IP ADDRESS SECURE MULTI-CHANNEL AUTHENTICATION FOR ONLINE TRANSACTIONS

• US 20100107228A1
• Filed: 09/02/2009
• Published: 04/29/2010
• Est. Priority Date: 09/02/2008
• Status: Active Grant

• Current Assignee: F2WARE
• Original Assignee: F2WARE
• Inventors: Lin, Paul
• Granted Patent: US 8,156,335 B2
• Time in Patent Office: Days
• US Class Current: 726/5
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3215 using a plurality of channels network architectures or network communication protocols using different networks H04L63/18

Abstract

A method for multi-factor authenticating of a user using an application server and an authentication server is disclosed. The method includes receiving from the application server a first source IP address associated with a request for authenticating from the user browser program to the application server. The method also includes receiving from the user browser program a request to perform additional authentication between the user browser program and the authentication server using a separate communication channel. The method additionally includes comparing the first source IP address with a second source IP address associated with the request to perform the additional authentication and failing, if the first source IP address does not match the second source IP address, authentication of the user.

Claims

1. A computer-implemented method for multi-factor authenticating of a user using an application server and an authentication server, said user interacting with said application server and said authentication server, said user communicating with at least one of said application server and said authentication server using a user browser program, comprising:

authenticating using said application server said user using first factor authentication credentials;

providing, from said application server to said authentication server, a first source IP address associated with a request for said authenticating using said first factor authentication credentials;

instructing said user to establish a separate communication channel between said user browser program and said authentication server to perform additional authentication;

comparing said first source IP address with a second source IP address, said second source IP address associated with communication from said user to said authentication server using said separate communication channel; and

if said first source IP address does not match said second source IP address, failing authentication of said user.

2. The method of claim 1 wherein the first factor authentication credentials include at least userid and password.

3. The method of claim 1 further comprising ascertaining whether said user is a subscriber of a multi-factor authenticating service prior to instructing said user to establish said separate communication channel between said user browser program and said authentication server to perform additional authentication.

4. The method of claim 1 wherein said additional authentication includes authenticating using a shared secret between said authentication server and said user browser program.

5. The method of claim 4 wherein said shared secret includes a known fact.

6. The method of claim 5 wherein said known fact is provided by said user using an out-of-band communication channel during registration.

7. The method of claim 6 wherein said out-of-band communication channel includes a voice call.

8. The method of claim 1 wherein said additional authentication is performed with encryption.

9. The method of claim 1 wherein said additional authentication is a two-way authentication between said authentication server and said user browser program.

10. The method of claim 1 wherein said instructing said user to establish said separate communication channel between said user browser program and said authentication server to perform additional authentication involves AJAX technology.

11. The method of claim 1 wherein said instructing said user to establish said separate communication channel between said user browser program and said authentication server employs HTML.

12. A computer-implemented method for multi-factor authenticating of a user using an application server and an authentication server, said user interacting with at least one of said application server and said authentication server using a user browser program, comprising:

receiving from said application server a first source IP address associated with a request for authenticating from said user browser program to said application server;

receiving from said user browser program a request to perform additional authentication between said user browser program and said authentication server using a separate communication channel from a communication channel employed to communicate between said application server and said authentication server;

comparing said first source IP address with a second source IP address, said second source IP address associated with said request to perform said additional authentication between said authentication server and said user browser program; and

if said first source IP address does not match said second source IP address, failing authentication of said user.

13. The method of claim 12 wherein said authenticating between said user browser program to said application server includes authenticating using first factor credentials.

14. The method of claim 12 wherein the first factor authentication credentials include at least userid and password.

15. The method or claim 12 further comprising ascertaining whether said user is a subscriber of a multi-factor authenticating service prior to instructing said user to establish said separate communication channel between said user browser program and said authentication server to perform said additional authentication.

16. The method of claim 12 wherein said additional authentication includes authenticating using a shared secret between said authentication server and said user browser program.

17. The method of claim 16 wherein said shared secret includes a known fact.

18. The method of claim 17 wherein said known fact is provided by said user using an out-of-band communication channel during registration.

19. The method of claim 12 wherein said additional authentication is a two-way authentication between said authentication server and said user browser program.

20. The method of claim 12 wherein said additional authentication is performed with encryption.