Systems and methods for anonymous authentication using multiple devices

Patent metadata

Field	Value
Publication number	US-2016182500-A1
Application number	US-201514788152-A
Country	US
Kind code	A1
Filing date	Jun 30, 2015
Priority date	Dec 22, 2014
Publication date	Jun 23, 2016
Grant date	—

Abstract

A system and method of anonymous authentication is described. In operation, the authenticator receives a request to access a resource from one of the user devices of an associated set of user devices, wherein each of the user devices is registered to at least one user requesting access to the resource registered to at least two users. The authenticator generates and transmits an authentication challenge in response to the request to a subset of the user devices. A user device subsequently generates and transmits a response to the authentication challenge to the authenticator. The authenticator determines whether the responses received from the one or more user devices constitutes a valid response and grants any one or more of the user devices of the associated set of user devices access to the resource if the responses received from the user devices constitutes a valid response to the authentication challenge.

First claim

1 . A method of authentication using at least two user devices of an associated set of user devices; the method comprising:
registering each user device of an associated set of user devices with an authenticator computing device, wherein each of the user devices of the associated set of user devices are registered to at least one user; receiving, at the authenticator computing device, a request to access a resource from one user device of the associated set of user devices, wherein the one user device requesting access to the resource is registered to more than one user; generating an authentication challenge at the authenticator computing device in response to the request; transmitting the authentication challenge to a subset of user devices of the associated set of user devices registered with the authenticator computing device, wherein the subset of user devices comprises at least one user device other than the one user device requesting access to the resource; generating at least one response to the authentication challenge at one or more user devices of the subset of user devices; transmitting the at least one response to the authenticator computing device; determining, at the authenticator computing device, if the at least one response constitutes a valid response to the authentication challenge; and granting any one or more of the user devices of the associated set of user devices registered with authenticator computing device access to the resource if the at least one response received at the authenticator computing device constitutes a valid response to the authentication challenge.

2 . The method of claim 1 , wherein registering each of the user devices of the associated set of user devices with an authenticator computing device, wherein each of the user devices of the associated set of user devices are registered to at least one user further comprises storing at least one user credential and storing at least one verified device identifier from each of the user devices of the associated set of user devices at the authenticator computing device.

3 . The method of claim 1 , wherein transmitting the authentication challenge to a subset of user devices of the associated set of user devices further comprises, transmitting the authentication challenge from the authenticator computing device to the subset of user devices according to a forwarding policy of the authenticator computing device.

4 . The method of claim 1 , wherein transmitting the authentication challenge to a subset of user devices of the associated set of user devices further comprises, transmitting the authentication challenge from the authenticator computing device to the user device requesting access to the resource and the user device requesting access to the resource subsequently transmitting the authentication challenge to the other user devices of the subset of user devices according to a forwarding policy of the user device requesting access to the resource.

5 . The method of claim 1 , wherein generating at least one response to the authentication challenge at one or more user devices of the subset of user devices further comprises, generating a response to the authentication challenge at each of the user devices of the subset of user devices according to a response policy of each of the user devices of the subset of user devices.

6 . The method of claim 5 further comprising, transmitting the response to the authentication challenge generated at each of the user devices of the subset of user devices to the authenticator computing device.

7 . The method of claim 6 , wherein determining, at the authenticator computing device, if the at least one response constitutes a valid response to the authentication challenge further comprises, determining if each response to the authentication challenge generated at each of the users devices of the subset of user devices constitutes a valid response.

8 . The method of claim 6 , wherein determining, at the authenticator computing device, if the at least one response constitutes a valid response to the authentication challenge further comprises, determining if each response to the authentication challenge generated at each of user devices of the subset of user devices constitutes a valid response according to a validation policy of the authenticator computing device.

9 . The method of claim 1 , wherein the authentication challenge is an encrypted or cryptographically signed authentication challenge.

10 . The method of claim 1 , wherein the authentication challenge comprises a Message Authentication Code (MAC).

11 . The method of claim 1 , wherein the authentication challenge comprises a timestamp.

12 . The method of claim 1 , wherein a transmission technique for authentication challenge is selected from the group consisting of a QR code, a sound wave, a light wave, an infrared signal, an NFC, a Bluetooth signal, a radio signal, an image, a state of a memory device and a vibration.

13 . The method of claim 1 , wherein the resource is selected from the group consisting of an application, a file, a process, a port, a service, a network bandwidth, a device, a memory and a processor time.

14 . One or more non-transitory computer-readable media having computer-executable instructions for performing a method of running a software program on a computing device, the method including issuing instructions from the software program, the instructions comprising:
registering each user device of an associated set of user devices with an authenticator computing device, wherein each of the user devices of the associated set of user devices are registered to at least one user; receiving, at the authenticator computing device, a request to access a resource from one user device of the associated set of user devices, wherein the one user device requesting access to the resource is registered to more than one user; generating an authentication challenge at the authenticator computing device in response to the request; transmitting the authentication challenge to a subset of user devices of the associated set of user devices registered with the authenticator computing device, wherein the subset of user devices comprises at least one user device other than the one user device requesting access to the resource; generating at least one response to the authentication challenge at one or more user devices of the subset of user devices; transmitting the at least one response to the authenticator computing device; determining, at the authenticator computing device, if the at least one response constitutes a valid response to the authentication challenge; and granting any one or more of the user devices of the associated set of user devices registered with the authenticator computing device access to the resource if the at least one response received at the authenticator computing device constitutes a valid response to the authentication challenge.

15 . The media of claim 14 , further comprising instructions for registering each of the user devices of the associated set of user devices to a user with an authenticator computing device, wherein each of the user devices of the associated set of user devices are registered to at least one user, by storing at least one user credential and storing at least one verified device identifier from each of the user devices of the associated set of user devices at the authenticator computing device.

16 . The media of claim 14 , further comprising instructions for transmitting the authentication challenge from the authenticator computing device to the subset o

Assignees

• Ligatti Jarred Adam
• Goldgof Dmitry
• Cetin Cagri
• Subils Jean-Baptiste
• Univ South Florida

Inventors

• Ligatti Jarred Adam
• Goldgof Dmitry
• Cetin Cagri
• Subils Jean-Baptiste

Classifications

• H04L63/0407

  wherein the identity of one or more communicating identities is hidden (cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00) · CPC title

• H04L63/0853 Primary

  using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234) · CPC title

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L9/3271 Primary

  using challenge-response · CPC title

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title