Shared registration system multi-factor authentication
A system and method for establishing a chain of trust from a registrant to a registry. A registrant request to a registrar to change a domain name record includes at least one registrant factor, such as a one time password. The registrar can formulate an extended EPP command that includes the factor to effectuate the change and send it to a registry. The registry can verify the at least one factor using at least one validation server. If the factor is successfully verified, the EPP can be processed by the registry. If the factor is not verified, the EPP command may not be processed and an error message may be generated and sent to the registrar.
1. A method for authentication of a registrant, comprising:
receiving, at a registry server, an extended extensible provisioning protocol (EPP) command from a registrar server, the EPP command including:
a registrant one-time password generated by the registrant, and
a registrant identifier;
sending the registrant one-time password and the registrant identifier from the registry server to a validation server;
receiving, at the registry server, a verification message from the validation server; and
processing, at the register server, in response to the verification message that is received from the validation server, the EPP command that is received from the registrar server.
2. The method of claim 1 , wherein the EPP command includes at least one of: transfer, create, delete, renew and update.
3. The method of claim 1 , wherein the registrant identifier is a token identifier from which one-time passwords can be generated.
4. The method of claim 1 , wherein the registrant identifier is based on a registrant user identifier.
5. A method for authentication, of a registrant, comprising:
receiving, at a registry server, a message from a registrar server, wherein the message includes at least one registrant factor that is generated by the registrant;
sending the at least one registrant factor to at least one validation server;
receiving at least one verification message from the at least one validation server; and
processing, at the registry server, in response to the at least one verification message that is received from the at least one validation server, the message that is received from the registrar server.
6. The method of claim 5 , wherein the message can include an extensible provisioning protocol (EPP) command.
7. The method of claim 5 , wherein the message can be an extended extensible provisioning protocol (EPP) command that includes at least one factor.
8. The method of claim 5 , wherein the message can include at least one extensible provisioning protocol (EPP) command from the group of: transfer, create, delete, renew and update.
9. The method of claim 5 , wherein the factor includes at least one of: biometric information, a one-time password, public key infrastructure (PKI) information, short message service (SMS) information, automated voice call identification and a device identifier.
10. The method of claim 5 , further including: receiving, at the registry, registrant information.
11. The method of claim 10 , wherein the registrant information includes at least one of: a registrant token identifier, information based upon a registrant logon identifier, and registrant network address information.
12. The method of claim 5 , further comprising:
sending the at least one registrant factor to a second validation server for verification.
13. The method of claim 5 , wherein processing the message includes at least one of: transferring a domain name record, creating the domain name record, deleting the domain name record, renewing the domain name record, and updating the domain name record.
14. The method of claim 12 , wherein the at least one registrant factor is sent to the second validation server in response to the message comprising an extensible provisioning protocol (EPP) transfer command.
15. The method of claim 5 , further comprising:
receiving a registrant factor for messages associated with domain names below a threshold value; and
receiving a plurality of registrant factors for messages above a threshold value.
16. The method of claim 5 , wherein the message further comprises an old token identifier, a one-time password associated with the old token identifier, and a new token identifier; and the processing further comprises associating the new token identifier with the registrar.