Authentication system and method
View Patent ↗A security protocol for use by computing devices communicating over an unsecured network is described. The security protocol makes use of secure data provided to a peripheral memory device from a server via a secure connection. When the peripheral memory device is coupled to a computing device that attempts to establish a secure connection to the server, the secure data is used to verify that the server is authentic. Similarly, the secure data assists the server in verifying that the request to access the server is not being made by a malicious third party.
1. A method comprising:
providing a secure data communication path between a server and a computer readable memory that is non-volatile;
storing secure data from the server on the computer readable memory;
after storing the secure data, severing the secure data communication path;
providing a communications path via an unsecured network between the server and a client computing device in data communication with the computer readable memory;
verifying an identity of the server in dependence upon the secure data stored within the computer readable memory;
verifying an identity of the computer readable memory in dependence upon the secure data;
providing fictitious credential data from the client computing device to the server, wherein a security filter receives the fictitious credential data at without allowing the server to process the fictitious credential data, the security filter providing legitimate credential data associated with the computer readable memory to the server in place of the fictitious credential data;
wherein said secure data from said server is stored on said computer readable memory while said computer readable memory is not coupled to said client computing device.
2. A method according to claim 1 comprising:
providing a peripheral memory storage device comprising the computer readable memory and an interface for supporting data communication between the computer readable memory and the client computing device;
wherein said data communication between the computer readable memory and the client computing device occurs only after said secure data is stored on said computer readable memory.
3. A method according to claim 2 wherein the interface is a USB interface.
4. A method according to claim 1 comprising:
upon verifying an identity of the server, initiating a security protocol comprising a generating of private key data and an exchange of public key data, the public key data generated in dependence upon the private key data.
5. A method according to claim 1 wherein verifying an identity of the server comprises receiving encrypted data from the server, the encrypted data encrypted according to a predetermined protocol and encrypted in dependence upon a pseudo random nonce.
6. A method according to claim 1 wherein the secure data comprises an indication of the server address.
7. A method according to claim 6 wherein the secure data comprises an indication of user authentication data for a user for accessing a service, one of the service and an authentication process for accessing the service accessible at the server address.