System, design and process for easy to use credentials management for online accounts using out-of-band authentication

• US 9,412,283 B2
• Filed: 12/30/2013
• Issued: 08/09/2016
• Est. Priority Date: 12/31/2012
• Status: Active Grant

• Current Assignee: GCOM IP LLC
• Original Assignee: Piyush Bhatnagar
• Inventors: Bhatnagar, Piyush
• Primary Examiner(s): Okeke, Izunna
• Assistant Examiner(s): Song, Hee
• Application Number:
  US14/143,659
• Publication Number:
  US 20140223175A1
• Time in Patent Office: 953 Days
• US Class Current: 1/1
• CPC Class Codes: G09C 5/00 Ciphering apparatus or methods not provided for in the preceding groups, e.g. involving the concealment or deformation of graphic data such as designs, written or printed messages
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys

Abstract

The invention provides an easy to use credential management mechanism for multi-factor out-of-band multi-channel authentication process to protect a large number of documents without the need to remember all the document passwords. When opened, the secure document application generates a multi-dimensional code. The user scans the multi-dimensional code and validates the secure document application and triggers an out-of-band outbound mechanism. The portable mobile device invokes the authentication server to get authenticated. The authentication server authenticates the user based on shared secret key and is automatically allowed access to the secure document. The process of the invention includes an authentication server, a secure document application to generate an authentication vehicle or an embodiment (i.e. multi-dimensional bar code) and handle incoming requests, secret keys and a portable communication device with a smartphone application.

Claims

1. A method for authentication for accessing an online portal in a system comprising a user, a client processing application, a portable communications device, and an authentication server having a provisioned user database and encrypted payload, wherein the method comprises:

providing a login portal and screen for access by a user, said login portal being in communication with said client processing application;

establishing contact between the client processing application and the authentication server wherein a new authentication session is started;

generating a session identifier at the authentication server, wherein the session identifier is communicated to the client processing application through at least a first communications channel;

creating a multi-dimensional barcode at the client processing application, wherein the barcode has dynamic encryption keys, portal information, session identifier, and a unique key, and wherein the barcode is displayed at the login screen;

holding the client processing application in waiting pending the authentication server notification of session validation;

starting authentication by user entering credential on the portable communications device, wherein the portable communications device validates credential and displays scan option;

using the portable communications device to scan the barcode displayed at the login screen and validate the client processing application;

finding on the portable communications device at least one encrypted user credentials with the encryption key from the barcode;

sending the encrypted credentials and session identifier from the portable communications device to the authentication server via a outbound out-of-band communications channel;

checking in provisioned user database of the authentication server, wherein the session is validated;

sending the encrypted payload to the waiting client processing application;

sending validation result from the authentication server to the portable communication device where the result is displayed;

decrypting the encrypted payload at the client processing application using the encryption keys;

extracting and decrypting the credentials at the client processing application;

using the decrypted credentials to access the online portal.

2. A method according to claim 1 wherein the login portal is provided at the client processing application for receiving information for the user.

3. A method according to claim 1 wherein the login portal and the client processing application for receiving information for the user are contained in a laptop.

4. A method according to claim 1 wherein the login portal and the client processing application for receiving information for the user are contained in a personal computer.

5. A method for authentication in a system comprising a user, a browser extension or plugin, a portable communications device, and an authentication server having a provisioned user database and a encrypted payload, wherein the method comprises:

detecting user intent to login to an online portal using a browser extension or plugin;

establishing contact between the browser extension or plugin and the authentication server wherein a new authentication session is started;

generating a session identifier at the authentication server, wherein the session identifier is communicated to the browser plugin through at least a first communications channel;

creating a multi-dimensional barcode at the browser extension or plugin, wherein the barcode has dynamic encryption keys, portal information, the session identifier, and a unique key, and wherein the barcode is displayed in the browser;

holding the browser in waiting pending authentication server notification of session validation;

starting authentication by user entering credential on the portable communications device, wherein the portable communications device validates the credential and displays scan option;

using the portable communications device to scan the barcode displayed at a login screen and validate the browser extension or plugin;

finding on the portable communications device at least one encrypted user credential with the encryption key from the barcode;

sending the at least one encrypted credential and the session identifier from the portable communications device to the authentication server via a outbound out-of-band communications channel;

checking in provisioned user database of the authentication server, wherein the session is validated;

sending the encrypted payload to the waiting browser extension or plugin;

sending validation result from the authentication server to the portable communication device where the result is displayed;

decrypting the payload at the browser extension or plugin using the encryption keys;

extracting and decrypting the at least one encrypted credential at the browser extension or plugin to obtain at least one decrypted credential;

using the at least one decrypted credential to populate a login form on the login page of the online portal in the browser;

initiating the login to the online portal by sending the login form to the online portal using the browser extension or plugin.