Patent Application
20090327722
This invention relates to an improved method for operating a computing device, and in particular to an improved method for providing user authentication on a computing device.
In the context of the present invention, authentication refers to the process by which the identity claimed by an individual is verified. It is frequently used in conjunction with computing devices to enable a user of the device to gain access to specific data and services which are only authorised for use by a particular individual. Such devices include, without being limited to, desktop and laptop computers, Personal Digital Assistants (PDAs), mobile telephones, smartphones, set-top boxes and games consoles, together with converged devices incorporating the functionality of one or more of the classes of device referred to above, as well as many other industrial and domestic electronic appliances such as ATM machines, digital cameras and digital music players.
Simple password protection is perhaps the most common means of authentication on such devices; an individual confirms their identity by typing in a password, which is then passed through a one-way hash with the result being compared to a previous version of the hashed password stored on the device. If there is a match, access is permitted; if there is a discrepancy, access is refused.
However, it is known that this authentication mechanism is not sufficient to protect any sensitive information that may be stored on the device. This may include commercially or personally valuable data, such as banking access keys and private addresses. The reason for this is that protecting access to the device by means of a password while leaving the data store as plain text data does not adequately protect the information if unauthenticated access to the raw file storage is possible without having to enter the password.
One example of such an attack is via software such as viruses or spyware which can infect the device, gain access to information, and either destroy it or steal it. Another example is where someone with physical access to the device accesses the storage hardware on the device directly; the simplest way of doing this would be to physically remove the memory storage from one device and then insert it in a different device.
To protect against such attacks, owners of computing devices commonly employ encryption technology to further protect their most sensitive data, with full access only being possible on provision of a specific decryption key. This is far more secure than simply password protecting use of a device, because even if the data is compromised by bypassing normal access methods, the fact that it is encrypted renders it unintelligible to anyone who does not possess the keys that provide the means of decrypting it.
It is logically impossible for those keys themselves to be stored in encrypted form; but at the same time, storing them on the device unencrypted (as plain text) leaves both them and any encrypted data vulnerable to precisely the same type of attack that the encryption was designed to avoid.
This apparent paradox can be solved by means of a transient key which is not permanently stored on the device itself.
One common implementation of a transient key protocol is provided in the popular PGP (Pretty Good Privacy) software originally designed by Phil Zimmermann. Keys are stored in an encrypted private store called a keyring, which is protected by a passphrase that the user has to remember. This passphrase is never stored on the device itself; when entered by the user, it enables the derivation of a transient protection key, which is never kept in persistent storage but only in volatile memory. This transient key is used to symmetrically encrypt and decrypt the keyring.
According to http://en.wikipedia.org/wiki/Authentication:
Methods based on authenticating who a user is have historically been computationally expensive in terms of both time and equipment where the personal data used is biometrically ‘hard’ (such as fingerprint or retinal scan or DNA) or else subject to change over time and susceptible to forgery where the data used is ‘soft’ (such as photographs and signatures, which are gradually being phased out as authentication factors on items such as passports and credit cards).
Methods based on authenticating something a user has are inherently limited to a small number of items and are also susceptible to theft and loss; people find it practicably impossible to carry dozens of different items with them and to rely on one common item introduces a highly susceptible single point of failure or attack. Additionally, both these methods are difficult to use in the remote authentication situations which are commonly used by computing devices in internet and telephone communication.
Consequently, the prior art as outlined above tends to be limited to authentication based on something that the user knows. Knowledge is quick and inexpensive to verify, it can be used remotely, and cannot easily be physically lost or stolen.
However, this type of authentication method can only be used reliably if the knowledge can be guaranteed to have been kept secret. When this essential secrecy has been compromised, the authentication is worthless. There are now many methods in use by malware and criminal gangs that make use of security vulnerabilities in systems that rely on secret knowledge. Among the most notorious of these are:
As well as these inadvertent disclosures of secret information, there are increasing instances and opportunities for deliberate leakage of secret access information, where the authorised user of a resource colludes in its misappropriation by a third party. Divulging access codes which enable piracy of computer software packages and digitally protected media content is an example of this type of leakage.
But at the same time as knowledge-based authentication has come under increasing attack, advances in technology have begun to bring down the expense involved in authentication based on something the user is. Biometric verifications of identity are now practical propositions on many devices; for example, a mobile phone with fingerprint recognition, the Pantech GI100, was launched in 2004 (see http://www.mobilemag.com/content/100/340/C3462/).
It is now increasingly practical in many situations to employ multi-factor authentications schemes, which overcome the limitations of individual authentication properties by using them in combination.
Ideally, the choice of which authentication method or methods to use in any circumstance should be a tradeoff based on the perceived damage arising from a security breach in any particular case, the perceived costs of the authentication, and the perceived threats. For example, if a person is eating lunch at an establishment where they are well-known, it would be considered disproportionate, unnecessary and excessively expensive for the manager to insist on the taking of fingerprints and retinal scans for a full biometric verification of identity when paying for relatively inexpensive food and drink with a bank debit card. However, such precautions may not be considered to be out of place if the person took the same bank debit card to a branch of the person's bank, and requested the entire balance of the account to be paid out in cash.
Additionally, the appropriate choices for any circumstance cannot be regarded as fixed. As social trends and the available technology change, the limits of acceptability and practicality are liable to change also. Circumstances also alter security calculations, both socially and personally; for example, the perception of a high danger of terrorist attacks may make it possible to enforce stronger and costlier methods of authentication for passengers on transport networks.
According to a first aspect of the present invention there is provided a method of operating a computing device comprising using one or a combination of methods chosen from amongst a plurality of methods for authenticating a user of the device by means of:
According to a second aspect of the present invention there is provided a computing device arranged to operate in accordance with a method of the first aspect.
According to a third aspect of the present invention there is provided an operating system for causing a computing device to operate in accordance with a method of the first aspect.
Embodiments of the present invention will now be described, by way of further example only, with reference to the accompanying drawings, wherein:—
A perception behind this invention is that there is a need to be able to choose dynamically the most appropriate authentication method or methods from a number of possible authentication methods, depending on the circumstances under which authentication is requested and the methods that are practical at any point in time.
Furthermore, to protect against plaintext attacks on the filesystem of a device, the invention also enables the type of transient key protection described above to be independently available to each of the authentication methods.
While modern computing devices, especially those with communications capabilities such as smart phones, are increasingly able to make use of a wide range of authentication methods, any single one or combination of which may be used or required at any time, the known devices do not allow for how this type of dynamic selection of one from amongst a number of methods employing transient key protection might be made. The existing devices, and the methods which they employ, incorporate fixed authentication techniques and cannot readily be adapted to dynamically change from one method to another.
Furthermore, the present invention also envisages allowing the addition of extra authentication methods as technology develops and the calculus of risks and costs alters. Adding authentication methods on a device implies it must be capable of storing multiple additional sets of data relating to their use; and each one of these needs to be stored in such a way that they are not vulnerable to plain text attack but are nevertheless available for use in the verification process prior to any authentication taking place.
This invention discloses, therefore, a means by which a computing device is able to safely store multiple encrypted keys for multiple possible authentication methods, which can be chosen dynamically on demand, and which allows for the dynamic addition of extra methods.
Furthermore, this invention can easily be adapted to be used by existing applications that currently make use of fixed authentication methods (such as PGP). It provides such applications, and computing devices which implement it, with:
A feature of this invention is the employment of an entity on the computing device that acts as a local Authentication Server (AS), which enables any of the various authentication methods to return a Consistent Identification Sequence (CIS) for any given user. If, for example, a fingerprint method returns a sequence of data octets after analysing a fingerprint, then the local authentication server guarantees that the sequence returned will be the same each time the same user authenticates with the same finger.
It is stressed that the requirement for consistency does not mean results obtained from an authentication method cannot be variable. However, before a method that produces variable results can be used for authentication, a period of training will generally be needed in order to ensure that it can reliably return a CIS. The training process preferably establishes the typical parameters which enable the method to be considered as reliable. In the case of the fingerprint method described above, the absence of unexplained points of dissimilarity together with a certain number of points of similarity would trigger the return of the same CIS irrespective of what those points of similarity might be. Equally, the use of a voiceprint would preferably need to be flexible enough to identify the voice of a specific individual consistently and reliably under a variety of circumstances. The precise nature of these training processes will vary from one authentication method to another, and are considered to be outside the scope of this invention.
Given the availability of an AS that returns a consistent CIS for each authentication method, a proposed scheme according to the present invention might work as follows for each user who registers to use the computing device:
The result of such processing can be stored on the computing device in tabular form, as shown below. In this table, there are three notional users (User0, User1 and User2) and three possible authentication methods (ModeA, ModeB and ModeC). For each combination of user and authentication method, the table holds the CPK as encrypted by the CISK, as shown in the following table.
Note that the structure of a table such as this is by no means fixed; for example, columns corresponding to new authentication methods and rows corresponding to new users can be added as required.
The table is used as follows:
Note that at no time is it necessary to store the CPK or the CISK other than transiently in RAM; avoiding persistent storage of these items is a requirement on each client.
As an optimisation of the above procedure, a one-way hash of each CISK can be generated during the registration process, and stored in the table as a tuple together with the CPK as encrypted by that CISK. When this optimisation is implemented, the resulting table (shown below) is used in broadly the same way as the first table shown above, except that each CISK returned by each authentication mechanism is subjected to the same hash, and matched with the hashed CISK stored in the table. This check avoids the need to decrypt something to check that the CISK is valid.
Such a table with the optimised method may look as follows:
Enhancements to the above processes may be implemented for untrusted clients.
It is conceivable that a malicious client may obtain the CPK and then publish it, thus leaving protected data open to attacks which only need to defeat the file system protection on the device.
In environments where some unique and unspoofable identifier is available for clients, it is possible to take an additional step and generate a further key by processing both the CPK and this identifier; for example, by generating a password by an XOR of their hashes, which can be written formulaically as PKCS#5(H(CPK)̂H (ClientIdentifier)). The result is again a Common Protection Key unique to the client in question rather than shared between trusted clients. Deliberately publishing this key is of little or no benefit since nobody else is using it. The limitation here is that only this specific client can decrypt data it encrypted. No protected data can be shared between clients without the clients making explicit provision for export and import.
To add authentication methods is relatively straightforward. Since the invention stores all data in a standard table, it can be manipulated by conventional database functions and procedures. Adding extra columns is therefore a straightforward operation to those skilled in the art.
As well as the three basic methods of authentication listed above (based on who you are, what you have, and what you know) this process is straightforward to use with other methods, including but not restricted to methods analogous to the following:
Combining these methods with others leads to some innovative permutations not possible without this invention; for example, a computing device equipped for electronic commerce and banking could dynamically impose a far more stringent set of authorization methods for high-value transactions than for low-value ones; or a different set of authorization methods could be applied for a location-aware device when it is used in an unfamiliar location, to ensure that it had not been stolen.
The present invention can be used with existing applications. One of the most widely used applications, as mentioned earlier, is PGP. With this invention, any authentication method or combination of methods could be used instead of the current sole method of passphrase entry to unlock the private key rings. By returning a single value to PGP regardless of the authentication mechanism employed, the application need have no knowledge of the actual mechanisms used.
Similarly, clients of such an authentication service benefit by not simply just determining the identity of the current user; they are also provided with a per-user CPK which can be immediately used to encrypt/decrypt information specifically for that user.
This invention removes the need for any client to manage and protect any of its own per-user keys while continuing to keep the critical information transient at all times. Essentially it relieves the clients of any key management issues when protecting information specific to a given user, whether privacy or security related.
It can be realized from the above description that many advantages can accrue through the use of the present invention. This invention is applicable to any device with controlling software that needs to support multiple authentication methods. It enables:
Although the present invention has been described with reference to particular embodiments, it will be appreciated that modifications may be effected whilst remaining within the scope of the present invention as defined by the appended claims.
| Number | Date | Country | Kind |
|---|---|---|---|
| 0611351.8 | Jun 2006 | GB | national |
| Filing Document | Filing Date | Country | Kind | 371c Date |
|---|---|---|---|---|
| PCT/GB2007/002104 | 6/7/2007 | WO | 00 | 6/25/2009 |
