US6263446B1
Expired / Lapsed
US
⏱️ 0.0 years remaining
Method and apparatus for secure distribution of authentication credentials to roaming users
Assignee: CA Inc
•
Filing: 1998-11-19
•
Granted: 2001-07-17
•
Expires: 2018-11-19
Abstract
Abstract A roaming user needing an his authentication credential (e.g., private key) to access a computer server to perform an electronic transaction may obtain the authentication credential in an on-demand fashion from a credential server accessible to the user over a computer network. In this way, the user is free to roam on the network without having to physically carry his authentication credential. Access to the credential may be protected by one or more challenge-response protocols involving simple shared secrets, shared secrets with one-to-one hashing, or biometric methods such as fingerprint recognition. If camouflaging is used to protect the authentication credential, decamouflaging may be performed either at the credential server or at the user's computer.
Inventors
- 👤 Balas Natarajan Kausik
- 👤 Rammohan Varadarajan
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-09 15:27
CPC Classifications
G; G06; G06F; G06F21/00; G06F21/60; G06F21/62; G06F21/6218; G06F21/6245; G06Q; G06Q20/00; G06Q20/02; G06Q20/30; G06Q20/36; G06Q20/367; G06Q20/3672; G06Q20/3674; G06Q20/38; G06Q20/382; G06Q20/3829; G07; G07F; G07F7/00; G07F7/08; G07F7/10; G07F7/1008; G07F7/1025; H; H04; H04L; H04L9/00; H04L9/08; H04L9/0816; H04L9/0838; H04L9/0841; H04L9/0844; H04L9/32; H04L9/3218; H04L9/3226; H04L9/3231; H04L9/3236; H04L9/3271; G06F2221/00; G06F2221/21; G06F2221/2127; H04L2209/00; H04L2209/56; H04L63/00; H04L63/08
Claims Analysis
Total Claims: 56
Claim 1
Independent Claim
130 words
A computer-implemented method for obtaining, in a networked environment, an authentication credential usable to conduct an electronic transaction, comprising: (a) accessing, over a network, a server to request therefrom a predetermined authentication credential, said authentication credential: (i) in existence at said server prior to said request therefor, (ii) uniquely identifying a requestor thereof, and (iii) suitable for use in conducting an electronic transaction; (b) receiving, from said server, a challenge soliciting a predetermined response associated with a holder of said authentication credential; (c) transmitting an answer to said challenge; and (d) in response to a determination by said server that said answer satisfies said challenge, receiving said authentication credential from said server; said method being operable in a repeatable, on-demand manner by said requestor from a plurality of requestor locations.
Claim 2
Dependent Claim
130 words
A computer-implemented method for obtaining, in a networked environment, an authentication credential usable to conduct an electronic transaction, comprising: (a) accessing, over a network, a server to request therefrom a predetermined authentication credential, said authentication credential: (i) in existence at said server prior to said request therefor, (ii) uniquely identifying a requestor thereof, and (iii) suitable for use in conducting an electronic transaction; (b) receiving, from said server, a challenge soliciting a predetermined response associated with a holder of said authentication credential; (c) transmitting an answer to said challenge; and (d) in response to a determination by said server that said answer satisfies said challenge, receiving said authentication credential from said server; said method being operable in a repeatable, on-demand manner by said requestor from a plurality of requestor locations.
Claim 3
Dependent Claim
16 words
The method of claim 1 where said authentication credential includes a secret credential of said requestor.
Claim 4
Dependent Claim
13 words
The method of claim 2 where said secret credential is a private key.
Claim 5
Dependent Claim
27 words
The method of claim 2 further comprising: (e) using said authentication credential to conduct said electronic transaction; and (f) deleting said credential from said requestor's computing device.
Claim 6
Dependent Claim
22 words
The method of claim 2 where said requestor's computing device includes a web browser, and said network is a distributed computer network.
Claim 7
Dependent Claim
14 words
The method of claim 2 where said requestor's computing device includes a digital wallet.
Claim 8
Dependent Claim
18 words
The method of claim 2 where said response includes a shared secret between said server and said requestor.
Claim 9
Dependent Claim
27 words
The method of claim 1 further comprising: (e) using said authentication credential to conduct said electronic transaction; and (f) deleting said credential from said requestor's computing device.
Claim 10
Dependent Claim
16 words
The method of claim 8 where said authentication credential includes a private key of said requestor.
Claim 11
Dependent Claim
15 words
The method of claim 1 where said received authentication credential is in cryptographically camouflaged form.
Claim 12
Dependent Claim
55 words
The method of claim 10 where said authentication credential is encrypted under an access code, and further comprising: (i) receiving from said requestor a candidate access code; (ii) verifying that said candidate access code belongs to a family of pseudo-valid responses; and (iii) using said pseudo-valid candidate access code to decrypt said stored authentication credential.
Claim 13
Dependent Claim
23 words
The method of claim 11 where said pseudo-valid responses have the characteristic of being hashable to the same output as said access code.
Claim 14
Dependent Claim
16 words
The method of claim 12 where said authentication credential includes a private key of said requestor.
Claim 15
Dependent Claim
16 words
The method of claim 10 where said authentication credential includes a secret credential of said requestor.
Claim 16
Dependent Claim
30 words
The method of claim 10 further comprising the steps of: (e) using said authentication credential to conduct said electronic transaction; and (f) deleting said credential from said requestor's computing device.
Claim 17
Dependent Claim
19 words
The method of claim 1 where said challenge and said response are members of a zero knowledge proof protocol.
Claim 18
Dependent Claim
19 words
The method of claim 1 where said steps (b) and (c) are part of a cryptographic camouflage challenge-response protocol.
Claim 19
Dependent Claim
19 words
The method of claim 1 further comprising downloading a digital currency from said server along with said authentication credential.
Claim 20
Independent Claim
160 words
An apparatus for obtaining, in a networked environment, an authentication credential usable to conduct an electronic transaction, comprising: (a) a network interface configured to: (i) access, over a network, a server to request therefrom a predetermined authentication credential, said authentication credential: (A) in existence at said server prior to said request therefor, (B) uniquely identifying a requestor thereof, and (C) suitable for use in conducting an electronic transaction, and (ii) receive, from the server, a challenge soliciting a predetermined response associated with said requestor of said authentication credential; (b) an user interface configured to receive, from said requestor, an answer to said challenge; (c) said network interface configured to receive said authentication credential in response to a determination by said server that said answer satisfies said challenge; and (d) a memory configured to store said authentication credential at said requestor's computing device; said apparatus being usable by said requestor to obtain repeated, on-demand access from a plurality of requestor locations.
Claim 21
Independent Claim
160 words
An apparatus for obtaining, in a networked environment, an authentication credential usable to conduct an electronic transaction, comprising: (a) a network interface configured to: (i) access, over a network, a server to request therefrom a predetermined authentication credential, said authentication credential: (A) in existence at said server prior to said request therefor, (B) uniquely identifying a requestor thereof, and (C) suitable for use in conducting an electronic transaction, and (ii) receive, from the server, a challenge soliciting a predetermined response associated with said requestor of said authentication credential; (b) an user interface configured to receive, from said requestor, an answer to said challenge; (c) said network interface configured to receive said authentication credential in response to a determination by said server that said answer satisfies said challenge; and (d) a memory configured to store said authentication credential at said requestor's computing device; said apparatus being usable by said requestor to obtain repeated, on-demand access from a plurality of requestor locations.
Claim 22
Dependent Claim
16 words
The apparatus of claim 19 wherein said authentication credential includes a secret credential of said requestor.
Claim 23
Dependent Claim
13 words
The apparatus of claim 20 wherein said secret credential is a private key.
Claim 24
Dependent Claim
21 words
The apparatus of claim 19 configured for use as a web browser, and wherein said network is a distributed computer network.
Claim 25
Dependent Claim
12 words
The apparatus of claim 19 configured for use as a digital wallet.
Claim 26
Dependent Claim
19 words
The apparatus of claim 19 wherein said server is configured to store said authentication credential in cryptographically camouflaged form.
Claim 27
Dependent Claim
67 words
The apparatus of claim 24 wherein: (i) said authentication credential is encrypted under an access code; (ii) said user interface is configured to receive, from said requestor, a candidate access code; and (iii) further comprising cryptographic logic configured to: (iv) verify that said candidate access code belongs to a family of pseudo-valid responses; and (v) use said pseudo-valid candidate access code to decrypt said stored authentication credential.
Claim 28
Dependent Claim
23 words
The apparatus of claim 25 wherein said pseudo-valid responses have the characteristic of being hashable to the same output as said access code.
Claim 29
Dependent Claim
16 words
The apparatus of claim 26 wherein said authentication credential includes a private key of said requestor.
Claim 30
Dependent Claim
20 words
The apparatus of claim 19 wherein said challenge and said predetermined response are part of a cryptographic camouflage challenge-response protocol.
Claim 31
Dependent Claim
16 words
The apparatus of claim 24 wherein said authentication credential includes a secret credential of said requestor.
Claim 32
Dependent Claim
123 words
A computer-implemented method for providing, in a networked environment, an authentication credential usable to conduct an electronic transaction, comprising: (a) receiving from a requestor, over a network, a request for a predetermined authentication credential, said authentication credential: (i) in existence at said server prior to said request therefor, (ii) uniquely identifying a requestor thereof, and (iii) suitable for use in conducting an electronic transaction; (b) transmitting, to said requestor, a challenge soliciting a predetermined response associated with said requestor; (c) receiving an answer to said challenge; (d) determining that said answer satisfies said challenge; and (e) transmitting said authentication credential for said requestor; said method being operable to process repeated, on-demand authentication credential requests by said requestor at a plurality of requestor locations.
Claim 33
Dependent Claim
123 words
A computer-implemented method for providing, in a networked environment, an authentication credential usable to conduct an electronic transaction, comprising: (a) receiving from a requestor, over a network, a request for a predetermined authentication credential, said authentication credential: (i) in existence at said server prior to said request therefor, (ii) uniquely identifying a requestor thereof, and (iii) suitable for use in conducting an electronic transaction; (b) transmitting, to said requestor, a challenge soliciting a predetermined response associated with said requestor; (c) receiving an answer to said challenge; (d) determining that said answer satisfies said challenge; and (e) transmitting said authentication credential for said requestor; said method being operable to process repeated, on-demand authentication credential requests by said requestor at a plurality of requestor locations.
Claim 34
Dependent Claim
16 words
The method of claim 30 where said authentication credential includes a secret credential of said requestor.
Claim 35
Dependent Claim
13 words
The method of claim 31 where said secret credential is a private key.
Claim 36
Dependent Claim
21 words
The method of claim 31 where said requestor is at a web browser, and said network is a distributed computer network.
Claim 37
Dependent Claim
16 words
The method of claim 31 where said transmitting is to a digital wallet of said requestor.
Claim 38
Dependent Claim
18 words
The method of claim 31 where said response includes a shared secret between said server and said requestor.
Claim 39
Dependent Claim
19 words
The method of claim 30 where said server is configured to store said authentication credential in cryptographically camouflaged form.
Claim 40
Dependent Claim
49 words
The method of claim 36 where said authentication credential is encrypted under an access code, and where said determining that said answer satisfies said challenge includes: (i) verifying that said answer belongs to a family of pseudo-valid responses; and (ii) using said response to decrypt said stored authentication credential.
Claim 41
Dependent Claim
23 words
The method of claim 37 where said pseudo-valid responses have the characteristic of being hashable to the same output as said access code.
Claim 42
Dependent Claim
16 words
The method of claim 38 where said authentication credential includes a private key of said requestor.
Claim 43
Dependent Claim
16 words
The method of claim 36 where said authentication credential includes a secret credential of said requestor.
Claim 44
Dependent Claim
27 words
The method of claim 36 where said step (e) includes transmitting said authentication credential to said requestor in cryptographically camouflaged form for cryptographic decamouflaging by said requestor.
Claim 45
Dependent Claim
19 words
The method of claim 30 further comprising sending a digital currency to said requestor along with said authentication credential.
Claim 46
Independent Claim
139 words
An apparatus for providing, in a networked environment, an authentication credential usable to conduct an electronic transaction, comprising: (a) a network interface configured to: (i) receive from a requestor, over a network, a request for a predetermined authentication credential, said authentication credential: (A) in existence at said apparatus prior to said request therefor; (B) uniquely identifying a requestor thereof; and (C) suitable for use in conducting an electronic transaction, (ii) transmit a challenge soliciting a predetermined response associated with said requestor, and (iii) receive, from said holder, an answer to said challenge; (b) logic configured to determine whether said answer satisfies said challenge; and (c) a memory configured to store said authentication credential to be released for said requestor; said apparatus being operable to process repeated, on-demand authentication credential requests by said requestor at a plurality of requestor locations.
Claim 47
Independent Claim
139 words
An apparatus for providing, in a networked environment, an authentication credential usable to conduct an electronic transaction, comprising: (a) a network interface configured to: (i) receive from a requestor, over a network, a request for a predetermined authentication credential, said authentication credential: (A) in existence at said apparatus prior to said request therefor; (B) uniquely identifying a requestor thereof; and (C) suitable for use in conducting an electronic transaction, (ii) transmit a challenge soliciting a predetermined response associated with said requestor, and (iii) receive, from said holder, an answer to said challenge; (b) logic configured to determine whether said answer satisfies said challenge; and (c) a memory configured to store said authentication credential to be released for said requestor; said apparatus being operable to process repeated, on-demand authentication credential requests by said requestor at a plurality of requestor locations.
Claim 48
Dependent Claim
16 words
The apparatus of claim 43 wherein said authentication credential includes a secret credential of said requestor.
Claim 49
Dependent Claim
13 words
The apparatus of claim 44 wherein said secret credential is a private key.
Claim 50
Dependent Claim
18 words
The apparatus of claim 44 wherein said response includes a shared secret between said server and said requestor.
Claim 51
Dependent Claim
19 words
The apparatus of claim 43 wherein said server is configured to store said authentication credential in cryptographically camouflaged form.
Claim 52
Dependent Claim
57 words
The apparatus of claim 47 wherein said authentication credential is encrypted under an access code, and where said logic to determine whether said answer satisfies said challenge includes: (i) cryptographic logic for verifying that said answer belongs to a family of pseudo-valid responses; and (ii) cryptographic logic for using said answer to decrypt said stored authentication credential.
Claim 53
Dependent Claim
23 words
The apparatus of claim 48 where said pseudo-valid responses have the characteristic of being hashable to the same output as said access code.
Claim 54
Dependent Claim
16 words
The apparatus of claim 49 where said authentication credential includes a private key of said requestor.
Claim 55
Dependent Claim
29 words
The apparatus of claim 47 wherein said network interface is configured to release said authentication credential to said requestor in cryptographically camouflaged form for cryptographic decamouflaging by said requestor.
Claim 56
Dependent Claim
16 words
The apparatus of claim 47 wherein said authentication credential includes a secret credential of said user.
References Cited (Backward Citations)
US3798605A
Cited
US5148479A
Cited
US5491752A
Cited
US5778065A
Cited
US5475756A
Cited
US5668876A
Cited
US5764890A
Cited
US5757918A
Cited
US5689566A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2004-07-16 | 2005-01-15 | 2005-07-17 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2008-07-16 | 2009-01-15 | 2009-07-17 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2012-07-16 | 2013-01-15 | 2013-07-17 | $7700.00 | Window Closed / Lapsed |