Cryptographic device operable in a challenge-response mode
View Patent ↗Methods, apparatus and articles of manufacture for implementing cryptographic devices operable in a challenge-response mode are provided herein. A method includes storing a set of authentication information in a first cryptographic device associated with a user, receiving a challenge in the first cryptographic device in connection with a user authentication request responsive to a request from the user to access a protected resource, wherein the challenge comprises an index of at least one non-sequential portion of the authentication information stored in the first cryptographic device, and outputting a non-sequential portion of the authentication information from the set of authentication information stored in the first cryptographic device in response to the challenge for use in authenticating the user.
1. A method comprising:
storing a set of authentication information in a first cryptographic device associated with a user;
receiving a challenge in the first cryptographic device in connection with a user authentication request responsive to a request from the user to access a protected resource, wherein the challenge comprises an index of at least one non-sequential portion of the authentication information stored in the first cryptographic device;
outputting the at least one non-sequential portion of the authentication information from the set of authentication information stored in the first cryptographic device in response to the challenge for use in authenticating the user;
replacing the at least one non-sequential portion of the authentication information in the first cryptographic device with one or more items of filler information subsequent to said outputting.
2. The method of claim 1 , wherein the first cryptographic device comprises a stored-passcode authentication token, wherein said stored-passcode authentication token is loaded with a set of pre-computed passcodes.
3. The method of claim 1 , wherein the first cryptographic device comprises a hardware component or a software component resident on a device.
4. The method of claim 1 , wherein the set of authentication information comprises one or more passcodes.
5. The method of claim 4 , wherein the one or more passcodes comprise a set of random passcodes and/or a set of pseudo-random passcodes.
6. The method of claim 1 , further comprising:
eradicating the at least one non-sequential portion of the authentication information outputted by the first cryptographic device in response to the challenge after the first cryptographic device emits the at least one non-sequential portion of the authentication information in response to the challenge.
7. The method of claim 1 , further comprising:
assigning a pseudo-random permutation to the first cryptographic device;
storing a cryptographic device-specific counter value in a second cryptographic device; and
receiving one or more subsequent challenges that are issued incrementally by the second cryptographic device based on a token-specific counter value.
8. The method of claim 1 , further comprising:
partitioning the set of authentication information in the first cryptographic device into one or more epochs, wherein an epoch is a predetermined interval.
9. The method of claim 8 , further comprising:
advancing to a subsequent epoch in the first cryptographic device when the first cryptographic device has been challenged on and emitted all authentication information for a current epoch.
10. The method of claim 8 , further comprising:
advancing to a subsequent epoch in the first cryptographic device when the first cryptographic device receives a particular fixed challenge value.
11. The method of claim 8 , further comprising:
advancing to a subsequent epoch in the first cryptographic device upon receiving an epoch-specific stored secret for a current epoch.
12. The method of claim 8 , further comprising:
advancing to a subsequent epoch in the first cryptographic device via use of time-based epochs, wherein each epoch lasts for a pre-determined period of time, and the first cryptographic device advances to the subsequent epoch automatically upon completion of the pre-determined period of time associated with a current epoch.
13. The method of claim 8 , further comprising:
facilitating detection of de-synchronization between the first cryptographic device and a second cryptographic device by embedding an epoch-specific hint in the set of authentication information in the first cryptographic device.
14. An article of manufacture comprising a non-transitory processor-readable storage medium having processor-readable instructions tangibly embodied thereon which, when implemented, cause a processor to carry out the steps of the method of claim 1 .
15. An apparatus comprising a cryptographic device, comprising:
a memory; and
at least one processor coupled to the memory and operative for:
storing a set of authentication information in a first cryptographic device associated with a user;
receiving a challenge in the first cryptographic device in connection with a user authentication request responsive to a request from the user to access a protected resource, wherein the challenge comprises an index of at least one non-sequential portion of the authentication information stored in the first cryptographic device;
outputting the at least one non-sequential portion of the authentication information from the set of authentication information stored in the first cryptographic device in response to the challenge for use in authenticating the user;
replacing the at least one non-sequential portion of the authentication information in the first cryptographic device with one or more items of filler information subsequent to said outputting.
16. A method comprising:
issuing a challenge to a first cryptographic device in connection with a user authentication request responsive to a request from the user to access a protected resource, wherein the challenge comprises an index of at least one non-sequential portion of the authentication information stored in the first cryptographic device;
granting the user authentication request upon verifying an output of the at least one non-sequential portion of the authentication information from the set of authentication information stored in the first cryptographic device, wherein said output of the at least one non-sequential portion of the authentication information is provided by the first cryptographic device in response to the challenge; and
rejecting the user authentication request upon detecting an output of one or more items of filler information provided by the first cryptographic device in response to the challenge, wherein said one or more items of filler information comprise one or more items of information that replaced the at least one non-sequential portion of the authentication information in the first cryptographic device subsequent to a previous response to the challenge provided by the first cryptographic device.
17. The method of claim 16 , further comprising:
maintaining a record of each issued challenge.
18. The method of claim 16 , wherein said verifying comprises collective verification by a subset of at least k cryptographic devices among a distributed set of n additional cryptographic devices.
19. An apparatus comprising a cryptographic device, comprising:
a memory; and
at least one processor coupled to the memory and operative for:
issuing a challenge to a first cryptographic device in connection with a user authentication request responsive to a request from the user to access a protected resource, wherein the challenge comprises an index of at least one non-sequential portion of the authentication information stored in the first cryptographic device;
granting the user authentication request upon verifying an output of the at least one non-sequential portion of the authentication information from the set of authentication information stored in the first cryptographic device, wherein said output of the at least one non-sequential portion of the authentication information is provided by the first cryptographic device in response to the challenge; and
rejecting the user authentication request upon detecting an output of one or more items of filler information provided by the first cryptographic device in response to the challenge, wherein said one or more items of filler information comprise one or more items of information that replaced the at least one non-sequential portion of the authentication information in the first cryptographic device subsequent to a previous response to the challenge provided by the first cryptographic device.