METHOD AND SYSTEM OF PROVIDING AUTHENTICATION OF USER ACCESS TO A COMPUTER RESOURCE VIA A MOBILE DEVICE USING MULTIPLE SEPARATE SECURITY FACTORS

• US 20160261411A1
• Filed: 05/16/2016
• Published: 09/08/2016
• Est. Priority Date: 11/28/2012
• Status: Active Grant

• Current Assignee: Hoverkey Limited
• Original Assignee: Hoverkey Limited
• Inventors: YAU, ARNOLD, IVES, STEVE
• Granted Patent: US 10,102,510 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: G06Q 20/065 using e-cash
• CPC Class Codes: G06Q 20/3278 RFID or NFC payments by means of M-devices
• CPC Class Codes: G06Q 20/3678 e-cash details, e.g. blinded, divisible or detecting double spending
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 20/38215 Use of certificates or encrypted proofs of transaction rights
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/4097 using mutual authentication between devices and transaction partners
• CPC Class Codes: G06Q 2220/00 Business processing using cryptography postage metering system using cryptography G06Q2250/05
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/105 : Multiple levels of security
• CPC Class Codes: H04L 63/18 : using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 9/0637 : Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]
• CPC Class Codes: H04L 9/3213 : using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807
• CPC Class Codes: H04L 9/3226 : using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04W 12/069 : using certificates or pre-shared keys
• CPC Class Codes: H04W 4/80 : Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication

Abstract

A method and system of authenticating a computer resource such as an application or data on a mobile device uses a contactless token to provide multi-factor user authentication. User credentials are stored on the token in the form of private keys, and encrypted data and passwords are stored on the device. When an application user requires access to the resource an encrypted password is transmitted to and decrypted on the token using a stored key. An unencrypted data encryption key or password is then transmitted back to the device under the protection of a cryptographic session key which is generated as a result of strong mutual authentication between the device and the token.

Claims

1. A method of conducting a cryptocurrency payment via a mobile computing device comprising:

using the mobile computing device, storing an encrypted wallet received from a portable security token that is separate from the mobile device, wherein the encrypted wallet comprises a cryptocurrency wallet encrypted with a secret key that is restricted to the portable security token;

using the mobile computing device, receiving a cryptocurrency payment instruction;

using the mobile computing device, prompting for a user credential to approve the cryptocurrency payment instruction;

using the mobile computing device, sending, to the portable security token, a message in response to receiving the user credential, wherein the message comprises the encrypted wallet, the cryptocurrency payment instruction, and the user credential; and

wherein the sending of the message causes the portable security token to;

decrypt, using the secret key, the cryptocurrency wallet from the encrypted wallet;

in response to confirming that the user credential matches an authentication identifier registered with the portable security token, create a cryptocurrency payment transaction by digitally signing the cryptocurrency payment instruction using the cryptocurrency wallet;

transmit the cryptocurrency payment transaction to a cryptocurrency network or cryptocurrency bank or exchange; and

erase the cryptocurrency wallet;

wherein the confirming the user credential matches an authentication identifier registered with the portable security token comprises using any of PIN, biometric or fingerprint on the mobile device, or authentication via button press confirmation, PIN or fingerprint on the portable security token.

2. The method of claim 1, wherein the encrypted wallet is stored on a remote cloud storage location.

3. The method of claim 1, wherein the receiving of the encrypted wallet is in response to sending, to the portable security token, an encryption request that embeds the cryptocurrency wallet.

4. The method of claim 1, wherein the receiving of the encrypted wallet is in response to sending, to the portable security token, an encryption request to create the cryptocurrency wallet as a new wallet.

5. The method of claim 1, wherein the cryptocurrency payment instruction is received from one of:

an application executing on the mobile device, an application executing on a separate computing device owned by a user of the mobile device, and a merchant terminal.

6. The method of claim 1, wherein the cryptocurrency payment instruction is received using one of:

a cryptocurrency exchange application program interface (API), one or more near field communication (NFC) messages, and cellular or wireless Internet access.

7. The method of claim 1, wherein the receiving of the encrypted wallet from the portable security token and the sending of the message to the portable security token utilize near field communication (NFC).

8. The method of claim 1, wherein the cryptocurrency payment transaction is transmitted to the cryptocurrency network by communicating with one of:

a separate computing device owned by a user of the mobile device, a merchant terminal, and a cryptographic currency exchange.

9. The method of claim 1, wherein the portable security token is one of:

a wearable device, a watch, a card, and a ring;

wherein the cryptocurrency wallet is a BITCOIN wallet.

10. A data processing system that is programmed to conduct a cryptocurrency payment via a mobile computing device, the system comprising:

the mobile computing device comprising stored program instructions that are programmed to cause, when executed by the mobile computing device, storing an encrypted wallet received from a portable security token that is separate from the mobile device, wherein the encrypted wallet comprises a cryptocurrency wallet encrypted with a secret key that is restricted to the portable security token;

stored program instructions that are programmed to cause, when executed by the mobile computing device, receiving a cryptocurrency payment instruction;

stored program instructions that are programmed to cause, when executed by the mobile computing device, prompting for a user credential to approve the cryptocurrency payment instruction; and

stored program instructions that are programmed to cause, when executed by the mobile computing device, sending, to the portable security token, a message in response to receiving the user credential, wherein the message comprises the encrypted wallet, the cryptocurrency payment instruction, and the user credential; and

wherein the sending of the message causes the portable security token to;

decrypt, using the secret key, the cryptocurrency wallet from the encrypted wallet;

in response to confirming that the user credential matches an authentication identifier registered with the portable security token, create a cryptocurrency payment transaction by digitally signing the cryptocurrency payment instruction using the cryptocurrency wallet;

transmit the cryptocurrency payment transaction to a cryptocurrency network or cryptocurrency bank or exchange; and

erase the cryptocurrency wallet;

wherein the confirming the user credential matches an authentication identifier registered with the portable security token comprises using any of PIN, biometric or fingerprint on the mobile device, or authentication via button press confirmation, PIN or fingerprint on the portable security token.

11. The system of claim 10, further comprising stored program instructions that are programmed to cause, when executed by the mobile computing device, storing the encrypted wallet on a remote cloud storage location.

12. The system of claim 10, wherein the authentication identifier is one of a personal identification number (PIN), or a biometric identifier such as a fingerprint.

13. The system of claim 10, further comprising stored program instructions that are programmed to cause, when executed by the mobile computing device, receiving the encrypted wallet in response to sending, to the portable security token, an encryption request that embeds the cryptocurrency wallet.

14. The system of claim 10, further comprising stored program instructions that are programmed to cause, when executed by the mobile computing device, receiving the encrypted wallet is in response to sending, to the portable security token, an encryption request to create the cryptocurrency wallet as a new wallet.

15. The system of claim 10, further comprising stored program instructions that are programmed to cause, when executed by the mobile computing device, receiving the cryptocurrency payment instruction from one of:

an application executing on the mobile device, an application executing on a separate computing device owned by a user of the mobile device, and a merchant terminal.

16. The system of claim 10, further comprising stored program instructions that are programmed to cause, when executed by the mobile computing device, receiving the cryptocurrency payment instruction using one of:

a cryptocurrency exchange application program interface (API), one or more near field communication (NFC) messages, and cellular or wireless Internet access.

17. The system of claim 10, further comprising stored program instructions that are programmed to cause, when executed by the mobile computing device, receiving the encrypted wallet from the portable security token and sending of the message to the portable security token using near field communication (NFC).

18. The system of claim 10, further comprising stored program instructions that are programmed to cause, when executed by the mobile computing device, transmitting the cryptocurrency payment transaction to the cryptocurrency network by communicating with one of:

a separate computing device owned by a user of the mobile device, a merchant terminal, and a cryptographic currency exchange.

19. The system of claim 10, wherein the portable security token is one of:

a wearable device, a watch, a card, and a ring;

wherein the cryptocurrency wallet is a BITCOIN wallet.

20. A method of providing two-factor authenticated login to a server computer via a mobile computing device comprising:

using the mobile computing device, storing an encrypted wallet received from a portable security token that is separate from the mobile device, wherein the encrypted wallet comprises a transaction wallet encrypted with a secret key that is restricted to the portable security token;

using the mobile computing device, receiving an instruction relating to logging in to a server computer that is associated with a secure application program that uses a block chain;

using the mobile computing device, prompting for a user credential to approve the instruction;

using the mobile computing device, sending, to the portable security token, a message in response to receiving the user credential, wherein the message comprises the encrypted wallet, the instruction, and the user credential; and

wherein the sending of the message causes the portable security token to;

decrypt, using the secret key, the transaction wallet from the encrypted wallet;

in response to confirming that the user credential matches an authentication identifier registered with the portable security token, create a login transaction by digitally signing the cryptocurrency payment instruction using the transaction wallet;

transmit the login transaction to the secure application program that uses the block chain; and

erase the transaction wallet;

wherein the confirming the user credential matches an authentication identifier registered with the portable security token comprises using any of PIN, biometric or fingerprint on the mobile device, or authentication via button press confirmation, PIN or fingerprint on the portable security token.

21. The method of claim 20, wherein the encrypted wallet is stored on a remote cloud storage location.

22. The method of claim 20, wherein the instruction is received from one of:

an application executing on the mobile device, an application executing on a separate computing device associated with a user of the mobile device; and

a server computer.

23. The method of claim 20, wherein the instruction is received using an application program interface (API) of a server computer application that uses block chain.

24. The method of claim 21, wherein the receiving of the encrypted wallet from the portable security token and the sending of the message to the portable security token utilize near field communication (NFC).