Identity authentication using credentials

Patent metadata

Field	Value
Publication number	US-9787669-B2
Application number	US-201313826777-A
Country	US
Kind code	B2
Filing date	Mar 14, 2013
Priority date	Mar 14, 2013
Publication date	Oct 10, 2017
Grant date	Oct 10, 2017

Abstract

A method and system may allow for authenticating a computing device. A computing device may send an authentication request over a network to an authentication computing device. The authentication request may include a user name and a password. The user name may include a credential and the password may be a digitally signed version of the user name. The authentication computing device may authenticate the requesting computing device by decrypting the password and comparing the received user name to the decrypted password.

First claim

We claim:

1. A method comprising:
receiving, from a computing device, an authentication request comprising a user name and a corresponding password, wherein:
the user name is in a first format, and comprises:
a value that is based on a time at which the user name was generated; and
a public key for the computing device; and

the password is encrypted, and is generated based on the user name;

extracting the public key from the user name;
decrypting the password, based on the public key, to create a decrypted password;
converting the user name from the first format to a second format;
comparing the decrypted password to the second format user name;
verifying, based on the value, the authentication request; and
in response to determining that the decrypted password corresponds to the second format user name, and in response to the verifying the authentication request, granting the authentication request from the computing device.

2. The method of claim 1 , wherein the password comprises a converted version of the user name, wherein the converted version of the user name has been encrypted using a private key for the computing device.

3. The method of claim 1 , wherein the user name comprises a digital certificate issued to the computing device from a trusted authority.

4. The method of claim 1 , wherein the password comprises a digital signature of the user name.

5. The method of claim 1 , wherein the converting the user name to the second format comprises hashing the user name, and wherein the decrypted password comprises a hash of the user name.

6. The method of claim 1 , further comprising:
verifying the authentication request by:
extracting the value from the user name, wherein the value comprises a time; and
determining, based on comparing the time from the value to a time of a stored time stamp associated with a previous authentication of the computing device, whether to verify the value.

7. The method of claim 6 , wherein the verifying the value is performed in response to determining that a difference between the time from the value and the time of the stored time stamp is greater than a threshold.

8. A system comprising:
a computing device comprising:
a first processor; and
a memory storing instructions that, when executed by the first processor, cause the computing device to:
generate an authentication request comprising a user name and a corresponding password, wherein:
the user name is in a first format, and comprises:
 a value that is based on a time at which the user name was generated; and
 a public key for the computing device; and
the password is encrypted, and is generated based on the user name;

send the authentication request; and

an authentication device comprising:
a second processor; and
a memory storing instructions that, when executed by the second processor, cause the authentication device to:
receive, from the computing device, the authentication request;
extract the public key from the user name;
decrypt the password, based on the public key, to create a decrypted password;
convert the user name from the first format to a second format;
compare the decrypted password to the second format user name;
verifying, based on the value, the authentication request; and
in response to determining that the decrypted password corresponds to the second format user name, and in response to the verifying the authentication request, grant the authentication request from the computing device.

9. The system of claim 8 , wherein the verifying the authentication request comprises:
extracting the value from the user name, wherein the value comprises a time stamp;
comparing the time stamp of the value to a previous time stamp that is associated with the computing device; and
determining that the time stamp of the value is valid in response to determining that the previous time stamp is chronologically earlier in time to the time stamp of the value.

10. The system of claim 9 , wherein the determining that the time stamp of the value is valid in response to determining that the previous time stamp is chronologically earlier in time to the time stamp of the value comprises:
determining that a duration between the time stamp of the value and the previous time stamp is greater than a threshold.

11. The system of claim 8 , wherein the password has been encrypted using a private key for the computing device, and wherein the public key is associated with the private key.

12. The system of claim 8 , wherein the user name comprises a digital certificate issued to the computing device from a trusted authority.

13. The system of claim 8 , wherein the verifying the authentication request comprises:
extracting the value from the user name, wherein the value comprises a random number;
comparing the random number of the value to a previous random number that is associated with the computing device; and
determining that the random number of the value is valid in response to determining that the previous random number is different from the random number of the value.

14. A method comprising:
receiving, from a computing device, an authentication request comprising a user name and a corresponding password, wherein:
the user name is in a first format, and comprises:
a random number that is based on a time at which the user name was generated; and
a public key for the computing device; and

the password is encrypted, and is generated based on the user name;

extracting the public key from the user name;
decrypting the password, based on the public key, to create a decrypted password;
converting the user name from the first format to a second format;
comparing the decrypted password to the second format user name;
verifying, based on the random number, the authentication request; and
in response to determining that the decrypted password corresponds to the second format user name, and in response to the verifying the authentication request, granting the authentication request from the computing device.

15. The method of claim 14 , further comprising:
extracting, from the user name, the random number, wherein the random number is associated with an identification of the computing device; and
verifying the random number.

16. The method of claim 15 , wherein the verifying the random number comprises:
comparing the extracted random number to a previous random number associated with the computing device; and
authenticating the extracted random number if the previous random number is different from the extracted random number.

Assignees

• Comcast Cable Comm Llc

Inventors

• Bransom Kris
• Zarcone Christopher

Classifications

• H04L63/083 Primary

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• H04L9/3226

  using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083) · CPC title

• H04L9/3247

  involving digital signatures · CPC title

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L9/321

  involving a third party or a trusted authority · CPC title