Single-Party, Secure Multi-Channel Authentication for Access to a Resource

• US 20080086770A1
• Filed: 05/22/2007
• Published: 04/10/2008
• Est. Priority Date: 10/06/2006
• Status: Active Grant

• Current Assignee: FMR LLC
• Original Assignee: FMR LLC
• Inventors: Thornton, William A., Greenberg, Adam, Marotto, Anthony M., Kulkarni, Rajandra Luxman
• Granted Patent: US 8,671,444 B2
• Time in Patent Office: Days
• US Class Current: 726/20
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 9/3215 using a plurality of channels network architectures or network communication protocols using different networks H04L63/18
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

A method for using multiple channels to access a resource, wherein an authenticated user requests a resource that requires a second authentication parameter over a first channel, a token value is transmitted to the user on the first channel, and the user transmits the token value and a second authentication parameter over a second channel. The token value is used to associate the first authentication parameter to the second authentication parameter, whereby the user is allowed access to the resource on the first or second channel.

Claims

1. A method for using multiple channels to access a resource, the method comprising:

authenticating a user;

receiving a request over a first channel for a resource that requires a second authentication parameter;

transmitting a token value over the first channel;

receiving the token value and the second authentication parameter over a second channel; and

using the token value to associate the request received over the first channel with the second authentication parameter received over the second channel.

2. The method of claim 1, wherein the resource requires the second authentication parameter and at least one additional authentication parameter, the method comprising:

receiving the token value and at least one additional authentication parameter over at least one additional channel; and

using the token value to associate the request received over the first channel with the at least one additional authentication parameter received over the at least one additional channel.

3. The method of claim 1, further comprising:

providing the resource over the first channel.

4. The method of claim 3, further comprising:

receiving a request over the first channel for an additional resource that requires at least one additional authentication parameter;

receiving the token value and the at least one additional authentication parameter over at least one additional channel; and

using the token value to associate the request received over the first channel with the at least one additional authentication parameter received over the at least one additional channel.

5. The method of claim 4, wherein the at least one additional authentication parameter is the second authentication parameter.

6. The method of claim 4, wherein the additional authentication parameter is not the first authentication parameter or the second authentication parameter.

7. The method of claim 4, wherein the additional authentication parameter requires more than either the first authentication parameter or the second authentication parameter.

8. The method of claim 4, wherein the additional authentication parameter is a user ID, password, partial-password, hard token, soft token, wireless applet, voiceprint, or any combination thereof.

9. The method of claim 4 wherein the at least one additional channel is the second channel.

10. The method of claim 1, further comprising:

providing the resource over the first channel and the second channel simultaneously.

11. The method of claim 1, wherein the first channel is a phone line, a wireless connection, or an online connection.

12. The method of claim 1, wherein the second channel is a phone line, a wireless connection, or an online connection.

13. The method of claim 1, wherein the second authentication parameter is a user ID, password, hard token, soft token, wireless applet, voiceprint, or any combination thereof.

14. The method of claim 1, wherein authenticating a user comprises using a multi-channel authentication process or a single-channel authentication process.

15. The method of claim 1, wherein authenticating a user comprises receiving a first authentication parameter from a first device through a first channel, wherein the first device is associated with the user.

16. The method of claim 15, wherein the first authentication parameter is a user ID, password, hard token, soft token, wireless applet, voiceprint, or any combination thereof.

17. The second authentication parameter of claim 15, wherein the second authentication parameter is not the first authentication parameter.

18. The second authentication parameter of claim 15, wherein the second authentication parameter requires more than the first authentication parameter.

19. The method of claim 15, wherein the first authentication and the second authentication parameter are channel specific.

20. The method of claim 1, further comprising:

generating a credential wherein information associated with the credential indicates that the resource may be provided to a first device without the second authentication parameter being provided over the second channel.

21. The credential of claim 20, wherein the credential comprises a permanent credential, a time-sensitive credential, a credential that expires after a pre-set number of user sessions, or any combination thereof.

22. The method of claim 20, wherein the user has exited their initial session and is attempting to begin a new session, the method comprising:

authenticating the user;

receiving a request for the resource from the first device over a first channel, wherein access to the resource requires the second authentication parameter provided over the second channel; and

processing information associated with the credential.

23. The method of claim 22, further comprising:

providing the resource if the information associated with the credential indicates that the resource should be provided to the first device without the second authentication parameter being provided over the second channel.