Computer-implemented method for mobile authentication and corresponding computer system

• US 9,705,868 B2
• Filed: 12/29/2015
• Issued: 07/11/2017
• Est. Priority Date: 10/06/2011
• Status: Active Grant

• Current Assignee: SAP SE
• Original Assignee: SAP SE
• Inventors: Thun, Philipp
• Primary Examiner(s): Dinh, Minh
• Application Number:
  US14/983,134
• Publication Number:
  US 20160134615A1
• Time in Patent Office: 560 Days
• Field of Search: None
• CPC Class Codes: G06F 21/42 using separate channels for security data
• CPC Class Codes: G06F 21/43 wireless channels
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications

Abstract

In one embodiment of the present invention a computerized method includes receiving at a personal-mobile device a first communication, which includes information for requesting user verification for logging into an account of a user, via a computing device. The account is with a service provided by an application server. The method includes starting a personal-authentication application on the personal-mobile device in response to receiving the first communication, and receiving in the personal-authentication application a user verification for confirming logging into the account. The method includes logging into the account via the computing device based on receipt of the user verification. Embodiments of the present invention provide enhanced security for logging into an account that a user may have with a service by providing that a personal-mobile device, such as a mobile telephone, which is personal to a user, is configured as a security token for login to the account.

Claims

1. A non-transitory computer-readable medium storing a program executable by one or more processors of a first computing device, the program comprising sets of instructions for:

receiving, by the first computing device, from a second computing device a login request to log into an account associated with a service hosted on the first computing device;

sending from the first computing device to a third computing device an authentication request to authenticate a user associated with the account;

receiving, by the first computing device, from the third computing device authentication information for logging into the account associated with the service, wherein the authentication information is based on a first information the third computing device receives from a personal smart card and a second information the third computing device receives from a mobile computing device, the first and second information configured for authenticating the user associated with the account; and

logging into the account associated with the service based on the authentication information in order to allow the user to access the account from the second computing device.

2. The non-transitory computer-readable medium of claim 1, wherein the authentication information is further based on a user verification for confirming logging into the account associated with the service.

3. The non-transitory computer-readable medium of claim 1, wherein the information the third computing device receives from the personal smart card comprises a unique identifier for confirming logging into the account associated with the service.

4. The non-transitory computer-readable medium of claim 3, wherein the third computing device is a personal-identity server configured to verify an identity of the user associated with the account as authentic when the unique identifier matches a credential in a person-identity account stores on the personal-identity server.

5. The non-transitory computer-readable medium of claim 1, wherein the authentication information comprises a login credential for logging into the account.

6. The non-transitory computer-readable medium of claim 1, wherein the third computing device receives the authentication information from the person smart card through a messaging service server.

7. A first computing device comprising:

one or more processors;

a non-transitory computer-readable medium storing a program executable by the one or more processors, the program comprising sets of instructions for;

receiving, by the first computing device, from a second computing device a login request to log into an account associated with a service hosted on the first computing device;

sending from the first computing device to a third computing device an authentication request to authenticate a user associated with the account;

receiving, by the first computing device, from the third computing device authentication information for logging into the account associated with the service, wherein the authentication information is based on a first information the third computing device receives from a personal smart card and a second information the third computing device receives from a mobile computing device, the first and second information configured for authenticating the user associated with the account; and

logging into the account associated with the service based on the authentication information in order to allow the user to access the account from the second computing device.

8. The system of claim 7, wherein the authentication information is further based on a user verification for confirming logging into the account associated with the service.

9. The system of claim 7, wherein the information the third computing device receives from the personal smart card comprises a unique identifier for confirming logging into the account associated with the service.

10. The system of claim 9, wherein the third computing device is a personal-identity server configured to verify an identity of the user associated with the account as authentic when the unique identifier matches a credential in a person-identity account stores on the personal-identity server.

11. The system of claim 7, wherein the authentication information comprises a login credential for logging into the account.

12. The system of claim 7, wherein the third computing device receives the authentication information from the person smart card through a messaging service server.

13. A method comprising:

receiving, by a first computing device, from a second computing device a login request to log into an account associated with a service hosted on the first computing device;

sending from the first computing device to a third computing device an authentication request to authenticate a user associated with the account;

receiving, by the first computing device, from the third computing device authentication information for logging into the account associated with the service, wherein the authentication information is based on a first information the third computing device receives from a personal smart card and a second information the third computing device receives from a mobile computing device, the first and second information configured for authenticating the user associated with the account; and

logging into the account associated with the service based on the authentication information in order to allow the user to access the account from the second computing device.

14. The method of claim 13, wherein the authentication information is further based on a user verification for confirming logging into the account associated with the service.

15. The method of claim 13, wherein the information the third computing device receives from the personal smart card comprises a unique identifier for confirming logging into the account associated with the service.

16. The method of claim 15, wherein the third computing device is a personal-identity server configured to verify an identity of the user associated with the account as authentic when the unique identifier matches a credential in a person-identity account stores on the personal-identity server.

17. The method of claim 13, wherein the authentication information comprises a login credential for logging into the account.

18. The method of claim 13, wherein the third computing device receives the authentication information from the person smart card through a messaging service server.