Login authentication using a trusted device

• US 8,214,890 B2
• Filed: 08/27/2008
• Issued: 07/03/2012
• Est. Priority Date: 08/27/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Kirovski, Darko, Meek, Christopher A.
• Primary Examiner(s): CHEA, PHILIP J
• Application Number:
  US12/198,914
• Publication Number:
  US 20100058064A1
• Time in Patent Office: 1,406 Days
• Field of Search: 713/171, 726/12, 726/9
• US Class Current: 726/12
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 2463/062 applying encryption of the keys cryptographic mechanisms or cryptographic arrangements for key distribution using key encryption key H04L9/0822
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 9/3073 involving pairings, e.g. identity based encryption [IBE], bilinear mappings or bilinear pairings, e.g. Weil or Tate pairing
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

A user working on a client computer is allowed to remotely login to a server over a computer network. A first secure connection is established between the client and the server. Communications with a trusted device which is in the user'"'"'s control is established via a communication channel between the trusted device and the client, where this channel is not part of the network. A second secure connection is established between the trusted device and the server through the client, where this second secure connection is tunneled within the first secure connection. The user remotely logs into the server over the second secure connection using the trusted device.

Claims

1. A computer-implemented process for allowing a user working on a client computer to remotely login to a server over a computer network, comprising using the client to perform the process actions of:

establishing a first secure connection between the client and the server;

establishing communications with a trusted device which is in the user'"'"'s control via a communication channel between the trusted device and the client other than said network; and

facilitating the establishment of a second secure connection between the trusted device and the server through the client, wherein the second secure connection is tunneled within the first secure connection and is employed to remotely login to the server using the trusted device.

2. The process of claim 1, wherein the client comprises a web browser and the process action of establishing a first secure connection between the client and the server comprises actions of:

transmitting a secure connection request message over the network to the server, said message comprising a list of ciphers and hash functions that are supported by the client'"'"'s browser;

receiving a secure connection response message over the network from the server, said message specifying the cipher and hash function picked by the server, and comprising a digital certificate which identifies the server and specifies a public key for the server;

using the digital certificate to verify the authenticity of the server;

whenever the server is determined to be unauthentic, disabling the first secure connection; and

whenever the server is determined to be authentic,

generating a random number-based first session key,

encrypting the first session key with the public key, and

transmitting the encrypted first session key over the first secure connection to the server.

3. The process of claim 2, wherein the process action of facilitating the establishment of a second secure connection between the trusted device and the server through the client comprises actions of:

transmitting the digital certificate which identifies the server and specifies its public key over the communication channel to the trusted device;

upon the trusted device using the digital certificate to verify the authenticity of the server and the trusted device subsequently generating a random number-based second session key which the trusted device encrypts with said public key, receiving a server authentication result message over the communication channel from the trusted device, said message comprising the encrypted second session key;

whenever said message specifies that the server was determined to be unauthentic, disabling the second secure connection; and

whenever said message specifies that the server was determined to be authentic, transmitting the encrypted second session key over the first secure connection to the server.

4. The process of claim 2, further comprising actions of:

whenever a trusted device connectivity application module is not installed on the client,

transmitting a message requesting said application over the first secure connection to the server, and

receiving said application over the first secure connection from the server, and installing and executing it on the client.

5. The process of claim 1, wherein the client comprises a web browser and the process action of establishing communications with a trusted device which is in the user'"'"'s control via a communication channel between the trusted device and the client other than said network comprises actions of:

prompting the user to choose between a plurality of different methods for remotely logging into the server via a user interface of the client; and

whenever the user chooses to remotely login to the server using the trusted device, pairing the client'"'"'s browser to the trusted device.

6. The process of claim 5, wherein the process action of pairing the client'"'"'s browser to the trusted device comprises actions of:

searching the communication channel between the trusted device and the client for other devices attached thereto;

displaying a user-selectable list of detected devices to the user via the user interface of the client, wherein said list comprises the trusted device;

upon the user'"'"'s entry into said user interface of their selection of the trusted device from the list, transmitting a pairing request message over the communication channel to the trusted device; and

upon receiving a pairing approval message over the communication channel from the trusted device, completing a pairing connection to the trusted device over the communication channel.

7. The process of claim 5, wherein the process action of facilitating the establishment of a second secure connection between the trusted device and the server through the client comprises an action of verifying the trusted device'"'"'s pairing to the client'"'"'s browser, said verification comprising actions of:

receiving a first random number over the first secure connection from the server;

displaying the first random number to the user via the user interface of the client along with a prompt for the user to visually compare said displayed number to a second random number which is displayed to the user via a user interface of the trusted device; and

upon the user'"'"'s entry into the user interface of the client of their comparison result,

transmitting a comparison result message over the first secure connection to the server, and

transmitting said message over the communication channel to the trusted device, wherein said message specifies whether or not the first random number matches the second random number, and upon receipt of said message by the trusted device said message is displayed to the user via the user interface of the trusted device.

8. The process of claim 1, wherein the trusted device comprises one of a mobile phone, a pocket personal computer, an ultra-mobile personal computer, a mobile music player, or an intelligent keypad.

9. The process of claim 1, wherein,

the communication channel between the trusted device and the client comprises one of a wireless Bluetooth connection or a wired Universal Serial Bus connection, and

the first secure connection and second secure connection are implemented using either a Secure Sockets Layer protocol or a Transport Layer Security protocol.

10. A computer-implemented process for allowing a user working on a client computer to remotely login to a server over a computer network, comprising using the server to perform the process actions of:

establishing a first secure connection between the server and the client;

establishing a second secure connection between the server and a trusted device through the client, wherein,

the trusted device is in the user'"'"'s control and communicates with the client via a communication channel between the trusted device and the client other than said network, and

the second secure connection is tunneled within the first secure connection; and

facilitating the user'"'"'s remote login over the second secure connection to the server using the trusted device.

11. The process of claim 10, wherein the client comprises a web browser and the process action of establishing a first secure connection between the server and the client comprises actions of:

receiving a secure connection request message over the network from the client'"'"'s browser, said message comprising a list of ciphers and hash functions that are supported by the client'"'"'s browser;

analyzing the list of ciphers and hash functions, and picking the strongest cipher and hash function that are supported by the server;

transmitting a secure connection response message over the network to the client'"'"'s browser, said message specifying the picked cipher and hash function, and comprising a digital certificate which identifies the server and specifies a public key for the server; and

upon the client'"'"'s browser using the digital certificate to verify the authenticity of the server, receiving an encrypted first session key over the first secure connection from the client'"'"'s browser and decrypting said first key using a private key for the server.

12. The process of claim 11, wherein the process action of establishing a first secure connection between the server and the client further comprises actions of:

receiving a message from the client'"'"'s browser over the first secure connection requesting a trusted device connectivity application module; and

transmitting said application over the first secure connection to the client'"'"'s browser.

13. The process of claim 11, wherein the process action of establishing a second secure connection between the server and a trusted device through the client comprises actions of:

transmitting a login method prompt message over the first secure connection to the client'"'"'s browser, wherein said message asks the user to choose between a plurality of different methods for remotely logging into the server; and

whenever the user chooses to remotely login to the server using the trusted device, and upon the trusted device being paired to the client'"'"'s browser via the communication channel between the trusted device and the client,

receiving an encrypted second session key over the first secure connection from the client'"'"'s browser and decrypting said second key using the private key for the server, said second key originating from the trusted device and signifying that the trusted device determined that the server was authentic using the digital certificate, and

verifying the trusted device'"'"'s pairing to the client'"'"'s browser.

14. The process of claim 13, wherein the process action of verifying the trusted device'"'"'s pairing to the client'"'"'s browser comprises actions of:

upon the generation of a random number by the trusted device and the display of said generated number to the user via a user interface of the trusted device, receiving said generated number over the second secure connection from the trusted device;

upon the user'"'"'s entry of said displayed generated number into a user interface of the client, receiving said entered number over the first secure connection from the client'"'"'s browser;

comparing said generated number received from the trusted device to said entered number received from the client'"'"'s browser; and

transmitting a comparison result message over the second secure connection to the trusted device, wherein said message specifies whether or not said generated number matches said entered number, and upon receipt of said message by the trusted device said message is displayed to the user via the user interface of the trusted device.

15. The process of claim 13, wherein the process action of verifying the trusted device'"'"'s pairing to the client'"'"'s browser comprises actions of:

transmitting an animation over the first secure connection to the client'"'"'s browser, wherein upon receipt of the animation by the client'"'"'s browser the animation is displayed to the user via a user interface of the client;

upon the user'"'"'s entry of animation control commands into a user interface of the trusted device, receiving the entered control commands over the second secure connection from the trusted device;

updating the animation based on the received control commands;

transmitting the updated animation over the first secure connection to the client'"'"'s browser, wherein upon receipt of the updated animation by the client'"'"'s browser the updated animation is displayed to the user via the user interface of the client; and

upon the user'"'"'s visual comparison of the entered control commands to the displayed updated animation, and upon the user'"'"'s subsequent entry of their comparison result into the user interface of the trusted device, receiving a comparison result message over the second secure connection from the trusted device, wherein said message specifies whether or not the entered control commands match the displayed updated animation.

16. The process of claim 10, wherein the server comprises a user account and either web pages, information services, or web pages and information services, the trusted device comprises a device identification (ID) code which has been pre-registered in the user account, and the process action of facilitating the user'"'"'s remote login over the second secure connection to the server using the trusted device comprises actions of:

transmitting a login prompt message over the second secure connection to the trusted device, wherein said message asks the user to enter their login credentials, and upon receipt of said message by the trusted device said message is displayed to the user via a user interface of the trusted device;

upon the user'"'"'s entry of their login credentials into the user interface of the trusted device,

receiving the entered login credentials and device ID code over the second secure connection from the trusted device, and

authenticating the received login credentials and device ID code against information in the user account;

whenever the received login credentials and device ID code are positively authenticated, establishing a login session with the client'"'"'s browser and allowing the browser to access the web pages and information services on the server that are specifically sanctioned by the user account; and

whenever the received login credentials and device ID code are not positively authenticated, preventing access to the web pages and information services on the server.

17. The process of claim 16, wherein the process action of establishing a login session with the client'"'"'s browser and allowing the browser to access the web pages and information services on the server that are specifically sanctioned by the user account comprises an action of verifying all data writes to the server which are initiated by the client'"'"'s browser, said verification comprising actions of:

upon receiving a data write request over the first secure connection from the client'"'"'s browser, transmitting a message over the second secure connection to the trusted device, said message requesting that the user explicitly approve the data write via the user interface of the trusted device; and

upon the user'"'"'s entry of their approval of the data write into the user interface of the trusted device, receiving a data write approval message over the second secure connection from the trusted device and allowing the data write to be completed.

18. The process of claim 16, wherein the process action of establishing a login session with the client'"'"'s browser and allowing the browser to access the web pages and information services on the server that are specifically sanctioned by the user account comprises an action of routinely verifying that the trusted device is still connected to the client, said verification comprising actions of:

routinely pinging the trusted device over the second SSL connection at a prescribed interval; and

whenever a ping response is not received from the trusted device within a prescribed timeframe, closing the login session.

19. The process of claim 16, wherein the process action of establishing a login session with the client'"'"'s browser and allowing the browser to access the web pages and information services on the server that are specifically sanctioned by the user account comprises an action of verifying each suspect action on the server which is initiated by the client'"'"'s browser, said verification comprising actions of:

upon receiving a request to perform a suspect action over the first secure connection from the client'"'"'s browser,

transmitting a first human interactive proof (HIP) over the first secure connection to the client'"'"'s browser, wherein upon receipt of said HIP by the client'"'"'s browser said HIP is displayed to the user via a user interface of the client, and

transmitting a second HIP over the second secure connection to the trusted device, wherein upon receipt of said HIP by the trusted device said HIP is displayed to the user via the user interface of the trusted device;

upon the user'"'"'s entry of an appropriate response to the first HIP into the user interface of the client, receiving said first HIP response over the first secure connection from the client'"'"'s browser;

upon the user'"'"'s entry of an appropriate response to the second HIP into the user interface of the trusted device, receiving said second HIP response over the second secure connection from the trusted device; and

whenever both the first HIP response and second HIP response are correct, allowing the suspect action to be completed.

20. A computer-implemented process for allowing a user working on a client computer comprising a web browser to remotely login to a server over a computer network, comprising using the client to perform the process actions of:

establishing a first secure connection between the client and the server, said establishment comprising actions of,

receiving a digital certificate which identifies the server and specifies a public key for the server,

using the digital certificate to verify the authenticity of the server, and

whenever the server is determined to be unauthentic, disabling the first secure connection;

prompting the user to choose between a plurality of different methods for remotely logging into the server via a user interface of the client; and

whenever the user chooses to remotely login to the server using a trusted device which is in the user'"'"'s control, wherein the trusted device communicates with the client via a communication channel there-between other than said network,

pairing the client'"'"'s browser to the trusted device,

facilitating the establishment of a second secure connection between the trusted device and the server through the client, wherein the second secure connection is tunneled within the first secure connection, said facilitation comprising actions of,

transmitting the digital certificate over the communication channel to the trusted device,

upon the trusted device using the digital certificate to verify the authenticity of the server and the trusted device subsequently generating a random number-based second session key which the trusted device encrypts with the public key, receiving a server authentication result message over the communication channel from the trusted device, said message comprising the encrypted second session key,

whenever said message specifies that the server was determined to be unauthentic, disabling the second secure connection, and

whenever said message specifies that the server was determined to be authentic, transmitting the encrypted second session key over the first secure connection to the server, and

verifying the trusted device'"'"'s pairing to the client'"'"'s browser, said verification comprising actions of,

receiving a first random number over the first secure connection from the server,

displaying the first random number to the user via the user interface of the client along with a prompt for the user to visually compare said displayed number to a second random number which is displayed to the user via a user interface of the trusted device, and

upon the user'"'"'s entry into the user interface of the client of their comparison result,

transmitting a comparison result message over the first secure connection to the server, and

transmitting said message over the communication channel to the trusted device, wherein said message specifies whether or not the first random number matches the second random number, and upon receipt of said message by the trusted device said message is displayed to the user via the user interface of the trusted device.