System and methods for online authentication
A method of establishing a communication channel between a network client and a computer server over a network is described. The network client may be configured to communicate with the computer server over the network and to communicate with a token manager. The token manager may be configured with a parent digital certificate that is associated with the token manager. The token manager or network client generates a credential from the parent digital certificate, and transmits the credential to the computer server. The credential may be associated with the computer server. The network client may establish the communications channel with the computer server in accordance with an outcome of a determination of validity of the credential by, the computer server.
1. A method of authenticating a network client to a computer server, the network client being configured to communicate with the computer server over a network and to communicate with a token manager, the token manager being configured to receive data originating from a hardware token interfaced with the token manager, the method comprising:
one of the token manager and the network client receiving a session token from the computer server;
the one of the token manager and the network client generating a credential associated with the token manager, and transmitting the credential to the computer server, wherein the token manager is configured with a parent digital certificate associated with the token manager, the parent digital certificate comprising a public encryption key, and wherein the credential generating comprises:
the one of the token manager and the network client generating the credential from the parent digital certificate;
the one of the token manager and the network client generating a child digital certificate from the parent digital certificate and signing the child digital certificate with a private encryption key uniquely associated with the public encryption key, the private encryption key and the public encryption key comprising an asymmetric encryption key pair; and
the one of the token manager and the network client incorporating the session token into the child digital certificate; and
the network client receiving an authentication payload from the computer server in accordance with a validity of the credential and the data of the hardware token, the authentication payload facilitating authentication of the network client to the computer server.
2. The method according to claim 1 , wherein the transmitting the credential comprises the one of the token manager and the network client determining a validity of the data of the hardware token, and transmitting the credential and the data of the hardware token in accordance with an outcome of the determining the validity of the data of the hardware token.
3. The method according to claim 2 , wherein the determining the validity of the data of the hardware token comprises the one of the token manager and the network client comparing the data of the hardware token with expected data received from the computer server.
4. The method according to claim 1 , wherein the credential generating comprises the one of the token manager and the network client incorporating the data of the hardware token into the credential.
5. The method according to claim 1 , wherein the credential is uniquely associated with the token manager and the computer server.
6. The method according to claim 1 , wherein the hardware token is associated with an entity other than the computer server.
7. The method according to claim 1 , wherein the credential generating comprises the token manager generating a pseudo-random code, and the one of the token manager and the network client signing the pseudo-random code with a private key uniquely associated with the public encryption key, the private encryption key and the public encryption key comprising an asymmetric encryption key pair, the credential comprising the signed pseudo-random code.
8. The method according to claim 1 , wherein the credential generating comprises the one of the token manager and the network client generating a pseudo-random code, and Incorporating the pseudo-random code into the child digital certificate, the pseudo-random code being verifiable by the computer server.
9. The method according to claim 1 , further comprising the one of the token manager and the network client receiving a server digital certificate associated with the computer server, and the generating a credential comprises the one of the token manager and the network client generating the credential after validating the server digital certificate.
10. The method according to claim 9 , further comprising, prior to the network client receiving the authentication payload from the computer server, the one of the token manager and the network client receiving a signed message from the computer server and authenticating the computer server by verifying the signed message from the server digital certificate, and the generating a credential comprises the one of the token manager and the network client generating the credential in accordance with an outcome of the computer server authenticating.
11. The method according to claim 10 , wherein the digitally-signed message includes a server pseudo-random code, and the computer server authenticating comprises the one of the token manager and the network client comparing the server pseudo-random code with a pseudo-random code expected for the computer server.
12. A non-transitory computer-readable medium comprising computer processing instructions stored thereon for execution by a computer, the computer processing instructions, when executed by the computer, causing the computer to perform the method of claim 1 .
13. A method of authenticating a network client to a computer server, the network client being configured to communicate with the computer server over a network and to communicate with a token manager, the method comprising:
the computer server transmitting a session token to one of the token manager and the network client;
the computer server receiving a credential from one of the token manager and the network client, wherein the token manager is configured with a parent digital certificate associated with the token manager, the parent digital certificate comprises a public encryption key, and wherein the credential is generated from the parent digital certificate and also comprises a child digital certificate generated from the parent digital certificate and signed with a private encryption key uniquely associated with the public encryption key, the private encryption key and the public encryption key comprising an asymmetric encryption key pair, and wherein the session token is incorporated into the child digital certificate; and
the computer server transmitting an authentication payload to the network client in accordance with a determination of validity of the credential and data originating from a hardware token interfaced with the token manager, the authentication payload facilitating authentication of the network client to the computer server.
14. The method according to claim 13 , wherein the determination of the validity comprises the computer server comparing the data of the hardware token with expected data.
15. The method according to claim 14 , wherein the determination of the validity comprises the computer server verifying that the credential is associated with the token manager.
16. The method according to claim 14 , wherein the determination of the validity comprises the computer server verifying that the credential is uniquely associated with the token manager and the computer server.
17. The method according to claim 13 , wherein the determination of the validity comprises verifying that the credential was signed with the private encryption key uniquely associated with the public encryption key.
18. The method according to claim 17 , wherein the credential comprises a digital certificate, and the determination of the validity comprises verifying that the credential comprises a child digital certificate of the parent digital certificate.
19. The method according to claim 13 , wherein the determination of the validity comprises comparing a pseudo-random code included in the credential with an expected pseudo-random code.
20. The method according to claim 13 , wherein the determination of the validity comprises comparing the transmitted session token with a session token included in the credential.
21. The method according to claim 13 , wherein the determination of validity of the credential and the data of the hardware token comprises a determination of a correlation between identifying data of the token manager and identifying data of the hardware token, and a previous token manager—hardware token association.
22. A non-transitory computer-readable medium comprising computer processing instructions stored thereon for execution by a computer, the computer processing instructions, when executed by the computer, causing the computer to perform the method of claim 13 .
23. A method of authenticating a network client to a computer server, the network client being configured to communicate with the computer server over a network and to communicate with a token manager, the token manager being configured to receive data originating from a hardware token interfaced with the token manager, the method comprising:
one of the token manager and the network client receiving a session token from the computer server;
one of the token manager and the network client generating a credential associated with the token manager, and transmitting the credential to the computer server, wherein the token manager is configured with a parent digital certificate associated with the token manager, the parent digital certificate comprising a public encryption key, and wherein the credential generating comprises:
the one of the token manager and the network client generating the credential from the parent digital certificate;
the one of the token manager and the network client generating a child digital certificate from the parent digital certificate and signing the child digital certificate with a private encryption key uniquely associated with the public encryption key, the private encryption key and the public encryption key comprising an asymmetric encryption key pair; and
the one of the token manager and the network client generating a pseudo-random code and incorporating the pseudo-random code into the child digital certificate, the pseudo-random code being verifiable by the computer server; and
the network client receiving an authentication payload from the computer server in accordance with a validity of the credential and the data of the hardware token, the authentication payload facilitating authentication of the network client to the computer server.
24. The method according to claim 23 , wherein the transmitting the credential comprises the one of the token manager and the network client determining a validity of the data of the hardware token, and transmitting the credential and the data of the hardware token in accordance with an outcome of the determining the validity of the data of the hardware token.
25. The method according to claim 24 , wherein the determining the validity of the data of the hardware token comprises the one of the token manager and the network client comparing the data of the hardware token with expected data received from the computer server.