System, design and process for secure documents credentials management using out-of-band authentication
First Claim
1. A method for authentication for accessing a document in a system comprising a user, a first channel document application, a second channel portable communications device application, and an authentication server application having a provisioned user database and encrypted payload, wherein the method comprises:
- providing a login portal for accessing a document by a user, said login portal being in communication with said first channel document application;
establishing contact between the first channel document application and the authentication server application wherein a new authentication session is started;
generating a session identification (“
ID”
) at the authentication server application, wherein the session ID is communicated to the first channel document application through at least a first communications channel;
creating a multi-dimensional barcode at the first channel document application, wherein the barcode has dynamic encryption keys, portal information, session ID, and a unique key, and wherein the barcode is displayed at the login screen;
creating a message at the first channel document application, wherein the message has dynamic encryption keys, portal information, session ID, and a unique key;
holding the first channel document application in waiting pending the authentication server application notification of session validation;
starting authentication by user entering at least one credential on the second channel portable communications device application, wherein the second channel portable communications device application validates at least one credential and displays at least one scan option;
using the second channel portable communications device application to scan the barcode displayed at the login screen and validate the first channel document application;
using the second channel portable communications device application to receive the message from the first channel document application and to validate the first channel document application;
finding on the second channel portable communications device application at least one encrypted user credential;
sending the at least one encrypted user credentials and session ID from the second channel portable communications device application to the authentication server application via an outbound out-of-band communications channel;
checking in provisioned user database of the authentication server application, wherein the new authentication session is validated;
sending the encrypted payload to the first channel document application;
sending validation result from authentication server application to the second channel portable communication device application where the result is displayed;
decrypting the encrypted payload at the first channel document application using the dynamic encryption keys;
extracting and decrypting the credentials at the first channel document application; and
using the decrypted credentials to access the document.
6 Assignments
0 Petitions
Accused Products
Abstract
The invention provides an easy to use credential management mechanism for multi-factor out-of-band multi-channel authentication process to protect a large number of documents without the need to remember all the document passwords. When opened, the secure document application generates a multi-dimensional code. The user scans the multi-dimensional code and validates the secure document application and triggers an out-of-band outbound mechanism. The portable mobile device invoices the authentication server to get authenticated. The authentication server authenticates the user based on shared secret key and is automatically allowed access to the secure document. The process of the invention includes an authentication server, a secure document application to generate an authentication vehicle or an embodiment (i.e. multi-dimensional bar code) and handle incoming requests, secret keys and a portable communication device with a smartphone application.
-
Citations
20 Claims
-
1. A method for authentication for accessing a document in a system comprising a user, a first channel document application, a second channel portable communications device application, and an authentication server application having a provisioned user database and encrypted payload, wherein the method comprises:
-
providing a login portal for accessing a document by a user, said login portal being in communication with said first channel document application; establishing contact between the first channel document application and the authentication server application wherein a new authentication session is started; generating a session identification (“
ID”
) at the authentication server application, wherein the session ID is communicated to the first channel document application through at least a first communications channel;creating a multi-dimensional barcode at the first channel document application, wherein the barcode has dynamic encryption keys, portal information, session ID, and a unique key, and wherein the barcode is displayed at the login screen; creating a message at the first channel document application, wherein the message has dynamic encryption keys, portal information, session ID, and a unique key; holding the first channel document application in waiting pending the authentication server application notification of session validation; starting authentication by user entering at least one credential on the second channel portable communications device application, wherein the second channel portable communications device application validates at least one credential and displays at least one scan option; using the second channel portable communications device application to scan the barcode displayed at the login screen and validate the first channel document application; using the second channel portable communications device application to receive the message from the first channel document application and to validate the first channel document application; finding on the second channel portable communications device application at least one encrypted user credential; sending the at least one encrypted user credentials and session ID from the second channel portable communications device application to the authentication server application via an outbound out-of-band communications channel; checking in provisioned user database of the authentication server application, wherein the new authentication session is validated; sending the encrypted payload to the first channel document application; sending validation result from authentication server application to the second channel portable communication device application where the result is displayed; decrypting the encrypted payload at the first channel document application using the dynamic encryption keys; extracting and decrypting the credentials at the first channel document application; and using the decrypted credentials to access the document. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9)
-
-
10. A method for authentication in a system comprising a user, a secure document application or plugin, a second channel portable communications device application, and an authentication server having a provisioned user database and an encrypted payload, wherein the method comprises:
-
detecting user intent to access an online document; establishing contact between the secure document application or plugin and the authentication server wherein a new authentication session is started; generating a session identification (“
ID”
) at the authentication server, wherein the session ID is communicated to the secure document application or plugin through at least a first communications channel;creating a multi-dimensional barcode at the secure document application or plugin, wherein the barcode has dynamic encryption keys, document identifier, the session ID, and a unique key, and wherein the multi-dimensional barcode is displayed in a browser; holding the secure document application or plugin in waiting pending authentication server notification of session validation; starting authentication by user entering credential on the second channel portable communications device application, wherein the second channel portable communications device application validates the credential and displays scan option; using the second channel portable communications device application to scan the multi-dimensional barcode displayed at login screen and validate the secure document application or plugin; finding on the second channel portable communications device application at least one encrypted user credential with an encryption key from the multi-dimensional barcode; sending the at least one encrypted credentials and the session ID from the second channel portable communications device application to the authentication server via an outbound out-of-band communications channel; checking in provisioned user database of the authentication server, wherein the new authentication session is validated; sending the encrypted payloads to waiting at the secure document application or plugin; sending validation result from the authentication server to the second channel portable communications device application where the result is displayed; decrypting the payloads at the secure document application or plugin using the dynamic encryption keys; extracting and decrypting the at least one user credentials at the secure document application or plugin; using the decrypted at least one user credentials to access the document.
-
-
11. A system of user authentication for accessing a document in a communications network, the system comprising:
-
a first channel document application having programming for communication with a login portal and screen for access by a user; an authentication server device having programming for establishing contact between the first channel document application wherein a new authentication session is started;
programming for generating a session identification (“
ID”
), and programming for communicating a session ID to the first channel document application through at least a first communications channel;wherein the first channel document application includes programming for creating a multi-dimensional barcode for display at the login screen, wherein the multi-dimensional barcode has dynamic encryption keys, document identifier, session ID, and a unique key; and
programming for holding the first channel document application in waiting pending notification of session validation by the authentication server device;wherein the first channel document application includes programming for authentication by receiving user credentials from a second channel portable communications device application, a second channel portable communications device application having programming for authentication, including programming for receiving user credentials and displaying at least one scan option;
programming for scanning the barcode displayed at the login screen;
programming for validating the first channel document application;
programming for finding at least one encrypted user credentials with the dynamic encryption keys from the multi-dimensional barcode; and
programming for sending the at least one encrypted user credentials and session ID to the authentication server via an outbound out-of-band communications channel;wherein the authentication server device further includes programming for checking a provisioned user database and validating the session ID;
programming for sending an encrypted payload to a waiting first channel document application;
programming for sending validation result to the second channel portable communications device application where the result can be displayed;wherein the first channel document application includes programming for decrypting the encrypted payload at the secure document application using the dynamic encryption keys;
programming for extracting and decrypting the at least one encrypted user credentials; and
programming for using the decrypted at least one user credentials to access a document. - View Dependent Claims (12, 13, 14, 15, 16, 17, 18, 20)
-
-
19. A system of user authentication for accessing a document in a communications network, the system comprising:
-
A secure document application having an interface, adapter, and programming for detecting user intent to access an online account and establishing communication between the secure document application and an authentication server device to start a new authentication session; wherein the secure document application includes programming that creates a multi-dimensional barcode containing dynamic encryption keys, document identifier, session identification (“
ID”
), and a unique key and said multi-dimensional barcode is displayed in an interface;
wherein the secure document application holds the document in place pending authentication from the authentication server and after the new authentication session is validated; and
wherein the secure document application includes programming to decrypt a payload from the authentication server and extract the credentials using the decrypted credentials to access the document;a second channel portable communications device application having programming for the process of validating the credentials entered by the user and displaying a scan option for the multi-dimensional barcode to validate the new authentication session; and
programming for finding at least one encrypted user credential with an encryption key from the multi-dimensional barcode and sending the credentials with the session ID to the authentication server; andthe authentication server device having programming for establishing a connection with the secure document application wherein the authentication server includes programming that generates the session ID and receives encrypted credentials from the second channel portable communications device application via an outbound out-of-band communications channel;
programming to check in its provisioned user database for the credentials; and
programming for validation of the new authentication session and sending of the encrypted payload to the secure document application.
-
Specification