Anonymous authentication system and methods for obscuring authentication information in networked computing systems
System and methods for anonymously authenticating a client device and/or user are disclosed. An authentication system can register and/or activate a client device and provide the client device with credentials for accessing or otherwise logging into a third-party application. The client device can provide the third-party application with credentials received from the authentication system and/or self-generated credentials. The third-party application can interact with the authentication system to confirm an identity of the client device and/or authenticate the client device to access the third-party application.
1. A method performed by an authentication system for authenticating a computing device, the method comprising:
receiving a request for a first credential from a computing device, wherein the request comprises a second credential generated by the computing device and encrypted session data, wherein the encrypted session data corresponds to a prior authentication of the computing device by the authentication system;
decrypting the encrypted session data to obtain decrypted session data;
determining a user identifier based on the decrypted session data;
generating the first credential;
generating a first authentication identifier based on the first credential, the second credential, and a cryptographically secure hash function;
generating a first key based on the first credential and the second credential;
encrypting client authentication data using the first key as a key to create encrypted client authentication data, wherein the client authentication data comprises the first authentication identifier;
communicating the first credential to the computing device, wherein the computing device uses the first credential and the second credential to log in to a third-party entity system;
receiving, from the third-party entity system, a request to authenticate a user, wherein the request to authenticate the user includes a set of credentials provided by the user as part of a login procedure for an application associated with the third-party entity system;
generating a second authentication identifier based on the set of credentials and the cryptographically secure hash function;
creating a second key based on the set of credentials; and
communicating an authentication decision to the third-party entity system based at least in part on the second authentication identifier and the second key.
2. The method of claim 1 , wherein the authentication decision indicates an approval of the user based on at least one of a determination that second key is usable to decrypt the client authentication data or a determination that the second authentication identifier matches the first authentication identifier.
3. The method of claim 1 , further comprises:
decrypting the client authentication data using the second key to obtain the first authentication identifier; and
comparing the second authentication identifier to the first authentication identifier,
wherein the authentication decision indicates an approval of the user based on a determination that the second authentication identifier matches the first authentication identifier.
4. The method of claim 1 , wherein the authentication decision indicates a denial of the user based on a determination that second key is not usable to decrypt the client authentication data.
5. The method of claim 1 , wherein the authentication decision indicates a denial of the user based on a determination that the second authentication identifier does not match the first authentication identifier.
6. The method of claim 1 , wherein the first key is assigned an expiration period, wherein the authentication decision indicates a denial of the user based on a determination that the expiration period is expired.
7. The method of claim 1 , wherein the first credential is a quickcode, and wherein the second credential is a quickpin.
8. The method of claim 1 , wherein the request to authenticate the user further comprises an API key, wherein the API key is a unique, private key previously assigned to the third-party entity system by the authentication system.
9. The method of claim 1 , wherein the second credential is a hashed version of a third credential, wherein the third credential is generated by the computing device accordingly to a generation policy.
10. The method of claim 1 , wherein said generating the first authentication identifier comprises:
hashing the first credential to create a hashed first credential; and
hashing the hashed first credential and the second credential to create the first authentication identifier.
11. The method of claim 1 , further comprising creating an authentication object key salt, wherein generating the first key is based on the authentication object key salt.
12. The method of claim 1 , wherein the session data includes at least one of a profile identifier or an account identifier.
13. An authentication system comprising
memory; and
one or more processors coupled to the memory and configured to:
receive a request for a first credential from a computing device, wherein the request comprises a second credential generated by the computing device and encrypted session data, wherein the encrypted session data corresponds to a prior authentication of the computing device by the authentication system;
decrypt the encrypted session data to identify an account user;
generate the first credential;
generate a first authentication identifier based on the first credential, the second credential, and a cryptographically secure hash function;
generate a first key based on the first credential and the second credential;
encrypt client authentication data using the first key as a key to create encrypted client authentication data, wherein the client authentication data comprises the first authentication identifier;
communicate the first credential to the computing device, wherein the computing device uses the first credential and the second credential to log in to a third-party entity system;
receive, from the third-party entity system, a request to authenticate a user, wherein the request to authenticate the user includes a set of credentials provided by the user as part of a login procedure for an application associated with the third-party entity system;
generate a second authentication identifier based on the set of credentials and the cryptographically secure hash function;
create a second key based on the set of credentials; and
communicate an authentication decision to the third-party entity system based at least in part on the second authentication identifier and the second key.
14. The authentication system of claim 13 , wherein the authentication decision indicates an approval of the user based on at least one of a determination that second key is usable to decrypt the client authentication data or a determination that the second authentication identifier matches the first authentication identifier.
15. The authentication system of claim 13 , wherein the one or more processors are further configured to:
decrypt the client authentication data using the second key to obtain the first authentication identifier; and
compare the second authentication identifier to the first authentication identifier,
wherein the authentication decision indicates an approval of the user based on a determination that the second authentication identifier matches the first authentication identifier.
16. The authentication system of claim 13 , wherein the authentication decision indicates a denial of the user based on a determination that second key is not usable to decrypt the client authentication data.
17. The authentication system of claim 13 , wherein the authentication decision indicates a denial of the user based on a determination that the second authentication identifier does not match the first authentication identifier.
18. The authentication system of claim 13 , wherein the first key is assigned an expiration period, wherein the authentication decision indicates a denial of the user based on a determination that the expiration period is expired.