Sharing a cryptographic device by partitioning challenge-response space
View Patent ↗Techniques, apparatus and articles of manufacture are provided herein. A method includes providing a first sub-set of authentication information from a set of authentication information associated with a first cryptographic device issued to a user to a second cryptographic device in connection with a first user authentication request responsive to a request from the user to access a first protected resource, wherein the first sub-set comprises a first set of N pre-computed passcodes and corresponding challenges, and providing a second sub-set of authentication information from the set of authentication information associated with the first cryptographic device to a third cryptographic device in connection with a second user authentication request responsive to a request from the user to access a second protected resource, wherein the second sub-set comprises a second set of N pre-computed passcodes and corresponding challenges.
1. A method comprising:
partitioning a set of multiple pre-computed passcodes and multiple challenges corresponding thereto associated with a given authentication token issued to a given user into multiple non-overlapping sub-sets of authentication information associated with the given authentication token issued to the given user, wherein each respective one of the multiple non-overlapping sub-sets of authentication information comprises (i) one or more distinct pre-computed passcodes selected from the multiple pre-computed passcodes and (ii) one or more distinct challenges (a) selected from the multiple challenges and (b) corresponding to the selected one or more distinct pre-computed passcodes;
randomizing each of the multiple non-overlapping sub-sets of authentication information associated with the given authentication token issued to the given user prior to providing a sub-set of authentication information to an authentication authority;
providing, from the multiple non-overlapping sub-sets of authentication information, a first randomized sub-set of authentication information associated with the given authentication token issued to the given user to a first authentication authority in connection with a first user authentication request responsive to a request from the given user to access a first protected resource; and
providing, from the multiple non-overlapping sub-sets of authentication information, a second randomized sub-set of authentication information associated with the given authentication token to a second authentication authority in connection with a second user authentication request responsive to a request from the given user to access a second protected resource.
2. The method of claim 1 , wherein the first authentication authority comprises a first service provider.
3. The method of claim 1 , wherein the second authentication authority comprises a second service provider.
4. The method of claim 1 , wherein the given authentication token comprises a hardware component.
5. The method of claim 1 , wherein the given authentication token comprises a software component resident on a device.
6. The method of claim 1 , further comprising:
eradicating a sub-set of authentication information upon revocation of the sub-set of authentication information from the corresponding authentication authority.
7. The method of claim 1 , further comprising:
providing one or more additional sub-sets of authentication information from the multiple pre-computed passcodes and multiple challenges corresponding thereto associated with the given authentication token issued to the given user to one or more additional authentication authorities in connection with one or more additional user authentication requests related to a request from the given user to access one or more additional protected resources.
8. An article of manufacture comprising a non-transitory processor-readable storage medium having processor-readable instructions tangibly embodied thereon which, when implemented, cause a processor to carry out the steps of the method of claim 1 .
9. A method comprising:
partitioning a set of multiple derived keys for passcode generation and multiple challenges corresponding thereto associated with a given authentication root key issued to a given user into multiple non-overlapping sub-sets of authentication information associated with the given authentication root key issued to the given user, wherein each of the multiple non-overlapping sub-sets of authentication information comprises (i) a given derived key, selected from the multiple derived keys, for passcode generation to be shared between a cryptographic device associated with the given user and a given authentication authority, and (ii) one or more of the multiple challenges corresponding thereto;
providing, from the multiple non-overlapping sub-sets of authentication information, a first sub-set of authentication information associated with the given authentication root key issued to the given user to a first authentication authority representing a first service provider in connection with a first user authentication request responsive to a request from the given user to access a first protected resource, wherein the first sub-set of authentication information comprises a first derived secret key for passcode generation to be shared between the cryptographic device associated with the given user and the first authentication authority; and
providing, from the multiple non-overlapping sub-sets of authentication information, a second sub-set of authentication information associated with the given authentication root key issued to the given user to a second authentication authority representing a second service provider in connection with a second user authentication request responsive to a request from the given user to access a second protected resource, wherein the second sub-set of authentication information comprises a second derived secret key for passcode generation to be shared between the cryptographic device associated with the given user and the second authentication authority.
10. An article of manufacture comprising a non-transitory processor-readable storage medium having processor-readable instructions tangibly embodied thereon which, when implemented, cause a processor to carry out the steps of the method of claim 9 .
11. The method of claim 9 , further comprising:
randomizing each of the multiple non-overlapping sub-sets of authentication information associated with the given authentication root key issued to the given user prior to providing a sub-set of authentication information to an authentication authority.
12. The method of claim 9 , further comprising:
eradicating a sub-set of authentication information upon revocation of the sub-set of authentication information from the corresponding authentication authority.
13. An apparatus comprising:
a memory; and
at least one processor coupled to the memory and operative for:
partitioning a set of multiple pre-computed passcodes and multiple challenges corresponding thereto associated with a given authentication token issued to a given user into multiple non-overlapping sub-sets of authentication information associated with the given authentication token issued to the given user, wherein each respective one of the multiple non-overlapping sub-sets of authentication information comprises (i) one or more distinct pre-computed passcodes selected from the multiple pre-computed passcodes and (ii) one or more distinct challenges (a) selected from the multiple challenges and (b) corresponding to the selected one or more distinct pre-computed passcodes;
randomizing each of the multiple non-overlapping sub-sets of authentication information associated with the given authentication token issued to the given user prior to providing a sub-set of authentication information to an authentication authority;
providing, from the multiple non-overlapping sub-sets of authentication information, a first randomized sub-set of authentication information associated with the given authentication token issued to the given user to a first authentication authority in connection with a first user authentication request responsive to a request from the given user to access a first protected resource; and
providing, from the multiple non-overlapping sub-sets of authentication information, a second randomized sub-set of authentication information associated with the given authentication token to a second authentication authority in connection with a second user authentication request responsive to a request from the given user to access a second protected resource.
14. The apparatus of claim 13 , wherein the given authentication token comprises a hardware component.
15. The apparatus of claim 13 , wherein the given authentication token comprises a software component resident on a device.
16. The apparatus of claim 13 , wherein the at least one processor is further operative for:
eradicating a sub-set of authentication information upon revocation of the sub-set of authentication information from the corresponding authentication authority.
17. The apparatus of claim 13 , wherein the at least one processor is further operative for:
providing one or more additional sub-sets of authentication information from the multiple pre-computed passcodes and multiple challenges corresponding thereto associated with the given authentication token issued to the given user to one or more additional authentication authorities in connection with one or more additional user authentication requests related to a request from the given user to access one or more additional protected resources.
18. An apparatus comprising:
a memory; and
at least one processor coupled to the memory and operative for:
partitioning a set of multiple derived keys for passcode generation and multiple challenges corresponding thereto associated with a given authentication root key issued to a given user into multiple non-overlapping sub-sets of authentication information associated with the given authentication root key issued to the given user, wherein each of the multiple non-overlapping sub-sets of authentication information comprises (i) a given derived key, selected from the multiple derived keys, for passcode generation to be shared between a cryptographic device associated with the given user and a given authentication authority, and (ii) one or more of the multiple challenges corresponding thereto;
providing, from the multiple non-overlapping sub-sets of authentication information, a first sub-set of authentication information associated with the given authentication root key issued to the given user to a first authentication authority representing a first service provider in connection with a first user authentication request responsive to a request from the given user to access a first protected resource, wherein the first sub-set of authentication information comprises a first derived secret key for passcode generation to be shared between the cryptographic device associated with the given user and the first authentication authority; and
providing, from the multiple non-overlapping sub-sets of authentication information, a second sub-set of authentication information associated with the given authentication root key issued to the given user to a second authentication authority representing a second service provider in connection with a second user authentication request responsive to a request from the given user to access a second protected resource, wherein the second sub-set of authentication information comprises a second derived secret key for passcode generation to be shared between the cryptographic device associated with the given user and the second authentication authority.
19. The apparatus of claim 18 , wherein the at least one processor is further operative for:
randomizing each of the multiple non-overlapping sub-sets of authentication information associated with the given authentication root key issued to the given user prior to providing a sub-set of authentication information to an authentication authority.
20. The apparatus of claim 18 , wherein the at least one processor is further operative for:
eradicating a sub-set of authentication information upon revocation of the sub-set of authentication information from the corresponding authentication authority.