Mobile security fob

• US 9,843,578 B2
• Filed: 08/26/2015
• Issued: 12/12/2017
• Est. Priority Date: 02/20/2013
• Status: Active Grant

• Current Assignee: FMR LLC
• Original Assignee: FMR LLC
• Inventors: Kalinichenko, Boris, Ferra, Joseph G.
• Primary Examiner(s): Lanier, Benjamin
• Application Number:
  US14/835,810
• Publication Number:
  US 20150365405A1
• Time in Patent Office: 839 Days
• Field of Search: None
• CPC Class Codes: G06F 21/43 wireless channels
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys

Abstract

A computer-implemented method comprising: receiving, from a primary factor authentication device by one or more computer systems, a request to enroll a mobile device as a secondary factor authentication device; and

• • enrolling by the one or more computer systems the mobile device as a first, secondary factor authentication device.

Claims

1. A computer-implemented method of enrolling a mobile device for secondary multifactor authentication, the method comprising:

receiving from a primary factor authentication device by one or more computer systems, a request to enroll a mobile device as a secondary factor authentication device;

receiving from the mobile device by the one or more computers, a unique device identifier,

wherein receiving the unique device identifier triggers generating by the one or more computers, a pairing instruction for the primary factor authentication device to cause the primary factor authentication device to automatically establish a direct connection to the mobile device, which pairing instruction includes information that causes the primary factor authentication device to execute a pairing operation with the mobile device;

transmitting by the one or more computers, the pairing instruction to the primary factor authentication device; and

enrolling by the one or more computer systems the mobile device as a secondary factor authentication device for the primary factor authentication device.

2. The method of claim 1 further comprising:

generating, by the one or more computer systems, a key code for enrolling the mobile device as the secondary factor authentication device; and

transmitting the key code to the primary factor authentication device.

3. The method of claim 2 wherein the primary factor authentication device is configured to re-transmit the key code to the mobile device.

4. The method of claim 1 further comprising:

receiving by the one or more computers from an authentication system that received the key code from the mobile device, a message specifying validation of the key code.

5. The method of claim 1 wherein the mobile device has a unique device identifier, the one or more computers accesses a user profile that is associated with login credentials of a user and the mobile device, and enrolling further comprises:

receiving, by the one or more computer systems from an authentication system, the unique device identifier of the mobile device; and

adding by the one or more computer systems, the unique device identifier to the user profile of the user associated with the primary factor authentication device that sent the request.

6. The computer-implemented method of claim 1, further comprising:

sending by the one or more computers to the mobile device an authentication application to enable the mobile device to forward to the one or more computers secondary factor authentication information.

7. The computer-implemented method of claim 6, wherein the one or more computers receives from the authentication application executed on the mobile device, the secondary factor authentication information including the key code entered into a user interface.

17. The method of claim 1 further comprising:

receiving from the mobile device by the one or more computers, secondary factor authentication information including an encryption key generated by the mobile device;

storing by the one or more computers, the encryption key and the unique device identifier in a data repository; and

generating by the one or more computers, an association between the encryption key and the unique device identifier.

8. A computer program product tangibly stored on a computer readable storage device, the computer program product comprising instructions for causing a computer system to:

receive from a primary factor authentication device, a request to enroll a mobile device as a secondary factor authentication device;

receive from the mobile device a unique device identifier, wherein receiving the unique device identifier triggers generating a pairing instruction for the primary factor authentication device to cause the primary factor authentication device to automatically establish a direct connection to the mobile device, which pairing instruction includes information that causes the primary factor authentication device to execute a pairing operation with the mobile device;

transmit the pairing instruction to the primary factor authentication device; and

enroll the mobile device as a secondary factor authentication device for the primary factor authentication device.

10. The computer program product of claim 8, further comprising instructions to cause the processor to:

generating, by the one or more computer systems, a key code for enrolling the mobile device as the secondary factor authentication device; and

transmitting the key code to the primary factor authentication device.

11. The computer program product of claim 8, further comprising instructions to cause the processor to:

receive from an authentication system that received the key code from the mobile device, a message specifying validation of the key code.

12. The computer program product of claim 8, wherein the mobile device has a unique device identifier the computer program accesses a user profile that is associated with login credentials of a user and the mobile device, and instructions to enroll further comprise instructions to cause the processor to:

receive from an authentication system, the unique device identifier of the mobile device; and

add the device identifier to the user profile of the user associated with the primary factor authentication device that sent the request.

18. The computer program product of claim 8 further comprising instructions for causing a computer system to:

receive from the mobile device, secondary factor authentication information including an encryption key generated by the mobile device;

store the encryption key and the unique device identifier in a data repository; and

generate an association between the encryption key and the unique device identifier.

9. An apparatus comprising:

a processor;

memory coupled to the processor; and

a storage medium storing a computer program for causing the processor to;

receive from a primary factor authentication device, a request to enroll a mobile device as a secondary factor authentication device;

receive from the mobile device a unique device identifier, wherein receiving the unique device identifier triggers generating a pairing instruction for the primary factor authentication device to cause the primary factor authentication device to automatically establish a direct connection to the mobile device, which pairing instruction includes information that causes the primary factor authentication device to execute a pairing operation with the mobile device;

transmit the pairing instruction to the primary factor authentication device; and

enroll the mobile device as a secondary factor authentication device for the primary factor authentication device.

13. The apparatus of claim 9, wherein the computer program product further comprises instructions to cause the processor to:

generate a key code for enrolling the mobile device as the secondary factor authentication device; and

transmit the key code to the primary factor authentication device.

14. The apparatus of claim 9, wherein the computer program product further comprises instructions to cause the processor to:

receive from an authentication system that received the key code from the mobile device, a message specifying validation of the key code.

15. The apparatus of claim 9, wherein the mobile device has a unique device identifier the computer program accesses a user profile that is associated with login credentials of a user and the mobile device, and instructions to enroll further comprise instructions to cause the processor to:

receive from an authentication system, the unique device identifier of the mobile device; and

add the device identifier to the user profile of the user associated with the primary factor authentication device that sent the request.

19. The apparatus of claim 9 wherein the computer program is further for causing the processor to:

receive from the mobile device, secondary factor authentication information including an encryption key generated by the mobile device;

store the encryption key and the unique device identifier in a data repository; and

generate an association between the encryption key and the unique device identifier.

16. A system comprises:

a business processor computer system, comprising one or more processors and memory coupled to the processors; and

a storage medium storing a computer program product for causing the business processor computer system to;

receive from a primary factor authentication device, a request to enroll a mobile device as a secondary factor authentication device;

receive from the mobile device a unique device identifier, wherein receiving the unique device identifier triggers generating a pairing instruction for the primary factor authentication device to cause the primary factor authentication device to automatically establish a direct connection to the mobile device, which pairing instruction includes information that causes the primary factor authentication device to execute a pairing operation with the mobile device;

transmit the pairing instruction to the primary factor authentication device; and

enroll the mobile device as a secondary factor authentication device for the primary factor authentication device; and

an authentication computer system, comprising one or more processors and memory coupled to the processors; and

a storage medium storing a computer program product for causing the an authentication computer system to;

receive a key code from the mobile device;

validate that key code is a valid key code generated by the business processor computer system, by comparing the received key code to other key codes previously received from the business processor computer system; and

store the device ID for mobile device and key in a data repository; and

generate an association between the device ID and the key.

20. The system of claim 16 wherein the computer program product is further for causing the business processor computer system to:

receive from the mobile device, secondary factor authentication information including an encryption key generated by the mobile device;

store the encryption key and the unique device identifier in a data repository; and

generate an association between the encryption key and the unique device identifier.