Using everyday objects as cryptographic keys
This disclosure involves the notion of using physical objects to generate public key-based authenticators and, in particular, to use “everyday” physical objects to create a generator seed for a key generator that will use that seed to generate a key pair comprising a public key, and its associated private key. In a preferred approach, the physical object is used to create a digital representation (of the physical object) that, together with some uniqueness associated to the user, gives rise to a key generator seed value. Without knowledge of (a) the physical object itself, (b) how the physical object characteristic is converted (to a digital representation), and (c) the uniqueness value, an attacker cannot reproduce the key generator seed (or the key(s) generated from that seed).
1. A method to enable a user to obtain authenticated access to a resource, comprising:
sensing a physical object associated with the user at a first time;
using one or more sensed physical object parameters to produce a first digital seed, the one or more sensed physical object parameters being a same set of data generated from at least two or more iterations of sensing the physical object, the same set of data having a given entropy;
augmenting the first digital seed with context-specific information to generate a second seed;
providing at least one of the first and second seeds to a key generator and, in response, receiving a key that is derived at least in part using the provided seed;
sensing the physical object at a second time to obtain the one or more sensed physical object parameters;
validating that a component of the key can be derived from the one or more sensed physical object parameters that are obtained when the physical object is sensed at the second time; and
upon successful validation, completing an authentication to access the resource.
2. The method as described in claim 1 wherein the key is a key of a key pair, the key pair comprising a public key, and an associated private key.
3. The method as described in claim 1 wherein the context-specific information is one of: a device identifier, a user identifier, a web service parameter, and data associated with an application associated with the resource.
4. The method as described in claim 1 wherein the two or more iterations of sensing the physical object are carried out by an input device.
5. The method as described in claim 1 wherein the two or more iterations of sensing the physical object are carried out under different environment conditions.
6. The method as described in claim 1 wherein the key generator is associated with an intermediary device for additional security.
7. Apparatus to enable a user to obtain authenticated access to a resource, comprising:
a processor;
computer memory holding computer program instructions executed by the processor, the computer program instructions comprising:
program code configured to sense a physical object associated with the user at a first time;
program code configured to use one or more sensed physical object parameters to produce a first digital seed, the one or more sensed physical object parameters being a same set of data generated from at least two or more iterations of sensing the physical object, the same set of data having a given entropy;
program code configured to augment the first digital seed with context-specific information to generate a second seed;
program code configured to provide at least one of the first and second seeds to a key generator and, in response, to receive a key that is derived at least in part using the provided seed;
program code configured to sense the physical object at a second time to obtain the one or more sensed physical object parameters;
program code configured to validate that a component of the key can be derived from the one or more sensed physical object parameters that are obtained when the physical object is sensed at the second time; and
program code configured to, upon successful validation complete an authentication to access the resource.
8. The apparatus as described in claim 7 wherein the key is a key of a key pair, the key pair comprising a public key, and an associated private key.
9. The apparatus as described in claim 7 wherein the context-specific information is one of: a device identifier, a user identifier, a web service parameter, and data associated with an application associated with the resource.
10. The apparatus as described in claim 7 wherein the two or more iterations of sensing the physical object are carried out by an input device.
11. The apparatus as described in claim 7 wherein the two or more iterations of sensing the physical object are carried out under different environment conditions.
12. The apparatus as described in claim 7 wherein the key generator is associated with an intermediary device for additional security.
13. A computer program product in a non-transitory computer readable storage medium, the computer program product holding computer program instructions executed by a hardware processor to enable a user to obtain authenticated access to a resource, the computer program instructions comprising:
program code configured to sense a physical object associated with the user at a first time;
program code configured e to use one or more sensed physical object parameters to produce a first digital seed, the one or more sensed physical object parameters being a same set of data generated from at least two or more iterations of sensing the physical object, the same set of data having a given entropy;
program code configured to augment the first digital seed with context-specific information to generate a second seed;
program code configured to provide at least one of the first and second seeds to a key generator and, in response, to receive a key that is derived at least in part using the provided seed;
program code configured to sense the physical object at a second time to obtain the one or more sensed physical object parameters;
program code configured to validate that a component of the key can be derived from the one or more sensed physical object parameters that are obtained when the physical object is sensed at the second time; and
program code configured to, upon successful validation complete an authentication to access the resource.
14. The computer program product as described in claim 13 wherein the key is a key of a key pair, the key pair comprising a public key, and an associated private key.
15. The computer program product as described in claim 13 wherein the context-specific information is one of: a device identifier, a user identifier, a web service parameter, and data associated with an application associated with the resource.
16. The computer program product as described in claim 13 wherein the two or more iterations of sensing the physical object are carried out by an input device.
17. The computer program product as described in claim 13 wherein the two or more iterations of sensing the physical object are carried out under different environment conditions.