Emc Corporation

Emc IP Holding Company LLC

Rsa Security Inc.

Piers Bowness

Yedidya Dotan

William Duane

Lawrence N Friedman

Karl Ackerman

Ronald L Rivest

Dmitri Pal

Salah E Machani

Zulfikar A Ramzan

Andrew Nanopoulos

Paul Dennis

Karl G Kowalski

Shane D Rice

Markus Jakobsson

Burt Kaliski

Methods, apparatus, and processor-readable storage media for temporary partial authentication value provisioning for offline authentication are provided herein. An example computer-implemented method includes generating, in response to a request from an access device, an intermediary set of cryptographic information from an initial set of cryptographic information; modifying the intermediary set of cryptographic information based at least in part on data pertaining to the access device and one or more security parameters, wherein modifying the intermediary set of cryptographic information comprises removing one or more items of the cryptographic information from the intermediary set; and transmitting, over a network connection, the modified intermediary set of cryptographic information to the access device for use in a subsequent offline authentication request.

Temporary partial authentication value provisioning for offline authentication

An apparatus includes at least one linear feedback shift register and at least one processing device comprising a processor coupled to a memory. The at least one processing device is configured to obtain a given value from the at least one linear feedback shift register, the given value comprising a set of bits representing a current state of the linear feedback shift register. The at least one processing device is also configured to generate authentication information by applying the given value obtained from the at least one linear feedback shift register as input to a pseudorandom function, and to provide the generated authentication information to a validating application.

Generating authentication information utilizing linear feedback shift registers

A cryptographic device comprises a processor coupled to a memory and is configured to maintain an event counter characterizing a number of successful administrative accesses to the cryptographic device. The cryptographic device is further configured to receive an event-based one-time passcode for a given administrative access attempt, to compare the received event-based one-time passcode to an expected event-based one-time passcode determined as a function of a current value of the event counter, and to grant or deny the given administrative access attempt based at least in part on a result of the comparing. The cryptographic device may store an administrative seed value, with the expected event-based one-time passcode being determined as a function of the administrative seed value and the current value of the event counter. The cryptographic device illustratively comprises a smartcard, a hardware or software authentication token, an Internet-of-Things (IoT) device, or other type of processor-based device having an administrative access interface.

Cryptographic device with administrative access interface utilizing event-based one-time passcodes

One embodiment is described of a method performed by a computing device for renewing a remote token. The method includes (a) receiving an activation code from the remote token across a network, the activation code including an identification of the token, (b) verifying that the activation code was cryptographically generated with reference to a one-time passcode (OTP) generated by the identified token using an initial key assigned to the token, and (c) in response to verifying, negotiating a new key with the token, the new key to be assigned to the token for use in producing OTPs in the future. Related computer program products, systems, and apparatuses are also described.

Automated token renewal using OTP-based authentication codes

A method performed by a client access device includes (1) receiving, at the client access device, a signal from a client authorizing device, the signal including an environmental detection instruction, the environmental detection instruction instructing the client access device to detect an aspect of a local environment, (2) detecting, at the client access device, the aspect of the environment indicated by the environmental detection instruction to yield a first environmental detection result, (3) sending the first environmental detection result from the client access device to a remote server, and (4) in response to sending the environmental detection result to the remote server, receiving a proximity signal from the remote server indicating whether or not proximity between the client access device and the client authorizing device has been established by comparing the first environmental detection result to a second environmental detection result sent from the client authorizing device to the server.

Proximity-based authentication

One embodiment is directed to a method performed by a computing device. The method includes (a) engaging in a handshake procedure with a remote second computing device to establish a secure channel, (b) generating a first encryption key using a first token having a secret seed, the first encryption key being the same as a second encryption key generated by the second computing device using a second token having the same secret seed, and (c) using the first encryption key to engage in encrypted communications with the second computing device. Other embodiments are directed to a computerized apparatus and a computer program product for performing a method similar to that described above.

Token-based key generation

In a system for disconnected authentication, verification records corresponding to given authentication token outputs over a predetermined period of time, sequence of events, and/or set of challenges are downloaded to a verifier. The records include encrypted or hashed information for the given authentication token outputs. In one embodiment using time intervals, for each time interval, token output data, a salt value, and a pepper value, are hashed and compared with the verification record for the time interval. After a successful comparison, a user can access the computer. A PIN value can also be provided as an input the hash function. A portion of the hash function output can be used as a key to decrypt an encrypted (Windows) password, or other sensitive information.

System and method providing disconnected authentication

A computing system has a local computing domain coupled to a one-time password (OTP) server. The OTP server maintains user-specific secret data used in a one-time-password (OTP) process to generate OTPs for user authentication. An authentication server in the computing domain sends an OTP request identifying a user to the OTP server. The OTP server executes the OTP process to generate a set of candidate OTPs, any one of which is expected to match a user-generated OTP for a valid authentication. The OTP server returns a response to the authentication server which includes second hashed OTP values, each generated by applying a hash function to a respective candidate OTP. The authentication server performs a comparison function between a first hashed OTP value from the user and the second hashed OTP values. Only upon determining that the first hashed OTP value matches one of the second hashed OTP values, the authentication server performs a protected function in the computing domain that is permitted only upon authentication of the user. Applications include authentication in a ticket-based authentication scheme such as a Kerberos system, in which the protected function may be the granting of a ticket-granting ticket enabling the user to engage service servers in the computing domain.

Growing community of inventors

Boxborough, MA, United States of America

Piers Bowness