SYSTEM AND METHOD FOR ACCOMPLISHING TWO-FACTOR USER AUTHENTICATION USING THE INTERNET

• US 20070136799A1
• Filed: 02/26/2007
• Published: 06/14/2007
• Est. Priority Date: 08/24/2001
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: Secure Computing Corporation (McAfee, LLC)
• Inventors: Brennan, Sean
• Granted Patent: US 7,516,483 B2
• Time in Patent Office: Days
• US Class Current: 726/9
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: H04L 2463/081 applying self-generating credentials, e.g. instead of receiving credentials from an authority or from another peer, the credentials are generated at the entity itself
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234

Abstract

A method of accomplishing two-factor user authentication, comprising providing two separate user authentication methods, enabling a user to communicate authentication data for both authentication methods to a first web site using the internet, and enabling the communication of at least some of the authentication data from the first web site to a second web site also using the internet. Both web sites are thus involved in user authentication using the authentication data.

Claims

1. A method of implementing token-based electronic security across multiple secure web sites, in which the user has a security token, comprising:

storing unique token identification information, and the seed value of each token, in a security system;

requiring the user, upon login to a secure web site, to enter at least the code generated by the user'"'"'s token;

passing the user'"'"'s token code from the web site to the security system;

using the security system to verify whether or not the user'"'"'s token code was generated by the user'"'"'s token; and

passing the verification information from the security system to the web site, for use in web site security.

2. The method of claim 1 wherein the requiring step further requires the user to enter a user name and user password.

3. The method of claim 2 further comprising the step of:

the web site verifying the user name and user password before passing the user'"'"'s token code to the security system.

4. A method of implementing token-based electronic security across a plurality of secure web sites, including a first and a second secure web site, the method comprising:

providing a security token to each user;

storing unique token identification information, and the seed value of each security token, in a security system;

providing each of the plurality of secure web sites with access to the security system;

requiring the user, upon login to one of the plurality of secure web sites, to enter into the secure web site at least the code generated by the user'"'"'s token;

passing the user'"'"'s token code from the secure web site to the security system;

using the security system to generate verification information indicating whether the user'"'"'s token code was generated by the user'"'"'s token; and

passing the verification information from the security system to the secure web site, for use in web site security.

5. The method of claim 4 wherein requiring includes having the user enter a user name and user password.

6. The method of claim 5, wherein passing the user'"'"'s token code includes verifying the user name and user password before passing the user'"'"'s token code to the security system.

7. The method of claim 4, wherein storing unique token identification information, and the seed value of each security token, in a security system includes entering the unique token identification information into one of the plurality of secure web sites and forwarding the unique token identification information from the secure web site to the security system.

8. In a system in which each user has a security token, wherein the security token generates a code, a method of implementing token-based electronic security, the method comprising:

providing a secure web site;

connecting the secure web site to a third party security system;

storing unique token identification information associated with the security token for each user, and the seed value of each security token, in the third party security system;

requiring the user, upon login to secure web site, to enter into the secure web site at least the code generated by the user'"'"'s token;

passing the user'"'"'s token code from the secure web site to the security system;

receiving from the security system and at the secure web site, verification information verifying if the user'"'"'s token code was generated by the user'"'"'s token; and

authorizing the user as a function of the verification information.

9. The method of claim 8, wherein requiring the user to enter into the secure web site at least the code generated by the user'"'"'s token includes having the user enter a user name and user password.

10. The method of claim 9, wherein passing the user'"'"'s token code includes verifying the user name and user password before passing the user'"'"'s token code to the security system.

11. The method of claim 8, wherein storing unique token identification information, and the seed value of each security token, in the third party security system includes entering the unique token identification information into the secure web site and forwarding the unique token identification information from the secure web site to the security system.

12. A security system which implements token-based electronic security across a plurality of secure web sites, the system comprising:

means for receiving communications from and sending communications to the plurality of secure web sites;

means for storing unique token identification information and the seed value of each security token;

means for receiving, from one or more of the plurality of secure web sites, a token code generated by a user'"'"'s security token;

means for generating verification information indicating whether the user'"'"'s token code was generated by the user'"'"'s token; and

means for passing the verification information from the security system to the secure web site, for use in web site security.