Method for distributed trust authentication
A method for distributed trust authentication of one or more users attempting to access one or more service providers operating on a network includes performing primary authentication of a user using a first authentication factor, generating a first partial digital signature for a first authentication response to the primary authentication, performing secondary authentication of the user using a second authentication factor, generating a second partial digital signature for the second authentication response to the secondary authentication, combining the first and second partial digital signatures to form a composite digital signature, and validating the composite digital signature.
1. A method for distributed trust authentication, the method comprising:
at a service provider:
using a common private cryptographic key of a public/private cryptographic key pair to generate a first private key share and a second private key share;
distributing, via one or more communications networks, each of the first private key share and the second private key share to an identity provider and a remote multi-factor authentication service, respectively; and
distributing a public cryptographic key of the public/private cryptographic key pair to one of the identity provider and the remote multi-factor authentication service, wherein whichever one of the identity provider and the remote multi-factor authentication service that has the public cryptographic key performs a validation of a combined digital signature;
identifying an attempt, by a user operating a computing device, to authenticate to the service provider;
validating the combined digital signature for authenticating the user, wherein:
the combined digital signature is formed by a combination of a first digital signature and a second digital signature,
the first digital signature being generated using the first private key share in response to a successful primary authentication of the user;
the second digital signature being generated using the second private key share in response to a successful secondary authentication of the user,
the first private key share and the second private key share being generated using the common private cryptographic key of the public/private cryptographic key pair;
wherein validating the combined digital signature includes using the public cryptographic key of the public/private cryptographic key pair to validate the combined digital signature; and
authenticating the user to the service provider based on the validation of the combined digital signature.
2. The method of claim 1 , wherein
validating the combined digital signature includes validating each of the first digital signature and the second digital signature of the combined digital signature using the public cryptographic key of the public/private cryptographic key pair.
3. The method of claim 1 , wherein
a primary authentication of the user is performed by an identity provider.
4. The method of claim 1 , wherein a secondary authentication of the user is performed by a multi-factor authentication service, wherein
at the multi-factor authentication service:
using the common private cryptographic key of the public/private cryptographic key pair to generate the first private key share and the second private key share;
distributing, via one or more communications networks, one of the first private key share and the second private key share to the identity provider; and
distributing the public cryptographic key of the public/private cryptographic key pair to the service provider, wherein the service provider performs the validation of the combined digital signature.
5. The method of claim 4 , wherein:
the multi-factor authentication service comprises a two-factor authentication service that performs the secondary authentication of the user only after an indication of a successful primary authentication of the user is provided by the identity provider.
6. The method of claim 1 , wherein:
the first digital signature is received at the computing device of the user from a primary authenticator of the user;
the second digital signature is received at the computing device of the user from a secondary authenticator of the user, wherein the first digital signature and the second digital signature are transformed into the combined digital signature by the computing device of the user, and
transmitting by the computing device of the user, via the one or more communication networks, the combined digital signature to the service provider for performing the validation of the combined digital signature.
7. The method of claim 6 , further comprising:
transmitting a secondary authentication request from the primary authenticator to the secondary authenticator in response to the successful primary authentication of the user,
wherein performing the secondary authentication comprises performing the secondary authentication only after receiving the secondary authentication request.
8. The method of claim 1 , wherein:
the first digital signature is received at the service provider from a primary authenticator of the user; and
the second digital signature is received at the service provider from a secondary authenticator of the user, wherein the first digital signature and the second digital signature are transformed into the combined digital signature by the service provider.
9. The method of claim 1 , wherein:
the first digital signature is received at the multi-factor authentication service from a primary authenticator of the user;
the first digital signature and the second digital signature are transformed into the combined digital signature by the multi-factor authentication service, and
transmitting by the multi-factor authentication service, via the one or more communication networks, the combined digital signature to the service provider for performing the validation of the combined digital signature.
10. The method of claim 1 , wherein:
generating the second digital signature by the secondary authenticator comprises generating the second digital signature in response to both of the successful primary authentication and the successful secondary authentication of the user.
11. The method of claim 1 , wherein:
the primary authentication of the user is performed using an authentication method that is different from an authentication method used in the secondary authentication of the user.
12. The method of claim 1 , wherein:
providing the user with authenticated access to the service provider includes providing a restricted scope of access to the service provider when only one of the first digital signature and the second digital signature of the combined digital signature is successfully validated using the public cryptographic key.