Workstation log-in

• US 10,581,810 B1
• Filed: 01/17/2019
• Issued: 03/03/2020
• Est. Priority Date: 07/07/2014
• Status: Active Grant

• Current Assignee: Microstrategy Incorporated
• Original Assignee: Microstrategy Incorporated
• Inventors: Gehret, John, Gabriel, Gary, Qiao, Yong, Alavi, Ali, Du, Xiaochen
• Primary Examiner(s): Avery, Jeremiah L
• Application Number:
  US16/250,512
• Time in Patent Office: 411 Days
• Field of Search: None
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/77 Graphical identity
• CPC Class Codes: H04W 4/80 Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication

Abstract

A method including actions of pairing with a mobile device and receiving a user name, a password encrypted with a connector password key, and a public key of the mobile device. Additional actions include providing the password encrypted with the connector password key, receiving the password in a decrypted form, obtaining a pairing key, encrypting the pairing key using the public key, encrypting the password with a local password key, providing the pairing key encrypted using the public key and the password encrypted with the local password key, disconnecting from the mobile device, after disconnecting form the mobile device, reconnecting with mobile device, providing a workstation identification, receiving the user name and the password encrypted with the local password key, decrypting the password encrypted with the local password key, and logging in the user using the user name and the password decrypted with the local password key.

Claims

1. A method performed by a computer system, the method comprising:

providing, to a mobile device paired with the computer system, a nonce and an identifier for the computer system;

receiving, by the computer system from the mobile device, an encrypted message that was encrypted using a pairing key for the pairing of the computer system and the mobile device, wherein the encrypted message comprises an encrypted form of the nonce, a password encrypted with a password key for the computer system, and an initialization vector that was used to encrypt the password with the password key;

decrypting, by the computer system, the encrypted message using the pairing key for the pairing of the computer system and the mobile device;

verifying, by the computer system, that a nonce decrypted from the encrypted message matches the nonce provided to the mobile device;

in response to successfully decrypting the encrypted message using the pairing key and verifying that the nonce decrypted from the encrypted message matches the nonce provided to the mobile device, decrypting, by the computer system, the encrypted password using (i) the password key and (ii) the initialization vector decrypted from the encrypted message; and

providing, by the computer system, the decrypted password to log-in a user corresponding to the mobile device.

2. The method of claim 1, further comprising receiving, by the computer system from the mobile device, a request to log-in to the computer system.

3. The method of claim 1, wherein the encrypted message further comprises a user name.

4. The method of claim 3, wherein providing the decrypted password to log-in the user corresponding to the mobile device further comprises providing, by the computer system, the user name from the decrypted message to log-in the user corresponding to the mobile device.

5. The method of claim 1, wherein the nonce provided to the mobile device comprises a random value generated by the computer system that corresponds to a log-in session for the mobile device.

6. The method of claim 1, in response to unsuccessfully decrypting the encrypted message or unsuccessfully verifying the nonce decrypted from the encrypted message, rejecting, by the computer system, a request from the mobile device to log-in to the computer system.

7. The method of claim 1, further comprising determining, by the computer system, that the mobile device is paired with the computer system.

8. The method of claim 7, wherein determining that the mobile device is paired with the computer system further comprises:

receiving, by the computer system from the mobile device, a badge identifier when the mobile device is in proximity to the computer system; and

determining, by the computer system from the mobile device, the badge identifier indicating that the mobile device is paired with the computer system.

9. The method of claim 7, wherein determining that the mobile device is paired with the computer system further comprises:

broadcasting, by the computer system, a discover identifier; and

receiving, by the computer system from the mobile device, an indication that the mobile device is paired with the computer system.

10. The method of claim 1, further comprising:

providing, by the computer system to the mobile device, a request for an optical machine readable representation that may be scanned to perform a log-in operation;

receiving, by the computer system and from the mobile device, the optical machine readable representation; and

displaying, by the computer system, the optical machine readable representation.

11. A system comprising:

a computer system comprising one or more computers; and

one or more computer-readable media storing instructions that, when executed by the one or more computers, cause the one or more computers to perform operations comprising;

providing, to a mobile device paired with the computer system, a nonce and an identifier for the computer system;

receiving, by the computer system from the mobile device, an encrypted message that was encrypted using a pairing key for the pairing of the computer system and the mobile device, wherein the encrypted message comprises an encrypted form of the nonce, a password encrypted with a password key for the computer system, and an initialization vector that was used to encrypt the password with the password key;

decrypting, by the computer system, the encrypted message using the pairing key for the pairing of the computer system and the mobile device;

verifying, by the computer system, that a nonce decrypted from the encrypted message matches the nonce provided to the mobile device;

in response to successfully decrypting the encrypted message using the pairing key and verifying that the nonce decrypted from the encrypted message matches the nonce provided to the mobile device, decrypting, by the computer system, the encrypted password using (i) the password key and (ii) the initialization vector decrypted from the encrypted message; and

providing, by the computer system, the decrypted password to log-in a user corresponding to the mobile device.

12. The system of claim 11, further comprising receiving, by the computer system from the mobile device, a request to log-in to the computer system.

13. The system of claim 11, wherein the encrypted message further comprises a user name.

14. The system of claim 13, wherein providing the decrypted password to log-in the user corresponding to the mobile device further comprises providing, by the computer system, the user name from the decrypted message to log-in the user corresponding to the mobile device.

15. The system of claim 11, wherein the nonce provided to the mobile device comprises a random value generated by the computer system that corresponds to a log-in session for the mobile device.

16. The system of claim 11, in response to unsuccessfully decrypting the encrypted message or unsuccessfully verifying the nonce decrypted from the encrypted message, rejecting, by the computer system, a request from the mobile device to log-in to the computer system.

17. The system of claim 11, further comprising determining, by the computer system, that the mobile device is paired with the computer system.

18. The system of claim 17, wherein determining that the mobile device is paired with the computer system further comprises:

receiving, by the computer system from the mobile device, a badge identifier when the mobile device is in proximity to the computer system; and

determining, by the computer system from the mobile device, the badge identifier indicating that the mobile device is paired with the computer system.

19. The system of claim 17, wherein determining that the mobile device is paired with the computer system further comprises:

broadcasting, by the computer system, a discover identifier; and

receiving, by the computer system from the mobile device, an indication that the mobile device is paired with the computer system.

20. One or more non-transitory computer-readable media storing instructions that, when executed by one or more computers of a computer system, cause the one or more computers to perform operations comprising:

providing, to a mobile device paired with the computer system, a nonce and an identifier for the computer system;

receiving, by the computer system from the mobile device, an encrypted message that was encrypted using a pairing key for the pairing of the computer system and the mobile device, wherein the encrypted message comprises an encrypted form of the nonce, a password encrypted with a password key for the computer system, and an initialization vector that was used to encrypt the password with the password key;

decrypting, by the computer system, the encrypted message using the pairing key for the pairing of the computer system and the mobile device;

verifying, by the computer system, that a nonce decrypted from the encrypted message matches the nonce provided to the mobile device;

in response to successfully decrypting the encrypted message using the pairing key and verifying that the nonce decrypted from the encrypted message matches the nonce provided to the mobile device, decrypting, by the computer system, the encrypted password using (i) the password key and (ii) the initialization vector decrypted from the encrypted message; and

providing, by the computer system, the decrypted password to log-in a user corresponding to the mobile device.