Method and apparatus for trusted authentication and logon

Patent metadata

Field	Value
Publication number	US-9490984-B2
Application number	US-55890709-A
Country	US
Kind code	B2
Filing date	Sep 14, 2009
Priority date	Sep 14, 2009
Publication date	Nov 8, 2016
Grant date	Nov 8, 2016

Abstract

A method and apparatus for trusted authentication and logon is disclosed. A trusted platform module (TPM) based logon method is presented for authentication and access. A user registers an identity with an identity provider that is tightly bound to the user's specific platform, e.g., the TPM. If the user decides to login, for example to a service provider using this identity, the identity provider challenges the user to provide the correct credentials. The credentials consist of a TPM generated ticket, that is, a credential chain. This allows the user to login without the need for a password at the identity provider.

First claim

What is claimed is:

1. A method for trusted authentication and access from a user platform associated with a user, the user platform comprising a trusted module, the method comprising:
logging onto a service provider using a predetermined identity associated with the user, wherein the user platform is directed to an identity provider that is associated with the predetermined identity;
the user platform receiving an authentication challenge from the identity provider;
in response to the authentication challenge, performing an authentication of the user;
when the authentication is successful, the user platform obtaining a certificate that indicates a certification of the trusted module by a certification authority;
generating, at the trusted module; an authentication response to the authentication challenge wherein the authentication response comprises the certificate, and the certificate indicates the certification of the trusted module by the certification authority;
if a verification of the authentication response is successful, the user platform accessing the service provider upon receiving a status message indicating that the verification was successful, thereby ensuring that the user of the user platform is legitimate; and
if the verification fails, receiving a message associated with a cause of the failed verification.

2. The method of claim 1 , wherein the predetermined identity is represented by a universal resource identifier.

3. The method of claim 1 , wherein the authentication response comprises a ticket that comprises data that validates an authenticity of the ticket.

4. The method of claim 1 , wherein the authentication challenge includes at least the predetermined identity and a type of service request.

5. The method of claim 4 , further comprising generating a certified signing key for signing the predetermined identity and the service request.

6. The method of claim 1 , wherein the predetermined identity is further associated with an attestation identity key (AIK), the method further comprising providing a password for the AIK corresponding to the predetermined identity and a storage root key password for authenticating usage of the trusted module.

7. The method of claim 1 , wherein the predetermined identity is further associated with an attestation identity key (AIK), and wherein the certificate corresponds to the AIK.

8. The method of claim 7 , wherein the certificate is obtained on a condition that a previously acquired certificate is unavailable.

9. The method of claim 1 , wherein the predetermined identity is further associated with an attestation identity key (AIK), the method further comprising:
sending a positive challenge acknowledgement in response to the authentication challenge received from the identity provider;
receiving a nonce in response to the positive challenge acknowledgement sent to the identity provider; and
generating a signed quote, wherein the signed quote is signed by the AIK and includes the nonce.

10. The method of claim 1 , wherein the predetermined identity is further associated with an attestation identity key (AIK), and wherein the authentication response comprises a certified signing key (CSK) signed predetermined identity, a CSK signed request, a CSK public key, and a privacy certification authority (PCA) issued AIK certificate.

11. The method of claim 10 , further comprising:
retrieving, from the trusted module, a signed quote of one or more platform configuration register (PCR) values that describe a configuration of the user platform;
in response to the authentication challenge, transmitting the signed quote of the PCR values from the trusted module and a measurement log, on a condition that the user platform accepted the authentication challenge, to the identity provider.

12. The method of claim 11 , wherein the verification indicates that the identity provider validated a timestamp of the AIK certificate, verified a signature of the certificate authority on the AIK certificate, verified an AIK signature on the CSK public key, verified the CSK signed predetermined identity, verified the CSK signed request, validated the measurement log, and verified the quote.

13. The method of claim 1 , further comprising receiving an encrypted cookie, protected by a certified signing key for subsequent service provider access.

14. The method of claim 1 , % herein the authentication challenge includes an authorization challenge.

15. The method of claim 1 , further comprising receiving an attestation challenge.

16. A user platform, which is associated with a user, for supporting trusted authentication and access, the user platform comprising communication circuitry such that the user platform is communicatively coupled to a network via its communication circuitry, wherein the user platform further comprises a processor, a trusted module, and a memory, the memory containing computer-executable instructions that when executed by the processor, cause the processor to:
access a service provider using a predetermined identity associated with the user, wherein the user platform is configured to be directed to an identity provider associated with the predetermined identity, and wherein the user platform is further configured to obtain a certificate that indicates a certification of the trusted module by a certification authority, the trusted module comprising a microcontroller configured to generate an authentication response to an authentication challenge received from an identity provider, wherein the authentication response comprises the certificate, and wherein the certificate indicates the certification of the trusted module by the certification authority;
if a verification of the authentication response is successful, access the service provider upon receiving a status message indicating that the verification was successful, thereby ensuring that the user of the user platform is legitimate; and
if the verification fails, receive a message associated with a cause of the failed verification.

17. The user platform of claim 16 , wherein the predetermined identity is further associated with an attestation identity key (AIK), and wherein the authentication response includes a certified signing key (CSK) signed predetermined identity, a CSK signed request, a CSK public key, and the certificate, and wherein the certificate comprises a privacy certification authority (PCA) issued AIK certificate.

18. The user platform of claim 17 , wherein the user platform is further configured to obtain an AIK signed quote and a measurement log from the trusted module.

19. The user platform of claim 16 , wherein the predetermined identity is further associated with an attestation identity key (AIK), and wherein the user platform is further configured to receive a nonce and generate an AIK signed quote that includes the nonce from the trusted module.

20. A method for trusted authentication and access from a user platform associated with a user, the user platform comprising a trusted module, the method comprising:
logging onto a service provider using a predetermined identity associated with the user, wherein the user platform is directed to an identity provider that is associated with the predetermined identity, the predetermined identity further associated with an attestation identity key (AIK);
the user platform receiving an authentication challenge from the identity provider;
retrieving, from the trusted module, a signed quote of one or more platform configuration register (PCR) values that

Assignees

• Leicher Andreas
• Schmidt Andreas U
• Interdigital Patent Holdings Inc

Inventors

• Leicher Andreas
• Schmidt Andreas U

Classifications

• H04L63/0807 Primary

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title

• H04L9/3234 Primary

  involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853) · CPC title

• H04L63/062

  for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819) · CPC title

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L63/083

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title