System and method for authentication of users in a secure computer system

• US 8,683,571 B2
• Filed: 07/24/2012
• Issued: 03/25/2014
• Est. Priority Date: 07/31/2007
• Status: Active Grant

• Current Assignee: KeyCorp
• Original Assignee: KeyCorp
• Inventors: Zapata, Onesimo, Zielinski, Susan E., Flannery, Deana M.
• Primary Examiner(s): Dada, Beemnet
• Assistant Examiner(s): BEHESHTI SHIRAZI, SAYED ARESH
• Application Number:
  US13/556,939
• Publication Number:
  US 20120291113A1
• Time in Patent Office: 609 Days
• Field of Search: 380/255, 380/259, 380/269, 726 1- 8, 726/10, 726/14, 726 17- 21, 726/26, 726/27, 726/28, 713/1, 713/150, 713/152, 713/153, 713/154, 713/155, 713/156, 713/159, 713/160, 713/161, 713/162, 713165-169
• US Class Current: 726/9
• CPC Class Codes: G06F 21/43 wireless channels
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

A system and method for authenticating a user in a secure computer system. A client computer transmits a request for a sign-on page, the secure computer system responds by transmitting a prompt for a first user identifier, and the client computer transmits a request including a first identifier, a second identifier stored in an object stored at the client computer and a plurality of request header attributes. A server module authenticates the first and second user identifiers, and compares the transmitted plurality of request header attributes with request header attributes stored at the computer system and associated with the first and second user identifiers. If the first and second user identifiers are authenticated, and if a predetermined number of transmitted request header attributes match stored request header attributes, the server software module transmits a success message, and the user is allowed to access the secure computer system.

Claims

1. A method of authenticating a user in a secure computer system, the method comprising:

in an enrollment session between the secure computer system and a client computer of a user,

storing, using hardware processor, a first user identifier on a computer-readable storage medium of the secure computer system, and associating the first user identifier with the user,

storing a second user identifier, unique to the user and selected by the secure computer system and that is not related to the client computer, on the computer-readable storage medium of the secure computer system, and associating the second user identifier with the user,

creating a persistent object containing the second user identifier, encrypting the persistent object and storing the encrypted persistent object at the client computer, and

storing request header attributes from the client computer received during the enrollment session on the computer-readable storage medium of the secure computer system, and associating the request header attributes received during the enrollment process with the first and second user identifiers; and

in a subsequent sign-on session between the secure computer system and the client computer,

receiving from the client computer by the secure computer system a request for a sign-on page;

transmitting from the secure computer system to the client computer a prompt for the first user identifier;

in response to said prompt, receiving from the client computer by the secure computer system a request including

the first user identifier,

the second user identifier stored in the object stored at the client computer, and

a plurality of current request header attributes;

authenticating at the secure computer system the first user identifier;

authenticating at the secure computer system the second user identifier;

comparing the transmitted plurality of current request header attributes with the plurality of request header attributes received during the enrollment session, stored at the computer system and associated with the first user identifier; and

if the first and second user identifiers are authenticated, and if at least some of the transmitted request header attributes correspond to the stored request header attributes, transmitting a success message by the secure computer system to the client computer to be viewed by the user and allowing the user into the secure computer system, wherein the secure computer system does not modify the persistent object created in the enrollment session or create a new persistent object.

2. The method of claim 1, wherein comparing the transmitted plurality of request header attributes with a plurality of stored request header attributes includes of determining whether a match exists therebetween of a predetermined number of said transmitted and said stored header attributes fewer than all of said transmitted and stored request header attributes.

3. The method of claim 1, wherein the comparing the transmitted plurality of request header attributes with a plurality of stored request header attributes includes

assigning a weighted value to each of said request header attributes;

and

determining whether a match exists between said transmitted header attributes and said stored request header attributes such that a sum of weighted values of matching transmitted and stored request header attributes equals or exceeds a predetermined value.

4. The method of claim 3, wherein determining whether a match exists includes sending an error message to the client computer to be viewed by the user instead of the success message in the event that the sum of weighted values of matching transmitted and stored request header attributes is less than the predetermined value.

5. The method of claim 4, wherein sending an error message further includes sending a message to the client computer to be viewed by the user that the user must enroll in the computer system.

6. The method of claim 1, wherein comparing the transmitted plurality of current request header attributes with the plurality of request header attributes received during the enrollment session includes comparing one or more of a transmitted locale request header attribute to a stored locale request header attribute, a transmitted user-agent request header attribute to a stored user-agent request header attribute, a transmitted accept-encoding request header attribute to a stored accept-encoding request header attribute, a transmitted IP address request header attribute to a stored IP address request header attribute, a transmitted character-encoding request header attribute to a stored character-encoding request header attribute, a transmitted referrer request header attribute to a stored referrer request header attribute, a transmitted accept request header attribute to a stored accept request header attribute, and a transmitted remote host request header attribute to a stored remote host request header attribute.

7. The method of claim 1 wherein, receiving from the client computer by the secure computer system a request including the second identifier includes receiving a plurality of second user identifiers stored in said object, each of said second user identifiers being associated with a different user.

8. The method of claim 7, wherein validating at the computer system the second user identifier includes sorting said plurality of second user identifiers to find a match between one of said plurality of second identifiers and said first identifier.

9. The method of claim 1, wherein receiving from the client computer by the secure computer system a request includes receiving the second user identifier stored in a local shared object stored on said client computer.

10. The method of claim 9, wherein receiving from the client computer by the secure computer system a request including the second user identifier includes receiving the second user identifier and an encrypted serial number associated with said user.

11. A method of enrolling a user in a secure computer system, the method comprising:

receiving, using hardware processor, from a client computer of a user by the secure computer system a request for an enrollment page, the request including a request header containing a plurality of device attributes specific to said client computer;

transmitting from the secure computer system to the client computer a prompt for a user identifier;

receiving by the secure computer system from the client computer the user identifier;

validating the user identifier;

authenticating the user identifier;

transmitting from the secure computer system to the client computer a request for a user identification and password;

receiving from the client computer and authenticating the user identification and password;

storing the user identification and password in a computer-readable storage medium associated with the secure computer system in a file containing the device attributes and user identifier;

creating a serial number and saving the serial number in the file;

encrypting the serial number;

creating a browser cookie containing the encrypted serial number and storing the browser cookie on the client computer;

creating a local shared object containing the encrypted serial number and storing the local shared object on the client computer;

comparing the transmitted plurality of current request header attributes with the plurality of request header attributes received during the enrollment session, stored at the computer system and associated with the first user identifier; and

if the first and second user identifiers are authenticated, and if at least some of the transmitted request header attributes correspond to the stored request header attributes, transmitting a success message by the secure computer system to the client computer to be viewed by the user and allowing the user into the secure computer system, wherein the secure computer system does not modify the persistent object created in the enrollment session or create a new persistent object.

12. The method of claim 11, further comprising, prior to creating a serial number, querying the user to determine if the user desires to register the user'"'"'s computer.

13. The method of claim 12, further comprising, subsequent to storing the local shared object on the client computer, transmitting from the computer system to the client computer a page notifying the user that the user'"'"'s computer has been registered.

14. The method of claim 11, wherein creating a browser cookie includes appending a date and time stamp to the serial number and encrypting the serial number and appended date and time stamp.

15. The method of claim 11, wherein creating a local shared object includes appending a date and time stamp to the serial number and encrypting the serial number and appended date and time stamp.

16. A system for authenticating a user in a secure computer system, the system comprising:

a server having at least one hardware processor, the server associated with the secure computer system and having a module configured to establish communication over a network with a client computer operable by a user, the server having a computer-readable storage medium;

the module being configured to transmit from the server to the client computer a prompt for a first user identifier;

the module being configured to receive from the client software module, in response to the prompt, the first user identifier, a second user identifier stored in an encrypted persistent object stored in the client computer, and a plurality of request header attributes;

the module being configured to validate the first user identifier and the second user identifier, and compare the transmitted plurality of request header attributes to a plurality of request header attributes in the computer-readable storage medium and associated with the first identifier;

the module being configured such that, if the first and second user identifiers are validated by the module, and if the transmitted request header attributes correspond to the stored request header attributes, the module allows the client computer access to the secure computer system.

17. The system of claim 16, wherein the second client identifier is a serial number provided by the module.

18. The system of claim 16, wherein the module is configured to assign a weighted value to each of the request header attributes, and determine whether a match exists between the transmitted header attributes and the stored request header attributes such that a sum of weighted values of matching transmitted and stored request header attributes equals or exceeds a predetermined value.

19. The system of claim 18, wherein the server software module is configured to send an error message to the client computer to be viewed by the user in the event that the sum of weighted values of matching transmitted and stored request header attributes is less than the predetermined value.

20. The system of claim 19, wherein the server is configured to transmit, along with the error message, a message to the client computer to be viewed by the user that the user must enroll in the computer system.

21. The system of claim 16, wherein the module is configured to compare at least one of a transmitted locale request header attribute to a stored locale request header attribute, a user-agent request header attribute to a stored user-agent request header attribute, a transmitted accept-encoding request header attribute to a stored accept-encoding request header attribute, a transmitted IP address request header attribute to a stored IP address request header attribute, a transmitted character-encoding request header attribute to a stored character-encoding request header attribute, a transmitted referrer request header attribute to a stored referrer request header attribute, a transmitted accept request header attribute to a stored accept request header attribute, and a transmitted remote host request header attribute to a stored remote host request header attribute.

22. The system of claim 16, wherein the module is configured to receive a plurality of second user identifiers stored in the encrypted persistent object, each of said second user identifiers being associated with a different user.

23. The system of claim 22, wherein the server software module is configured to sort the plurality of second user identifiers to find a match between one of said plurality of second identifiers and said first identifier.

24. The system of claim 16, wherein the module is configured to cause the client computer to create a local shared object on the client computer;

and the module is configured to store a second user identifier in the local shared object.

25. The system of claim 24, wherein the module is configured to cause the client computer to transmit the second user identifier stored in the local shared object to the server in response to the prompt.

26. The system of claim 25, wherein the module is configured to cause the client computer to transmit an encrypted serial number associated with said user to the server.

27. The system of claim 26, wherein the module is configured to cause the client computer to transmit an encrypted serial number and date-time stamp to the server.

28. The system of claim 27, wherein the serial number and date-time stamp are hashed, then encrypted.

29. A system for authenticating a client computer of a user in a secure computer system, the system comprising:

a server having at least one hardware processor, the server associated with the secure computer system in communication with the client computer and having a computer-readable storage medium;

the server having a module configured to transmit from the server over a network during a sign-on session between the secure computer system and the client computer

in response to a request for a sign-on page

a prompt for a first user identifier;

the module configured to receive from the client computer over the network in response to the prompt, a request including

the first user identifier,

a second user identifier stored in an object stored at the client computer, and

a plurality of request header attributes; and

the module configured to authenticate the first user identifier and the second user identifier and compare the plurality of request header attributes transmitted from the client computer with a plurality of request header attributes in the computer-readable storage medium and associated with the first identifier;

whereby, if the first and second user identifiers are authenticated the server software module, and if at least some of the transmitted request header attributes correspond to the stored request header attributes, the server software module is configured to allow the client computer access to the secure computer system, wherein the secure computer system does not modify the persistent object created in the enrollment session or create a new persistent object.

30. A system of authenticating a user in a secure computer system, the system comprising:

a server having at least one hardware processor, the server associated with the secure computer system having a server software module configured to communicate over a network with a client computer of the user, the server having storage containing information pertaining to the user;

the server software module being configured to receive from the client computer during an enrollment session a request for an enrollment page, the request including a request header containing a plurality of device attributes specific to the client computer;

the server software module configured to transmit to the client computer a prompt for a user identifier, receive the user identifier from the client computer,

validate the user identifier, authenticate the user identifier, transmit from the server a request for a user identification and password, validate the user identification and password received from the client computer, and store the user identification and password on the computer-readable storage medium;

the module configured to receive from the client computer a request to register the client computer;

the module configured such that, in response to the request to register, the module creates a serial number unique to the user and saves the serial number and the request attributes on the computer-readable storage medium associated with the user identification and password, stores the serial number on the client computer, and allows the client computer access to the secure computer system; and

the module being configured to, in a subsequent sign-on session;

receive from the client computer a request for a sign-on page;

transmit from the computer system to the client computer a prompt for the first user identifier;

in response to said prompt, receive from the client computer a request including

the first user identifier, the serial number stored in at least one of a browser cookie and a local shared object stored at the client computer and a plurality of current request header attributes;

authenticate at the secure computer system the first user identifier;

authenticate at the secure computer system the second user identifier;

compare the transmitted plurality of current request header attributes with the plurality of request header attributes stored at the secure computer system and associated with the first and second identifiers; and

the secure computer system being configured such that, if the first and second user identifiers are validated, and if the transmitted request header attributes correspond to the stored request header attributes, the user computer is allowed to access the secure computer system.

31. A method of authenticating a user in a secure computer system, the method comprising:

receiving from a client computer of a user by the secure computer system over a network a request for an enrollment page, the request including a request header containing a plurality of device attributes specific to said client computer;

transmitting from the secure computer system to the client computer a prompt for a user identifier;

the secure computer system receiving from the client computer the user identifier,

validating the user identifier, authenticating the user identifier, and transmitting to the client computer a request for a user identification and password;

the secure computer system receiving from the client computer a user identification and password, validating the user identification and password and storing the user identification and password in computer-readable storage medium associated therewith;

the secure computer system receiving from the client computer a request to register the client computer;

the secure computer system creating a serial number unique to the user and storing the serial number and request header in the computer-readable storage medium associated with the user identification and password; and

the secure computer system storing the serial number on the client computer;

allowing the user access to the secure computer system; and

in a subsequent sign-on session;

the secure computer system receiving from the client computer a request for a sign-on page;

transmitting from the computer system to the client computer a prompt for the first user identifier;

in response to said prompt, the secure computer system receiving from the client computer a request including

the first user identifier,

the serial number stored in at least one of a browser cookie and a local shared object stored at the client computer and

a plurality of current request header attributes;

authenticating at the secure computer system the first user identifier;

authenticating at the secure computer system the second user identifier;

the secure computer system comparing the transmitted plurality of current request header attributes with the plurality of request header attributes stored at the secure computer system and associated with the first and second identifiers; and

the secure computer system being configured such that, if the first and second user identifiers are validated, and if the transmitted request header attributes correspond to the stored request header attributes, the user computer is allowed to access the secure computer system.

32. The method of claim 31, wherein storing includes the secure computer system creating a browser cookie on the client computer and storing the serial number in the browser cookie.

33. The method of claim 31, wherein storing includes creating a local shared object on the client computer and storing the serial number in the local shared object.

34. The method of claim 31, further comprising:

prior to transmitting from the computer system to the client computer a prompt for a user identifier, transmitting from the computer system to the client computer of the user disclosure material pertaining to services provided by the secure computer system.

35. The method of claim 31, wherein the user identifier is selected from a Social Security number, an ATM number, an ATM PIN and an email address of the user.

36. The method of claim 31, wherein storing the serial number on the user computer includes appending a date and time stamp to the serial number and encrypting the second serial number, date and time stamp string.

37. The method of claim 31, wherein comparing the request header attributes received from the user computer with the request header attributes associated with the serial number in the storage to determine whether a match exists, includes assigning a value to each of the request header attributes matched, and determining that a match exists only if the total values of the matching request header attributes at least meets a predetermined total.

38. The method of claim 37, wherein the predetermined total is less than the total of all of the values.

39. The method of claim 38, wherein the values are numeric values and the predetermined total is a numeric total.

40. The method of claim 31, wherein the user is a banking customer and the secure computer system is a secure banking computer system.