Secure authorization systems and methods

• US 10,021,091 B2
• Filed: 05/23/2014
• Issued: 07/10/2018
• Est. Priority Date: 05/23/2013
• Status: Active Grant

• Current Assignee: Intertrust Technologies Corporation (Fidelio Acquisition Co LLC)
• Original Assignee: Intertrust Technologies Corporation (Fidelio Acquisition Co LLC)
• Inventors: Yang, Peng, Gong, Jiahua, Huang, Chitai Kenny
• Primary Examiner(s): Hoffman, Brandon S
• Assistant Examiner(s): Salehi, Helai
• Application Number:
  US14/286,618
• Publication Number:
  US 20140351911A1
• Time in Patent Office: 1,509 Days
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

Systems and methods for secure user authentication are described. In certain embodiments, a client device such as a smartphone may be provisioned with a secure key and/or other secret information. The client device may be used to generate unique secure tokens and/or other credentials used in connection with an authentication processes. A user may provide the generated tokens and/or other credentials to a service provider in connection with a request to access a managed service. The validity of the generated tokens and/or other credentials may be verified by an authentication service in communication with the service provider.

Claims

1. A method performed by a system for authenticating the right of a user to access a managed resource, the method comprising:

receiving, from a service provider system associated with a managed resource, authentication credentials provided to the service provider system by the user, the authentication credentials comprising a first secure token generated by a client device associated with the user, wherein the client device includes software executing on a mobile computing platform, wherein the mobile computing platform is personalized by a personalization service, contains a first secure key provisioned to the mobile computing platform by the personalization service used for generating the first secure token, and includes an open processing environment and a protected processing environment, the protected processing environment being configured to store the first secure key in an encrypted format and to generate the first secure token without exposing the first secure key in an unencrypted format in memory of the open processing environment;

retrieving, based on the authentication credentials, a second secure key;

generating, based on the second secure key, a second secure token wherein generating the second secure token comprises performing a computation based on the first secure key and other information common to the system and the client device;

comparing the first secure token with the second secure token;

generating an authentication result based on a result of the comparison; and

transmitting the authentication result to the service provider system.

2. The method of claim 1, wherein the method further comprises:

determining, based on the result of the comparison, that the first secure token matches the second secure token; and

wherein the authentication result comprises an indication that the first secure token is valid.

3. The method of claim 1, wherein the method further comprises:

determining, based on the result of the comparison, that the first secure token does not match the second secure token; and

wherein the authentication result comprises an indication that the first secure token is not valid.

4. The method of claim 1, wherein the computation comprises a cryptographic hash computation.

5. The method of claim 1, wherein the computation comprises a time-based one-time password (“

TOTP”

) computation.

6. The method of claim 1, wherein the computation comprises a HMAC-based one-time password (“

HOTP”

) computation.

7. The method of claim 1, wherein the other information comprises a value provided by a clock.

8. The method of claim 1, wherein the other information comprises a value provided by a counter.

9. The method of claim 1, wherein comparing the first secure token with the second secure token comprises determining that the first secure token and the second secure token were both generated within a particular period of time.

10. The method of claim 1, wherein the managed resource comprises an online service.

11. The method of claim 1, wherein the first secure key and the second secure key are the same.