Workstation log-in

• US 10,212,136 B1
• Filed: 07/07/2015
• Issued: 02/19/2019
• Est. Priority Date: 07/07/2014
• Status: Active Grant

• Current Assignee: Microstrategy Incorporated
• Original Assignee: Microstrategy Incorporated
• Inventors: Gehret, John, Gabriel, Gary, Qiao, Yong, Alavi, Ali, Du, Xiaochen
• Primary Examiner(s): Avery, Jeremiah L
• Application Number:
  US14/793,186
• Time in Patent Office: 1,323 Days
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/77 Graphical identity
• CPC Class Codes: H04W 4/80 Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication

Abstract

A method including actions of pairing with a mobile device and receiving a user name, a password encrypted with a connector password key, and a public key of the mobile device. Additional actions include providing the password encrypted with the connector password key, receiving the password in a decrypted form, obtaining a pairing key, encrypting the pairing key using the public key, encrypting the password with a local password key, providing the pairing key encrypted using the public key and the password encrypted with the local password key, disconnecting from the mobile device, after disconnecting form the mobile device, reconnecting with mobile device, providing a workstation identification, receiving the user name and the password encrypted with the local password key, decrypting the password encrypted with the local password key, and logging in the user using the user name and the password decrypted with the local password key.

Claims

1. A method performed by a computer system, the method comprising:

pairing the computer system with a mobile device;

receiving, by the computer system and from the mobile device, a user name, a password encrypted with a connector password key, and a public key of the mobile device;

providing, by the computer system and to a server, the password encrypted with the connector password key;

receiving, by the computer system and from the server, the password not encrypted with the connector password key;

obtaining, by the computer system, a pairing key;

encrypting, by the computer system, the pairing key using the public key of the mobile device;

encrypting, by the computer system, the password with a local password key of the computer system;

providing, by the computer system and to the mobile device, (i) the pairing key encrypted using the public key of the mobile device and (ii) the password encrypted with the local password key of the computer system, wherein the public key of the mobile device is different from the local password key of the computer system; and

providing, by the computer system, an identifier for the computer system to the mobile device.

2. The method of claim 1, comprising:

providing a request for an optical machine readable representation that may be scanned to perform a log-in operation;

receiving the optical machine readable representation; and

displaying the optical machine readable representation.

3. The method of claim 2, wherein pairing with the mobile device is in response to the mobile device scanning the displayed optical machine readable representation.

4. The method of claim 1, comprising:

receiving, from the mobile device, a message signed with a private key of the mobile device, the message including the user name, the password encrypted with the connector password key, and the public key of the mobile device; and

authenticating the message using the public key of the mobile device.

5. The method of claim 1, comprising:

receiving, from the mobile device, a message signed with the pairing key, the message including the user name and the password encrypted with the local password key; and

authenticating the message using the pairing key.

6. The method of claim 1, wherein receiving, from the mobile device, the user name, the password encrypted with the connector password key, and the public key of the mobile device includes:

receiving an organization identifier; and

verifying that the organization identifier matches with a valid organization identifier.

7. The method of claim 1, wherein encrypting the password with the local password key comprises:

generating a second initialization vector; and

encrypting the password with the local password key and the second initialization vector, wherein

providing, to the mobile device, the pairing key encrypted using the public key of the mobile device and the password encrypted with the local password key comprises;

providing the second initialization vector to the mobile device.

8. The method of claim 1, further comprising:

receiving, by the computer system and from the mobile device, (i) the user name and (ii) the password encrypted with the local password key;

decrypting, by the computer system, the password encrypted with the local password key; and

using, by the computer system, the user name and the password decrypted with the local password key to log in a user corresponding to the user name.

9. A system comprising:

a computer system comprising one or more computers; and

one or more storage devices storing instructions that are operable, when executed by the one or more computers, to cause the one or more computers to perform operations comprising;

pairing the computer system with a mobile device;

receiving, by the computer system and from the mobile device, a user name, a password encrypted with a connector password key, and a public key of the mobile device;

providing, by the computer system and to a server, the password encrypted with the connector password key;

receiving, by the computer system and from the server, the password not encrypted with the connector password key;

obtaining, by the computer system, a pairing key;

encrypting, by the computer system, the pairing key using the public key of the mobile device;

encrypting, by the computer system, the password with a local password key of the computer system;

providing, by the computer system and to the mobile device, (i) the pairing key encrypted using the public key of the mobile device and (ii) the password encrypted with the local password key of the computer system, wherein the public key of the mobile device is different from the local password key of the computer system; and

providing, by the computer system, an identifier for the computer system to the mobile device.

10. The system of claim 9, the operations comprising:

providing a request for an optical machine readable representation that may be scanned to perform a log-in operation;

receiving the optical machine readable representation; and

displaying the optical machine readable representation.

11. The system of claim 10, wherein pairing with the mobile device is in response to the mobile device scanning the displayed optical machine readable representation.

12. The system of claim 9, the operations comprising:

receiving, from the mobile device, a message signed with a private key of the mobile device, the message including the user name, the password encrypted with the connector password key, and the public key of the mobile device; and

authenticating the message using the public key of the mobile device.

13. The system of claim 9, the operations comprising:

receiving, from the mobile device, a message signed with the pairing key, the message including the user name and the password encrypted with the local password key; and

authenticating the message using the pairing key.

14. The system of claim 9, wherein receiving, from the mobile device, the user name, the password encrypted with the connector password key, and the public key of the mobile device includes:

receiving an organization identifier; and

verifying that the organization identifier matches with a valid organization identifier.

15. The system of claim 9, wherein encrypting the password with the local password key comprises:

generating a second initialization vector; and

encrypting the password with the local password key and the second initialization vector, wherein

providing, to the mobile device, the pairing key encrypted using the public key of the mobile device and the password encrypted with the local password key comprises;

providing the second initialization vector to the mobile device.

16. The system of claim 9, wherein the operations further comprise:

receiving, by the computer system and from the mobile device, (i) the user name and (ii) the password encrypted with the local password key;

decrypting, by the computer system, the password encrypted with the local password key; and

using, by the computer system, the user name and the password decrypted with the local password key to log in a user corresponding to the user name.

17. One or more non-transitory computer-readable media storing software comprising instructions executable by a computer system comprising one or more computers which, upon such execution, cause the one or more computers to perform operations comprising:

pairing the computer system with a mobile device;

receiving, by the computer system and from the mobile device, a user name, a password encrypted with a connector password key, and a public key of the mobile device;

providing, by the computer system and to a server, the password encrypted with the connector password key;

receiving, by the computer system and from the server, the password not encrypted with the connector password key;

obtaining, by the computer system, a pairing key;

encrypting, by the computer system, the pairing key using the public key of the mobile device;

encrypting, by the computer system, the password with a local password key of the computer system;

providing, by the computer system and to the mobile device, (i) the pairing key encrypted using the public key of the mobile device and (ii) the password encrypted with the local password key of the computer system, wherein the public key of the mobile device is different from the local password key of the computer system; and

providing, by the computer system, an identifier for the computer system to the mobile device.

18. The one or more non-transitory computer-readable media of claim 17, the operations comprising:

providing a request for an optical machine readable representation that may be scanned to perform a log-in operation;

receiving the optical machine readable representation; and

displaying the optical machine readable representation.

19. The one or more non-transitory computer-readable media of claim 18, wherein pairing with the mobile device is in response to the mobile device scanning the displayed optical machine readable representation.

20. The one or more non-transitory computer-readable media of claim 17, wherein the operations further comprise:

receiving, by the computer system and from the mobile device, (i) the user name and (ii) the password encrypted with the local password key;

decrypting, by the computer system, the password encrypted with the local password key; and

using, by the computer system, the user name and the password decrypted with the local password key to log in a user corresponding to the user name.