Non-repudiation method and system
In one embodiment, the present disclosure is directed to a system for digital authentication. A device includes a second processor for security functionality. The second processor generates a public key and a private key, and uses the private key and to-be-signed signature data to generate digital signatures. The device transmits the public key and a first digital signature to the server. As part of subsequent communication, the device transmits the public key and a second digital signature to the server. Using the public key, the server validates the second digital signature to verify that the second digital signature is from the device or a user of the device, thereby verifying that the subsequent communication is from the device or the user of the device.
1. A system for digital authentication comprising:
a server;
a device comprising:
a first processor comprising a central processing unit (CPU) configured to provide general processing for the device; and
a second processor separate and distinct from the first processor, the second processor programmed to:
in response to an instruction from the CPU, generate a public key and a private key;
generate at least a first digital signature by:
generating a secret, or receiving a secret from the server;
combining the generated secret and the with other metadata from the device;
generating a device signature comprising device identification information;
combining the combined secret and the device signature to form to-be-signed signature data; and
signing, by the private key, the to-be-signed signature data to generate the first digital signature;
wherein the device is programmed to transmit the public key and the first digital signature to the server;
wherein, after the device transmits the public key and the first digital signature to the server as part of subsequent communication, the device is programmed to generate a second digital signature by repeating the steps for generating the first digital signature;
wherein the device is programmed to transmit the public key and the second digital signature to the server; and
wherein the server is programmed to retrieve using the public key, validate the second digital signature to verify that the second digital signature is from the device or a user of the device, thereby verifying that the subsequent communication is from the device or the user of the device.
2. The system of claim 1 wherein the second processor is dedicated solely to security functionality.
3. The system of claim 1 wherein the device is further programmed to transmit the secret to the server.
4. The system of claim 1 :
wherein, as part of the subsequent communication, the device is programmed to generate a second secret, and to transmit the second secret to the server; and
wherein the server is programmed to use the public key to validate the second secret to verify the second secret is from the device or the user of the device.
5. The system of claim 1 :
wherein the device is a smartphone, and the server authenticates the user of the smartphone;
or
the device is a non-internet-enabled device forming part of an internet of things, and the server authenticates the non-internet-enabled device.
6. The system of claim 1 wherein the server validates the public key.
7. The system of claim 1 wherein the server validates the first digital signature with the public key.
8. The system of claim 1 wherein the second processor is programmed to generate certificates for public keys.
9. A method of providing digital authentication comprising:
a) providing a device comprising:
i) a first processor comprising a central processing unit (CPU) configured to provide general processing for the device; and
ii) a second processor separate and distinct from the first processor;
b) in response to an instruction from the CPU, the second processor generating a public key and a private key;
c) the second processor generating at least a first digital signature by:
generating a secret, or receiving a secret from the server;
combining the generated secret and the with other metadata from the device;
generating a device signature comprising device identification information;
combining the combined secret and the device signature to form to-be-signed signature data; and
signing, by the private key, the to-be-signed signature data to generate the first digital signature;
the device transmitting the public key and the first digital signature to a server;
after the transmitting the public key and the first digital signature to a server is completed, as part of a subsequent communication, repeating step c) to generate a second digital signature;
the device transmitting the public key and the second digital signature to the server; and
using the public key, the server validating the second digital signature to verify that the second digital signature is from the device or a user of the device, thereby verifying that the subsequent communication is from the device or the user of the device.
10. The method of claim 9 wherein the second processor is dedicated solely to security functionality.
11. The method of claim 9 wherein the device is further programmed to transmit the secret to the server.
12. The method of claim 9 :
wherein, as part of the subsequent communication, the device is programmed to generate a second secret, and to transmit the second secret to the server; and
wherein the server is programmed to use the public key to validate the second secret to verify the second secret is from the device or the user of the device.
13. The method of claim 9 :
wherein the device is a smartphone, and the server authenticates the user of the smartphone;
or
the device is a non-internet-enabled device forming part of an internet of things, and the server authenticates the non-internet-enabled device.
14. The method of claim 9 wherein the server validates the public key.
15. The method of claim 9 wherein the server validates the first digital signature with the public key.
16. The method of claim 9 wherein the second processor is programmed to generate certificates for public keys.