Network-based device authentication system

1. A system comprising:

a processor; and

a memory comprising instructions that are executable by the processor for causing the processor to:

transmit a signature key to a user device to enable the user device to generate an encrypted signature by encrypting information using the signature key;

subsequent to transmitting the signature key to the user device, receive a request for secure information from the user device, wherein the request includes:

a device identifier corresponding to the user device,

a timestamp for a transmission time at which the request was transmitted from the user device to the processor, and

an encrypted signature including a version of the device identifier and the timestamp encrypted by the user device; and

subsequent to receiving the request:

calculate a one-way delay between (i) the transmission time at which the request was transmitted by the user device and (ii) a receipt time at which the request was received by the processor;

determine whether the one-way delay is within a threshold window of time;

generate a server-side signature that includes a version of the device identifier and the timestamp encrypted using a stored signature key retrieved from a database;

compare the server-side signature to the encrypted signature in the request to determine a signature match; and

based on determining the signature match and that the one-way delay is within the threshold window of time, authenticate the user device to access the secure information.

2. The system of claim 1 , wherein the request further includes a token code, and wherein the encrypted signature is generated based at least in part on the token code.

3. The system of claim 2 , wherein the memory further comprises instructions that are executable by the processor for causing the processor to retrieve a stored token code from a database based on a correlation between the device identifier and the stored token code in the database, wherein the server-side signature is generated based at least in part on the stored token code.

4. The system of claim 2 , wherein the memory further comprises instructions that are executable by the processor for causing the processor to, prior to receiving the request:

receive user authentication information from the user device;

authenticate the user device using the user authentication information; and

based on authenticating the user device:

generate the token code;

determine the signature key;

transmit the token code and the signature key to the user device; and

associate the device identifier with the token code and the signature key in the database.

5. The system of claim 1 , wherein the memory further comprises instructions that are executable by the processor for causing the processor to compare the server-side signature to the encrypted signature subsequent to determining that the one-way delay is within the threshold window of time.

6. The system of claim 1 , wherein the memory further comprises instructions that are executable by the processor for causing the processor to generate the server-side signature by calculating a keyed-hash message authentication code (“HMAC”) using the device identifier and the timestamp in combination with the stored signature key.

7. The system of claim 1 , wherein the memory further comprises instructions that are executable by the processor for causing the processor to, subsequent to authenticating the user device to access the secure information:

determine an information type identifier associated with the device identifier in the database, wherein the information type identifier indicates a specific type of data to transmit to the user device in response to the request; and

transmit the specific type of data to the user device as at least a portion of the secure information.

8. A method comprising:

transmitting, by a processor, a signature key to a user device;

subsequent to transmitting the signature key to the user device, receiving, by the processor, a request for secure information from the user device, wherein the request includes:

a device identifier corresponding to the user device,

a timestamp for a transmission time at which the request was transmitted from the user device to the processor, and

an encrypted signature including the device identifier and the timestamp, as encrypted by the user device using the signature key; and

subsequent to receiving the request:

calculating, by the processor, a one-way delay between (i) the transmission time at which the request was transmitted by the user device and (ii) a receipt time at which the request was received by the processor;

determining, by the processor, whether the one-way delay is within a threshold window of time;

generating, by the processor, a server-side signature that includes the device identifier and the timestamp, as encrypted by the processor using a stored signature key retrieved from a database;

comparing, by the processor, the server-side signature to the encrypted signature in the request to determine a signature match; and

based on determining the signature match and that the one-way delay is within the threshold window of time, authenticating, by the processor, the user device to access the secure information.

9. The method of claim 8 , wherein the request further includes a token code, and wherein the encrypted signature is generated based at least in part on the token code.

10. The method of claim 9 , further comprising retrieving a stored token code from the database based on a correlation between the device identifier and the stored token code in the database, wherein the server-side signature is generated based at least in part on the stored token code.

11. The method of claim 9 , further comprising, prior to receiving the request:

receiving user authentication information from the user device;

authenticating the user device using the user authentication information; and

based on authenticating the user device:

generating the token code;

determining the signature key;

transmitting the token code and the signature key to the user device; and

associating the device identifier with the token code and the signature key in the database.

12. The method of claim 8 , further comprising comparing the server-side signature to the encrypted signature subsequent to determining that the one-way delay is within the threshold window of time.

13. The method of claim 8 , further comprising generating the server-side signature by calculating a keyed-hash message authentication code (“HMAC”) using the device identifier and the timestamp in combination with the stored signature key.

14. The method of claim 8 , further comprising, subsequent to authenticating the user device to access the secure information:

determining an information type identifier associated with the device identifier in the database, wherein the information type identifier indicates a specific type of data to transmit to the user device in response to the request; and

transmitting the specific type of data to the user device as at least a portion of the secure information.

15. A non-transitory computer-readable medium comprising program code that is executable by a processor for causing the processor to:

transmit a signature key to a user device;

subsequent to transmitting the signature key to the user device, receive a request for secure information from the user device, wherein the request includes:

a device identifier corresponding to the user device,

a timestamp for a transmission time at which the request was transmitted from the user device to the processor, and

an encrypted signature including the device identifier and the timestamp, as encrypted by the user device using the signature key; and

subsequent to receiving the request:

calculate a one-way delay between (i) the transmission time at which the request was transmitted by the user device and (ii) a receipt time at which the request was received by the processor;

determine whether the one-way delay is within a threshold window of time;

generate a server-side signature that includes the device identifier and the timestamp, as encrypted by the processor using a stored signature key retrieved from a database;

compare the server-side signature to the encrypted signature in the request to determine a signature match; and

based on determining the signature match and that the one-way delay is within the threshold window of time, authenticate the user device to access the secure information.

16. The non-transitory computer-readable medium of claim 15 , wherein the request further includes a token code, and wherein the encrypted signature is generated based at least in part on the token code.

17. The non-transitory computer-readable medium of claim 16 , further comprising program code that is executable by the processor for causing the processor to retrieve a stored token code from the database based on a correlation between the device identifier and the stored token code in the database, wherein the server-side signature is generated based at least in part on the stored token code.

18. The non-transitory computer-readable medium of claim 16 , further comprising program code that is executable by the processor for causing the processor to, prior to receiving the request:

receive user authentication information from the user device;

authenticate the user device using the user authentication information; and

based on authenticating the user device:

generate the token code;

determine the signature key;

transmit the token code and the signature key to the user device; and

associate the device identifier with the token code and the signature key in the database.

19. The non-transitory computer-readable medium of claim 16 , further comprising program code that is executable by the processor for causing the processor to compare the server-side signature to the encrypted signature subsequent to determining that the one-way delay is within the threshold window of time.

20. The non-transitory computer-readable medium of claim 16 , further comprising program code that is executable by the processor for causing the processor to generate the server-side signature by calculating a keyed-hash message authentication code (“HMAC”) using the device identifier and the timestamp in combination with the stored signature key.