System and method for decentralized authentication of supplicant devices

An information handling system comprising:

• at least one processor and memory, wherein the at least one processor is operable to:
• enroll a supplicant device as an authentication factor for a user by receiving a first request for enrollment from an access device, publishing an authentication uniform resource location (URL) to the access device, storing a public key of an asymmetric key pair generated by an authentication application on the supplicant device and receiving an enrollment package comprising the public key from the supplicant device via the authentication URL;
• wherein the publishing of the authentication URL comprises a quick response (QR) code comprising the authentication URL to be displayed on the access device;
• receive, from an access device, a second request to access a service using an identity of the user;
• in response to receipt of the first request, publish an authentication code to the access device comprising the authentication URL;
• wherein the authentication code is forwarded from the access device to the supplicant device via a loop-back communication path;
• receive an authentication package from the authentication application on the supplicant device using the authentication URL, the authentication package comprising a digital signature of the authentication code;
• validate the digital signature using the public key;
• and
• responsive to a determination that the validation is successful, allow the access device to access the service.

A computer-program product comprising a non-transitory computer-usable medium having computer-readable program code embodied therein, the computer-readable program code adapted to be executed to implement a method comprising:

• enrolling, with an authenticator computer system comprising an access device interface, an authentication module, a database, and a supplicant device interface, a supplicant device as an authentication factor for a user;
• wherein the enrolling comprises receiving a first request for enrollment from the access device, publishing an authentication uniform resource location (URL) to the access device, storing a public key of an asymmetric key pair generated by an authentication application on the supplicant device and receiving an enrollment package comprising the public key from the supplicant device via the authentication URL;
• wherein the publishing of the authentication URL comprises causing a quick response (QR) code comprising the authentication URL to be displayed on the access device;
• receiving, from an access device, a first request to access a service using an identity of the user;
• responsive to the receiving, publishing an authentication code comprising the authentication URL to the access device;
• wherein the authentication code is forwarded from the access device to the supplicant device via a loop-back communication path;
• receiving an authentication package from the authentication application on the supplicant device using the authentication URL, the authentication package comprising a digital signature of the authentication code;
• validating the digital signature using the public key;
• and
• responsive to a determination that the validating is successful, allowing the access device to access the service.