US 7,549,048 B2Granted

Efficient and secure authentication of computing systems

AssigneeMicrosoft Corporation

InventorsTrevor William Freeman, Timothy M. Moore, Bernard D. Aboba, Daniel R. Simon

Life of this patent

Estimating the term…

Loading patent…

Abstract

The principles of the present invention relate to systems, methods, and computer program products for more efficiently and securely authenticating computing systems. In some embodiments, a limited use credential is used to provision more permanent credentials. A client receives a limited-use (e.g., a single-use) credential and submits the limited-use credential over a secure link to a server. The server provisions an additional credential (for subsequent authentication) and sends the additional credential to the client over the secure link. In other embodiments, computing systems automatically negotiate authentication methods using an extensible protocol. A mutually deployed authentication method is selected and secure authentication is facilitated with a tunnel key that is used encrypt (and subsequently decrypt) authentication content transferred between a client and a server. The tunnel key is derived from a shared secret (e.g., a session key) and nonces.

Claims22

Dependent claims

In a client computing system, a method for participating in authentication with a server computing system, the method comprising:

an act of the client computing system receiving a first server request that includes at least a first indication of the authentication mechanisms deployed at the server computing system and a server nonce;
an act of the client computing system sending a first response to the server computing system and that includes a client public key, a client nonce and a selected set of the authentication mechanisms that were included in the first indication of the authentication mechanisms received from the server computing system and that are also deployed at the client computing system;
an act of identifying a tunnel key that can be used to encrypt content transferred between the client computing system and the server computing system, the tunnel key comprising a hash of a concatenation of a session key together with the server nonce and the client nonce;
an act of receiving a second server request that includes encrypted authentication content, the encrypted authentication content being encrypted with the tunnel key and including a server challenge, a mutually deployed authentication method and a trust anchor;
an act of decrypting the encrypted authentication content with the tunnel key to reveal unencrypted authentication content, the unencrypted authentication content including the mutually deployed authentication mechanism the server challenge and the trust anchor;
and
an act of sending a second response to the second server request, the second response including encrypted response data that is responsive to the unencrypted authentication content, including at least one of a client challenge, a hashed message authentication code that corresponds to the server challenge, or a client authentication signature, the encrypted response data being used for authenticating the client computing system with the server computing system according to the mutually deployed authentication mechanism.

4 more elements

In a server computing system, a method for participating in authentication with a client computing system, the method comprising:

an act of the server computing system sending a first request that includes at least a first indication of the authentication mechanisms deployed at the server computing system and a server nonce;
an act of the server computing system receiving a first client response to the first request and that includes a client public key, a client nonce and a selected set of the authentication mechanisms that were included in the first indication of the authentication mechanisms deployed by the server and that are also deployed at the client computing system;
an act of identifying a tunnel key that can be used to encrypt content transferred between the client computing system and the server computing system, the tunnel key comprising a hash of a concatenation of a session key together with the server nonce and the client nonce;
an act of sending a second request that includes encrypted authentication content, the encrypted authentication content being encrypted with the tunnel key, the encrypted authentication content including a server challenge, a mutually deployed authentication mechanism and a trust anchor;
and
an act of receiving a second client response, the second client response including encrypted response data that is responsive to the encrypted authentication content and that includes at least one of a client challenge, a hashed message authentication code corresponding to the server challenge, or a client authentication signature, the encrypted response data being used for authenticating the client computing system with the server computing system according to the mutually deployed authentication mechanism.

3 more elements

Dependencies are inferred from the claim text.

Facts

Application: 10/804,591Filed 19 Mar 2004
Published: US 2005/0210252 A122 Sep 2005
Granted: 16 Jun 2009
Term ends: Not estimatedThe source records don’t support an estimate.

Classification8 codes

H04L 63/0428
For providing a confidential data exchange among entities communicating through data packet networks: wherein the data content is protected, e.g.…
G06F 21/31
Authentication, i.e. establishing the identity or authorisation of security principals: user authentication
H04L 63/0838
Using passwords: using one-time-passwords
H04L 63/0846
Using passwords: using time-dependent-passwords, e.g. periodically changing passwords