a challenge (e),
- wherein the challenge (e) is generated by a service provider;
- and
- a processor circuit,
- wherein the processor circuit is configured to blind the encrypted user identity for the challenge (e) in conjunction with the user system,
- wherein the blinded encrypted user identity (BPPu;
- (PPu)e;
- [(PPau)e,(PPbu)e]) is computed from multiple private inputs,
- wherein the helper server is arranged to provide as private inputs the first share (PPau) of the encrypted user identity and the blinded challenge (he),
- wherein the user system is arranged to provide as private inputs the second share of the encrypted user identity (PPbu) and the unblinded challenge (e),
- wherein the blinding is a multi-party computation,
- wherein the helper server obtaining the blinded encrypted user identity,
- wherein the processor circuit is configures to send the blinded encrypted user identity to an authentication server.
18 more elements
An authentication server comprising:
- a communication interface circuit,
- wherein the communication interface circuit is configured to communicate at least with a helper system and a user system,
- wherein the communication interface circuit is configured to receive a blinded encrypted user identity,
- wherein the blinded encrypted user identity is jointly computed by the helper server and the user system,
- a processor circuit,
- wherein the processor circuit is configured to configured to compute an encrypted identity for a service provider from the blinded encrypted user identity decryptable using a private key of the service provider and a challenge (e),
- wherein the processor circuit is arranged to send the encrypted identity to the user system.
4 more elements
A service provider comprising
- a storage, wherein the storage is arranged to store a private key;
- a communication interface circuit, wherein the communication interface circuit is configured to communicate at least with a user system;
- and
- a processor circuit,
- wherein the processor circuit is configured to generate a challenge (e) and to compute a blinded challenge (he;
- ge),
- wherein the blinded challenge corresponds to the challenge (e), sending the challenge and the blinded challenge to the user system,
- wherein the processor circuit is configured to receive an encrypted identity,
- wherein the processor circuit is configured to decrypt the encrypted identity with the private key and unblind with the challenge (e).
6 more elements
A second user device comprising
- a storage,
- wherein the storage is arranged to store a second share of an encrypted user identity (PPbu;
- hrU),
- wherein a first share (PPau;
- gr) of the encrypted user identity (U) is stored in an authentication system;
- a communication interface circuit,
- wherein the communication interface circuit is configured to communicate at least with a service provider and the authentication system,
- wherein the communication interface circuit is configured to receive a challenge (e) from the service provider;
- and
- a processor circuit,
- wherein the processor circuit is configured to blind the encrypted user identity for the challenge (e) in conjunction with the authentication system,
- wherein the blinded encrypted user identity (BPPu;
- (PPu)e;
- [(PPau)e,(PPbu)e]) is computed from multiple private inputs,
- wherein the authentication system is arranged to provide as private inputs the first share (PPau) of the encrypted user identity and a blinded challenge (he),
- wherein a user system is arranged to provide as private inputs the second share of the encrypted user identity (PPbu) and the unblinded challenge (e),
- wherein the blinding is a multi-party computation, the authentication system obtaining the blinded encrypted user identity.
14 more elements
An authentication method comprising
- storing a first share (PPau;
- gr) of an encrypted user identity (U), wherein a user system is arranged to store a second share of the encrypted user identity (PPbu;
- hrU);
- establishing communication at least with the user system;
- receiving a blinded challenge (he;
- ge) corresponding to a challenge (e), wherein the challenge (e) is generated by a service provider;
- blinding the encrypted user identity for the challenge (e) in conjunction with the user system,
- wherein the blinded encrypted user identity (BPPu;
- (PPu)e;
- [(PPau)e,(PPbu)e]) is computed from multiple private inputs,
- wherein the authentication system is arranged to provide as private inputs the first share (PPau) of the encrypted user identity and the blinded challenge (he),
- wherein the user system is arranged to provide as private inputs the second share of the encrypted user identity (PPbu) and the unblinded challenge (e),
- wherein the blinding is a multi-party computation, thus obtaining the blinded encrypted user identity;
- and
- computing an encrypted identity for the service provider from the blinded encrypted user identity decryptable using a private key of the service provider and the challenge (e).
12 more elements
A second user method comprising:
- storing a second share of an encrypted user identity (PPbu;
- hrU), wherein a first share (PPau;
- gr) of the encrypted user identity (U) is stored in at an authentication system;
- establishing communication with at least with a service provider and the authentication system, wherein the communication interface circuit is configured to receive a challenge (e) from the service provider;
- blinding the encrypted user identity for the challenge (e) in conjunction with the authentication system,
- wherein the blinded encrypted user identity (BPPu;
- (PPu)e;
- [(PPau)e,(PPbu)e]) is computed from multiple private inputs;
- and
- providing as private inputs the second share of the encrypted user identity (PPbu) and the unblinded challenge (e),
- wherein the authentication system is arranged to provide as private inputs the first share (PPau) of the encrypted user identity and the blinded challenge (he),
- wherein the blinding is a multi-party computation,
- wherein the authentication system is arranged to obtain the blinded encrypted user identity.
10 more elements
Dependencies are inferred from the claim text.