System and methods for ensuring confidentiality of information used during authentication and authorization operations

• US 9,059,990 B2
• Filed: 04/18/2014
• Issued: 06/16/2015
• Est. Priority Date: 07/23/2013
• Status: Active Grant

• Current Assignee: Kaspersky Lab ZAO
• Original Assignee: Kaspersky Lab ZAO
• Inventors: Borovikov, Nikolay V.
• Primary Examiner(s): Kim, Jung
• Assistant Examiner(s): Kusyk, Janusz
• Application Number:
  US14/256,357
• Publication Number:
  US 20150033299A1
• Time in Patent Office: 424 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/313 using a call-back technique via a telephone network
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/42 using separate channels for security data
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

Disclosed are systems and methods for ensuring confidentiality of information of a user of a service. One example method includes receiving a request to carry out an operation control procedure for the service; identifying the user of the service; selecting a trusted device associated with the identified user of the service; sending, to the selected trusted device, a request for confidential information of the user, wherein the confidential information is used to carry out the operation control procedure; receiving the confidential information from the selected trusted device; and carrying out the operation control procedure using the received confidential information.

Claims

1. A method for providing confidentiality of information of a user of a service, comprising:

receiving a request to perform an operation control procedure for the service;

identifying the user of the service;

selecting, based on a database of trusted devices, a trusted device associated with the identified user of the service, comprising;

upon detecting two or more trusted devices being associated with the identified user of the service, identifying current malware threats to information security of the detected two or more trusted devices; and

selecting the trusted device to avoid the identified current malware threats based at least on information security software installed on each of the two or more trusted devices and data relating to an operating system of each of the two or more trusted devices;

sending, to the selected trusted device, a request to enter confidential information of the user on the trusted device, wherein the confidential information is used to perform the operation control procedure;

receiving the confidential information from the selected trusted device; and

performing the operation control procedure using the received confidential information.

2. The method of claim 1, wherein the identifying the user of the service is based on data entered by the user of the service on a device that is used to send the request to perform the operation control procedure.

3. The method of claim 1, wherein the confidential information is entered by the user of the service on the trusted device through a protected module of the trusted device or through an application.

4. The method of claim 1, wherein the operation control procedure comprises one or more of an operation of authentication of the user of the service or an authorization procedure for the service.

5. The method of claim 1, wherein the service comprises one or more of an online banking service, an Internet commerce service, a payments service, a remote work service, program commands used at critically important infrastructure facilities, or operations of installing software on devices being controlled.

6. The method of claim 1, wherein the confidential information comprises a password to an account record, biometric data, or a PIN code.

7. The method of claim 1, wherein the trusted device comprises a notebook, a netbook, a smartphone, a mobile telephone, a communicator, or a thin client.

8. The method of claim 1, wherein the trusted device uses a protected channel in an encrypted form for receiving the request for the confidential information and sending the confidential information.

9. The method of claim 1, wherein the database of trusted devices includes one or more of:

characteristics of the trusted devices,

the installed modules for information security of each of the trusted devices, and

the data relating to the operating system of each of the trusted devices.

10. The method of claim 1, wherein identifying the current malware threats to information security of the database of trusted devices is based on a database of current threats to information security.

11. A system for providing confidentiality of information of a user of a service, comprising:

a processor configured to;

receive a request to perform an operation control procedure for the service;

identify the user of the service;

select, based on a database of trusted devices, a trusted device associated with the identified user of the service, comprising;

upon detecting two or more trusted devices being associated with the identified user of the service, identifying current malware threats to information security of the detected two or more trusted devices; and

selecting the trusted device to avoid the identified current malware threats based at least on information security software installed on each of the two or more trusted devices and data relating to an operating system of each of the two or more trusted devices;

send, to the selected trusted device, a request to enter confidential information of the user on the trusted device, wherein the confidential information is used to perform the operation control procedure;

receive the confidential information from the selected trusted device; and

perform the operation control procedure using the received confidential information.

12. The system of claim 11, wherein the identifying the user of the service is based on data entered by the user of the service on a device that is used to send the request to perform the operation control procedure.

13. The system of claim 11, wherein the confidential information is entered by the user of the service on the trusted device through a protected module of the trusted device or through an application.

14. The system of claim 11, wherein the operation control procedure comprises one or more of an operation of authentication of the user of the service or an authorization procedure for the service.

15. The system of claim 11, wherein the service comprises one or more of an online banking service, an Internet commerce service, a payments service, a remote work service, program commands used at critically important infrastructure facilities, or operations of installing software on devices being controlled.

16. The system of claim 11, wherein the confidential information comprises a password to an account record, biometric data, or a PIN code.

17. The system of claim 11, wherein the trusted device comprises a notebook, a netbook, a smartphone, a mobile telephone, a communicator, or a thin client.

18. The system of claim 11, wherein the trusted device uses a protected channel in an encrypted form for receiving the request for the confidential information and sending the confidential information.

19. A computer program product stored on a non-transitory computer-readable storage medium, the computer program product comprising computer-executable instructions for providing confidentiality of information of a user of a service, including instructions for:

receiving a request to perform an operation control procedure for the service;

identifying the user of the service;

selecting, based on a database of trusted devices, a trusted device associated with the identified user of the service, comprising;

upon detecting two or more trusted devices being associated with the identified user of the service, identifying current malware threats to information security of the detected two or more trusted devices; and

selecting the trusted device to avoid the identified current malware threats based at least on information security software installed on each of the two or more trusted devices and data relating to an operating system of each of the two or more trusted devices;

sending, to the selected trusted device, a request to enter confidential information of the user on the trusted device, wherein the confidential information is used to perform the operation control procedure;

receiving the confidential information from the selected trusted device; and

performing the operation control procedure using the received confidential information.

20. The computer program product of claim 19, wherein the identifying the user of the service is based on data entered by the user of the service on a device that is used to send the request to perform the operation control procedure.

21. The computer program product of claim 19, wherein the confidential information is entered by the user of the service on the trusted device through a protected module of the trusted device or through an application.

22. The computer program product of claim 19, wherein the operation control procedure comprises one or more of an operation of authentication of the user of the service or an authorization procedure for the service.

23. The computer program product of claim 19, wherein the confidential information comprises a password to an account record, biometric data, or a PIN code.

24. The computer program product of claim 19, wherein the trusted device uses a protected channel in an encrypted form for receiving the request for the confidential information and sending the confidential information.