SYSTEM AND METHOD FOR SECOND FACTOR AUTHENTICATION SERVICES

• US 20080250477A1
• Filed: 06/19/2008
• Published: 10/09/2008
• Est. Priority Date: 07/15/2004
• Status: Active Grant

• Current Assignee: Anakam, Inc. (Equifax, Inc.)
• Original Assignee: Anakam, Inc. (Equifax, Inc.)
• Inventors: Camaisa, Allan, Samuelsson, Jonas
• Granted Patent: US 8,533,791 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/40 by quorum, i.e. whereby two or more security principals are required
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3273 for mutual authentication network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869

Abstract

A customer server receives a client request to access protected resources over the Internet. First factor authentication is performed and if it is successful a vendor authentication engine is invoked to undertake second factor authentication. The results of the second factor authentication are returned to the customer server, which grants access only if both first and second factor authentication succeeds.

Claims

1. A method for selectively granting a user access to data, comprising:

at a first authentication server provided by a first vendor, receiving a request for access from a user computer,

using signals from the user computer, providing first factor authentication of the user,

only if first factor authentication is successful, using a second factor authentication engine provided by a second vendor different from the first vendor to provide second factor authentication of the user; and

only if second factor authentication is successful, granting the user access to the data.

2. The method of claim 1, wherein the first factor authentication is executed by the first authentication server and includes testing for correct user name and password.

3. The method of claim 1, wherein a single customer possesses both the first authentication server and the second factor authentication engine.

9. The method of Claim 1, wherein the challenge is defined at least in part by the first authentication server and issued by the second factor authentication engine.

4. A second factor authentication engine on a tangible computer readable medium executable by a processor to execute logic comprising:

receive from a customer'"'"'s system an indication that a user name of a user and an associated password have been verified;

undertaking second factor authentication of the user on behalf of the customer, and

at least some of the time returning to the customer system an indication of results of second factor authentication.

5. The engine of claim 4, wherein a single customer possesses both the customer'"'"'s system and the second factor authentication engine.

10. The engine of claim 4, wherein the challenge is defined at least in part by the customer system and is issued by the engine.

6. A server comprising:

at least one processor;

at least one tangible computer readable medium accessible by the processor and bearing instructions embodying logic comprising;

receiving a user request to access information;

in response to the request, causing a user name and password received from the user to be authenticated;

if the user name and password are not authenticated, denying the user access to the information;

wherein only if the user name and password are authenticated, a vendor authentication engine undertakes a second factor authentication and generates a result;

receiving the result from the engine;

if the result indicates that second factor authentication fails, denying the user access to the information, otherwise granting the user access to the information.

7. The server of claim 6, wherein the server authenticates the user name and password and if authentication is successful, the logic comprises sending a signal to the engine to cause the engine to undertake second factor authentication.

8. The server of claim 6, wherein the server requests the user name and password and sends the user name and password to the engine for authentication thereof.

11. The server of claim 6, wherein the challenge is defined at least in part by the server and is issued by the vendor authentication engine.