Legacy authentication for user authentication with self-signed certificate and identity verification

1. A method for authenticating a user to a verifying computer over a network, comprising:

generating a self-signed root certificate signed by a root private key on a user device, wherein the root private key is stored on the user device, and the signing of the self-signed root certificate by the root private key occurs on the user device;

generating an intermediate private key from a hardware security module (HSM) on the user device;

signing an intermediate certificate with the root private key;

linking the intermediate certificate to the self-signed root certificate to form a user device certificate chain, the certificate chain including a public key corresponding to the intermediate private key;

transmitting the user device certificate chain to the verifying computer over the network;

redirecting the user device certificate chain to an authentication server;

providing a user name, user password and verifying computer address to the authentication server;

storing the user name, user password and verifying computer address in association with the user device certificate chain in a password database accessible by the authentication server;

receiving, at the authentication server, a subsequent communication intended for the verifying computer, the subsequent communication including the user device certificate chain;

looking up an associated user name and user password associated with the user device certificate chain in the password database; and

transmitting the associated user name and user password to the verifying computer.

2. The method of claim 1 further comprising:

receiving, by the authentication server, a login token from the verifying computer; and

redirecting the login token to the user device.

3. The method of claim 1 further comprising:

creating, by the authentication server, a new password on behalf of the user;

storing the new password in association with the user device certificate chain in the password database; and

providing the new password to the verifying computer.

4. The method of claim 1 where the step of redirecting the user device certificate chain to an authentication server is performed by a redirect module on the user device.

5. The method of claim 1 where the step of redirecting the user device certificate chain to an authentication server is performed by a redirect module associated with the verifying computer.

6. The method of claim 1 further comprising:

determining that the verifying computer accepts certificates; and

halting the redirecting of the user device certificate chain to the authentication server.

7. The method of claim 1 further comprising:

determining that the self-signed root certificate belongs to the user by:

issuing a challenge question to the user device, by the authentication server, using a user public key to encrypt the challenge question;

decrypting the challenge question by the user device using the intermediate private key; and

sending, by the user device, a response to the challenge question, encrypted with the intermediate private key.

8. The method of claim 1 further comprising:

storing, by the user device, the intermediate private key in a signing application in a memory of the user device.

9. The method of claim 1 further comprising:

storing, by the user device, the root private key in an external electronic device; and

recovering the root private key from the external electronic device.

10. A method for authenticating a user to a verifying computer over a network, comprising:

generating a self-signed certificate signed by a private key on a user device;

transmitting the self-signed certificate to a verifying computer over the network;

redirecting the self-signed certificate chain to an authentication server;

providing a user name, user password and verifying computer address to the authentication server;

storing the user name, user password and verifying computer address in association with the self-signed certificate chain in a password database accessible by the authentication server;

receiving, at the authentication server, a subsequent communication intended for the verifying computer, the subsequent communication including the self-signed certificate;

looking up an associated user name and user password associated with the self-signed certificate in the password database; and

transmitting the associated user name and user password to the verifying computer.

11. The method of claim 10 further comprising:

generating an intermediate private key from a hardware security module (HSM) on the user device;

signing an intermediate certificate with the intermediate private key; and

linking the intermediate certificate to the self-signed certificate to form a user device certificate chain, the certificate chain including a public key corresponding to the intermediate private key.

12. The method of claim 11 further comprising:

creating, by the authentication server, a new password on behalf of the user;

storing the new password in association with the user device certificate chain in the password database; and

providing the new password to the verifying computer.

13. The method of claim 10 where the step of redirecting the self-signed certificate to an authentication server is performed by a redirect module on the user device.

14. The method of claim 10 where the step of redirecting the self-signed certificate to an authentication server is performed by a redirect module associated with the verifying computer.

15. A system for authenticating a user to a verifying computer over a network, comprising:

(a) a user device including a processor and non-transitory computer readable medium having stored thereon software instructions that, when executed by the processor, cause the processor to generate control signals for executing the steps comprising

generating a self-signed root certificate signed by a root private key on the user device, wherein the root private key is stored on the user device, and the signing of the self-signed root certificate by the root private key occurs on the user device;

generating an intermediate private key from a hardware security module (HSM) on the user device;

signing an intermediate certificate with the root private key;

linking the intermediate certificate to the self-signed root certificate to form a user device certificate chain, the certificate chain including a public key corresponding to the intermediate private key;

transmitting the user device certificate chain to a verifying computer over the network;

(b) a password database;

(c) an authenticating server including a processor and non-transitory computer readable medium having stored thereon software instructions that, when executed by the processor, cause the processor to generate control signals for authenticating a user to a verifying computer over a network, by executing the steps comprising

receiving the self-signed certificate redirected to the authenticating server;

receiving a user name, user password and verifying computer address from the user device;

storing the user name, user password and verifying computer address in association with the self-signed certificate chain in the password database;

receiving a subsequent communication intended for the verifying computer, the subsequent communication including the self-signed certificate;

looking up an associated user name and user password associated with the self-signed certificate in the password database; and

transmitting the associated user name and user password to the verifying computer.

16. The system of claim 15 wherein the non-transitory computer readable medium software instructions of the authenticating server, when executed by processor of the authenticating server, further cause the processor of the authenticating server to generate control signals to execute the steps comprising:

creating a new password on behalf of the user;

storing the new password in association with the self-signed certificate in the password database; and

providing the new password to the verifying computer.

17. The system of claim 15 wherein the non-transitory computer readable medium software instructions of the authenticating server, when executed by processor of the authenticating server, further cause the processor of the authenticating server to generate control signals to execute the steps comprising:

periodically changing the password associated with the self-signed certificate, and providing instructions to the verifying computer to change the user password, without involving the user device.