SYSTEMS AND METHODS OF AUTHENTICATION IN A DISCONNECTED ENVIRONMENT

• US 20110321144A1
• Filed: 09/30/2010
• Published: 12/29/2011
• Est. Priority Date: 06/24/2010
• Status: Active Grant

• Current Assignee: Infosys Limited
• Original Assignee: Infosys Technologies Limited (Infosys Limited)
• Inventors: SAXENA, Ashutosh, PONNAPALLI, Harigopal K.B.
• Granted Patent: US 9,009,800 B2
• Time in Patent Office: Days
• US Class Current: 726/6
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/42 using separate channels for security data
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: G06F 2221/2117 User registration
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links

Abstract

A communication system and method are disclosed for establishing a secure communication channel including: a server for generating and storing a first instance of a unique personalized client application associated with a first-time user on the server, a client terminal for the user to communicate with the server over a communication channel and a standalone computing device having a second instance of the unique personalized application. The user authenticates the server based on a first dynamic identifier (DI-1) generated by the first instance of the unique personalized client application and the server authenticates the user based on a second dynamic identifier (DI-2) generated by the second instance of the unique personalized client application.

Claims

1. A method for establishing a secure communication channel, said method comprising:

registration of a first-time user at a server, wherein said server generates and stores a first instance of a unique personalized client application associated with said first-time user on the server, said first-time user installs a second instance of said unique personalized client application on a standalone computing device;

authentication of said remote sever by said user, wherein said second instance of said unique personalized client application authenticates said server based on a first dynamic identifier (DI-1) generated by said first instance of said unique personalized client application; and

authentication of said user by said server, wherein said first instance of said unique personalized client application authenticates said user based on a second dynamic identifier (DI-2) generated by said second instance of said unique personalized client application.

2. The method as recited in claim 1, wherein said server includes a registration server or an authentication server or both.

3. The method as recited in claim 1, wherein registration at said server is initiated in response to submission of static credentials by said user using a client terminal to said server over the communication channel.

4. The method as recited in claim 3, wherein said first instance of said unique personalized client application is conveyed over the communication channel to said client terminal.

5. The method as recited in claim 3, wherein said first dynamic identifier (DI-1) is generated by the said server in response to submission of said static credentials to said server.

6. The method as recited in claim 3, wherein said second dynamic identifier (DI-2) is generated in response to submission of said static credentials to said second instance of said unique personalized client application.

7. The method as recited in claim 1, wherein said second dynamic identifier (DI-2) is generated by the second instance of the client personalized application in response to submission of said first dynamic identifier (DI-1) to said second instance of said client personalized application.

8. The method as recited in claim 1, wherein said standalone computing device is selected from at least of a desktop computer system or a laptop computer system or a cellular telephone or a personal digital assistant (PDA) or a radio identification system (RFID) and a gadget capable of storing and processing data or combinations thereof.

9. A method for confirming the validity of a server to a user, said method comprising:

registration of a first-time user at a server, wherein said server generates and stores a first instance of a unique personalized client application associated with said first-time user on the server, said first-time user installs a second instance of said unique personalized client application on a standalone computing device; and

authentication of said sever by said user, wherein said second instance of said unique personalized client application authenticates said server based on a dynamic identifier (DI) generated by said first instance of said unique personalized client application.

10. The method as recited in claim 9, further comprising authentication of said user by said server, wherein the authentication of said user by said server is based on a dynamic identifier (DI) adapted for authentication using the said second instance of said unique personalized client application, said dynamic identifier (DI) generated by said first instance of said unique personalized client application.

11. The method as recited in claim 10, wherein said server includes a registration server or an authentication server or both.

12. The method as recited in claim 10, wherein registration at said server is initiated in response to submission of static credentials by said user using a client terminal to said server over the communication channel.

13. The method as recited in claim 10, wherein said first instance of said unique personalized client application is conveyed over the communication channel to said client terminal.

14. The method as recited in claim 10, wherein said dynamic identifier (DI) is generated in response to submission of said static credentials to said server.

15. The method as recited in claim 10, wherein said standalone computing device is selected from at least of a desktop computer system or a laptop computer system or a cellular telephone or a personal digital assistant (PDA) or a radio identification system (RFID) and a gadget capable of storing and processing data or combinations thereof.

16. A system for establishing for establishing a secure communication channel, said system comprising:

a server for generating and storing a first instance of a unique personalized client application associated with a first-time user on said server;

a client terminal for a user to communicate with said server over a communication channel; and

a standalone computing device comprising a second instance of said unique personalized application, said personalized client applications installed by said first-time user.

wherein said user authenticates said server based on a first dynamic identifier (DI-1) generated by said first instance of said unique personalized client application, and said server authenticates said user based on a second dynamic identifier (DI-2) generated by said second instance of said unique personalized client application, hence establishing a secure communication channel.

17. The system as recited in claim 16, wherein said server includes a registration server or an authentication server or both.

18. The system as recited in claim 16, wherein registration at said server is initiated in response to submission of static credentials by said user to said server over the communication channel.

19. The system as recited in claim 16, wherein said first instance of said unique personalized client application is conveyed over the communication channel to said client terminal.

20. The system as recited in claim 16, wherein said first dynamic identifier (DI-1) is generated in response to submission of said static credentials to said server.

21. The system as recited in claim 16 wherein said second dynamic identifier (DI-2) is generated in response to submission of said static credentials to said second instance of said unique personalized client application.

22. The system as recited in claim 16, wherein said second dynamic identifier (DI-2) is generated in response to submission of said first dynamic identifier (DI-1) to said second instance of said unique personalized client application.

23. The system as recited in claim 16, wherein said standalone computing device is selected from at least of a desktop computer system or a laptop computer system or a cellular telephone or a personal digital assistant (PDA) or a radio identification system (RFID) and a gadget capable of storing and processing data or combinations thereof.

24. A system for confirming the validity of a server to a user, said system comprising:

a server for generating and storing a first instance of a unique personalized client application associated with a first-time user on said server;

a client terminal for a user to communicate with said server over a communication channel; and

a standalone computing device comprising a second instance of said unique personalized application, said personalized client applications installed by said first-time user.

wherein said user authenticates said server based on a dynamic identifier (DI) generated by said first instance of said unique personalized client application.

25. The system as recited in claim 24, further comprising authentication of said user by said server, wherein the authentication of said user by said server is based on a dynamic identifier (DI) adapted for authentication using the said second instance of said unique personalized client application, said dynamic identifier (DI) generated by said first instance of said unique personalized client application.

26. The system as recited in claim 24, wherein said server includes a registration server or an authentication server or both.

27. The system as recited in claim 25, wherein registration at said server is initiated in response to submission of static credentials by said user to said server over the communication channel.

28. The system as recited in claim 25, wherein said first instance of said unique personalized client application is conveyed over the communication channel to said client.

29. The system as recited in claim 25, wherein said dynamic identifier (DI) is generated in response to submission of said static credentials to said server.

30. The system as recited in claim 25, wherein said standalone computing device is selected from at least of a desktop computer system or a laptop computer system or a cellular telephone or a personal digital assistant (PDA) or a radio identification system (RFID) and a gadget capable of storing and processing data or combinations thereof.