Apparatus and Method for Authenticating a User via Multiple User Devices

• US 20160112437A1
• Filed: 09/04/2013
• Published: 04/21/2016
• Est. Priority Date: 09/04/2013
• Status: Active Grant

• Current Assignee: Anton Nikolaevich Churyumov
• Original Assignee: Anton Nikolaevich Churyumov
• Inventors: Churyumov, Anton Nikolaevich
• Granted Patent: US 9,756,056 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/43 wireless channels
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32

Abstract

A method includes forming, during access to a site, an association between a user and a first device. Contact information for a second device associated with the user is obtained. During a subsequent access to the site the first device is recognized. The user is prompted to authenticate without inputting identifying information. The user is authenticated at the site relying upon the association and a positively acknowledged message from the second device.

Claims

1. A method, comprising:

forming, during access to a server, an association between a user and a first device used to access the server, wherein the association constitutes a first possession factor linking the user to the first device;

sending a code to the first device;

receiving the code and contact information for a second device associated with the user, wherein the contact information facilitates a second possession factor linking the user to the second device;

recognizing, during a subsequent access to the server, the first device and therefore establish the first possession factor;

sending a message to the second device in response to recognizing;

obtaining a positively acknowledged message from the second device and therefore establish the second possession factor; and

authenticating the user based upon the first possession factor and the second possession factor.

4. The method of claim 1 wherein forming includes initially authenticating the user.

5. The method of claim 4 wherein initially authenticating the user is achieved by one or more of:

receiving a username and password,

receiving a client SSL certificate,

receiving a one-time password,

confirming a code sent to a user email address, and

confirming a code sent to the second device.

6. The method of claim 1 wherein recognizing includes one or more of:

reading a cookie on the first device that uniquely identifies the first device,

checking the IP address of the first device,

checking the MAC address of the first device, and

checking a unique browser identifier.

8. The method of claim 1 wherein the message includes a single gesture prompt to establish the positively acknowledged message.

9. The method of claim 1 wherein sending and receiving rely upon Internet Protocol network communications.

10. The method of claim 1 wherein sending and receiving rely upon short message service communications.

11. The method of claim 1 wherein authenticating includes:

passing a token from the server to a first server;

associating, at the first server, the token with user identification;

sending a message from the first server to the second device;

receiving, at the first server, a positive acknowledgement of the message; and

passing the user identification from the first server to the second server.

12. The method of claim 1 wherein the first device and second device are the same physical device running two distinct software programs that are recognized by the server as separate communication endpoints.

13. The method of claim 1 wherein the second device is identified by one or more of:

a hardcoded user ID associated with an application on the second device,

a device ID for the second device,

a username and password on the second device, and

external hardware associated with the second device.

14. The method of claim 1 further comprising receiving a negatively acknowledged message from the second device.

15. The method of claim 14 wherein the negatively acknowledged message reports an unauthorized access attempt.

18. The method of claim 1 wherein the contact information comprises one or more of:

a telephone number, and

a push notification address.

24. The method of claim 1 wherein sending includes sending QR code for display by the first device.

2-3. -3. (canceled)

7. (canceled)

16-17. -17. (canceled)

19-23. -23. (canceled)