Two-factor authentication systems and methods

• US 8,578,454 B2
• Filed: 10/25/2012
• Issued: 11/05/2013
• Est. Priority Date: 10/25/2011
• Status: Active Grant

• Current Assignee: Salesforce.com, Inc.
• Original Assignee: Toopher, Inc. (Salesforce.com, Inc.)
• Inventors: Grim, Evan Tyler
• Primary Examiner(s): Chai, Longbit
• Application Number:
  US13/660,976
• Publication Number:
  US 20130104198A1
• Time in Patent Office: 376 Days
• Field of Search: 726/4
• US Class Current: 726/4
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/50 Secure pairing of devices
• CPC Class Codes: H04W 4/023 using mutual or relative location information between multiple location based services [LBS] targets or of distance thresholds

Abstract

Systems and methods for authenticating defined user actions over a computer network. An authentication service receives an authentication request from an authenticating service to perform an action on behalf of a user. The authentication service then sends a permission request to a mobile device associated with the user, asking the user whether or not the action should be allowed. The user sends a permission response via the mobile device to the authentication service, granting or denying the action. The user may automate future similar responses so long as at least one automation criterion is met (e.g., the physical location of the mobile device), eliminating the need to manually provide a response to future permission requests. Information necessary to determine whether the automation criterion is met is stored locally on the mobile device.

Claims

1. A method of authentication/authorization, comprising:

receiving an authentication request from an authenticating service system to verify an action to be performed on behalf of a user based on an authentication/authorization process using at least one mobile device;

sending a permission request to said at least one mobile device associated with said user to grant or deny permission to perform said action, wherein said at least one mobile device is paired with said authenticating service system;

sending a permission response from said at least one mobile device to said authenticating service system, wherein said permission response can be generated manually or automatically;

enabling said user to select a feature to automate said permission response to allow said user to eliminate a need to manually grant or deny any future permission request for said action, wherein said future permission requests meet at least one automation criterion; and

automating said permission response to said future permission requests without prompting said user to grant or deny said future permission requests if said user has selected said feature to automate.

2. The method of claim 1, further comprising prompting said user to grant or deny said future permission requests if said at least one automation criterion is not met or if said user has not selected said feature to automate.

3. The method of claim 1, wherein information determining whether said at least one automation criterion is met is stored on said at least one mobile device.

4. The method of claim 1, wherein said at least one criterion comprises proximity of said at least one mobile device to a geographic location.

5. The method of claim 1, wherein said at least one criterion comprises proximity of said at least one mobile device to one of a plurality of geographic locations.

6. The method of claim 1, wherein said action comprises logging on to a web site of said authenticating service system.

7. The method of claim 1, wherein said action comprises a critical action as defined by said authenticating service system.

8. The method of claim 1, wherein said action comprises a transfer of funds.

9. The method of claim 1, further comprising pairing said at least one mobile device with said authenticating service system.

10. The method of claim 9, wherein said pairing comprises establishing a shared secret between said at least one mobile device and said authenticating service system.

11. The method of claim 10, wherein permission response includes a one-time password.

12. The method of claim 9, wherein said pairing comprises establishing a unique pairing identifier between said at least one mobile device and said authenticating service system, said authentication request being automatically denied if said pairing identifier is not present with said authentication request.

13. The method of claim 1, further comprising pre-seeding said permission response when said at least one automation criterion changes states.

14. The method of claim 1, wherein said permission request comprises a designator of said authenticating service system, an action description, a user name, a terminal description.

15. A system for authentication/authorization, comprising:

at least one processor;

at least one memory element storing instructions for controlling said at least one processor to perform steps comprising;

receiving an authentication/authorization request from an authenticating service system to verify an action to be performed on behalf of a user based on an authentication/authorization process using at least one mobile device;

sending a permission request to said at least one mobile device associated with said user to grant or deny permission to perform said action, wherein said at least one mobile device is paired with said authenticating service system;

sending a permission response from said at least one mobile device to said authenticating service system, wherein said permission response can be generated manually or automatically;

enabling said user to select a feature to automate said permission response to allow said user to eliminate a need to manually grant or deny any future permission request for said action, wherein said future permission requests meet at least one automation criterion; and

automating said permission response to said future permission requests without prompting said user to grant or deny said future permission requests if said user has selected said feature to automate.

16. The system of claim 15, wherein information determining whether said at least one automation criterion is met is stored on said at least one mobile device.

17. A non-transitory computer-readable medium including one or more sequences of instructions which, when executed by one or more processors, causes said one or more processors to perform the steps comprising:

receiving an authentication/authorization request from an authenticating service system to verify an action to be performed on behalf of a user based on an authentication/authorization process using at least one mobile device;

sending a permission request to said at least one mobile device associated with said user to grant or deny permission to perform said action, wherein said at least one mobile device is paired with said authenticating service system;

sending a permission response from said at least one mobile device to said authenticating service system, wherein said permission response can be generated manually or automatically;

enabling said user to select a feature to automate said permission response to allow said user to eliminate a need to manually grant or deny any future permission request for said action, wherein said future permission requests meet at least one automation criterion; and

automating said permission response to said future permission requests without prompting said user to grant or deny said future permission requests if said user has selected said feature to automate.

18. The non-transitory computer-readable medium of claim 17, wherein information determining whether said at least one automation criterion is met is stored on said at least one mobile device.

19. A mobile device for authenticating/authorizing a permission request from an authenticating service system, said mobile device including a processor and operable to perform operations comprising:

receiving a permission request from an authentication service system after an authentication/authorization request has been received by said authentication service system to verify an action to be performed on behalf of a user based on an authentication/authorization process using said mobile device;

presenting information related to said permission request, wherein said mobile device is paired with said authenticating service system;

receiving sensory input from a user to determine a permission response;

sending said permission response from said mobile device to said authentication service terminal, wherein said permission response can be generated manually or automatically; and

receiving sensory input from a user that selects whether to automate a permission response for future permission requests when at least one automation criterion is met, such that future permission responses do not require sensory input from said user to eliminate a need to manually grant or deny any future permission requests for said action,

wherein information necessary to determine whether said at least one automation criterion is met is stored on said mobile device.