System and method for establishing trust using secure transmission protocols
A system, apparatus, method, and machine readable medium are described for establishing trust using secure communication protocols. For example, one embodiment of a method comprises: generating a first authentication-related communication at an authentication server on behalf of a relying party the first authentication-related communication being directed to a client device having one or more authenticators; signing the first authentication-related communication using a first key of a self-signed certificate from a decentralized public key infrastructure (PKI); establishing a first secure communication channel with a relying party app on the client device using a trusted secure communication infrastructure; transmitting the first authentication-related communication with the signature to the relying party app over the first secure communication channel; establishing a second secure communication channel with an authentication client on the client device using a trusted secure communication infrastructure; transmitting a second key of the self-signed certificate from the decentralized PKI to the authentication client over the second communication channel; providing the first authentication-related communication from the relying party app to the authentication client; and the authentication client using the second key to validate the signature generated over the first authentication-related communication with the first key.
1. A method comprising:
generating a first authentication-related communication at an authentication server on behalf of a relying party the first authentication-related communication being directed to a client device having one or more authenticators;
signing the first authentication-related communication using a first key of a self-signed certificate from a decentralized public key infrastructure (PKI);
establishing a first secure communication channel with a relying party app on the client device using a trusted secure communication infrastructure;
transmitting the first authentication-related communication with the signature to the relying party app over the first secure communication channel;
establishing a second secure communication channel with an authentication client on the client device using a trusted secure communication infrastructure;
transmitting a second key of the self-signed certificate from the decentralized PKI to the authentication client over the second communication channel;
providing the first authentication-related communication from the relying party app to the authentication client; and
the authentication client using the second key to validate the signature generated over the first authentication-related communication with the first key.
2. The method as in claim 1 wherein the first key comprises a private key of the decentralized PKI and the second key comprises a corresponding public key.
3. The method as in claim 1 wherein the trusted secure communication infrastructure includes a trusted certificate usable to establish a secure transport layer security (TLS) connection for the first and/or second secure communication channels.
4. The method as in claim 3 wherein the trusted certificate comprises an X.509 certificate.
5. The method as in claim 1 further comprising:
the authentication client generating a second authentication-related communication responsive to the first authentication-related communication.
6. The method as in claim 5 wherein the first authentication-related communication comprises an authentication request generated at an authentication server operated on behalf of the relying party, and the second authentication-related communication comprises an authentication response generated by the authentication client.
7. The method as in claim 6 wherein the authentication request comprises a random challenge and a signature generated over the random challenge using a public key associated with an authenticator on the client device.
8. The method as in claim 7 wherein the authentication client uses a private key associated with the authenticator to validate the signature.
9. The method as in claim 8 wherein the authentication client generates the authentication response in response to a successful user authentication using one or more of the authenticators on the client device.
10. The method as in claim 9 wherein the authenticators on the client device include a fingerprint authenticator.
11. The method as in claim 1 wherein providing the first authentication-related communication from the relying party app to the authentication client further comprises implementing inter-process communication (IPC) between the relying party app and the authentication client.
12. The method as in claim 1 wherein the second key of the self-signed certificate is transmitted over the second communication channel in a public key file.
13. A system for performing authentication comprising:
a client device having one or more authenticators, an authentication client and a relying party app;
an authentication server operated on behalf of a relying party generating a first authentication-related communication directed to the client device;
the authentication server signing the first authentication-related communication using a first key of a self-signed certificate from a decentralized public key infrastructure (PKI);
the authentication server establishing a first secure communication channel with a relying party app on the client device using a trusted secure communication infrastructure;
the authentication server transmitting the first authentication-related communication with the signature to the relying party app over the first secure communication channel;
the authentication server establishing a second secure communication channel with an authentication client on the client device using a trusted secure communication infrastructure;
the authentication server transmitting a second key of the self-signed certificate from the decentralized PKI to the authentication client over the second communication channel;
the relying party app providing the first authentication-related communication to the authentication client; and
the authentication client using the second key to validate the signature generated over the first authentication-related communication with the first key.
14. The system as in claim 13 wherein the first key comprises a private key of the decentralized PKI and the second key comprises a corresponding public key.
15. The system as in claim 13 wherein the trusted secure communication infrastructure includes a trusted certificate usable to establish a secure transport layer security (TLS) connection for the first and/or second secure communication channels.
16. The system as in claim 15 wherein the trusted certificate comprises an X.509 certificate.
17. The system as in claim 13 further comprising:
the authentication client generating a second authentication-related communication responsive to the first authentication-related communication.
18. The system as in claim 17 wherein the first authentication-related communication comprises an authentication request generated at an authentication server operated on behalf of the relying party, and the second authentication-related communication comprises an authentication response generated by the authentication client.
19. The system as in claim 18 wherein the authentication request comprises a random challenge and a signature generated over the random challenge using a public key associated with an authenticator on the client device.
20. The system as in claim 19 wherein the authentication client uses a private key associated with the authenticator to validate the signature.
21. The system as in claim 20 wherein the authentication client generates the authentication response in response to a successful user authentication using one or more of the authenticators on the client device.
22. The system as in claim 21 wherein the authenticators on the client device include a fingerprint authenticator.
23. The system as in claim 13 wherein providing the first authentication-related communication from the relying party app to the authentication client further comprises implementing inter-process communication (IPC) between the relying party app and the authentication client.
24. The system as in claim 13 wherein the second key of the self-signed certificate is transmitted over the second communication channel in a public key file.