Systems and methods for providing authentication and authorization utilizing a personal wireless communication device

• US 8,369,833 B2
• Filed: 03/08/2010
• Issued: 02/05/2013
• Est. Priority Date: 08/06/2002
• Status: Active Grant

• Current Assignee: Boojum Mobile
• Original Assignee: Boojum Mobile
• Inventors: McClain, Fred
• Primary Examiner(s): MITCHELL, NATHAN A
• Application Number:
  US12/719,755
• Publication Number:
  US 20100257357A1
• Time in Patent Office: 1,065 Days
• Field of Search: 455/410, 455/411, 713/1, 713/182
• US Class Current: 455/411
• CPC Class Codes: G06F 21/43 wireless channels
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications

Abstract

An authorization and authentication system utilizing a mobile communication device. The authentication and authorization system enables a trusted server, in conjunction with a user controlled mobile communication device (which has been registered with the trusted site), to authorize a transaction carried out at a transaction management system. An identity of the user is authenticated by a verification that the user is in possession of the mobile communication device. In this way, the transaction management system is able to effectuate an authorized transaction with confidence that the authorization was from the user and not a third party. In variations, the authentication is a multi-factor authentication, i.e., the user must both possess the mobile communication device and information, e.g., a password.

Claims

1. A method for authenticating a user in a wireless communications system, comprising:

receiving an address of a wireless communication device at a trusted server, wherein the address identifies the wireless communication device in a communications network;

locating the address of the wireless communication device among a plurality of addresses in a database, wherein the user is associated with the address in the database;

establishing, in response to the locating the address, a wireless communication link with the wireless communication device;

receiving identifying information from the wireless communication device over a communication path including the wireless communication link, wherein the identifying information is produced, at least in part, from shared information stored in a user programmable memory of the wireless communication device and the shared information includes a shared secret generated via a cryptographic key exchange between the wireless communication device and the trusted server; and

authenticating the user in response to the identifying information.

2. The method of claim 1 wherein the cryptographic key exchange includes a Diffie-Hellman key exchange.

3. The method of claim 1 further comprising sending a digital signature of a quantity incorporating at least a portion of the user information and the shared secret, wherein the digital signature is disposed for comparison to a validation signature generated at the wireless communications device so as to initialize the communications device for use as an authentication device.

4. The method of claim 3 further comprising:

receiving at the wireless communications device, from the trusted server, a digital signature of a quantity incorporating at least a portion of the user information and the shared secret;

digitally signing a quantity incorporating at least a portion of the user information and the shared secret stored in the user programmable memory so as to generate a validation signature;

comparing the digital signature with the validation signature; and

aborting, in the event the digital signature and the validation signature are different, the initialization of the wireless communication device for use as an authentication device.

5. The method of claim 1, wherein the shared information comprises a representation of a password, wherein the password was provided to the trusted server during an initialization of the wireless communication device.

6. The method of claim 5, wherein the identifying information comprises a digital signature of a combination of the password and a username, wherein the username is associated with the user.

7. The method of claim 5, wherein the shared information comprises a shared secret key produced at both the wireless communication device and the trusted server.

8. The method of claim 7, wherein the identifying information comprises a digital signature of a combination of information, wherein the information includes the shared secret and a timestamp.

9. The method of claim 1, wherein the identifying information is not stored at either the wireless communication device or the trusted server.

10. The method of claim 1, wherein the receiving the address comprises receiving the address of the wireless communication device from a transaction management system, wherein the address is sent from the transaction management system in response to the user requesting access to a resource controlled by the transaction management system, wherein the authenticating comprises sending an authentication to the transaction management system.

11. The method of claim 1, wherein the wireless communication device is a device selected from the group consisting of a cellular telephone and a personal digital assistant (PDA).

12. The method of claim 1, wherein the authenticating comprises sending a communication to a transaction management system indicating the user is authenticated.

13. The method of claim 1 further comprising:

receiving a request from the user to change information associated with the user within a database of the trusted server; and

changing the information associated with the user in response to the receiving the request, wherein the authenticating the user in response to the identifying information comprises comparing verification information at the trusted server with the identifying information and wherein the verification information is changed as a result of the changing the information associated with the user.

14. A system for authenticating a user in a wireless communications system, comprising:

a trusted computer server disposed for communicating with a plurality of wireless communications devices in a communications network including one or more wireless communications links, including;

one or more processors; and

one or more memories,

said one or more memories including instructions for execution on the one or more processors to;

receive an address of a first wireless communication device of the plurality of wireless communications devices, wherein the address identifies the wireless communication device in a communications network;

locate the address of the wireless communication device among a plurality of addresses in a database, wherein the user is associated with the address in the database;

initiate establishment, in response to the locating the address, a wireless communication link with the wireless communication device;

receive identifying information from the wireless communication device over a communication path including the one or more wireless communication links,

wherein the identifying information is produced, at least in part, from shared information stored in a user programmable memory of the wireless communication device and the shared information includes a shared secret generated via a cryptographic key exchange between the wireless communication device and the trusted server; and

authenticate the user in response to the identifying information.

15. The system of claim 14 wherein the instructions include instructions to provide the cryptographic key exchange with the wireless communications device as a Diffie-Hellman key exchange.

16. The system of claim 14 further including instructions to send a digital signature of a quantity incorporating at least a portion of the user information and the shared secret, wherein the digital signature is disposed for comparison to a validation signature generated at the wireless communications device so as to initialize the communications device for use as an authentication device.

17. The system of claim 14, wherein the shared information comprises a representation of a password, wherein the password was provided to the trusted server during an initialization of the wireless communication device.

18. The system of claim 17, wherein the shared information comprises a digital signature of a combination of the password and a username, wherein the username is associated with the user.

19. The system of claim 17, wherein the shared information comprises a Shared secret key produced at both the wireless communication device and the trusted server.

20. The system of claim 19, wherein the identifying information comprises a digital signature of a combination of information, wherein the information includes the shared secret and a timestamp.

21. The system of claim 14, wherein the identifying information is not stored at the trusted server.

22. The system of claim 14, wherein the instructions to receive the address include instructions to receive the address of the wireless communication device from a transaction management system, wherein the address is sent from the transaction management system in response to the user requesting access to a resource controlled by the transaction management system, and wherein the instructions for authentication comprise instructions to initiate sending an authentication to the transaction management system.