Authenticated communication using a shared unpredictable secret

A non-transitory computer readable storage medium containing computer program instructions for validating a client device by a server device during a registration phase of the client device with the server device, the computer program instructions causing the execution of the following steps:

• generating a first shared unpredictable secret comprising an unpredictable component and a fixed component, wherein the fixed component remains the same during a user log-in phase that occurs after completion of the registration phase;
• storing the first shared unpredictable secret in the server device;
• sending, by the server device, update data to the client device, wherein the update data is to be applied to the first shared unpredictable secret by the client device to generate a second shared unpredictable secret, and wherein the second shared unpredictable secret comprises the same fixed component;
• accepting, by the server device, the first shared unpredictable secret as the correct shared unpredictable secret to validate the client device for requests for validation until the server device receives acknowledgment data to confirm that the client device has replaced the first shared unpredictable secret with the second shared unpredictable secret;
• accepting, by the server device, the second shared unpredictable secret as the correct shared unpredictable secret to validate the client device for requests for validation;
• receiving, by the server device prior to receiving the acknowledgment data, first proof data from the client device, wherein the first proof data is derived from the first shared unpredictable secret using a client proof data generation algorithm and the first proof data does not divulge the first shared unpredictable secret, wherein the client proof data generation algorithm comprises a one-way function;
• verifying, by the server device, the first proof data using a server proof data generation algorithm consistent with the client proof data generation algorithm used by the client device, wherein the server proof data generation algorithm comprises a one-way function;
• and
• upon determining, by the server device, that the first proof data presented by the client device was generated from the same first shared unpredictable secret stored in the server device, validating, by the server device, the client device.

A system for validating a client device by a server device during a registration phase of the client device with the server device, the system comprising:

• a memory to store a first shared unpredictable secret in a server device;
• at least one processor to:
• generate the first shared unpredictable secret, wherein the first shared unpredictable secret comprises an unpredictable component and a fixed component, and wherein the fixed component remains the same during a user log-in phase that occurs after completion of the registration phase;
• send, by the server device, update data to the client device, wherein the update data is to be applied to the first shared unpredictable secret by the client device to generate a second shared unpredictable secret, and wherein the second shared unpredictable secret comprises the same fixed component;
• accept, by the server device, the first shared unpredictable secret as the correct shared unpredictable secret to validate the client device for requests for validation until the server device receives acknowledgement data to confirm that the client device has replaced the first shared unpredictable secret with the second shared unpredictable secret;
• accept, by the server device, the second shared unpredictable secret as the correct shared unpredictable secret to validate the client device for requests for validation;
• receive, by the server device prior to receiving the acknowledgment data, first proof data from the client device, wherein the first proof data is derived from the first shared unpredictable secret using a client proof data generation algorithm and the first proof data does not divulge the first shared unpredictable secret, wherein the client proof data generation algorithm comprises a one-way function;
• verify, by the server device, the first proof data using a server proof data generation algorithm consistent with the client proof data generation algorithm used by the client device, wherein the server proof data generation algorithm comprises a one-way function;
• and
• upon determination, by the server device, that the first proof data presented by the client device was generated from the same first shared unpredictable secret stored in the server device, validate, by the server device, the client device.