System And Method Of Non-Centralized Zero Knowledge Authentication For A Computer Network

Abstract

Zero-knowledge authentication proves identity without revealing information about a secret that is used to prove that identity. An authentication agent performs authentication of a prover agent without knowledge or transfer of the secret. A non-centralized zero-knowledge authentication system contains multiple authentication agents, for access by multiple computers seeking access on a computer network through local prover agents. Once authenticated, those multiple computers may also implement authentication agents. The secret may periodically expire by publishing a new encrypted secret by a trusted source, thwarting attempts to factor or guess information about the secret.

1 . A method of non-centralized zero-knowledge authentication for a computer network, comprising steps of:
 establishing a first computer having a first authentication agent and a first prover agent on the computer network;   detecting a first authentication request over the computer network from a second computer having a second prover agent;   authenticating the second prover agent through a zero-knowledge identification protocol; and   promoting the second computer with a second authentication agent to perform authentication for the computer network.   
     
     
         2 . The method of  claim 1 , further comprising periodically generating and distributing a new secret to the first and second authentication agents. 
     
     
         3 . The method of  claim 1 , further comprising:
 detecting a second authentication request over the computer network from a third computer having a third prover agent;   authenticating the third prover agent through a zero-knowledge identification protocol with the second authentication agent; and   promoting the third computer with a third authentication agent to perform authentication for the computer network.   
     
     
         4 . The method of  claim 1 , further comprising periodically publishing encrypted numbers for the zero-knowledge identification protocol, including the steps of:
 generating first and second large prime numbers;   calculating a product of the first and second large prime numbers;   generating a secret to have a value relatively prime to the product, greater than zero and less than the product;   encrypting the product;   encrypting the secret; and   publishing encrypted values of the secret and product.   
     
     
         5 . A system of non-centralized zero-knowledge authentication for a computer network, comprising:
 two or more computers establishing the computer network, each of the computers containing an authentication agent, secret and prover agent; and   a requesting computer having a prover agent, for requesting access to the computer network,   wherein the prover agent of the requesting computer and one of the authentication agents of the two or more computers engaging in a zero-knowledge authentication protocol, and wherein the requesting computer operates with an authentication agent on the computer network when the requesting computer is authenticated through the zero-knowledge authentication protocol.   
     
     
         6 . The system of  claim 5 , further comprising a trusted source for periodically generating a new secret for the authentication agents of computers on the network. 
     
     
         7 . The system of  claim 5 , the requesting computer comprising a cell phone. 
     
     
         8 . The system of  claim 7 , wherein the cell phone is authenticated without transmitting the secret to or from the cell phone. 
     
     
         9 . A software product comprising instructions, stored on computer-readable media, wherein the instructions, when executed by a computer, perform steps for non-centralized zero-knowledge authentication for a computer network, comprising:
 instructions for establishing a first computer having a first authentication agent and a first prover agent on the computer network;   instructions for detecting a first authentication request over the computer network from a second computer having a second prover agent;   instructions for authenticating the second prover agent through a zero-knowledge identification protocol; and   instructions for promoting the second computer with a second authentication agent to perform authentication for the computer network.