Use of personal communication devices for user authentication

• US 6,993,658 B1
• Filed: 03/06/2000
• Issued: 01/31/2006
• Est. Priority Date: 03/06/2000
• Status: Expired due to Term

• Current Assignee: Dynapass IP Holdings LLC (Dynapass Inc.)
• Original Assignee: April System Design AB
• Inventors: Jonsson, Ake, Engberg, Sten-Olov
• Primary Examiner(s): Barroń, Jr., Gilberto
• Assistant Examiner(s): HENEGHAN, MATTHEW E
• Application Number:
  US09/519,829
• Time in Patent Office: 2,157 Days
• Field of Search: 380/247, 380/249, 455/411, 713/202, 713/182, 713/183, 713/185, 705/74, 235/382.5, 379/114.2, 709/219
• US Class Current: 713/185
• CPC Class Codes: G06F 21/43 wireless channels
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215

Abstract

A password setting system for a secure system includes a user token server and a communication module. The user token server generates a random token in response to a request for a new password from a user. The server creates a new password by concatenating a secret passcode that is known to the user with the token. The server sets the password associated with the user'"'"'s user ID to be the new password. The communication module transmits the token to a personal communication device, such as a mobile phone or a pager carried by the user. The user concatenates the secret passcode with the received token in order to form a valid password, which the user submits to gain access to the secure system. Accordingly, access to the system is based upon: nonsecret information known to the user, such as the user ID; secret information known to the user, such as the passcode; and information provided to the user through an object possessed by the user, such as the token.

Claims

1. A method of authenticating a user on a first secure computer network, the user having a user account on said first secure computer network, the method comprising:

associating the user with a personal communication device possessed by the user, said personal communication device in communication over a second network, wherein said second network is a cell phone network different from the first secure computer network;

receiving a request from the user for a token via the personal communication device, over the second network;

generating a new password for said first secure computer network based at least upon the token and a passcode, wherein the token is not known to the user and wherein the passcode is known to the user;

setting a password associated with the user to be the new password;

activating access the user account on the first secure computer network;

transmitting the token to the personal communication device;

receiving the password from the user via the first secure computer network; and

deactivating access to the user account on the first secure computer network within a predetermined amount of time after said activating, such that said user account is not accessible through any password, via said first secure computer network.

2. The method of claim 1, wherein the new password is generated by concatenating the token and the passcode.

3. The method of claim 1, wherein the personal communication device is a mobile phone.

4. The method of claim 1, wherein the personal communication device is a pager.

5. A user authentication system comprising:

a computer processor;

a user database configured to associate a user with a personal communication device possessed by the user, said personal communication device configured to communicate over a cell phone network with the user authentication system;

a control module executed on the computer processor configured to create a new password based at least upon a token and a passcode, wherein the token is not known to the user and wherein the passcode is known to the user, the control module further configured to set a password associated with the user to be the new password;

a communication module configured to transmit the token to the personal communication device through the cell phone network; and

an authentication module configured to receive the password from the user through a secure computer network, said secure computer network being different from the cell phone network, wherein the user has an account on the secure computer network, wherein the authentication module activates access to the account in response to the password and deactivates the account within a predetermined amount of time after activating the account, such that said account is not accessible through any password via the secure computer network.

6. The system of claim 5, wherein the communication module is further configured to receive a request from the user for the token, and wherein the control module is further configured to create the new password in response to the request.

7. The system of claim 6, wherein the request is transmitted by the user through the personal communication device.