Device registration, authentication, and authorization system and method

• US 10,367,809 B2
• Filed: 12/28/2017
• Issued: 07/30/2019
• Est. Priority Date: 04/15/2014
• Status: Active Grant

• Current Assignee: Level 3 Communications LLC (Lumen Technologies, Inc.)
• Original Assignee: Level 3 Communications LLC (Lumen Technologies, Inc.)
• Inventors: Dixon, Allen E., Rdzak, Steven M., Swift, Christopher T., Grippo, Rene, Scheufele, Jeff
• Primary Examiner(s): Homayounmehr, Farid
• Assistant Examiner(s): Sarker, Sanchit K
• Application Number:
  US15/856,779
• Publication Number:
  US 20180124044A1
• Time in Patent Office: 579 Days
• Field of Search: 713181
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/082 using revocation of authorisation
• CPC Class Codes: H04W 12/084 using delegated authorisation, e.g. open authorisation [OAuth] protocol

Abstract

A system includes one or more processors to receive a registration request, the registration request comprising a representation of a username and a password, verify the username and the password and transmit a one-time-use password, receive the one-time-use password and first device identifier information from a mobile computing device, receive an access request from the mobile computing device comprising the representation of the username and the password, second device identifier information, and application key information, verify the username, the password, the second device identifier information, and the application key information, and transmit a token to the mobile computing device, and receive a resource request from the mobile computing device comprising the token and third device identifier information.

Claims

1. A system, comprising:

a server comprising at least one processor to;

receive a registration request, the registration request comprising a representation of a username and a password;

verify the username and the password and transmit a one-time-use password;

receive the one-time-use password and first device identifier information from a mobile computing device;

receive an access request from the mobile computing device comprising the representation of the username and the password, second device identifier information, and application key information;

verify the username, the password, the second device identifier information, and the application key information at the server, and transmit a token to the mobile computing device;

receive a resource request from the mobile computing device comprising the token and third device identifier information;

verify the token and the third device identifier information; and

transmit information associated with the resource request to the mobile computing device.

2. The system as recited in claim 1, the at least one processor further to:

store the first device identifier information in a memory, the first device identifier information comprising a first device identifier and a first device identifier secret.

3. The system as recited in claim 2, wherein the second device identifier information comprises a second device hash-based message authentication code.

4. The system as recited in claim 3, the at least one processor further to:

perform a cryptographic hash function on the first device identifier and the first device identifier secret to obtain a first device hash-based message authentication code; and

compare the first device hash-based message authentication code with the second hash-based message authentication code to verify the second device identifier information.

5. The system as recited in claim 2, wherein the third device identifier information comprises a third device hash-based message authentication code.

6. The system as recited in claim 5, the at least one processor further to:

perform a cryptographic hash function on the first device identifier and the first device identifier secret to obtain a first device hash-based message authentication code; and

compare the first device hash-based message authentication code with the third device hash-based message authentication code to determine that the resource request is valid,

wherein the information transmitted to the mobile computing device comprises a representation of a resource associated with the resource request to the mobile computing device.

7. The system as recited in claim 5, the at least one processor further to:

perform a cryptographic hash function on the first device identifier and the first device identifier secret to obtain a first device hash-based message authentication code; and

compare the first device hash-based message authentication code with the third hash-based message authentication code to determine that the resource request is invalid,

wherein the information transmitted to the mobile computing device comprises an indication that the resource request is invalid to the mobile computing device.

8. The system as recited in claim 1, wherein the application key information comprises a first application hash-based message authentication code based on an application key and an application key secret.

9. The system as recited in claim 2, the at least one processor further to:

disable at least one of the first device identifier and the first device identifier secret; and

deny the resource request from the mobile computing device.

10. The system as recited in claim 2, the at least one processor further to:

delete at least one of the first device identifier and the first device identifier secret; and

deny the resource request from the mobile computing device.

11. A method, comprising:

receiving, by at least one processor at a server, a registration request, the registration request comprising a representation of a username and a password;

verifying, by at least one processor, the username and the password and transmitting a one-time-use password;

receiving, by the at least one processor, the one-time-use password and first device identifier information from a mobile computing device;

receiving, by the at least one processor, an access request from the mobile computing device comprising the representation of the username and the password, second device identifier information, and application key information;

verifying, by the at least one processor, the username, the password, the second device identifier information, and the application key information at the server, and transmitting a token to the mobile computing device;

receiving, by the at least one processor, a resource request from the mobile computing device comprising the token and third device identifier information;

verifying the token and the third device identifier information; and

transmitting, by the at least one processor, information associated with the resource request to the mobile computing device.

12. The method as recited in claim 11, further comprising:

storing the first device identifier information in a memory, the first device identifier information comprising a first device identifier and a first device identifier secret.

13. The method as recited in claim 12, wherein the second device identifier information comprises a second device hash-based message authentication code.

14. The method as recited in claim 13, further comprising:

performing a cryptographic hash function on the first device identifier and the first device identifier secret to obtain a first device hash-based message authentication code; and

comparing the first device hash-based message authentication code with the second hash-based message authentication code to verify the second device identifier information.

15. The method as recited in claim 12, wherein the third device identifier information comprises a third device hash-based message authentication code.

16. The method as recited in claim 15, further comprising:

performing a cryptographic hash function on the first device identifier and the first device identifier secret to obtain a first device hash-based message authentication code; and

comparing the first device hash-based message authentication code with the third device hash-based message authentication code to determine that the resource request is valid,

wherein transmitting the information comprises transmitting a representation of a resource associated with the resource request to the mobile computing device.

17. The method as recited in claim 15, further comprising:

performing a cryptographic hash function on the first device identifier and the first device identifier secret to obtain a first device hash-based message authentication code; and

comparing the first device hash-based message authentication code with the third hash-based message authentication code to determine that the resource request is invalid,

wherein transmitting the information comprises transmitting an indication that the resource request is invalid to the mobile computing device.

18. The method as recited in claim 12, further comprising:

disabling at least one of the first device identifier and the first device identifier secret; and

denying the resource request from the mobile computing device.

19. The method as recited in claim 12, further comprising:

deleting at least one of the first device identifier and the first device identifier secret; and

denying the resource request from the mobile computing device.

20. A non-transitory computer-readable medium having instructions stored thereon that, when executed by at least one processor, cause the at least one processor to perform operations comprising:

receiving a registration request at a server, the registration request comprising a representation of a username and a password;

verifying the username and the password and transmitting a one-time-use password;

receiving the one-time-use password and first device identifier information from a mobile computing device;

receiving an access request from the mobile computing device comprising the representation of the username and the password, second device identifier information, and application key information;

verifying the username, the password, the second device identifier information, and the application key information at the server, and transmitting a token to the mobile computing device;

receiving a resource request from the mobile computing device comprising the token and third device identifier information;

verifying the token and the third device identifier information; and

transmitting information associated with the resource request to the mobile computing device.