Secure offline authentication

A user workstation stores a vendor identifier and encrypted data comprising a first string of randomized data, a second string of randomized data, and encrypted text, the encrypted text further comprising a first security answer. The user workstation receives credentials information and a second security answer. The user workstation then generates an encryption key. Further, the user workstation uses the encryption key to decrypt the encrypted text and extract the first security answer. Then, the user workstation compares the second security answer with the first security answer and authenticates the second username if the second security answer is the same as the first security answer.

TECHNICAL FIELD OF THE INVENTION

This invention relates generally to user authentication, and more specifically to secure offline authentication.

BACKGROUND

It is often necessary for users, such as employees of a company, to use electronic devices in remote locations where network connectivity is not available. For example, workers may need to travel to remote facilities to assess oil rigs or other industrial operations. Users may need access to sensitive information on their user devices when they are at such remote locations. This sensitive information needs to be stored securely so that only authorized users are able to access it. However, it may not be possible to authenticate such users via a network connection because network connectivity is not available in these remote areas. Thus, an offline authentication mechanism is needed for authenticating users and decrypting securely stored information.

SUMMARY

According to embodiments of the present disclosure a user workstation operable to store a vendor identifier and encrypted data comprising a first string of randomized data, a second string of randomized data, and encrypted text, the encrypted text further comprising a hashed first security answer is disclosed. The user workstation is operable to receive credentials information and a second security answer, apply a hash function to the credentials information, and apply a hash function to the second security answer. The user workstation may then generate an encryption key using the hashed credentials information, vendor identifier, and the first string of randomized data. Further, the user workstation may use the encryption key and the second string of randomized data to decrypt the encrypted text and extract the hashed first security answer. Then, the user workstation may compare the hashed second security answer with the hashed first security answer and authenticate the second username if the hashed second security answer is the same as the hashed first security answer.

The present embodiment presents several technical advantages. First, in the present embodiment, a user workstation is able to access secure data stored on the user workstation even when the user workstation is not connected to a network. Second, the present embodiment provides multiple layers of security for authenticating a user before that user is able to access secure information. These encryption layers ensure that only the authorized user using an authorized user workstation is able to access the information stored on the user workstation. Additionally, in the present embodiment, a user enrolls for offline authentication through an enrollment module which ensures that users who do not have access to the enrollment module cannot access the secure data stored on user workstation

Certain embodiments of the present disclosure may include some, all, or none of the above advantages. One or more other technical advantages may be readily apparent to those skilled in the art from the figures, descriptions, and claims included herein.

DETAILED DESCRIPTION OF THE DRAWINGS

FIG. 1illustrates a system10for encrypting data on a user workstation12and enrolling the user workstation12for secure offline authentication. Secure offline authentication may involve, for example, authenticating that a user14seeking access to data stored on a user workstation12is authorized to access that data even if the user workstation12is not connected to a network16. Such authentication prevents unauthorized users and unauthorized devices from gaining access to secure data.

In the present embodiment, user workstation12and user14are first enrolled for offline authentication while user workstation12is connected to enrollment module18via network16. Once user workstation12and user14are enrolled for secure offline authentication, user workstation12and user14may access secure data stored locally on user workstation12even when user workstation12is not connected to network16and/or enrollment module18.

InFIG. 1, user workstation12is connected, via network16, to enrollment module18. To enroll for offline authentication, user14first enters credential information20, including, for example, a username and a password, into user workstation12. User14also selects a security question24and provides a security answer26. User workstation12transmits this credentials information20, a vendor identifier22(which may identify one or more specific user workstations12), security question24, and security answer26to enrollment module18. Enrollment module18then uses the received information to generate encrypted data28. Enrollment module18sends the encrypted data28to workstation12. Encrypted data28is then stored locally at workstation12. At this point, user workstation12and user14are enrolled for secure offline authentication.

As discussed in greater detail with respect toFIG. 3andFIG. 4below, once user workstation12and user14are enrolled for secure offline authentication, a user14using user workstation12may access secure data stored on user workstation12even if user workstation12is not connected to enrollment module18. To access the secure data, user14may enter credential information20as well as security answer26into user workstation12to be authenticated locally at user workstation12.

The present embodiment presents several technical advantages. First, in the present embodiment, a user workstation12is able to access secure data stored on the user workstation12even when the user workstation12is not connected to a network16. Second, the present embodiment provides multiple layers of security for authenticating a user14before user14is able to access secure information. For example, because the encryption and decryption processes of the present embodiment uses credential information20and security answer26to generate encrypted data28, only a user14with access to credential information20is able to decrypt encrypted data28to access the secure data stored on user workstation12. Next, because the encryption and decryption processes of the present embodiment use a vendor identifier22that is unique to one or more particular user workstation12, only users14using an authorized user workstation12are able to access the secure data. Additionally, in the present embodiment, a user14enrolls for offline authentication through the enrollment module18which ensures that users14who do not have access to enrollment module18cannot access the secure data stored on user workstation12. This allows users14to store highly valuable and sensitive data locally on their workstations12with security.

As illustrated inFIG. 1, in system10, workstation12enables one or more users14to interact with enrollment module18over network16. Workstation12may include one or more laptops, personal computers, monitors, display devices, handheld devices, smartphones, servers, user input devices, or other suitable components for enabling user input. Workstation12may be a part of an enterprise or could remotely access an enterprise.

Network16represents any suitable network operable to facilitate communication between the components of system10. Network16may include any interconnecting system capable of transmitting audio, video, signals, data, messages, or any combination of the preceding. Network16may include all or a portion of a public switched telephone network (PSTN), a public or private data network, a local area network (LAN), a metropolitan area network (MAN), a wide area network (WAN), a local, regional, or global communication or computer network such as the Internet, a wireline or wireless network, an enterprise intranet, or any other suitable communication link, including combinations thereof operable to facilitate communication between the components.

Enrollment module18represents any suitable components that facilitates secure offline authentication. Enrollment module18may include a network server, remote server, mainframe, host computer, workstation, web server, personal computer, file server, or any other suitable device operable to communicate with other devices and process data. In some embodiments, enrollment module18may execute any suitable operating system such as IBM's zSeries/Operating System (z/OS), MS-DOS, PC-DOS, MAC-OS, WINDOWS, UNIX, OpenVMS, Linux, or any other appropriate operating systems, including future operating systems.

The functions of enrollment module18may be performed by any suitable combination of one or more servers or other components at one or more locations. In the embodiment where the modules are servers, the servers may be public or private servers, and each server may be a virtual or physical server. The server may include one or more servers at the same or at remote locations. Enrollment module18may also include any suitable component that functions as a server. In some embodiments, workstation12may be integrated with enrollment module18or they may operate as part of the same device or devices.

In the illustrated embodiment, enrollment module18includes module interface30, module processor32, and module memory34, which comprises enrollment program36. Similarly, user workstation12has workstation interface38, workstation processor40, workstation memory42, and authentication program44.

Interfaces30and38represent any suitable devices operable to receive information from network16, transmit information through network16, perform suitable processing of the information, communicate to other devices, or any combination thereof. For example, module interface30may receive credential information20, vendor identifier22, security question24, and security answer26via network16. Module interface30may also send encrypted data28over network16. Similarly, workstation interface38may send credential information20, vendor identifier22, security question24, and security answer26over network16. And workstation interface38may receive encrypted data28over network16. Interfaces30and38may represent any port or connection, real or virtual, including any suitable hardware and/or software, including protocol conversion and data processing capabilities, to communicate through a LAN, WAN, or other communication system that allows enrollment module18and user workstation12, respectively, to exchange information with each other, network16, or any other components of system10.

Module processor32communicatively couples module interface30and module memory34and controls the operation of enrollment module18. Similarly, workstation processor40communicatively couples workstation interface38and workstation memory42and controls the operation of workstation12. Processors32and40include any hardware and software that operates to control and process information. Processors32and40may execute computer-executable program instructions stored in memory34and42respectively. Each of processors32and40may include, but are not limited to, a microprocessor, an application specific integrated circuit (ASIC), and or state machines. Each of processors32and40may comprise one or more processing devices.

Module memory34stores, either permanently or temporarily, data, operational software, other information for module processor32, other components of enrollment module18, or other components of system10. Similarly, workstation memory42stores, either permanently or temporarily, data, operational software, other information for workstation processor40, other components of workstation12, or other components of system10. Memory34and42include any one or a combination of volatile or non-volatile local or remote devices suitable for storing information. For example, memory34and42may include RAM, ROM, flash memory, magnetic storage devices, optical storage devices, network storage devices, cloud storage devices, solid state devices, or any other suitable information storage device or a combination of these devices.

Memory34and42may store information in one or more databases, file systems, tree structures, any other suitable storage system, or any combination thereof. Furthermore, different information stored in memory34and42may use any of these storage systems. Any information stored in memory34and42may be encrypted or unencrypted, compressed or uncompressed, and static or editable. Although illustrated as including particular modules, module memory34may include any suitable information for use in the operation of enrollment module18. For example, module memory34may store credential information20. Similarly, workstation memory42may include any suitable information for use in the operation of workstation12. For example, workstation memory42may store vendor identifier22. Vendor identifier22may be a unique identifier for one or more particular user workstations12. Workstation memory42may also store any sensitive or confidential information that a user14may need to access when workstation12is offline.

In the illustrated embodiment, module memory34includes enrollment program36. Module processor32may implement enrollment program36to facilitate the enrollment of user workstation12and user14in the manner described below with respect toFIG. 2. Similarly, workstation memory42may store authentication program44. Workstation processor40may implement authentication program44to facilitate the offline authentication of user workstation12and user14in the manner described below with respect toFIG. 4.

FIG. 2illustrates an example enrollment process50for encrypting data on user workstation12and enrolling user workstation12for secure offline authentication. In one embodiment, enrollment process50may be executed by enrollment program36on enrollment module18. During enrollment process50, user workstation12is connected to enrollment module18via network16.

As illustrated inFIG. 2, enrollment process50starts when enrollment module18receives credential information20such as a username and a password, and vendor identifier22from user workstation12. In one embodiment, enrollment module18authenticates credential information20and checks whether credential information20is already enrolled for offline authentication. If credential information20is already registered for offline authentication, enrollment process50may end.

In some embodiments, enrollment module18applies a hash function to the received credential information20. A hash function may be any function that can be used to map digital data of arbitrary size to digital data of a fixed size. In various embodiments, enrollment module18may apply the hash function to some or all of credential information20. Enrollment module18may group the hashed credential information20with the vendor identifier22to generate a seed.

Credential information20and vendor identifier22may then be coupled to salt52which comprises randomized data. Next, enrollment module18may apply a key derivation function to the combination of credential information20, vendor identifier22, and salt52to generate encryption key54.

In various embodiments, enrollment module18may apply various different key derivation functions to generate encryption key54. A key derivation function may be any function that can derive one or more keys from an input using a pseudo-random function. For example, enrollment module18may apply PBKDF2, bcrypt, scrypt or any other suitable key derivation functions to generate encryption key54.

Next, user workstation12may present user14with one or more security questions24. User14may select a security question24and provide a security answer26. In some embodiments, enrollment module18may apply a hash function to the security answer26to generate a hashed security answer56. Enrollment module18couples hashed security answer56with the security question24that the user14selected. Next, enrollment module18may generate an initialization vector58. Initialization vector58may comprise randomized data. Enrollment module18may then combine the security question24, hashed security answer56, encryption key54, and initialization vector58and input them into an encryption algorithm to generate encrypted text60.

In various embodiments, enrollment module18may use different encryption algorithms to generate encrypted text60. For example, enrollment module18may use the AES256, DES, or any other suitable encryption algorithm.

Next, enrollment module18may group salt52, initialization vector58, and encrypted text60to generate encrypted data28. Encrypted data28is then sent from enrollment module18via network16to workstation12. Workstation12stores encrypted data28locally in workstation memory42. At this point, user workstation12is enrolled for secure offline authentication and enrollment process50may end.

In some embodiments, workstation12may also retrieve additional secure data from module memory34and store it in workstation memory42before, after, or during enrollment process50. User workstation12and user14may need to be authenticated to access this secure data.

FIG. 3illustrates an example system100for authenticating a user14and decrypting encrypted data28that is stored locally on user workstation12. System100may be used, for example, to authenticate a user14and decrypt the encrypted data28so that the user14may access secure data that is stored on workstation memory42. The components ofFIG. 3are substantially similar to the components ofFIG. 1discussed above. However, unlike inFIG. 1, inFIG. 3user workstation12is no longer connected to enrollment module18via network16. As such, user workstation12and user14cannot be authenticated by enrollment module18and are instead authenticated locally at user workstation12.

FIG. 4illustrates an example authenticating process150for authenticating a user14and decrypting data on a user workstation12while user workstation12is disconnected from module18. In one embodiment, authenticating process150may be executed by authentication program44on user workstation12.

Authenticating process150may authenticate user workstation12after user workstation12has been enrolled for secure offline authentication through, for example, enrollment process50discussed above with respect toFIG. 2. During enrollment process50, workstation12receives encrypted data28and stores it locally in workstation memory42.

Authenticating process150starts when user workstation12receives offline credentials information154such as a username and password. In one embodiment, a user14may enter offline credentials information154into user workstation12. User workstation12then couples the offline credentials information154with vendor identifier22.

In some embodiments, user workstation12may hash offline credentials information154. Depending upon whether enrollment module18hashed some, all, or none of credentials information20inFIG. 2, in various embodiments, user workstation12may hash some, all, or none of offline credentials information154as well.

User workstation12then retrieves the encrypted data28from workstation memory42and separates it into the salt52, the initialization vector58, and the encrypted text60. User workstation12then applies a key generation algorithm to offline credentials information154, salt52, and vendor identifier22to generate an offline encryption key156. User workstation12may apply any suitable key generation algorithm to generate offline encryption key156including applying the same key generation algorithm used to generate encryption key54above.

Next, user workstation12couples offline encryption key156with initialization vector58and tries to decrypt encrypted text60using the combination of offline encryption key156and initialization vector58.

If user workstation12is unable to decrypt encrypted text60, user14may be allowed to reenter offline credentials information154. In some embodiments, user14may be notified that the entered offline credentials information154is incorrect. In some embodiments, user14may only be allowed to enter offline credentials information154a predetermined number of times before user workstation12locks out user14.

If user workstation12is able to decrypt encrypted text60, user workstation12retrieves the security question24and hashed security answer56from the decrypted text. User workstation12presents user14with security question24and prompts user14for an answer. User workstation12then hashes the received answer and compares it with the hashed security answer56. If the hashed received answer is different from the hashed security answer56, user workstation12may allow user14to enter the correct answer. In some embodiments, user14may only be allowed to enter the correct answer a predetermined number of times before user workstation12locks out the user14. If the hashed received answer and the hashed security answer56are the same, user14is authenticated and may be allowed access to the secure data in workstation memory42.

Modifications, additions, or omissions may be made to the systems, apparatuses, and processes described herein without departing from the scope of the disclosure. The components of the systems and apparatuses may be integrated or separated. Moreover, the operations of the systems and apparatuses may be performed by more, fewer, or other components. The methods may include more, fewer, or other steps. Additionally, steps may be performed in any suitable order. Additionally, operations of the systems and apparatuses may be performed using any suitable logic. As used in this document, “each” refers to each member of a set or each member of a subset of a set.

Although several embodiments have been illustrated and described in detail, it will be recognized that substitutions and alterations are possible without departing from the spirit and scope of the present disclosure, as defined by the appended claims. To aid the Patent Office, and any readers of any patent issued on this application in interpreting the claims appended hereto, applicants wish to note that they do not intend any of the appended claims to invoke 35 U.S.C. §112(f) as it exists on the date of filing hereof unless the words “means for” or “step for” are explicitly used in the particular claim.