SYSTEM AND METHOD FOR SECURE REMOTE ACCESS

• US 20130275754A1
• Filed: 02/12/2013
• Published: 10/17/2013
• Est. Priority Date: 02/03/2009
• Status: Active Grant

• Current Assignee: inBay Technologies, Inc.
• Original Assignee: inBay Technologies, Inc.
• Inventors: KUANG, Randy, XAVIER, Stanislus Kisito, STEKLASA, Robert Frank, WILSON, Stephen George, ZHU, He
• Granted Patent: US 8,739,252 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: H04L 2463/062 applying encryption of the keys
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04W 12/77 Graphical identity

Abstract

System, method, and apparatus for providing access to remote computing services are described. The method includes authenticating a user and a client device; establishing a connection to a server computer including: a server program executing on the server computer detecting the connection; the server program creating a blocking process on the server computer to block access of the user to a service on the connection, authorizing, using a client program executing on the client device and the server program, the user to use the service on the server computer including: terminating the blocking process, the user using the service; and the user closing the connection to the server computer. Embodiments of the present invention provide secure remote access to computing services.

Claims

1. A method for remote secure connection to a service on a server computer, the method comprising:

authenticating a user and a client device;

establishing a connection to the server computer comprising;

a server program, comprising computer readable instructions, executing on the server computer detecting the connection; and

the server program creating a blocking process on the server computer to block access of the user to the service on the connection;

authorizing the user to access the service on the server computer, using a client program executing on the client device and the server program, comprising terminating the blocking process on the server computer;

using the service; and

closing the connection to the server computer.

2. The method as claimed in claim 1 wherein the authenticating further comprises:

establishing a secure connection from the client device to the server computer;

sending an invitation over the secure connection including a URL (Uniform Resource Locator) from a server program to the client device;

downloading a client program to the client device from a location provided by the URL;

initiating execution of the client program on the client device;

entering a predetermined user PIN (personal identification number) to the client program;

sending a client device ID (identification number) and the predetermined user PIN from the client program to the server program over the secure connection;

the server program generating a random number to provide a secret key;

the server program encrypting the secret key using the user PIN and the client device ID as keys;

the server program sending the encrypted secret key to the client program over the secure connection;

the client program decrypting the encrypted secret key using the user PIN and the client device ID as keys; and

the user entering user account credentials into the client program; and

the client program closing the secure connection.

3. The method as claimed in claim 1 wherein establishing the connection comprises:

establishing a remote desktop connection from the client device to the server computer.

4. The method as claimed in claim 1 wherein establishing the connection comprises:

establishing a remote desktop connection from a client terminal to the server computer.

5. The method as claimed in claim 1 wherein the server program creating the blocking process further comprises computer readable instructions stored in a memory, creating a blocking window on a desktop of the server computer.

6. The method as claimed in claim 5 wherein the server program creating the blocking window further comprises the server program creating a modal dialog window.

7. The method as claimed in claim 1 wherein the server program creating the blocking process further comprises the server program creating a blocking window on a desktop of the server computer.

8. The method as claimed in claim 7 wherein the server program creating the blocking window comprises the server program creating a modal dialog window.

9. The method as claimed in claim 1 wherein the authorizing the user further comprises:

the client program creating a client OTA (One Time Authorization) code;

the server program creating a server OTA code;

the client program sending the client OTA code to the server program; and

the server program comparing the server OTA code with the client OTA code.

10. The method as claimed in claim 9 wherein the client program creating the client OTA code comprises the client program combining a secret key with dynamic connection information using a one-way function.

11. The method as claimed in claim 10 wherein the server program creating the server OTA code comprises the server program combining the secret key with the dynamic connection information using the one-way function.

12. The method as claimed in claim 9 further comprising:

the server program providing a quick response (QR) code including dynamic connection information in a blocking window on a desktop of the server computer; and

the client program receiving the dynamic connection information from the QR code.

13. The method as claimed in claim 9 wherein the client program sending the client OTA to the server program further comprises:

the client program copying the client OTA code to a shared clipboard; and

the server program detecting the client OTA code on the shared clipboard.

14. The method as claimed in claim 9 wherein the client program sending the client OTA code to the server program comprises sending the client OTA code on a secure channel.

15. The method as claimed in claim 9 wherein the client program sending the client OTA code to the server program further comprises:

the client program copying the client OTA code to a clipboard;

the user pasting the client OTA code into a secure shell executing a blocking program.

16. The method as claimed in claim 1 wherein the using the service further comprises:

the client program automatically signing into the service in a remote desktop window on the client device using user account credentials; and

the user signing out of the service in the remote desktop window on the client device.

17. The method as claimed in claim 1 wherein the using the service further comprises:

the user signing into the service in a remote desktop window on the client device using user account credentials; and

the user signing out of the service in the remote desktop window on the client device.

18. A system for remote secure connection to a service on a server computer, comprising:

a client device configured to execute a client program having computer readable instructions stored in a memory of the client device; and

a server computer having a processor configured to execute a server program, having computer readable instructions stored in a memory of the server computer;

the client program and server program are configured to;

authenticate a user and the client device;

establish a connection to the server computer including;

the server program detecting the connection; and

the server program creating a blocking process on the server computer to block access of the user to a service on the connection, and

authorize the user to access the service on the server computer, including terminating the blocking process on the server computer.

19. The system as claimed in claim 18 further comprising a client terminal configured to establish the connection to the server computer.

20. An apparatus comprising:

a server computer having a processor configured to execute a server program stored in a computer memory, the server program being configured to;

detect a connection established by a trusted device to the server computer;

create a blocking process on the server computer to block access to a service on the connection; and

authorize the trusted device to access the service on the server computer, comprising terminating the blocking process on the server computer.