SECURE MOBILE DEVICE TWO-FACTOR AUTHENTICATION

• US 20170257363A1
• Filed: 02/28/2017
• Published: 09/07/2017
• Est. Priority Date: 03/04/2016
• Status: Abandoned Application

• Current Assignee: SecureAuth Incorporated
• Original Assignee: SecureAuth Incorporated
• Inventors: Franke, Michael L., Dana, Robert Morrison
• Application Number:
  US15/445,067
• Publication Number:
  US 20170257363A1
• Time in Patent Office: Days
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04W 12/062 Pre-authentication
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys

Abstract

A user of a computer seeking to access a protected resource must first authenticate with an authentication appliance. The user provides credentials to the authentication appliance for verification and for use in determining a mobile device associated with the user. The authentication appliance then dynamically generates a reference shared secret, such as an image, pattern, or key, which is also displayed to the user on the computer. The authentication appliance sends an authentication request to an application on the mobile device associated with the user. The application provides an interface in which the user may select, enter, draw, or reproduce the earlier-viewed shared secret on the mobile device. The user-provided secret is then compared to the reference shared secret. If the user-provided secret matches the reference shared secret, then the authentication appliance may provide the user or the computer access to the protected resource.

Claims

1. A computing appliance for performing multi-factor authentication, the appliance comprising:

one or more processors;

a computer-readable memory; and

an authentication program comprising executable instructions stored in the computer-readable memory, wherein the executable instructions direct the one or more processors to at least;

obtain a set of user credentials from a client computer, wherein the set of user credentials are associated with a user identity;

access a database containing a set of reference user credentials;

verify the user identity by comparing the set of user credentials with the set of reference user credentials;

determine a mobile device associated with the user identity;

generate a shared secret;

transmit the shared secret to the client computer to be displayed on the client computer;

transmit an authentication request to the mobile device, wherein the authentication request is configured to be accessed by an application on the mobile device in order to obtain a user-supplied secret;

obtain an authentication response from the mobile device;

upon obtaining the authentication response, verify the user-supplied secret matches the shared secret; and

upon verifying that the user-supplied secret matches the shared secret, provide the client computer access to a protected resource.

2. The computing appliance of claim 1, wherein the shared secret comprises a pattern.

3. The computing appliance of claim 1, wherein the shared secret comprises an image.

4. The computing appliance of claim 1, wherein the authentication request comprises a push notification.

5. The computing appliance of claim 1, wherein the authentication response comprises the user-supplied secret, and wherein to verify that the user-supplied secret matches the shared secret, the executable instructions further direct the one or more processors to compare the user-supplied secret from the authentication response with the shared secret.

6. The computing appliance of claim 1, wherein the authentication response comprises an indication that the user-supplied secret matches the shared secret, and wherein to verify that the user-supplied secret matches the shared secret, the executable instructions further direct the one or more processors to assess the indication in the authentication response.

7. The computing appliance of claim 1, wherein the mobile device comprises a smart phone or a mobile phone.

8. The computing appliance of claim 1, wherein the authentication request comprises information associated with the shared secret.

9. A computerized method for performing multi-factor authentication, the method comprising:

by one or more hardware processors executing computing instructions;

receiving a set of user credentials from a client computer, wherein the set of user credentials are associated with a user identity;

accessing a database containing a set of reference user credentials;

verifying the user identity by comparing the set of user credentials with the set of reference user credentials;

determining a mobile device associated with the user identity;

generating a shared secret;

transmitting the shared secret to the client computer to be displayed on the client computer;

transmitting an authentication request to the mobile device, wherein the authentication request is configured to be accessed by an application on the mobile device in order to obtain a user-supplied secret;

receiving an authentication response from the mobile device;

upon receiving the authentication response, verifying the user-supplied secret matches the shared secret; and

upon verifying that the user-supplied secret matches the shared secret, providing the client computer access to a protected resource.

10. The computerized method of claim 9, wherein the shared secret comprises a pattern.

11. The computerized method of claim 9, wherein the shared secret comprises an image.

12. The computerized method of claim 9, wherein the authentication response comprises the user-supplied secret, and wherein the method further comprises comparing the user-supplied secret from the authentication response with the shared secret.

13. The computerized method of claim 9, wherein the authentication response comprises an indication that the user-supplied secret matches the shared secret, and wherein the method further comprises assessing the indication in the authentication response.

14. The computerized method of claim 9, wherein the mobile device comprises a smart phone or a mobile phone.

15. The computerized method of claim 9, wherein the authentication request comprises information associated with the shared secret.

16. A non-transitory computer storage medium which stores a mobile client application comprising executable code that directs a mobile device to perform a process comprising:

accessing an authentication request transmitted from an authentication appliance, wherein the authentication appliance is configured to;

obtain a set of user credentials from a client computer, wherein the set of user credentials are associated with a user identity;

access a database containing a set of reference user credentials;

verify the user identity by comparing the set of user credentials with the set of reference user credentials;

determine the mobile device, wherein the mobile device is associated with the user identity;

generate a shared secret;

transmit the shared secret to the client computer to be displayed on the client computer;

transmit the authentication request to the mobile device, wherein the authentication request is configured to be accessed by the application in order to obtain a user-supplied secret;

obtain an authentication response from the mobile device;

upon obtaining the authentication response, verify the user-supplied secret matches the shared secret; and

upon verifying that the user-supplied secret matches the shared secret, provide the client computer access to a protected resource; and

generating an interactive authentication interface configured to allow a user of the mobile device to provide the user-supplied secret, wherein the user is associated with the user identity;

obtaining, through the interactive authentication interface, the user-supplied secret from the user; and

upon obtaining the user-supplied secret, sending the authentication response to the authentication appliance.

17. The non-transitory computer storage medium of claim 16, wherein the interactive authentication interface comprises a pattern lock and the user-supplied secret comprises a pattern lock pattern.

18. The non-transitory computer storage medium of claim 16, wherein the interactive authentication interface comprises a plurality of images and the user-supplied secret comprises an image selected from the plurality of images.

19. The non-transitory computer storage medium of claim 16, wherein the authentication response comprises the user-supplied secret.

20. The non-transitory computer storage medium of claim 16, wherein the mobile client application comprising executable code directs the mobile device to, prior to sending the authentication response to the authentication appliance, verify that the user-supplied secret matches the shared secret, and wherein the authentication response comprises an indication that the user-supplied secret matches the shared secret.