Combined authentication and encryption
A system and methods are provided for establishing an authenticated and encrypted communication connection between two devices with at most two round-trip communications. During establishment of an initial authenticated, encrypted communication connection (or afterward), a first device (e.g., a server) provides the second device (e.g., a client) with a token (e.g., a challenge) that lives or persists beyond the current connection. After that connection is terminated and the second device initiates a new connection, it uses the token as part of the handshaking process to reduce the necessary round-trip communications to one.
1. A method comprising:
providing a device with a first unsolicited token during an authenticated first communication connection, wherein the first unsolicited token is associated with a lifetime during which the first unsolicited token remains valid and the lifetime is selected based on a type of the device or a type of user associated with the device;
receiving encrypted authentication data generated from the first unsolicited token from the device after termination of the authenticated first communication connection; and:
if the encrypted authentication data was received within the lifetime of the first unsolicited token, decrypting the encrypted authentication data and establishing a second communication connection based on the decrypted authentication data, or
if the encrypted authentication data was not received within the lifetime of the first unsolicited token, providing the device with a second token configured to authenticate the second communication connection.
2. The method of claim 1 , wherein decrypting the encrypted authentication data comprises:
generating a session key from the first unsolicited token; and
decrypting the encrypted authentication data with the session key.
3. The method of claim 1 , wherein the authentication data comprises:
an identifier of a user of the device;
the first unsolicited token or the second token; and
device-specific data.
4. The method of claim 3 , wherein the identifier of the user of the device is a telephone number associated with the user.
5. The method of claim 1 , wherein the first unsolicited token is a token sent to the device as part of a periodic token replacement schedule.
6. A non-transitory computer readable medium storing instructions that, when executed by one or more processors, cause the one or more processors to:
provide a device with a first unsolicited token during an authenticated first communication connection, wherein the first unsolicited token is associated with a lifetime during which the first unsolicited token remains valid and the lifetime is selected based on a type of the device or a type of user associated with the device;
receive encrypted authentication data generated from the first unsolicited token from the device after termination of the authenticated first communication connection; and:
if the encrypted authentication data was received within the lifetime of the first unsolicited token, decrypting the encrypted authentication data and establishing a second communication connection based on the decrypted authentication data, or
if the encrypted authentication data was not received within the lifetime of the first unsolicited token, providing the device with a second token configured to authenticate the second communication connection.
7. The medium of claim 6 , wherein decrypting the encrypted authentication data comprises:
generating a session key from the first unsolicited token; and
decrypting the encrypted authentication data with the session key.
8. The medium of claim 6 , wherein the authentication data comprises:
an identifier of a user of the device;
the first unsolicited token or the second token; and
device-specific data.
9. The medium of claim 8 , wherein the identifier of the user of the device is a telephone number associated with the user.
10. The medium of claim 6 , wherein the first unsolicited token is a token sent to the device as part of a periodic token replacement schedule.
11. A system comprising:
a processor; and
memory configured to store instructions that, when executed by the processor, cause the system to:
provide a device with a first unsolicited token during an authenticated first communication connection, wherein the first unsolicited token is associated with a lifetime during which the first unsolicited token remains valid and the lifetime is selected based on a type of the device or a type of user associated with the device;
receive encrypted authentication data generated from the first unsolicited token from the device after termination of the authenticated first communication connection; and:
if the encrypted authentication data was received within the lifetime of the first unsolicited token, decrypting the encrypted authentication data and establishing a second communication connection based on the decrypted authentication data, or
if the encrypted authentication data was not received within the lifetime of the first unsolicited token, providing the device with a second token configured to authenticate the second communication connection.
12. The apparatus of claim 11 , wherein decrypting the encrypted authentication data comprises:
generating a session key from the first unsolicited token; and
decrypting the encrypted authentication data with the session key.
13. The apparatus of claim 11 , wherein the authentication data comprises:
an identifier of a user of the device;
the first unsolicited token or the second token; and
device-specific data.
14. The apparatus of claim 13 , wherein the identifier of the user of the device is a telephone number associated with the user.