METHOD FOR AUTHENTICATING A USER DEVICE DURING THE PROCESS OF LOGGING INTO A SERVER

• US 20170316198A1
• Filed: 10/15/2015
• Published: 11/02/2017
• Est. Priority Date: 10/24/2014
• Status: Active Grant

• Current Assignee: RingCentral Incorporated
• Original Assignee: Unify GmbH & Co. KG (Atos SE)
• Inventors: Lederer, Thomas
• Granted Patent: US 10,546,115 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: G09C 5/00 Ciphering apparatus or methods not provided for in the preceding groups, e.g. involving the concealment or deformation of graphic data such as designs, written or printed messages
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04L 9/3297 involving time stamps, e.g. generation of time stamps

Abstract

The invention relates to a computer system (10) and to a method for authenticating a user device (Bm) associated with a user during the process of logging into a server (20), wherein the user device (Bm) belongs to a user device group (B1-Bn) known to the server (20) and has both a user ID (IDBm) and a password (PBm), which are known to the server (20). The method comprises the following steps: a) the server (20) generates input requests (Et1-Etx), each of which is valid only during a defined time period, and displays said input requests (Et1-Etx) individually in succession in a login screen (31), b) the user device (Bm) reads in the input request (Et2) displayed at the time of the login and calculates a response (ABm) by using said input request (Et2), the password (PBm) of the user device, and the current time (t2), c) the user device (Bm) transmits the calculated response (ABm) to the login screen (31), d) the response (ABm) is transmitted by the login screen (31) to the server (20), e) at least for part of the user device group (B1-Bn), the server (20) calculates a response (AS1-ASn) in each case by using the input request (Et2) displayed at the time of the login, the particular password (PB1-PBn), and the current time (t2) and compares the responses (AS1-ASn) calculated by the server with the response (ABm) transmitted by the user device (Bm), and f) the server (20) confirms the authentication for that user device (Bm) for which the response (ASm) calculated by the server (20) matches the response (ABm) transmitted by the user device (Bm).

Claims

1-10. -10. (canceled)

11. A computer-implemented method for authenticating a user device assigned to a user during the process of logging into a server, wherein the user device belongs to a user device group known to the server and has a user ID as well as a password that are known to the server, comprising the following steps:

generating input requests by the server that are only valid for a defined length of time, and displaying these input requests in sequence, one at a time, on a login screen;

reading the input request displayed at the time of the login and calculating a response using this input request, its password, and a current time;

transmitting the calculated response using the user device to the login screen;

transmitting the response by the login screen to the server;

calculating by the server a respective response for at least part of the user device group, using the input request displayed at the time of the login, the respective password, and the current time, and comparing the responses calculated by the server to the response transmitted by the user device; and

confirming by the server the authentication for each user device for which the response calculated by the server matches the response transmitted by the user device.

12. The method of claim 11, comprising considering the confirmed authentication preliminary;

and repeating prior steps after a predefined waiting period using the current time at that moment, after which, when authentication is confirmed the second time, authentication is considered fully valid.

13. The method of claim 12, wherein the server, for a second execution of the calculating step, calculates only a single response for the preliminarily authenticated user device and compares it to the response transmitted by the user device.

14. The method of claim 11, wherein the times used in calculating the input requests each comprise a defined time window that is configured such that the response calculated by the user device can typically be sent back to the server within this time window, wherein the time window is 30-60 seconds long.

15. The method of claim 11, further comprising steps of:

calculating, by the server, an additional respective response for at least part of the user device group, using an earlier input request that immediately preceded the input request displayed at the time of the login, the respective password, and a time that was valid during the earlier input request, and also compares these responses calculated by it to the response transmitted by the user device; and

confirming, by the server, the authentication for each user device for which the response calculated by the server matches the response transmitted by the user device.

16. The method of claim 11, comprising generating a QR code and displaying the QR code as the input request.

17. The method of claim 11, comprising substituting a random number for a current time, wherein said random number is valid only for a defined length of time.

18. A computer program product with program code that, when executed, carries out the method of claim 11.

19. A machine-readable data carrier with a computer program product according to claim 18 stored on it.

20. A computer system for authenticating a user device assigned to a user during the process of logging into a server, comprising:

a server for generating input requests that are valid only for a defined length of time, storing user IDs and passwords, and calculating responses to the input requests;

multiple user devices, each of which belongs to a user device group and has both a user ID (IDB1-IDBn) and a password (PB1-PBn), and

each of which can calculate a response to the input requests; and

a login screen assigned to the server for displaying the input requests and inputting the calculated responses,

wherein the server comprises a control device that carries out the method of claim 11.