Device pre-authentication

Patent metadata

Field	Value
Publication number	US-12003493-B2
Application number	US-202117197616-A
Country	US
Kind code	B2
Filing date	Mar 10, 2021
Priority date	Mar 10, 2021
Publication date	Jun 4, 2024
Grant date	Jun 4, 2024

Abstract

A method, a device, and a non-transitory storage medium are described in which an pre-authentication service is provided. The service may support a transport layer security handshake and determine authentication based on the initial message. The service may provide for the generation of a message that initiates a handshake between devices in which the message includes an authentication string used for authentication. The service may provide for the generation of another authentication string for comparison. The service may also support authorization of a device. The service may minimize potential malicious attacks and activities between the devices.

First claim

What is claimed is:

1. A method comprising:
receiving, by a first device from a second device, a first message that includes a first authentication string including a password or a message authentication code, and initiates a handshaking procedure with the first device;
generating, by the first device, a second authentication string based on the first authentication string;
comparing, by the first device, the second authentication string and the first authentication string;
determining, by the first device based on the comparing, whether the second device is authenticated; and
determining, by the first device, whether to establish a connection with the second device based on the determining.

2. The method of claim 1 , wherein the handshaking procedure is a transport layer security (TLS) handshaking procedure, and the first message is a client hello of the TLS that includes the first authentication string in an extension field of the client hello.

3. The method of claim 2 , further comprising:
omitting, by the first device, to transmit a message to the second device based on determining that the second device is not authenticated.

4. The method of claim 1 , further comprising:
identifying, by the first device, a secret key based on an identifier of the second device included in the first authentication string, and wherein the generating of the second authentication string further comprises:
generating, by the first device, the second authentication string based on the secret key and other data included in the first authentication string.

5. The method of claim 1 , further comprising:
generating, by the first device, a secret key based on a master key and an identifier of the second device included in the first authentication string, and wherein the generating of the second authentication string further comprises:
generating, by the first device, the second authentication string based on the secret key and other data included in the first authentication string.

6. The method of claim 5 , wherein the other data includes at least one of an identifier that identifies the master key or an identifier of an anti-malware component of the second device.

7. The method of claim 1 , further comprising:
issuing, by the first device to the second device before the receiving, an identifier of the second device and a secret key.

8. The method of claim 1 , further comprising:
determining, by the first device, whether the second device is an authorized device based on the first authentication string.

9. A device comprising:
a processor configured to:
receive, from a second device, a first message that includes a first authentication string including a password or a message authentication code, and initiates a handshaking procedure with the device;
generate a second authentication string based on the first authentication string;
compare the second authentication string and the first authentication string;
determine, based on the comparison, whether the second device is authenticated; and
determine whether to establish a connection with the second device based on the determination.

10. The device of claim 9 , wherein the handshaking procedure is a transport layer security (TLS) handshaking procedure, and the first message is a client hello of the TLS that includes the first authentication string in an extension field of the client hello.

11. The device of claim 9 , wherein the processor is further configured to:
omit to transmit a message to the second device based on a determination that the second device is not authenticated.

12. The device of claim 9 , wherein the processor is further configured to:
identify a secret key based on an identifier of the second device included in the first authentication string, and wherein for the generation of the second authentication string, the processor is further configured to:
generate the second authentication string based on the secret key and other data included in the first authentication string.

13. The device of claim 9 , wherein the processor is further configured to:
generate a secret key based on a master key and an identifier of the second device included in the first authentication string, and wherein for the generation of the second authentication string, the processor is further configured to:
generate the second authentication string based on the secret key and other data included in the first authentication string.

14. The device of claim 13 , wherein the other data includes at least one of an identifier that identifies the master key or an identifier of an anti-malware component of the second device.

15. The device of claim 9 , wherein the processor is further configured to:
issue to the second device before the receipt of the first message, an identifier of the second device and a secret key.

16. The device of claim 9 , wherein the processor is further configured to:
determine whether the second device is an authorized device based on the first authentication string.

17. A non-transitory computer-readable storage medium storing instructions executable by a processor of a device, which when executed cause the device to:
receive, from a second device, a first message that includes a first authentication string including a password or a message authentication code, and initiates a handshaking procedure with the device;
generate a second authentication string based on the first authentication string;
compare the second authentication string and the first authentication string;
determine, based on the comparison, whether the second device is authenticated; and
determine whether to establish a connection with the second device based on the determination.

18. The non-transitory computer-readable storage medium of claim 17 , wherein the handshaking procedure is a transport layer security (TLS) handshaking procedure, and the first message is a client hello of the TLS that includes the first authentication string in an extension field of the client hello.

19. The non-transitory computer-readable storage medium of claim 17 , wherein the instructions further comprise instructions, which when executed cause the device to:
omit to transmit a message to the second device based on a determination that the second device is not authenticated.

20. The non-transitory computer-readable storage medium of claim 17 , wherein for the generation of the second authentication string, the instruction further comprise instructions, which when executed cause the device to:
generate the second authentication string based on a secret key and other data included in the first authentication string, wherein the other data includes at least one of an identifier that identifies a master key or an identifier of an anti-malware component of the second device.

Assignees

• Verizon Patent & Licensing Inc

Inventors

• Bilger Brent R
• Patel Rajesh M
• Venugopal Shailesh K
• Dave Anurag
• Basmaji Michel J

Classifications

• H04L63/08 Primary

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• G06F21/45

  Structures or tools for the administration of authentication · CPC title

• H04L9/0866 Primary

  involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics · CPC title

• H04L63/166

  at the transport layer · CPC title

• H04W12/062

  Pre-authentication · CPC title