Simple two-factor authentication

• US 20070107050A1
• Filed: 11/07/2005
• Published: 05/10/2007
• Est. Priority Date: 11/07/2005
• Status: Abandoned Application

• Current Assignee: JEXP Incorporated
• Original Assignee: JEXP Incorporated
• Inventors: Selvarajan, Balamurugan
• Application Number:
  US11/267,148
• Publication Number:
  US 20070107050A1
• Time in Patent Office: Days
• US Class Current: 726/5
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/42 using separate channels for security data
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215

Abstract

Internet Security is increasingly of concern as more and more cases of identity theft of online data is reported. Simple login and password authentication for access to sensitive websites like financial, health or other personal data is no longer sufficient. Several mechanisms for additional security, called two-factor authentication have been proposed. Most of them involve the use of a physical device like a card which is read by a card reader or suggest the use of biometric authentication. Although, these are very secure, the cost of implementation of these “physical” authentications is high. This invention outlines the use of a simple two factor authentication using mobile phones, PDAs or Credit and Debit cards that most users already have, without the need for any special hardware.

Claims

1. A method for logging into a website securely with a second level of authentication in addition to the typical login id and password, comprising of:

a user that desires to login and a service provider that provides the secure website.

2. The method of claim 1, further comprising of the said user registering a phone or a PDA or other Internet enabled device with the service provider to enable two-factor authentication for future logins.

3. The method of claim 2, wherein, before the step of authentication is complete, the user visits a service provider URL using the said registered device to obtain a confirmation code through the device and which the user enters on to the website to complete the authentication.

4. The method of claim 3, alternatively comprising, the service provider displaying a confirmation code on the website and requesting the user to send it to the service provider from the user'"'"'s registered device (using SMS or other methods) to complete the authentication.

5. The method of claim 2, alternatively comprising of, the user registering a credit, debit or other electronic card or just authorizing the service provider if the service provider already has the card information.

6. The method of claim 5, wherein, before the step of authentication is complete, the service provider requests the said user to enter some randomly chosen digits from the said card, which is verified before completing authentication.