Quorum-based secure authentication
Representative embodiments of secure authentication to a resource in accordance with a predefined, electronically stored quorum-based authentication policy include causing electronic interaction among multiple devices that constitute a quorum in accordance with the policy, computationally determining whether the interaction satisfies the policy, and if so, electronically according access to the resource to one or more individuals associated with the interacting device(s).
1. A wireless mobile device for accessing a resource to which access is controlled in accordance with a predefined, electronically stored quorum-based authentication policy, the device comprising:
communication circuitry for wirelessly interacting with other mobile devices;
an electronically stored identifier for identifying the mobile device and/or a user associated with the mobile device;
a processor;
a memory; and
an electronically stored application for, upon electronic interaction with one or more other mobile devices, (i) receiving a partial key from at least one of the other mobile devices, wherein the partial key comprises keys contributed by one or more of the other mobile devices, (ii) contributing a key for combination with the partial key into a final key, and (iii) transmitting the final key to an authentication server,
wherein (i) the partial key is associated with one or more users different from the user associated with the mobile device, and (ii) the resource is accessible to the mobile device only if the final key satisfies the authentication policy.
2. The device of claim 1 , wherein the application contributes the key to the final key by retrieving the key from the memory.
3. The device of claim 1 , wherein the application contributes the key to the final key by generating the key only upon the electronic interaction.
4. The device of claim 3 , wherein the partial key comprises keys contributed by two or more of the other mobile devices.
5. The device of claim 3 , wherein the authentication policy specifies an order of pairwise interactions among the mobile device and two or more of the other mobile devices.
6. The device of claim 3 , wherein the application is configured to receive the partial key from the at least one of the other mobile devices when the at least one of the other mobile devices is disposed at a first geographic location different from a second geographic location at which the mobile device is disposed.
7. The device of claim 1 , wherein the application transmits the final key to the authentication server only if the final key satisfies the authentication policy.
8. The device of claim 1 , wherein the partial key comprises keys contributed by two or more of the other mobile devices.
9. The device of claim 1 , wherein the authentication policy specifies an order of pairwise interactions among the mobile device and two or more of the other mobile devices.
10. The device of claim 1 , wherein the application is configured to receive the partial key from the at least one of the other mobile devices when the at least one of the other mobile devices is disposed at a first geographic location different from a second geographic location at which the mobile device is disposed.
11. The device of claim 1 , wherein the application is configured to, after contributing the key for combination with the partial key into the final key, transmitting the final key to one or more of the other mobile devices to enable access to the resource from the one or more of the other mobile devices.
12. A wireless mobile device for providing access to a resource to which access is controlled in accordance with a predefined, electronically stored quorum-based authentication policy, the device comprising:
communication circuitry for wirelessly interacting with other mobile devices;
an electronically stored identifier for identifying the device and/or a user associated with the device;
a processor;
a memory; and
an electronically stored application for, upon electronic interaction with one or more other mobile devices, (i) receiving a partial key from at least one of the other mobile devices, wherein the partial key comprises keys contributed by one or more of the other mobile devices, (ii) contributing a key for combination with the partial key into a final key, and (iii) transmitting to an authentication server (a) the final key and (b) identifier information associated with a computing device (I) different from the mobile device and (II) capable of according access to the resource,
wherein the resource is accessible to the computing device only if the final key satisfies the authentication policy.
13. The device of claim 12 , wherein the application contributes the key to the final key by retrieving the key from the memory.
14. The device of claim 12 , wherein the application contributes the key to the final key by generating the key only upon the electronic interaction.
15. The device of claim 12 , wherein the application transmits the final key to the authentication server only if the final key satisfies the authentication policy.
16. The device of claim 12 , wherein the partial key is associated with one or more users different from the user associated with the device.
17. The device of claim 12 , wherein the computing device is different from any of the mobile devices and does not contribute a key for combination into the final key.
18. The device of claim 12 , wherein the application is configured to (i) receive a credential from the authentication server when the final key satisfies the authentication policy and (ii) transmit the credential to the computing device to provide access to the resource via the computing device.
19. A method of secure authentication to a resource in accordance with a predefined, electronically stored quorum-based authentication policy, the resource residing on a computer network having an authentication server residing thereon, the method comprising:
assembling a final key via electronic interaction among a plurality of devices (i) each associated with a different user thereof, (ii) each being different from the resource and different from the authentication server, and (iii) constituting a quorum in accordance with the authentication policy, each of the devices contributing a different key for assembly into the final key;
after the final key is assembled, transmitting the final key to the authentication server;
when the authentication server computationally determines that the final key satisfies the authentication policy, electronically according access to the resource.
20. The method of claim 19 , wherein the final key is assembled without interaction between the authentication server and any of the plurality of devices.
21. The method of claim 19 , further comprising transmitting to the authentication server with the final key, identifier information associated with a computing device capable of according access to the resource,
wherein access is accorded to the resource via the computing device.
22. The method of claim 21 , wherein the computing device is different from any of the devices in the plurality of devices.
23. The method of claim 21 , wherein according access to the resource comprises transmission of a credential from the authentication server.
24. The method of claim 23 , wherein the credential is transmitted from the authentication server to one of the plurality of devices and thence to the computing device.
25. The method of claim 24 , further comprising receiving a second authentication factor, different from the final key, at the computing device before according access to the resource at the computing device.
26. The method of claim 19 , wherein the plurality of devices comprises at least three different devices.