SYSTEM, DESIGN AND PROCESS FOR EASY TO USE CREDENTIALS MANAGEMENT FOR ONLINE ACCOUNTS USING OUT-OF-BAND AUTHENTICATION

• US 20140223175A1
• Filed: 12/30/2013
• Published: 08/07/2014
• Est. Priority Date: 12/31/2012
• Status: Active Grant

• Current Assignee: GCOM IP LLC
• Original Assignee: Piyush Bhatnagar
• Inventors: BHATNAGAR, PIYUSH
• Granted Patent: US 9,412,283 B2
• Time in Patent Office: Days
• US Class Current: 713/159
• CPC Class Codes: G09C 5/00 Ciphering apparatus or methods not provided for in the preceding groups, e.g. involving the concealment or deformation of graphic data such as designs, written or printed messages
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys

Abstract

The invention provides an easy to use credential management mechanism for multi-factor out-of-band multi-channel authentication process to protect a large number of documents without the need to remember all the document passwords. When opened, the secure document application generates a multi-dimensional code. The user scans the multi-dimensional code and validates the secure document application and triggers an out-of-band outbound mechanism. The portable mobile device invokes the authentication server to get authenticated. The authentication server authenticates the user based on shared secret key and is automatically allowed access to the secure document. The process of the invention includes an authentication server, a secure document application to generate an authentication vehicle or an embodiment (i.e. multi-dimensional bar code) and handle incoming requests, secret keys and a portable communication device with a smartphone application.

Claims

1. A method for authentication for accessing an online portal in a system comprising a user, a client processing application, a portable communications device, and an authentication server having a provisioned user database and encrypted payload, wherein the method comprises:

providing a login portal and screen for access by a user, said login portal being in communication with said client processing application;

establishing contact between client processing application and authentication server wherein a new authentication session is started;

generating a session ID at the authentication server, wherein the session ID is communicated to the client processing application through at least a first communications channel;

creating a multi-dimensional barcode at client processing application, wherein the barcode has dynamic encryption keys, portal information, session ID, and a unique key, and wherein the barcode is displayed at login screen;

holding client processing application in waiting pending authentication server notification of session validation;

starting authentication by user entering credential on portable communications device, wherein portable communications device validates credential and displays scan option;

using portable communications device to scan barcode displayed at login screen and validate client processing application;

finding on the portable communications device the encrypted user credentials with encryption key from barcode;

sending encrypted credentials and session ID from portable communications device to authentication server via a outbound out-of-band communications channel;

checking in provisioned user database of authentication server, wherein session is validated;

sending encrypted payload to waiting client processing application;

sending validation result from authentication server to portable communication device where the result is displayed;

decrypting payload at client processing application using encryption keys;

extracting and decrypting credentials at client processing application;

using decrypted credentials to access the online portal.

2. A method according to claim 1 wherein the login portal is provided at the client processing application for receiving information for the user.

3. A method according to claim 1 wherein the login portal and client processing application for receiving information for the user are contained in a laptop.

4. A method according to claim 1 wherein the login portal and client processing application for receiving information for the user are contained in a personal computer.

5. A method for authentication in a system comprising a user, a browser extension or plugin, a portable communications device, and an authentication server having a provisioned user database and encrypted payload, wherein the method comprises:

detecting user intent to login to an online portal (like, gmail, yahoo, ebay, etc) using a browser;

establishing contact between browser extension or plugin and authentication server wherein a new authentication session is started;

generating a session ID at the authentication server, wherein the session ID is communicated to the browser plugin through at least a first communications channel;

creating a multi-dimensional barcode at the browser extension or plugin, wherein the barcode has dynamic encryption keys, portal information, session ID, and a unique key, and wherein the barcode is displayed in the browser;

holding browser in waiting pending authentication server notification of session validation;

starting authentication user entering credential on portable communications device, wherein portable communications device validates credential and displays scan option;

using portable communications device to scan barcode displayed at login screen and validate browser extension or plugin;

finding on the portable communications device the encrypted user credentials with encryption key from barcode;

sending encrypted credentials and session ID from portable communications device to authentication server via a outbound out-of-band communications channel;

checking in provisioned user database of authentication server, wherein session is validated;

sending encrypted payload to waiting browser extension or plugin;

sending validation result from authentication server to portable communication device where the result is displayed;

decrypting payload at browser extension or plugin using encryption keys;

extracting and decrypting credentials at browser extension or plugin;

using decrypted credentials to populate the login form on the login page of the online portal in the browser;

initiating the login to the online portal by sending the login form to the online portal using the browser extension or plugin.