REMOTE PROVISION OF CONSISTENT ONE-TIME PASSWORD FUNCTIONALITY FOR DISPARATE ON-LINE RESOURCES

• US 20080301460A1
• Filed: 09/12/2007
• Published: 12/04/2008
• Est. Priority Date: 06/01/2007
• Status: Active Grant

• Current Assignee: Bank of America Corp.
• Original Assignee: Bank of America Corp.
• Inventors: Miller, Eric W., Newton, Clay D.
• Granted Patent: US 8,869,251 B2
• Time in Patent Office: Days
• US Class Current: 713/183
• CPC Class Codes: G06F 21/40 by quorum, i.e. whereby two or more security principals are required
• CPC Class Codes: G06Q 20/42 Confirmation, e.g. check or permission by the legal debtor of payment
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234

Abstract

Consistent one-time password (OTP) functionality is provided from a presentation server to secure various on-line resources. A seed file can be provided to or created by a service provider for execution as part of a hosted page displayed at a client to a user. A presentation server receives a call from the seed file. A user interface widget can be initialized at the presentation server in response to the call from the seed file. The widget can be displayed as part of the remotely hosted Web page so that the user perceives the UI widget to be embedded in the page as viewed on the client computer system. Security for the interaction between the servers can be provided through use of security assertion markup language (SAML).

Claims

1. A method of providing one-time password (OTP) functionality for a remotely hosted Web page displayed at a client, the method comprising:

receiving a call from a seed file executing in association with the remotely hosted Web page;

initializing a widget at a presentation server in response to the call from the seed file, the widget for display as part of the remotely hosted Web page, the widget including the OTP functionality; and

providing the OTP functionality at the client using the widget.

2. The method of claim 1 further comprising:

providing an identity associated with the client to a security assertion markup language (SAML) server;

retrieving an SAML artifact from the SAML server; and

providing the SAML artifact to the widget for embedding in the remotely hosted Web page as a means of verifying the identity associated with the client.

3. The method of claim 2 further comprising providing the seed file to a service provider maintaining the remotely hosted Web page.

4. The method of claim 1 wherein the providing of the OTP functionality further comprises verifying an OTP input at the client after being obtained from a token.

5. The method of claim 1 wherein the providing of the OTP functionality further comprises verifying an OTP input at the client after being obtained from a mobile terminal.

6. The method of claim 2 wherein the providing of the OTP functionality further comprises verifying an OTP input at the client after being obtained from a token.

7. The method of claim 2 wherein the providing of the OTP functionality further comprises verifying an OTP input at the client after being obtained from a mobile terminal.

8. The method of claim 3 wherein the providing of the OTP functionality further comprises verifying an OTP input at the client after being obtained from a token.

9. The method of claim 3 wherein the providing of the OTP functionality further comprises verifying an OTP input at the client after being obtained from a mobile terminal.

10. A computer program product for providing one-time password (OTP) functionality for a remotely hosted Web page displayed at a client, the computer program product comprising a medium including computer program code, the computer program code further comprising:

instructions for receiving a call from a seed file executing in association with the remotely hosted Web page;

instructions for initializing a widget at a presentation server in response to the call from the seed file, the widget for display as part of the remotely hosted Web page, the widget including the OTP functionality; and

instructions for providing the OTP functionality at the client using the widget.

11. The computer program product of claim 10 wherein the computer program code further comprises:

instructions for providing an identity associated with the client to a security assertion markup language (SAML) server;

instructions for retrieving an SAML artifact from the SAML server; and

instructions for providing the SAML artifact to the widget for embedding in the remotely hosted Web page as a means of verifying the identity associated with the client.

12. The computer program product of claim 10 wherein the instructions for providing the OTP functionality further comprise instructions for verifying an OTP input at the client after being obtained from a token.

13. The computer program product of claim 10 wherein the instructions for providing the OTP functionality further comprise instructions for verifying an OTP input at the client after being obtained from a mobile terminal.

14. The computer program product of claim 10 wherein the instructions for providing the OTP functionality further comprise:

instructions for verifying an OTP input at the client after being obtained from a mobile terminal; and

instructions for verifying an OTP input at the client after being obtained from a token.

15. The computer program product of claim 11 wherein the instructions for providing the OTP functionality further comprise instructions for verifying an OTP input at the client after being obtained from a token.

16. The computer program product of claim 11 wherein the instructions for providing the OTP functionality further comprise instructions for verifying an OTP input at the client after being obtained from a mobile terminal.

17. The computer program product of claim 11 wherein the instructions for providing the OTP functionality further comprise:

instructions for verifying an OTP input at the client after being obtained from a mobile terminal; and

instructions for verifying an OTP input at the client after being obtained from a token.

18. Apparatus for providing one-time password (OTP) functionality for a remotely hosted Web page displayed at a client, the apparatus comprising:

means for providing a seed file for the remotely hosted Web page;

means for initializing a widget at a presentation server in response to execution of the seed file, the widget for display as part of the remotely hosted Web page, the widget including the OTP functionality; and

means for providing the OTP functionality at the client using the widget.

19. The apparatus of claim 18 further comprising:

means for providing an identity associated with the client to a security assertion markup language (SAML) server;

means for retrieving an SAML artifact from the SAML server; and

means for providing the SAML artifact to the widget for embedding in the remotely hosted Web page as a means of verifying the identity associated with the client.

20. A system for providing one-time password (OTP) functionality for a remotely hosted Web page displayed at a client, the system including at least a presentation server and further comprising:

a widget that can be initiated at the presentation server in response to a call from a seed file, the widget for display as part of the Web page; and

OTP functionality to verify an OTP input to the widget at the client after being received from at least one of a token and a mobile terminal.

21. The system of claim 20 further comprising a service provider host connected to the presentation server, the service provider host to host the Web page and to execute the seed file as part of the Web page.

22. The system of claim 20 further comprising a security assertion markup language (SAML) server connected to the presentation server and the service provider host, the SAML server to receive an identity associated with the client, provide an SAML artifact to for embedding in the Web page, and to verify the identity associated with the client when the SAML artifact is returned by the remotely hosted Web page.

23. The system of claim 21 further comprising a security assertion markup language (SAML) server connected to the presentation server and the service provider host, the SAML server to receive an identity associated with the client, provide an SAML artifact to for embedding in the Web page, and to verify the identity associated with the client when the SAML artifact is returned by the remotely hosted Web page.