Authentication of PKI credential by use of a one time password and pin

Patent metadata

Field	Value
Publication number	US-9780950-B1
Application number	US-201313918269-A
Country	US
Kind code	B1
Filing date	Jun 14, 2013
Priority date	Mar 15, 2013
Publication date	Oct 3, 2017
Grant date	Oct 3, 2017

Abstract

A method and system for authenticating a credential via a one time password which includes receiving a user ID, a client ID, and the one time password from a client device, and then validating the one time password based on the user ID and the credential ID. Upon validating the one time password, a response is sent to the client device, and the response includes at least one of an authorization to access a private key stored on the client device or at least a portion of the private key.

First claim

What is claimed is:

1. A method comprising:
receiving at a server, prior to accessing a private key stored at a client device, a request to validate a one time password from the client device, wherein the request comprises a user identification (ID), a credential ID, the one time password, and a key ID of the private key, wherein the key ID is for identifying the private key out of a plurality of private keys associated with a user having the user ID and is different from the private key;
validating, by a processing device at the server, the one time password received from the client device based on the user ID and the credential ID within a time period corresponding to a validity of the one time password; and
in response to validating the one time password within the time period, sending a response from the server to the client device, the response comprising:
a portion of the private key that is stored at the server and corresponds to the key ID; and
an authorization to access another portion of the private key that corresponds to the key ID and a certificate associated with the client device, wherein the authorization to access the another portion of the private key further comprises an authorization for importation of the another portion of the private key from a separate hardware device different from the server and client device;

wherein the another portion of the private key and the certificate are stored locally in a secure container on the client device;
in response to the sending a response from the server to the client device, the client device is to access the another portion of the private key located in the secure container on the client device, wherein the accessing the another portion of the private key located in the secure container on the client device further comprises the client device importing the portion of the private key from the separate hardware device and storing the another portion of the private key in the secure container; and
accessing the another portion of the private key, accessing the portion of the private key that is stored at the server, and combining both private key portions to form the private key stored at the client device, in response to the importation of the another portion of the private key from the separate hardware device.

2. The method of claim 1 , wherein the response comprises a cloud portion of the private key.

3. The method of claim 1 further comprising:
upon execution of an initial key generation function by the client device, receiving, by the server, a cloud portion of the private key.

4. A system comprising:
a memory; and
a processing device coupled to the memory to:
receive, at a server, prior to accessing a private key stored at a client device, a request to validate a one time password from a client device, wherein the request comprises a user ID, a credential ID, the one time password, and a key ID of the private key, wherein the key ID is for identifying the private key out of a plurality of private keys associated with a user having the user ID and is different from the private key;
validate, at the server, the one time password received from the client device based on the user ID and the credential ID within a time period corresponding to a validity of the one time password; and
in response to validating the one time password within the time period, sending a response from the server to the client device, the response comprising:
a portion of the private key that is stored at the server and corresponds to the key ID; and
an authorization to access another portion of the private key that corresponds to the key ID and a certificate associated with the client device, wherein the authorization to access the another portion of the private key further comprises an authorization for importation of the another portion of the private key from a separate hardware device different from the server and client device;

wherein the another portion of the private key and the certificate are stored locally in a secure container on the client device;
in response to the sending a response from the server to the client device, the client device is to access the another portion of the private key located in the secure container on the client device, wherein the accessing the another portion of the private key located in the secure container on the client device further comprises the client device importing the portion of the private key from the separate hardware device and storing the another portion of the private key in the secure container; and
accessing the another portion of the private key, accessing the portion of the private key that is stored at the server, and combining both private key portions to form the private key stored at the client device, in response to the importation of the another portion of the private key from the separate hardware device.

5. The system of claim 4 , wherein the response comprises a cloud portion of the private key.

6. The system of claim 4 , wherein the processing device is further to, upon execution of an initial key generation function by the client device, receive a cloud portion of the private key.

7. A non-transitory computer readable storage medium including instructions that, when executed by a processing device, cause the processing device to perform operations comprising:
receiving, at a server, prior to accessing a private key stored at a client device, a request to validate a one time password from a client device, wherein the request comprises a user ID, a credential ID, the one time password, and a key ID of the private key, wherein the key ID is for identifying the private key out of a plurality of private keys associated with a user having the user ID and is different from the private key;
validating, at the server, the one time password received from the client device based on the user ID and the credential ID within a time period corresponding to a validity of the one time password; and
in response to validating the one time password within the time period, sending a response from the server to the client device, the response comprising;
a portion of the private key that is stored at the server and corresponds to the key ID; and
an authorization to access another portion of the private key that corresponds to the key ID and a certificate associated with the client device, wherein the authorization to access the another portion of the private key further comprises an authorization for importation of the another portion of the private key from a separate hardware device different from the server and client device;

wherein the another portion of the private key and the certificate are stored locally in a secure container on the client device;
in response to the sending a response from the server to the client device, the client device is to access the another portion of the private key located in the secure container on the client device, wherein the accessing the another portion of the private key located in the secure container on the client device further comprises the client device importing the portion of the private key from the separate hardware device and storing the another portion of the private key in the secure container; and
accessing the another portion of the private key, accessing the portion of the private key that is stored at the server, and combining both private key portions to form the private key stored at the client device, in response to the importation of the another portion of the private key from the separate hardware device.

8. The non-transitory computer readable storage medium of claim 7 , wherein the response comprises a cloud portion of the private key.

9. The non-transitory com

Assignees

• Symantec Corp

Inventors

• Dundas Alan
• Herskedal Eirik

Classifications

• H04L9/0897

  involving additional devices, e.g. trusted platform module [TPM], smartcard or USB · CPC title

• H04L9/3228

  One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key · CPC title

• H04L9/321 Primary

  involving a third party or a trusted authority · CPC title

• H04L9/3247

  involving digital signatures · CPC title

• H04L63/0838 Primary

  using one-time-passwords · CPC title