Multiple factor authentication in an identity certificate service
View Patent ↗Multiple factor authentication in an identity certificate service is disclosed. A certificate including a cryptographically-obscured identifier associated with the end entity is sent from an end entity to a service node. The service node uses both the certificate and the identifier to authenticate the end entity at least in part by comparing the identifier to a reference identifier. A service associated with the service node is accessed based at least in part on the authentication.
1. A method, comprising:
sending, from an end entity to a service node, a certificate including a cryptographically-obscured identifier associated with the end entity, wherein the certificate is received by the end entity from a device management server that is separate from the end entity and the service node, wherein the service node uses both the certificate and the cryptographically-obscured identifier to authenticate the end entity at least in part by comparing the cryptographically-obscured identifier to a reference identifier and in response to the cryptographically-obscured identifier matching the reference identifier, the service node is configured to validate the certificate at least in part by communicating with a certificate authority, wherein the certificate authority reviews the validity of the certificate itself, wherein the service node is configured to deny the end entity with access to a service associated with the service node in the event the cryptographically-obscured identifier is validated and the certificate is not validated; and
accessing, based at least in part on the authentication and the validation, the service associated with the service node.
2. The method of claim 1 , wherein the device management server generates the certificate including the cryptographically-obscured identifier on behalf of the end entity.
3. The method of claim 2 , wherein the device management server generates the certificate on behalf of the end entity at least in part by:
generating the cryptographically-obscured identifier;
sending, to a certificate authority, a certificate request including the cryptographically-obscured identifier; and
receiving the certificate including the cryptographically-obscured identifier from the certificate authority.
4. The method of claim 1 , further comprising:
receiving the cryptographically-obscured identifier;
sending a certificate request including the cryptographically-obscured identifier to a certificate authority; and
receiving the certificate including the cryptographically-obscured identifier.
5. The method of claim 1 , further comprising:
sending a certificate request to a certificate authority; and
receiving the certificate including the cryptographically-obscured identifier, wherein the certificate authority generates the certificate at least in part by injecting the cryptographically-obscured identifier into the certificate.
6. The method of claim 1 , wherein the end entity includes one or more of a mobile device and an application included on the mobile device.
7. The method of claim 1 , wherein the cryptographically-obscured identifier is generated at a device management server.
8. The method of claim 1 , wherein the cryptographically-obscured identifier includes a hash of an identifier associated with the end entity.
9. The method of claim 1 , wherein the cryptographically-obscured identifier is generated by encrypting an identifier associated with the end entity using a public key associated with the service node.
10. The method of claim 1 , wherein the cryptographically-obscured identifier is generated by encrypting an identifier associated with the end entity using a shared secret associated with the service node and a device management server.
11. The method of claim 1 , wherein the cryptographically-obscured identifier includes one or more of a media access control (MAC) address, a mobile device serial number, an application universally unique identifier (UUID), a user identifier, and a mobile device international mobile station equipment identity (IMEI).
12. The method of claim 1 , wherein the reference identifier includes a device or application identifier included in a protocol-related communication between the end entity and the service node.
13. The method of claim 1 , wherein the service node uses both the certificate and the identifier to authenticate the end entity at least in part by:
extracting the cryptographically-obscured identifier from the certificate;
determining that the extracted identifier matches the reference identifier;
validating the certificate with a certificate authority that issued the certificate; and
providing access to the service based at least in part on the determined match and the validated certificate.
14. The method of claim 1 , wherein the service node uses both the certificate and the identifier to authenticate the end entity at least in part by:
extracting a hashed identifier from the certificate;
retrieving a hashed reference identifier;
determining that the hashed identifier from the certificate matches the hashed reference identifier;
validating the certificate with a certificate authority that issued the certificate; and
providing access to the service based at least in part on the determined match and the validated certificate.
15. The method of claim 1 , wherein the service node uses both the certificate and the identifier to authenticate the end entity at least in part by:
decrypting an encrypted identifier included in the certificate;
determining that the decrypted identifier matches a reference identifier;
validating the certificate with a certificate authority that issued the certificate; and
providing access to the service based at least in part on the determined match and the validated certificate.
16. The method of claim 15 , wherein decrypting the encrypted identifier included in the certificate includes decrypting the encrypted identifier using one or more of a private key associated with the service node and a shared secret associated with the service node and a device management server.
17. A system, comprising:
a processor; and
a memory coupled with the processor, wherein the memory is configured to provide the processor with instructions which when executed cause the processor to:
send, from an end entity to a service node, a certificate including a cryptographically-obscured identifier associated with the end entity, wherein the certificate is received by the end entity from a device management server that is separate from the end entity and the service node, wherein the service node uses both the certificate and the cryptographically-obscured identifier to authenticate the end entity at least in part by comparing the cryptographically-obscured identifier to a reference identifier and in response to the cryptographically-obscured identifier matching the reference identifier, the service node is configured to validate the certificate at least in part by communicating with a certificate authority, wherein the certificate authority reviews the validity of the certificate itself, wherein the service node is configured to deny the end entity with access to a service associated with the service node in the event the cryptographically-obscured identifier is validated and the certificate is not validated; and
access, based at least in part on the authentication and the validation, the service associated with the service node.
18. The system recited in claim 17 , wherein the service node uses both the certificate and the identifier to authenticate the end entity at least in part by:
extracting the cryptographically-obscured identifier from the certificate;
determining that the extracted identifier matches the reference identifier;
validating the certificate with a certificate authority that issued the certificate; and
providing access to the service based at least in part on the determined match and the validated certificate.
19. The system recited in claim 17 , wherein the device management server generates the certificate including the cryptographically-obscured identifier on behalf of the end entity.
20. A computer program product, the computer program product being embodied in a tangible non-transitory computer readable storage medium and comprising computer instructions for:
sending, from an end entity to a service node, a certificate including a cryptographically-obscured identifier associated with the end entity, wherein the certificate is received by the end entity from a device management server that is separate from the end entity and the service node, wherein the service node uses both the certificate and the cryptographically-obscured identifier to authenticate the end entity at least in part by comparing the cryptographically-obscured identifier to a reference identifier and in response to the cryptographically-obscured identifier matching the reference identifier, the service node is configured to validate the certificate at least in part by communicating with a certificate authority, wherein the certificate authority reviews the validity of the certificate itself, wherein the service node is configured to deny the end entity with access to a service associated with the service node in the event the cryptographically-obscured identifier is validated and the certificate is not validated; and
accessing, based at least in part on the authentication and the validation, the service associated with the service node.
21. The computer program product recited in claim 20 , wherein the device management server generates the certificate including the cryptographically-obscured identifier on behalf of the end entity.