System and methods for authorizing operations on a service using trusted devices

• US 9,300,674 B2
• Filed: 05/04/2015
• Issued: 03/29/2016
• Est. Priority Date: 07/23/2013
• Status: Active Grant

• Current Assignee: Kaspersky Lab ZAO
• Original Assignee: Lab A.O. Kaspersky
• Inventors: Borovikov, Nikolay V.
• Primary Examiner(s): Hailu, Teshome
• Assistant Examiner(s): LE, THANH H
• Application Number:
  US14/702,896
• Publication Number:
  US 20150237054A1
• Time in Patent Office: 330 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/313 using a call-back technique via a telephone network
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/42 using separate channels for security data
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

Disclosed are systems and methods for ensuring confidentiality of information of a user of a service. One example method includes receiving a request to perform an operation for a service; selecting, based on a database of trusted devices, a trusted device for authorizing the operation of the service; establishing a secure connection with the trusted device; sending to the trusted device via the secure connection a request to enter confidential information on the trusted device to authorize the operation of the service; receiving the confidential information from the trusted device; and determining whether to authorize the operation of the service based on the confidential information.

Claims

1. A method for ensuring confidentiality of information used during authentication and authorization operations, the method comprising:

receiving a request from a first user to perform an operation for a service;

identifying a second user responsible for authorizing the operation of the service, the second user being different from the first user;

selecting, based on a database of trusted devices, a trusted device associated with the second user for authorizing the operation of the service;

establishing a secure connection with the trusted device;

sending to the trusted device via the secure connection a request to the second user to enter confidential information on the trusted device for authorizing to authorize the operation of the service;

receiving the confidential information from the trusted device; and

determining whether to authorize the operation of the service based on the confidential information.

2. The method of claim 1, wherein the request is received from an unsecure device via an unsecure connection, and the operation for the service is performed on the unsecure device associated with the first user.

3. The method of claim 1, wherein the trusted device is configured to use a hacking identification module to prevent authorized opening, theft, or hacking of software installed on the trusted device.

4. The method of claim 1, wherein the confidential information comprises a password to an account record, biometric data, or a PIN code.

5. The method of claim 1, wherein the trusted device comprises a notebook, a netbook, a smartphone, a mobile telephone, a communicator, or a thin client.

6. A system for ensuring confidentiality of information used during authentication and authorization operations, the system comprising:

a processor configured to;

receive a request from a first user to perform an operation for a service;

identify a second user responsible for authorizing the operation of the service, the second user being different from the first user;

select, based on a database of trusted devices, a trusted device associated with the second user for authorizing the operation of the service;

establish a secure connection with the trusted device;

send to the trusted device via the secure connection a request to the second user to enter confidential information on the trusted device for authorizing the operation of the service;

receive the confidential information from the trusted device; and

determine whether to authorize the operation of the service based on the confidential information.

7. The system of claim 6, wherein the request is received from an unsecure device via an unsecure connection, and the operation for the service is performed on the unsecure device associated with the first user.

8. The system of claim 6, wherein the trusted device is configured to use a hacking identification module to prevent authorized opening, theft, or hacking of software installed on the trusted device.

9. The system of claim 6, wherein the confidential information comprises a password to an account record, biometric data, or a PIN code.

10. The system of claim 6, wherein the trusted device comprises a notebook, a netbook, a smartphone, a mobile telephone, a communicator, or a thin client.

11. A non-transitory computer-readable storage medium having a computer program product stored thereon, the computer-readable storage medium comprising computer-executable instructions for ensuring confidentiality of information used during authentication and authorization operations, the instructions comprising:

receiving a request from a first user to perform an operation for a service;

identifying a second user responsible for authorizing the operation of the service, the second user being different from the first user;

selecting, based on a database of trusted devices, a trusted device associated with the second user for authorizing the operation of the service;

establishing a secure connection with the trusted device;

sending to the trusted device via the secure connection a request to the second user to enter confidential information on the trusted device for authorizing to of the operation of the service;

receiving the confidential information from the trusted device; and

determining whether to authorize the operation of the service based on the confidential information.

12. The computer-readable storage medium of claim 11, wherein the request is received from an unsecure device via an unsecure connection, and the operation for the service is performed on the unsecure device associated with the first user.

13. The computer-readable storage medium of claim 11, wherein the trusted device is configured to use a hacking identification module to prevent authorized opening, theft, or hacking of software installed on the selected trusted device.

14. The computer-readable storage medium of claim 11, wherein the instructions further comprises identifying another trusted device in the database of trusted devices associated with the second user for authorizing the operation of the service.

15. The computer-readable storage medium of claim 11, wherein the confidential information comprises a password to an account record, biometric data, or a PIN code, and the trusted device comprises a notebook, a netbook, a smartphone, a mobile telephone, a communicator, or a thin client.