Secure authentication of a device through attestation by another device
Methods and systems for secure authentication of a first device through attestation by one or more other devices are described herein. A server used to authenticate the first device may transmit, to the first device, a request for attestation of the first device by one or more other devices. A user of the first device may attempt to find a user of a second device to attest to the identity of the first device and/or the user of the first device. Once the user of the second device attests to the identity of the first device and/or the user of the first device, the server device may receive, from the second device, an indication of the attestation. Based on the attestation, the server device may grant, to the first device, access to one or more services associated with the server device. One or more additional devices may be used to attest to the identity of the first device and/or the user of the first device.
1. A method comprising:
receiving, by a server device and from an untrusted client device requesting access to one or more services associated with the server device, first credentials for authenticating a first user of the untrusted client device;
authenticating the first user of the untrusted client device based on the first credentials;
in response to authenticating the first user, generating, by the server device, a challenge code;
transmitting, by the server device and to the untrusted client device, a request for attestation of the untrusted client device, wherein the request for attestation comprises the challenge code and an identifier for the server device;
receiving, by the server device and from a trusted client device, second credentials for authenticating a second user of the trusted client device and an indication that the trusted client device attests to an identity of one or more of the untrusted client device or the first user of the untrusted client device, wherein the second user is different from the first user, wherein the indication comprises the challenge code, and wherein the trusted client device is different from the untrusted client device that is requesting access to the one or more services associated with the server device; and
based on the second credentials and further based on the indication that the trusted client device attests to the identity of one or more of the untrusted client device or the first user of the untrusted client device, transmitting, by the server device and to the untrusted client device, an indication that the untrusted client device has been granted access to the one or more services associated with the server device.
2. The method of claim 1 , wherein the challenge code comprises a one-time challenge code, and wherein the generating the challenge code comprises generating the challenge code using a random number generator associated with the server device.
3. The method of claim 1 , wherein the identifier for the server device comprises a uniform resource identifier for the server device.
4. The method of claim 1 , further comprising:
determining a plurality of users authorized for attestation of the untrusted client device; and
transmitting, by the server device and to the untrusted client device, data indicating the plurality of users authorized for attestation of the untrusted client device.
5. The method of claim 1 , wherein the receiving the indication that the trusted client device attests to the identity of one or more of the untrusted client device or the first user of the untrusted client device is performed after an authentication of the trusted client device by a second server device.
6. The method of claim 1 , wherein the transmitting the indication that the untrusted client device has been granted access to the one or more services is based on a determination that the challenge code received from the trusted client device corresponds to the challenge code transmitted to the untrusted client device.
7. The method of claim 1 , further comprising:
receiving, by the server device and from a second trusted client device, an indication that the second trusted client device attests to the identity of one or more of the untrusted client device or the first user of the untrusted client device,
wherein the transmitting the indication that the untrusted client device has been granted access to the one or more services is based on the indication that the second trusted client device attests to the identity of one or more of the untrusted client device or the first user of the untrusted client device.
8. The method of claim 1 , further comprising:
based on a quantity of one or more trusted client devices attesting to the identity of one or more of the untrusted client device or the first user of the untrusted client device, determining, by the server device, a level of access of the untrusted client device to the one or more services associated with the server device.
9. The method of claim 1 , further comprising:
based on a level of access of the trusted client device to the one or more services associated with the server device, determining, by the server device, a level of access of the untrusted client device to the one or more services associated with the server device.
10. A method comprising:
transmitting, by an untrusted client device and to a server device, credentials for authenticating a first user of the untrusted client device;
receiving, by the untrusted client device and from the server device, a request for attestation of the untrusted client device, wherein the request for attestation comprises a challenge code generated by the server device and an identifier for the server device;
generating, by the untrusted client device, a code by encoding at least:
the challenge code,
the identifier for the server device, and
data identifying one or more of the untrusted client device or the first user of the untrusted client device;
displaying, by the untrusted client device and for a trusted client device associated with a second user different from the first user, the code; and
receiving, by the untrusted client device and from the server device, an indication that the untrusted client device has been granted access to one or more services associated with the server device, wherein the indication that the untrusted client device has been granted access is based on an attestation sent by the trusted client device to the server device.
11. The method of claim 10 , wherein the challenge code comprises a one-time challenge code generated by a random number generator associated with the server device.
12. The method of claim 10 , wherein the identifier for the server device comprises a uniform resource identifier for the server device.
13. The method of claim 10 , further comprising:
receiving, by the untrusted client device and from the server device, data indicating a plurality of users for attestation of the untrusted client device,
wherein displaying the code comprises displaying, by the untrusted client device, the code and the plurality of users for attestation of the untrusted client device.
14. The method of claim 10 , wherein the code comprises a Quick Response (QR) code.
15. The method of claim 10 , wherein the indication that the untrusted client device has been granted access is based on an attestation of the untrusted client device by one or more other trusted client devices, and wherein the one or more other trusted client devices comprises the trusted client device.
16. The method of claim 10 , further comprising:
receiving, by the untrusted client device and from the server device, an indication of a quantity of attestations of the untrusted client device by one or more other trusted client devices; and
displaying, by the untrusted client device, the indication of the quantity of attestations of the untrusted client device by the one or more other trusted client devices.
17. An apparatus comprising:
a processor; and
memory storing computer-executable instructions that, when executed by the processor, cause the apparatus to:
receive, from an untrusted client device requesting access to one or more services associated with the apparatus, first credentials for authenticating a first user of the untrusted client device;
authenticate the first user of the untrusted client device based on the first credentials;
in response to authenticating the first user, generate a challenge code;
transmit, to the untrusted client device, a request for attestation of the untrusted client device, wherein the request for attestation comprises the challenge code and an identifier for the apparatus;
receive, from a trusted client device, second credentials for authenticating a second user of the trusted client device and an indication that the trusted client device attests to an identity of one or more of the untrusted client device or the first user of the untrusted client device, wherein the second user is different from the first user, wherein the indication comprises the challenge code, and wherein the trusted client device is different from the untrusted client device that is requesting access to the one or more services associated with the apparatus; and
based on the second credentials and further based on the indication that the trusted client device attests to the identity of one or more of the untrusted client device or the first user of the untrusted client device, transmit, to the untrusted client device, an indication that the untrusted client device has been granted access to the one or more services associated with the apparatus.
18. The apparatus of claim 17 , wherein the computer-executable instructions, when executed by the processor, further cause the apparatus to:
determine a plurality of users authorized for attestation of the untrusted client device; and
transmit, to the untrusted client device, data indicating the plurality of users authorized for attestation of the untrusted client device.
19. The apparatus of claim 17 , wherein the transmission of the indication that the untrusted client device has been granted access to the one or more services is based on a determination that the challenge code received from the trusted client device corresponds to the challenge code transmitted to the untrusted client device.
20. The apparatus of claim 17 , wherein the computer-executable instructions, when executed by the processor, further cause the apparatus to:
receive, from a second trusted client device, an indication that the second trusted client device attests to the identity of one or more of the untrusted client device or the first user of the untrusted client device,
wherein the transmission of the indication that the untrusted client device has been granted access to the one or more services is based on the indication that the second trusted client device attests to the identity of one or more of the untrusted client device or the first user of the untrusted client device.