Authentication of a client device based on entropy from a server or other device
Methods and systems for authenticating a client device using entropy provided by a server and/or a device paired with the client device are described herein. The system may generate static entropy and time-limited entropy based on data from the server and/or the paired device. The static and time-limited entropy may be used to authenticate the client device (application or a user of the client device) in addition to authentication credentials or entropy such as a PIN or password provided by the user. The time-limited entropy may have an expiration time. If the time-limited entropy is expired, the system may request the user to perform a hard authentication with the server, such as by providing a username, password, and/or optionally a two-factor authentication code, among other information.
1. A method comprising:
generating, by a server, using first entropy generated by the server, and using a passcode provided by a user at a client device, a key for second entropy generated by the server, wherein the key is usable to decrypt the second entropy;
generating, by the server and based on a key derivation function using the first entropy generated by the server and the second entropy generated by the server, a key for the passcode provided by the user at the client device;
receiving a request from the client device for the first entropy generated by the server, wherein the first entropy comprises an expiration time;
determining whether a current time exceeds the expiration time of the first entropy; and
if the current time does not exceed the expiration time of the first entropy, sending the first entropy to the client device.
2. The method of claim 1 , further comprising:
if the current time does not exceed the expiration time of the first entropy, encrypting, by the server, the first entropy using a public key of the client device,
wherein sending the first entropy comprises sending the first entropy encrypted using the public key of the client device.
3. The method of claim 1 , wherein the request is received at the server, the method further comprising:
if the current time exceeds the expiration time of the first entropy, sending, by the server, a response requesting the client device to perform a hard authentication.
4. The method of claim 3 , wherein the hard authentication comprises providing a username and a password or a two-factor authentication code.
5. The method of claim 1 , further comprising:
receiving and storing, at a device paired with the client device, the first entropy generated by the server,
wherein the request for the first entropy is received at the device paired with the client device, and wherein the sending the first entropy to the client device is performed by the device paired with the client device.
6. The method of claim 5 , wherein the device paired with the client device comprises a mouse connected to the client device via Bluetooth, Near Field Communication, Wi-Fi, or USB.
7. The method of claim 1 , further comprising:
prior to sending the first entropy to the client device, modifying the expiration time of the first entropy.
8. The method of claim 1 , further comprising:
encrypting the second entropy using the key for the second entropy; and
sending the encrypted second entropy to the client device.
9. A method comprising:
receiving, at a client device, a user credential;
in response to receiving the user credential, sending, by the client device, a request for first entropy generated by a server, wherein the first entropy expires at a predefined time;
receiving, by the client device, the first entropy generated by the server;
determining, based on the first entropy, a key for a second entropy generated by the server;
decrypting, by the client device and using the key for the second entropy, the second entropy generated by the server;
accessing, by the client device, a stored user credential based on the first entropy generated by the server and the decrypted second entropy generated by the server, wherein accessing the stored user credential based on the first entropy and the second entropy comprises:
determining a key for the stored user credential based on the decrypted second entropy; and
decrypting the stored user credential using the key for the stored user credential; and
authenticating a user of the client device by comparing the received user credential to the stored user credential.
10. The method of claim 9 , wherein determining the key for the second entropy is based on the first entropy and the received user credential.
11. The method of claim 9 , wherein the client device comprises a first client device, the method further comprising after authenticating the user of the first client device:
accessing, by the first client device, data stored in a secure vault; and
sending, by the first client device, the data stored in the secure vault to a second client device, wherein the data stored in the secure vault is usable by the second client device to access one or more resources accessible to the first client device.
12. The method of claim 9 , wherein the client device sends the request for the first entropy to the server or to a device paired with the client device.
13. The method of claim 9 , further comprising:
locally storing, by the client device, the first entropy, wherein the locally stored first entropy expires at a second predefined time; and
fetching the locally stored first entropy in response to receiving the user credential.
14. The method of claim 9 , further comprising:
prior to sending the request for the first entropy, determining, by the client device, that the first entropy has not expired,
wherein the request for the first entropy is sent in response to receiving the user credential and in response to determining that the first entropy has not expired.
15. An apparatus, comprising:
a processor; and
memory storing computer-executable instructions that, when executed by the processor, cause the apparatus to:
determine first entropy for a client device, the first entropy having an expiration time;
determine second entropy for the client device;
generate a key for the second entropy using a passcode for a user of the client device and the first entropy, wherein the passcode is usable to authenticate the user;
encrypt the second entropy using the key for the second entropy;
generate a key for the passcode using the first entropy and the second entropy;
encrypt the passcode using the generated key for the passcode; and
send the encrypted second entropy and the encrypted passcode to the client device.
16. The apparatus of claim 15 , wherein the memory stores additional computer-executable instructions that, when executed by the processor, cause the apparatus to:
authenticate a device paired with the client device;
encrypt the first entropy with a key accessible by the client device; and
send the encrypted first entropy and the expiration time to the device paired with the client device.
17. The apparatus of claim 16 , wherein the device paired with the client device comprises a mouse connected to the client device via Bluetooth, Near Field Communication, Wi-Fi, or USB.
18. The apparatus of claim 15 , wherein the memory stores additional computer-executable instructions that, when executed by the processor, cause the apparatus to:
determine whether a current time exceeds the expiration time; and
if the current time does not exceed the expiration time, send the first entropy to the client device.
19. The apparatus of claim 18 , wherein the memory stores additional computer-executable instructions that, when executed by the processor, cause the apparatus to:
if the current time does not exceed the expiration time, encrypt the first entropy using a public key of the client device,
wherein sending the first entropy comprises sending the first entropy encrypted using the public key of the client device.