System and method for an integrity focused authentication service

Patent metadata

Field	Value
Publication number	US-10021113-B2
Application number	US-201715661277-A
Country	US
Kind code	B2
Filing date	Jul 27, 2017
Priority date	Apr 17, 2014
Publication date	Jul 10, 2018
Grant date	Jul 10, 2018

Abstract

Systems and methods for authentication. At an authentication service, key synchronization information is stored for an enrolled authentication device for a user identifier of a service provider. The key synchronization information indicates that a private key stored by the authentication device is synchronized with a public key stored at the service provider. Responsive to an authentication request provided by the service provider for the user identifier, the authentication service determines an authentication device for the user identifier that stores a synchronized private key by using the key synchronization information, and provides the authentication request to the authentication device. The authentication service provides a signed authentication response to the service provider. The authentication response is responsive to the authentication request and signed by using the private key. The service provider verifies the signed authentication response by using the public key.

First claim

What is claimed is:

1. A method comprising:
at an authentication service, the authentication service being implementing by one or more computing servers:
(i) receiving from a remote service provider, via a network, an account identifier and an authentication request for authenticating a service request received at the remote service provider from an initiator, wherein the authentication request comprises an authentication challenge that is cryptographically secured with a public cryptographic key of the remote service provider;
(ii) using the account identifier to identify a predefined synchronization mapping established with the authentication service that identifies a destination of a user device having a private cryptographic key corresponding to the public cryptographic key of the remote service provider or a user application having a private cryptographic key corresponding to the public cryptographic key of the remote service provider, wherein the private cryptographic key of the destination and the public cryptographic key of the remote service provider define an asymmetric cryptographic key pair;
(iii) in response to identifying the destination based on the predefined synchronization mapping, routing by the authentication service the authentication request to the destination;
(iv) receiving from the destination an authentication response to the authentication request, the authentication response comprising a challenge response to the authentication challenge, the authentication response being cryptographically secured using the private cryptographic key of the destination; and
(v) in response to receiving the authentication response from the destination, routing the authentication response to the remote service provider based on the predefined synchronization mapping.

2. The method of claim 1 , wherein the cryptographically signed authentication response is signed by the destination using the private cryptographic key, and
wherein, upon receipt of the cryptographically signed authentication response routed from the authentication service, the remote service provider decrypts and verifies the cryptographically signed authentication response using the public cryptographic key.

3. The method of claim 1 , wherein, prior to transmitting the authentication request by the remote service provider to the authentication service, the authentication request is cryptographically signed by the remote service provider using the public cryptographic key.

4. The method of claim 1 , wherein further at the authentication service:
storing a plurality of predefined synchronization mappings, wherein each predefined synchronization mapping maps the remote service provider to each of a plurality of destinations associated with different account identifiers; and
using the predefined synchronization mapping associated with the account identifier to select the destination among the plurality of destination.

5. The method of claim 1 , wherein further at the authentication service:
using the predefined synchronization mapping to select an authentication application residing on the authentication device as the destination; and
wherein transmitting the cryptographically signed authentication request includes delivering the cryptographically signed authentication request to the authentication device via the selected authentication application.

6. The method of claim 1 , wherein further at the authentication service:
responsive to synchronization of the asymmetric cryptographic keys between the remote service provider and the destination enrolled for the account identifier of the remote service provider, storing asymmetric cryptographic key synchronization information in association with address information of the destination, the account identifier, and authentication service account information for the remote service provider, the asymmetric cryptographic key synchronization information indicating that the private cryptographic key associated with the destination is synchronized with the public cryptographic key stored at the remote service provider in association with the account identifier.

7. The method of claim 6 , wherein:
at least one of the authentication service, the remote service provider and the authentication device synchronizes the private cryptographic key and the public cryptographic key between the remote service provider and the destination.

8. The method of claim 1 , wherein:
the asymmetric cryptographic key pair comprising the public cryptographic key of the remote service provider and the private cryptographic key of the destination is inaccessible to the authentication service.

9. A method comprising:
at an authentication service:
configuring an authentication channel via the authentication service between a service provider and a user authentication device for authenticating a service request to the service provider;
wherein:
a private cryptographic key associated with the user authentication device is synchronized with a public cryptographic key associated with the service provider during an enrollment of the user authentication device at the authentication service;
the user authentication device is enrolled responsive to enrollment information provided by at least one of the user authentication device, a primary device, and the service provider, the enrollment information including a user identifier, address information of the user authentication device, and information identifying the service provider;
an enrollment record is stored at the authentication service, the enrollment record including the enrollment information;
at least one of the authentication service, the user authentication device and the service provider synchronizes the private cryptographic key and the public cryptographic key between the user authentication device and the service provider; and
information associated with the synchronization is stored at the authentication service in association with the enrollment record as cryptographic key synchronization information, the cryptographic key synchronization information indicating that an asymmetric cryptographic key pair is synchronized between the user authentication device and the service provider;
responsive to an authentication request received from the service provider for the user identifier, the authentication request comprising an authentication challenge that is cryptographically secured with the public cryptographic key of the service provider;
using the user identifier to identify the synchronization information established with the authentication service that identifies a destination of the user authentication device having the private cryptographic key corresponding to the public cryptographic key of the service provider;
in response to identifying the destination based on the synchronization information, routing by the authentication service the authentication request to the user authentication device;
receiving from the user authentication device an authentication response to the authentication request, the authentication response comprising a challenge response to the authentication challenge, the authentication response being cryptographically secured using the private cryptographic key of the destination; and
in response to receiving the authentication response from the destination, routing the authentication response to the service provider based on the synchronization information.

10. The method of claim 9 ,
wherein the service provider decrypts and verifies the signed authentication response by using the public cryptographic key.

11. The method of claim 9 ,
wherein the user authentication device decrypts the authentication

Assignees

• Duo Security Inc

Inventors

• Oberheide Jon
• Song Douglas

Classifications

• H04L9/3215 Primary

  using a plurality of channels (network architectures or network communication protocols using different networks H04L63/18) · CPC title

• H04L63/12 Primary

  Applying verification of the received information (cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32) · CPC title

• H04L9/3247

  involving digital signatures · CPC title

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L63/18

  using different networks or channels, e.g. using out of band channels (cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215) · CPC title