System, design and process for easy to use credentials management for accessing online portals using out-of-band authentication

• US 9,742,766 B2
• Filed: 06/24/2016
• Issued: 08/22/2017
• Est. Priority Date: 12/31/2012
• Status: Active Grant

• Current Assignee: GCOM IP LLC
• Original Assignee: Piyush Bhatnagar
• Inventors: Bhatnagar, Piyush
• Primary Examiner(s): Okeke, Izunna
• Assistant Examiner(s): SONG, HEE K
• Application Number:
  US15/192,622
• Publication Number:
  US 20160308678A1
• Time in Patent Office: 424 Days
• CPC Class Codes: G06Q 20/38215 Use of certificates or encrypted proofs of transaction rights
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: G09C 5/00 Ciphering apparatus or methods not provided for in the preceding groups, e.g. involving the concealment or deformation of graphic data such as designs, written or printed messages
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 9/3215 using a plurality of channels network architectures or network communication protocols using different networks H04L63/18
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key

Abstract

The invention provides an easy to use credential management mechanism for multi-factor out-of-band multi-channel authentication process to protect user access to online portals. When opened, the client processing application generates a multi-dimensional code. The user scans the multi-dimensional code and validates the client processing application and triggers an out-of-band outbound mechanism. The portable mobile device invokes the authentication server to get authenticated. The authentication server authenticates the user based on shared secret key and is automatically allowed access to the online portal. The process of the invention includes an authentication server, a client processing application to generate an authentication vehicle or an embodiment (i.e. multi-dimensional bar code) and handle incoming requests, secret keys and a portable communication device with a smartphone application.

Claims

1. A system of user authentication for accessing an online portal in a communications network, the system comprising:

a client processing application having programming for communication with a login portal and screen for access by a user;

a hardware authentication server device having programming for establishing contact between the client processing application and the hardware authentication server device wherein a new authentication session is started;

programming for generating a session identification (“

ID”

), and programming for communicating a session ID to the client processing application through at least a first communications channel;

wherein the client processing application includes programming for creating a multi-dimensional barcode for display at the login screen, wherein the multi-dimensional barcode has dynamic encryption keys, portal information, session ID, and a unique key; and

programming for holding the client processing application in waiting pending notification of session validation by the hardware authentication server device;

wherein the client processing application includes programming for authentication by receiving user credentials from a portable communications device,

a portable communications device application having programming for authentication;

including programming for receiving user credentials and displaying at least one scan option;

programming for scanning the multi-dimensional barcode displayed at the login screen;

programming for validating the client processing application;

programming for finding at least one encrypted user credential with the encryption key from the multi-dimensional barcode; and

programming for sending the at least one encrypted user credential and session ID to the hardware authentication server device via an outbound out-of-band communications channel;

wherein the hardware authentication server device further includes programming for checking a provisioned user database and validating the session ID;

programming for sending an encrypted payload to the waiting client processing application;

programming for sending validation result to the portable communication device where the result can be displayed;

wherein the client processing application includes programming for extracting and decrypting the at least one encrypted user credential; and

programming for using an at least one decrypted user credential to access the online portal.

2. A system according to claim 1, wherein the client processing application further includes programming to create a multi-dimensional barcode from a QR code in the encrypted payload.

3. A system according to claim 1 wherein the client processing application further includes programming to send the encrypted credentials and session ID to the authentication server via an outbound out-of-band communications channel.

4. A system according to claim 1 wherein the browser extension further includes programming to send the encrypted credentials and session ID via an outbound out-of-band communications channel to the authentication server.

5. A system according to claim 1 wherein the client processing application further includes processing to create an RSA key.

6. A method for authentication for accessing an online portal in a system comprising a user, a client processing application, a portable communications device, and an authentication server having a provisioned user database and encrypted payload, wherein the method comprises:

providing a login portal and screen for access by a user, said login portal being in communication with said client processing application;

establishing contact between the client processing application and the authentication server wherein a new authentication session is started;

generating a session identification (“

ID”

) at the client processing application;

creating a multi-dimensional barcode at the client processing application, wherein the multi-dimensional barcode has dynamic encryption keys, portal information, session ID, and a unique key, and wherein the multi-dimensional barcode is displayed at the login screen;

holding the client processing application in waiting pending the authentication server notification of session validation;

starting authentication by user entering credentials on the portable communications device, wherein the portable communications device validates the credentials and displays scan option;

using the portable communications device to scan the multi-dimensional barcode displayed at the login screen and validate the client processing application;

finding on the portable communications device at least one encrypted user credential with an encryption key from the multi-dimensional barcode;

sending the at least one encrypted user credentials and session ID from the portable communications device to the authentication server via an outbound out-of-band communications channel;

checking in provisioned user database of the authentication server, wherein the new authentication session is validated;

sending an encrypted payload to waiting at the client processing application;

sending validation result from the authentication server to the portable communication device where the result is displayed;

decrypting the encrypted payload at the client processing application using the dynamic encryption keys;

extracting and decrypting the at least one encrypted user credential at the client processing application; and

using an at least one decrypted user credential to access the online portal.

7. A method according to claim 6 wherein the step of creating a multidimensional barcode includes the client processing application creating a QR code from the encrypted payload.

8. A method according to claim 6 wherein the step of sending the at least one encrypted user credential and session ID from the portable communications device to the authentication server via an outbound out-of-band communications channel is performed by the client processing application.

9. A method according to claim 6 wherein the step of sending the encrypted credentials and session ID to the authentication server via an outbound out-of-band communications channel is performed by the browser extension.

10. A method according to claim 6 wherein the client processing application creates an RSA key.