System and method for processing random challenges within an authentication framework
A system, apparatus, method, and machine readable medium are described for transparently requesting a new random challenge from a server within an authentication framework. For example, one embodiment of a method comprises: transmitting a random challenge and an indication of a timeout period associated with the random challenge from a server to a client within the context of a network registration or authentication process using authentication devices communicatively coupled to the client; automatically detecting that the random challenge is no longer valid based on the timeout period; and responsively transmitting a request for a new random challenge from the client to a server, wherein transmitting is performed transparently to a user of the client.
1. A method comprising:
generating a first random challenge comprising a first randomly-generated code at a server;
transmitting the first random challenge and an indication of a timeout period associated with the first random challenge from the server to a client;
automatically detecting at the client that the first random challenge comprising the first random code is no longer valid based on the timeout period;
responsively transmitting a request for a new random challenge from the client to the server, wherein transmitting is performed without user intervention;
generating a new random challenge comprising a new randomly-generated code at the server responsive to the request for the new random challenge received from the client, and transmitting the new randomly-generated code and an indication of a timeout period associated with the new random challenge to the client;
using the new randomly-generated code when registering one or more authentication devices on the client with the server or a different server and/or when authenticating the user with the server or a different server using the one or more authentication devices,
wherein during the operations of registering the authentication devices or authenticating the user, the new randomly-generated code, a signature generated over the new randomly-generated code, and/or an encrypted version of the new randomly-generated code, is transmitted from the client to the server, and
validating the new randomly-generated code at the server to confirm the operations of registering the authentication devices and/or authenticating the user.
2. The method as in claim 1 wherein the first and new random challenges comprise random numbers or random ID codes generated by the server.
3. The method as in claim 2 wherein the first and new randomly-generated codes comprise cryptographic nonces.
4. The method as in claim 1 further comprising:
transmitting the new randomly-generated code from the client to the server to establish a secure connection between the client and the server.
5. The method as in claim 1 wherein the encrypted version of the new randomly-generated code is encrypted using a key associated with an authenticator on the client.
6. The method as in claim 5 further comprising:
collecting biometric authentication data from a user using a biometric authentication device on the client;
confirming the identity of the user with the biometric authentication data prior to the new random challenge becoming invalid due to expiration of the time period; and
transmitting the new authentication data to the server with the new random challenge.
7. The method as in claim 6 wherein the server verifies the identity of the user and decrypts the new randomly-generated code using a key corresponding to the biometric authentication device.
8. The method as in claim 1 wherein the indication of the timeout period comprises an amount of time after which the first randomly-generated code becomes invalid.
9. The method as in claim 8 wherein the indication of the timeout period includes a timestamp associated with the transmission of the first randomly-generated code from the server to the client.
10. The method as in claim 1 wherein the indication of the timeout period comprises a specific time.
11. A system comprising a non-transitory machine-readable medium for storing program code and a processor for processing the program code to perform the operations of:
generating a first random challenge comprising a first randomly-generated code at a server;
transmitting the first random challenge and an indication of a timeout period associated with the first random challenge from the server to a client;
automatically detecting at the client that the first random challenge comprising the first random code is no longer valid based on the timeout period;
responsively transmitting a request for a new random challenge from the client to the server, wherein transmitting is performed without user intervention;
generating a new random challenge comprising a new randomly-generated code at the server responsive to the request for the new random challenge received from the client, and transmitting the new randomly-generated code and an indication of a timeout period associated with the new random challenge to the client;
using the new randomly-generated code when registering one or more authentication devices on the client with the server or a different server and/or when authenticating the user with the server or a different server using the one or more authentication devices,
wherein during the operations of registering the authentication devices or authenticating the user, the new randomly-generated code, a signature generated over the new randomly-generated code, and/or an encrypted version of the new randomly-generated code, is transmitted from the client to the server, and
validating the new randomly-generated code at the server to confirm the operations of registering the authentication devices and/or authenticating the user.
12. The system as in claim 11 wherein the first and new random challenges comprise random numbers or random ID codes generated by the server.
13. The system as in claim 12 wherein the first and new randomly-generated codes comprise cryptographic nonces.
14. The system as in claim 11 further comprising program code to cause the processor to perform the operations of:
transmitting the new randomly-generated code from the client to the server to establish a secure connection between the client and the server.
15. The system as in claim 11 wherein the encrypted version of the new randomly-generated code is encrypted using a key associated with an authenticator on the client.
16. The system as in claim 15 further comprising program code to cause the processor to perform the operations of:
collecting biometric authentication data from a user using a biometric authentication device on the client;
confirming the identity of the user with the biometric authentication data prior to the new random challenge becoming invalid due to expiration of the time period; and
transmitting the new authentication data to the server with the new random challenge.
17. The system as in claim 16 wherein the server verifies the identity of the user and decrypts the new randomly-generated code using a key corresponding to the biometric authentication device.
18. The system as in claim 11 wherein the indication of the timeout period comprises an amount of time after which the first randomly-generated code becomes invalid.
19. The system as in claim 18 wherein the indication of the timeout period includes a timestamp associated with the transmission of the first randomly-generated code from the server to the client.
20. The system as in claim 11 wherein the indication of the timeout period comprises a specific time.
21. A non-transitory machine-readable medium having program code stored thereon which, when executed by a machine, causes the machine to perform the operations of:
generating a first random challenge comprising a first randomly-generated code at a server;
transmitting the first random challenge and an indication of a timeout period associated with the first random challenge from the server to a client;
automatically detecting at the client that the first random challenge comprising the first random code is no longer valid based on the timeout period;
responsively transmitting a request for a new random challenge from the client to the server, wherein transmitting is performed without user intervention;
generating a new random challenge comprising a new randomly-generated code at the server responsive to the request for the new random challenge received from the client, and transmitting the new randomly-generated code and an indication of a timeout period associated with the new random challenge to the client;
using the new randomly-generated code when registering one or more authentication devices on the client with the server or a different server and/or when authenticating the user with the server or a different server using the one or more authentication devices,
wherein during the operations of registering the authentication devices or authenticating the user, the new randomly-generated code, a signature generated over the new randomly-generated code, and/or an encrypted version of the new randomly-generated code, is transmitted from the client to the server, and
validating the new randomly-generated code at the server to confirm the operations of registering the authentication devices and/or authenticating the user.
22. The non-transitory machine-readable medium as in claim 21 wherein the first and new random challenges comprise random numbers or random ID codes generated by the server.
23. The non-transitory machine-readable medium as in claim 22 wherein the first and new randomly-generated codes comprise cryptographic nonces.
24. The non-transitory machine-readable medium as in claim 21 comprising additional program code to cause the machine to perform the operations of:
transmitting the new randomly-generated code from the client to the server to establish a secure connection between the client and the server.
25. The non-transitory machine-readable medium as in claim 21 wherein the encrypted version of the new randomly-generated code is encrypted using a key associated with an authenticator on the client.
26. The non-transitory machine-readable medium as in claim 25 comprising additional program code to cause the machine to perform the operations of:
collecting biometric authentication data from a user using a biometric authentication device on the client;
confirming the identity of the user with the biometric authentication data prior to the new random challenge becoming invalid due to expiration of the time period; and
transmitting the new authentication data to the server with the new random challenge.
27. The non-transitory machine-readable medium as in claim 26 wherein the server verifies the identity of the user and decrypts the new randomly-generated code using a key corresponding to the biometric authentication device.
28. The non-transitory machine-readable medium as in claim 21 wherein the indication of the timeout period comprises an amount of time after which the first randomly-generated code becomes invalid.
29. The non-transitory machine-readable medium as in claim 28 wherein the indication of the timeout period includes a timestamp associated with the transmission of the first randomly-generated code from the server to the client.
30. The non-transitory machine-readable medium as in claim 21 wherein the indication of the timeout period comprises a specific time.
31. The method as in claim 1 wherein registering one or more authentication devices on the client with the server comprises:
the client establishing a secure communication connection with the server;
the client transmitting over the secure connection to the server one or more sets of identification data identifying one or more authentication devices on the client to be registered with the server; and
the server attesting the one or more devices using the identification data.
32. The method as in claim 31 further comprising:
generating at least one key for each of the one or more authentication devices;
securely storing a key associated with each of the one or more authentication devices in a secure storage on the client; and
securely storing a key associated with each of the one or more authentication devices in a secure storage on the server.
33. The method as in claim 32 wherein generating at least one key for each of the one or more authentication devices comprises generating a public/private key pair for each of the one or more authentication devices, wherein the private key of the public/private key pair is stored in the secure storage on the client and the public key of the public/private key pair is stored in the secure storage on the server.
34. The method as in claim 33 wherein authenticating the user with the server or a different server using the one or more authentication devices comprises:
a user of the client attempting to complete a transaction which requires authentication;
the server or a different server identifying at least one of the one or more authentication devices on the client to be used for authentication;
the user performing authentication using the identified one of the one or more authentication devices;
the client encrypting the new randomly-generated code using the private key associated with the identified one of the one or more authentication devices and transmitting the encrypted new randomly-generated code to the server; and
the server validating the new randomly-generated code by decrypting the new randomly-generated code using the public key associated with the identified one of the one or more authentication devices.