User authentication management

• US 8,832,806 B2
• Filed: 10/15/2012
• Issued: 09/09/2014
• Est. Priority Date: 10/20/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Ozzie, Raymond E., Ozzie, Jack E., Galvin, Thomas A., Patey, Eric M.
• Primary Examiner(s): Chen, Shin-Hon
• Application Number:
  US13/652,025
• Publication Number:
  US 20130042309A1
• Time in Patent Office: 694 Days
• Field of Search: None
• US Class Current: 726/5
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06F 21/88 Detecting or preventing theft or loss
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: G06Q 20/38215 Use of certificates or encrypted proofs of transaction rights
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

End users of a multi-factor authentication service can utilize an account management service, and third-party website can register to utilize the multi-factor authentication service. Registering a third-party website can comprise the multi-factor authentication service receiving a valid digital identity certificate for the third-party website, and receiving an agreement to terms of use of the multi-factor authentication service for the third-party website. Once received, the multi-factor authentication service can enable the third-party website to utilize the service (e.g., switch the service on, or send an authorization key to the third-party website). Further, registering a user to the multi-factor authentication service can comprise determining availability of service, and providing a location-specific access code. Additionally, registering the user can comprise registering the user'"'"'s mobile device, for example, to provide multi-factor authentication. Also, an Internet-based user account management user interface can be provided that allows a user to view transactions on their account, and an ability to shut off a designated mobile device'"'"'s ability to authenticate.

Claims

1. A method, comprising:

enabling a third-party website to utilize a multi-factor authentication service;

registering a user of the third-party website with the multi-factor authentication service, the registering comprising at least one of;

providing an indication of an availability of the multi-factor authentication service to the user;

providing a short-code to the user;

or

registering a mobile device of the user;

providing a user account revocation service comprising a user interface (UI) that enables the user to revoke user designation of the mobile device for multi-factor authentication; and

providing a user account reporting service comprising a UI that enables the user to access a report, the report indicative of at least one of a domain of a second third-party website initiating the multi-factor authentication service in association with the user or an internet protocol (IP) address of a second user engaging the multi-factor authentication service in association with the user.

2. The method of claim 1, the enabling performed based upon at least one of a digital identity certificate or an acquiescence to terms of use of the multi-factor authentication service.

3. The method of claim 1, the providing an indication performed based upon a locality of the user.

4. The method of claim 1, the providing a short-code performed based upon a locality of the user.

5. The method of claim 1, the report corresponding to one or more transactions.

6. The method of claim 1, the report indicative of both the domain and the IP address.

7. The method of claim 1, the report indicative of at least one of a transaction date or a transaction time.

8. A system, comprising:

one or more processing units; and

memory comprising instructions that when executed by at least some of the one or more processing units, perform a method comprising;

enabling a third-party website to utilize a multi-factor authentication service;

registering a user of the third-party website with the multi-factor authentication service, the registering comprising at least one of;

providing an indication of an availability of the multi-factor authentication service to the user;

providing a short-code to the user;

or

registering a mobile device of the user;

providing a user account revocation service comprising a user interface (UI) that enables the user to revoke user designation of the mobile device for multi-factor authentication; and

providing a user account reporting service comprising a UI that enables the user to access a report, the report indicative of a domain of a second third-party website initiating the multi-factor authentication service in association with the user.

9. The system of claim 8, the enabling performed based upon at least one of a digital identity certificate or an acquiescence to terms of use of the multi-factor authentication service.

10. The system of claim 8, the providing an indication performed based upon a locality of the user.

11. The system of claim 8, the providing a short-code performed based upon a locality of the user.

12. The system of claim 8, the report corresponding to one or more transactions.

13. The system of claim 8, the report indicative of an internet protocol (IP) address of a second user engaging the multi-factor authentication service in association with the user.

14. The system of claim 8, the report indicative of at least one of a transaction date or a transaction time.

15. A computer readable storage medium, excluding signals, comprising instructions that when executed, perform a method, comprising:

enabling a third-party website to utilize a multi-factor authentication service;

registering a user of the third-party website with the multi-factor authentication service, the registering comprising at least one of;

providing an indication of an availability of the multi-factor authentication service to the user;

providing a short-code to the user;

or

registering a mobile device of the user;

providing a user account revocation service comprising a user interface (UI) that enables the user to revoke user designation of the mobile device for multi-factor authentication; and

providing a user account reporting service comprising a UI that enables the user to access a report, the report indicative of an internet protocol (IP) address of a second user engaging the multi-factor authentication service in association with the user.

16. The computer readable storage medium of claim 15, the method comprising displaying a code for the user via the third-party website.

17. The computer readable storage medium of claim 15, the method comprising sending a code to the user via a message to the mobile device of the user.

18. The computer readable storage medium of claim 15, the method comprising receiving a code from the user via the third-party website.

19. The computer readable storage medium of claim 15, the method comprising receiving a code from the user via a message from the mobile device of the user.

20. The computer readable storage medium of claim 15, the report indicative of a domain of a second third-party website initiating the multi-factor authentication service in association with the user.