초록 ▼

Systems and methods for end-to-end encryption are disclosed. According to one embodiment, a method for device registration includes (1) an application executed by a computer processor receiving a user password from a user; (2) using the computer processor, the application combining the user password

Systems and methods for end-to-end encryption are disclosed. According to one embodiment, a method for device registration includes (1) an application executed by a computer processor receiving a user password from a user; (2) using the computer processor, the application combining the user password and a password extension; (3) using the computer processor, the application cryptographically processing the combined user password and password extension, resulting cryptographic public information; and (4) providing the cryptographic public information to a server. The user password is not provided to the server. In another embodiment, a method for user authentication includes (1) using a computer processor, receiving a login page from a server; (2) sending a Hash-based Message Authentication Code to the server; and (3) receiving an authentication from the server. In one embodiment, the login page may include a transkey and a value B.

대표청구항 ▼

1. A method for user authentication, comprising: at least one computer processor receiving a login page from a server, the login page including a value B, wherein the value B is defined as: B=gb mod p where b is an arbitrary number, g is a primitive root, and p is a prime number;sending a Hash-based

1. A method for user authentication, comprising: at least one computer processor receiving a login page from a server, the login page including a value B, wherein the value B is defined as: B=gb mod p where b is an arbitrary number, g is a primitive root, and p is a prime number;sending a Hash-based Message Authentication Code to the server; andreceiving an authentication from the server;wherein the Hash-based Message Authentication Code comprises HMAC(K,(UserID, encrypted value b, OTP));wherein K is equal to Ba mod p, and a is a concatenation of a password and a password extension; andwherein the UserID is a user identifier; andwherein the OTP is a one-time password. 2. The method of claim 1, wherein the arbitrary number is a random number. 3. The method of claim 1, wherein the arbitrary number is a pseudo-random number. 4. A method for user authentication, comprising: at least one computer processor receiving a login page from a server, the login page including a value B, wherein the value B is defined as: B=gb mod p where b is an arbitrary number, g is a primitive root, and p is a prime number;sending a Hash-based Message Authentication Code to the server; andreceiving an authentication from the server;the at least one computer processor verifying the authenticity of the server, comprising: receiving a server value RESP from the server, the server value RESP equal to HMAC(K,(UserID, encrypted value b, OTP, timestamp+1));using the computer processor, calculating a client value RESP equal to HMAC(K,(UserID, encrypted value b, OTP, timestamp+1)); andverifying that the server value RESP against the client value RESP. 5. The method of claim 4, wherein the arbitrary number is a random number. 6. The method of claim 4, wherein the arbitrary number is a pseudo-random number. 7. A method for user authentication, comprising: a server comprising at least one computer processor generating a value B, wherein the value B is defined as: B=g1b mod p1where b is an arbitrary number, g1 is a first primitive root, and p1 is a first prime number;the server generating a login page containing the value B;the server providing the login page to a client device;the server receiving a Hash-based Message Authentication Code from the client device, the Hash-based Message Authentication Code comprising a UserID and a onetime password;retrieving a stored cryptographic public information and a stored one-time password associated with the UserID;using the computer processor, the server determining a client value K; andusing the computer processor, the server validating the client value K against a server value K;wherein the Hash-based Message Authentication Code comprises HMAC(K,(UserID, encrypted value b, one-time password));wherein K is equal to Ba mod p2, a is a concatenation of a password and a password extension, and p2 is a second prime number; andwherein the UserID is a user identifier. 8. The method of claim 7, wherein the server rejects the authentication request if the server does not validate the value K. 9. The method of claim 7, wherein the server does receive a user password. 10. The method of claim 7, further comprising: a second server receiving the Hash-based Message Authentication Code from the client device, the Hash-based Message Authentication Code comprising a UserID and a one-time password;the second server retrieving a second stored cryptographic public information and a stored one-time password associated with the UserID;using the computer processor, the second server determining a second client value K; andusing the computer processor, the second server validating the second client value K against a second server value K. 11. The method for user authentication of claim 7, wherein the value for p1 and p2 are equal. 12. The method of claim 7, wherein the arbitrary number is a random number. 13. The method of claim 7, wherein the arbitrary number is a pseudo-random number. 14. A method for user authentication, comprising: a server comprising at least one computer processor generating a value B, wherein the value B is defined as: B=g1b mod p1where b is an arbitrary number, g1 is a first primitive root, and p1 is a first prime number;the server generating a login page containing the value B;the server providing the login page to a client device;the server receiving a Hash-based Message Authentication Code from the client device, the Hash-based Message Authentication Code comprising a UserID and a one-time password;retrieving a stored cryptographic public information and a stored one-time password associated with the UserID;using the computer processor, the server determining a client value K; andusing the computer processor, the server validating the client value K against a server value K;wherein the server determines the client value K from using the equation K=Ba mod p2, a is a concatenation of a password and a password extension, and p2 is a second prime number. 15. The method for user authentication of claim 14, wherein the value for p1 and p2 are equal. 16. The method of claim 14, wherein the arbitrary number is a random number. 17. The method of claim 14, wherein the arbitrary number is a pseudo-random number. 18. A method for user authentication, comprising: a server comprising at least one computer processor generating a value B, wherein the value B is defined as: B=gb mod p where “b” is an arbitrary number, “g” is a primitive root, and “p” is a prime number;the server generating a login page containing the value “B”;the server providing the login page to a client device;the server receiving, from the client device, a UserID, a one-time password, and a Hash-based Message Authentication Code;the server retrieving a value “A” based on the UserID;the server calculating a server value K, the server value K equal to Ab mod p,the server calculating a client value K equal to Ba mod p, wherein “a” is a concatenation of a password and a password extension; andthe server validating the client value K against a server value K. 19. The method of claim 18, wherein a second UserID is associated with a second prime number “p2.” 20. The method of claim 18, wherein the arbitrary number is a random number. 21. The method of claim 18, wherein the arbitrary number is a pseudo-random number.