METHOD, APPARATUS, AND SYSTEM FOR SENDING CREDENTIALS SECURELY

• US 20090249462A1
• Filed: 03/31/2008
• Published: 10/01/2009
• Est. Priority Date: 03/31/2008
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: CHHABRA, Jasmeet
• Granted Patent: US 8,234,697 B2
• Time in Patent Office: Days
• US Class Current: 726/8
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/83 input devices, e.g. keyboards, mice or controllers thereof
• CPC Class Codes: G06F 9/44526 Plug-ins; Add-ons
• CPC Class Codes: G06Q 20/10 specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
• CPC Class Codes: G06Q 20/356 Aspects of software for card payments
• CPC Class Codes: G06Q 20/3567 Software being in the reader
• CPC Class Codes: G06Q 20/35765 Access rights to memory zones
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G07F 19/208 Use of an ATM as a switch or hub
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04L 63/166 at the transport layer

Abstract

A software application executing in a first local operating environment may be used to connect to a remote server that requires a credential of a user to complete a transaction. In a second local operating environment that operates external to the first local environment a user may be authenticated based on a user input received in the second local operating environment. The credential of the user may be securely communicated to the remote server from the second local operating environment. Other embodiments are described and claimed.

Claims

1. A method comprising:

connecting to a remote server using a software application executing in a first local operating environment, wherein the remote server requires a credential of a user to complete a transaction;

authenticating, in a second local operating environment, a user based on a user input received in the second local operating environment, the second local operating environment operating external to the first local operating environment; and

communicating the credential of the user to the remote server from the second local operating environment.

2. The method of claim 1, wherein the credential is accessible only in the second local operating environment.

3. The method of claim 1, wherein the software application comprises a plugin to communicate with the second local operating environment.

4. The method of claim 1 comprising:

connecting to a database server using the first software application executing in the first local operating environment; and

in the second local operating environment, receiving from the database server a command request string for completing the transaction.

5. The method of claim 1, wherein the transaction is a login transaction.

6. The method of claim 1, comprising accepting the credential in the second local operating environment in a secure input mode not visible to the first local operating environment.

7. The method of claim 1, wherein the second local operating environment comprises a manageability engine.

8. The method of claim 1, comprising encrypting the credential in the second local operating environment before the credential is communicated to the remote server.

9. An apparatus comprising:

a computing platform to host a first local operating environment, the first operating environment to execute a first software application to connect to a remote server, the remote server requiring a credential of a user to complete a transaction, and to host a second local operating environment, the second local operating environment to execute a second software application to authenticate a user based on a user input received in the second local operating environment and to communicate the credential of the user to the remote server, wherein the second local operating environment is to operate external to the first local operating environment; and

an input device to collect the user input for reception in the second local operating environment.

10. The apparatus of claim 9, wherein the credential is accessible only in the second local operating environment.

11. The apparatus of claim 9, wherein the software application comprises a plugin to communicate with the second local operating environment.

12. The apparatus of claim 9, wherein:

the first software application is to connect to a database server; and

the second software application to receive from the database server an https string for completing the transaction.

13. The apparatus of claim 9, wherein the transaction is a login transaction.

14. The apparatus of claim 9, wherein the second local operating environment is a manageability engine.

15. A method comprising:

connecting to a remote application from a host operating environment, the application requiring a credential for completion of a transaction;

confirming that the remote application supports completing the transaction from a secure local operating environment, the secure local operating environment operating external to the host operating environment;

receiving in the secure local operating environment via an out-of-band connection a string for completing the transaction, the out-of-band connection being inaccessible to the host operating environment;

in the secure local operating environment, determining a user is authorized to complete the transaction based on a user input to the secure local operating environment; and

if the user is authorized to complete the transaction, communicating the credential to the remote application via the out-of-band connection.

16. The method of claim 15, wherein confirming comprises:

connecting to a database of supported applications; and

confirming an entry referencing the remote application is in the database.

17. The method of claim 15, comprising:

receiving in the secure local operating environment from the remote application session information after completing the transaction; and

passing the session information to the host operating environment.

18. A processor-readable storage medium having stored thereon instructions that, if executed by a processor, cause the processor to perform a method comprising:

connecting to a remote server using a software application executing in a first local operating environment, wherein the remote server requires a credential of a user to complete a transaction;

authenticating, in a second local operating environment, a user based on a user input received in the second local operating environment, the second local operating environment operating external to the first local operating environment; and

communicating the credential of the user to the remote server from the second local operating environment.

19. The processor-readable storage medium of claim 18, further comprising instructions that if executed by a processor, cause the processor to perform the method wherein the credential is accessible only in the second local operating environment.

20. The processor-readable storage medium of claim 18, further comprising instructions that if executed by a processor, cause the processor to perform the method wherein the software application comprises a plugin to communicate with the second local operating environment.