System and method for authenticating users

• US 10,171,433 B2
• Filed: 04/24/2018
• Issued: 01/01/2019
• Est. Priority Date: 03/25/2009
• Status: Active Grant

• Current Assignee: PACid Technologies, LLC
• Original Assignee: PACid Technologies, LLC
• Inventors: Fielder, Guy
• Primary Examiner(s): Shaw, Brian F
• Application Number:
  US15/961,640
• Publication Number:
  US 20180248852A1
• Time in Patent Office: 252 Days
• Field of Search: 713168, 713169, 713171, 713181, 713189, 370338, 709204
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 2221/2123 Dummy operation
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 2463/121 Timestamp cryptographic mechanisms or cryptographic arrangements involving time stamps H04L9/3297
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H05K 999/99 dummy group

Abstract

A security application for a computing device, e.g., a mobile phone, allows generation of a secret according to a unique user input (e.g., user credentials). The secret is stored in a directory such that it is retrievable when the unique user input is received via a user interface of a device on which the security application executes or is coupled with. Responsive to receiving an identifier associated with the secret, the security application prompts, e.g., via a user interface of the mobile phone, entry of the unique user input; and, subsequently, verifies the unique user input. Following such verification, the security application provides the secret for use in encoding a communication with a remote computer-based station. Entry of the user credentials may be required prior to the security application generating the secret, and may be responsive to receipt of an invitation (e.g., from the remote computer-based station) to generate it.

Claims

1. A method for authenticating a user, comprising:

receiving, by an application running on a mobile phone, a unique user input, said application processing said unique user input and generating a secret;

storing said secret at the mobile phone, said secret being stored with an identifier so as to be retrievable when the unique user input is received again by the mobile phone;

receiving at the mobile phone from a remote computer-based station a first communication comprising a request for user credentials of the user of the mobile phone, said first communication including the identifier associated with the secret;

responsive to said receiving, the mobile phone prompting a user via a user interface for the unique user input, verifying said unique user input, and transmitting to the remote computer-based station a second communication encoded using the secret.

2. The method of claim 1, wherein the secret comprises an encryption key and is stored along with other information and the identifier is used to distinguish the encryption key from the other information.

3. The method of claim 1, wherein the other information comprises decoy encryption keys.

4. The method of claim 1, wherein the secret is stored in an encrypted format.

5. The method of claim 1, wherein the unique user input comprises user credentials.

6. The method of claim 5, further comprising receiving at the mobile phone an invitation to create the secret prior to generating the secret.

7. The method of claim 6, wherein the invitation to create the secret is received from the remote computer-based station.

8. The method of claim 1, wherein the first and second communications comprise two related communications of a communication session.

9. The method of claim 4, wherein the secret comprises an encryption key and is stored along with other information and the identifier is used to distinguish the encryption key from the other information.

10. The method of claim 9, wherein the other information comprises decoy encryption keys.

11. The method of claim 4, wherein the first communication comprises a request for user credentials of the user of the computing device.

12. The method of claim 4, further comprising receiving at the computing device an invitation to create the secret prior to generating the secret.

13. The method of claim 4, wherein the invitation to create the secret is received from the remote computer-based station.

14. The method of claim 4, wherein the first and second communications comprise two related communications of a communication session.

15. A method, comprising:

sending, to an application running on a computing device, an invitation directed to a user of the computing device, whereby upon receipt of said invitation, said application (i) prompts the user of the computing device for a unique user input, (ii) processes the unique user input provided by the user of the computing device, (iii) responsive to processing said unique user input generates a secret, and (iv) stores said secret at the computing device along with an identifier so as to be retrievable when said unique user input is again provided by the user of the computing device;

sending, from a remote computer-based station to the computing device, a first communication, said first communication including said identifier associated with the secret, whereby upon receipt of said first communication said application running on the computing device (i) prompts the user of the computing device for said unique user input, (ii) responsive to receiving said unique user input verifies said unique user input, and (iii) responsive to verifying said unique user input uses said secret to transmit to the remote computer-based station an encoded communication; and

at the remote computer-based station, receiving said encoded communication.

16. The method of claim 15, wherein the secret comprises an encryption key and is stored along with other information and the identifier is used to distinguish the encryption key from the other information.

17. The method of claim 15, wherein the computing device comprises a mobile computing device.

18. The method of claim 15, wherein the secret is stored in an encrypted format.

19. The method of claim 15, wherein the unique user input comprises user credentials.

20. The method of claim 15, wherein the first communication and the encoded communication comprise two related communications of a communication session.