System and method for user authentication by means of web-enabled personal trusted device

• US 8,914,866 B2
• Filed: 01/20/2011
• Issued: 12/16/2014
• Est. Priority Date: 01/19/2010
• Status: Expired due to Fees

• Current Assignee: Adjoy, Inc., TOP, Inc.
• Original Assignee: Envlzio Incorporated
• Inventors: Kontsevich, Leonid
• Primary Examiner(s): Lipman, Jacob
• Application Number:
  US13/009,861
• Publication Number:
  US 20120192260A1
• Time in Patent Office: 1,426 Days
• Field of Search: 726/9
• US Class Current: 726/9
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/42 using separate channels for security data
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853

Abstract

A system of token-based user authentication for the purpose of authorizing user access to protected resources, such as web applications, computer systems or computer controlled devices. The system utilizes a personal trusted device (PTD), which is owned and operated by one specific user, to establish secure communication channels that are subsequently used to pass user credentials to authentication service. Association of a PTD with servers controlling access to resources is performed by publishing and capturing unique tokens via sensors embedded in PTD, such as an optical camera.

Claims

1. A token-based user authentication system, comprising:

a processor for a token management service that in operation creates one or more unique tokens that are scannable digital sequences of information relating to items purchased by a user and presented during product purchase check-out by a consumer, an authentication subsystem included in the token management service that requests and receives authentication information from a user'"'"'s Personal Trusted Device (PTD) in response to requests by the user or is read from non-volatile memory of the PTD, the PDT being in communication with a token management service, the PTD in operation capturing tokens received from the management service using an embedded capture device by communication via wireless or wired digital networks, the PTD possessing a unique device identifier (UDID) capable of capturing short digital sequences (tokens) via digital signal processing of optical, audio, or radio-frequency input;

accepting user input needed for user authentication with embedded keyboard, touch sensors, optical sensor, or voice recognition;

transmitting and receiving messages via network connection,

a plurality of Token Presentation Devices coupled to the token management system that allow users to capture tokens with a user'"'"'s mobile device;

a plurality of network-connected Action Servers act on behalf of users and require the users to be identified and authenticated; and

a Network-connected Token Management Service that facilitates token-based authentication by;

generating unique tokens upon requests coming from an Authentication Service on behalf of the Action Servers;

receiving messages from PTDs that contain PTDs'"'"' UDIDs and the tokens captured by PTDs from Token Presentation Devices;

establishing links between said tokens and UDIDs of the PTDs that sent the messages with the tokens;

notifying the Authentication Service about the newly established links,

a processor for an Authentication Service that;

communicates with PTDs and provides authentication of users, and authenticates users, a PTD sending a message with a captured token to the token management service, the token management service notifies the authentication service, the PTD passes user credentials to the authentication service and the authentication service provides notification of a completed authentication, the Authentication service maintaining a database of the user records containing a unique user identifier, UDID'"'"'s of the PTDs owned by the user, user credentials, and user identifiers for Servers, the Authentication Service providing an interface to the Action Servers that allows association of a user identifier on an Action Server using a user record in the database providing an interface to the Action Servers that allows initiation of token-based authentication, notifies an Action Server in the event when token-based authentication previously initiated on behalf of that Action Server has been successfully completed using a combination of the user credentials and the use of PTD associated with a user'"'"'s record.

2. The token-based user authentication system of claim 1, wherein a network-connected Action Server is a computer system serving web applications that require user authentication.

3. The token-based user authentication system of claim 1, wherein a network-connected Action Server is a login subsystem of a computer operating system.

4. The token-based user authentication system of claim 1, wherein a network-connected Action Server is a software program that requires user authentication.

5. The token-based user authentication system of claim 1, wherein a network-connected Action Server is an actuator of a physical process selected from at least one of, operation of locks, switches, alarm systems, industrial equipment, machinery, and other automation systems.

6. The token-based user authentication system of claim 1, wherein a network-connected Action Server controls access to weapon systems.

7. The token-based user authentication system of claim 1, wherein the PTD is selected from at least one of, a mobile phone, tablet PC, Personal Digital Assistant (PDA), and portable media player device.

8. The token-based user authentication system of claim 7, wherein the token is transmitted to the PTD with an embedded camera via an optical channel.

9. The token-based user authentication system of claim 7, wherein the token is transmitted to the PTD with an embedded microphone via audio channel.

10. The token-based user authentication system of claim 7, wherein the token is transmitted to the PTD with an embedded near-field communication device via radio frequency.

11. The token-based user authentication system of claim 8, wherein a Token Presentation Device is a monitor controlled by at least one of, a computer, mobile phone, tablet PC, PDA, portable media player, TV set, point of sale terminal, digital projection system and other display device capable of presenting an optical representation of the token.

12. The token-based user authentication system of claim 8, wherein a Token Presentation Device is a hard copy of an token optical representation.