Device registration, authentication, and authorization system and method

• US 9,860,241 B2
• Filed: 06/30/2014
• Issued: 01/02/2018
• Est. Priority Date: 04/15/2014
• Status: Active Grant

• Current Assignee: Level 3 Communications LLC (Lumen Technologies, Inc.)
• Original Assignee: Level 3 Communications LLC (Lumen Technologies, Inc.)
• Inventors: Dixon, Allen E., Rdzak, Steven M., Swift, Christopher T., Grippo, Rene, Scheufele, Jeff
• Primary Examiner(s): Homayounmehr, Farid
• Assistant Examiner(s): SARKER, SANCHIT K
• Application Number:
  US14/320,179
• Publication Number:
  US 20150295930A1
• Time in Patent Office: 1,282 Days
• Field of Search: 713181
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/082 using revocation of authorisation
• CPC Class Codes: H04W 12/084 using delegated authorisation, e.g. open authorisation [OAuth] protocol

Abstract

A system includes one or more processors to receive a registration request, the registration request comprising a representation of a username and a password, verify the username and the password and transmit a one-time-use password, receive the one-time-use password and first device identifier information from a mobile computing device, receive an access request from the mobile computing device comprising the representation of the username and the password, second device identifier information, and application key information, verify the username, the password, the second device identifier information, and the application key information, and transmit a token to the mobile computing device, and receive a resource request from the mobile computing device comprising the token and third device identifier information.

Claims

1. A server, comprising:

at least one processor to;

receive a registration request, the registration request comprising a representation of a username and a password;

verify the username and the password and transmit a one-time-use password;

receive the one-time-use password and first device identifier information from a mobile computing device;

receive an access request from the mobile computing device comprising the representation of the username and the password, second device identifier information, and application key information;

verify the username, the password, the second device identifier information, and the application key information at the server;

transmit a token to the mobile computing device responsive to verification of the username, the password, the second device identifier information, and the application key information;

receive a resource request from the mobile computing device comprising the token and third device identifier information;

verify the token and the third device identifier information; and

transmit a representation of the requested resource to the mobile computing device.

2. The server of claim 1, the at least one processor further to:

store the first device identifier information in a memory, the first device identifier information comprising a first device identifier and a first device identifier secret.

3. The server of claim 2, wherein the second device identifier information comprises a second device hash-based message authentication code.

4. The server of claim 3, the at least one processor further to:

perform a cryptographic hash function on the first device identifier and the first device identifier secret to obtain a first device hash-based message authentication code; and

compare the first device hash-based message authentication code with the second hash-based message authentication code to verify the second device identifier information.

5. The server of claim 2, wherein the third device identifier information comprises a third device hash-based message authentication code.

6. The server of claim 5, the at least one processor further to:

perform a cryptographic hash function on the first device identifier and the first device identifier secret to obtain a first device hash-based message authentication code;

compare the first device hash-based message authentication code with the third device hash-based message authentication code to determine that the resource request is valid;

transmit a representation of a resource associated with the resource request to the mobile computing device.

7. The server of claim 5, the at least one processor further to:

perform a cryptographic hash function on the first device identifier and the first device identifier secret to obtain a first device hash-based message authentication code;

compare the first device hash-based message authentication code with the third hash-based message authentication code to determine that the resource request is invalid; and

transmit an indication that the resource request is invalid to the mobile computing device.

8. The server of claim 1, wherein the application key information comprises a first application hash-based message authentication code based on an application key and an application key secret.

9. The server of claim 2, the at least one processor further to:

disable at least one of the first device identifier and the first device identifier secret; and

deny the resource request from the mobile computing device.

10. The server of claim 2, the at least one processor further to:

delete at least one of the first device identifier and the first device identifier secret; and

deny the resource request from the mobile computing device.

11. A method, comprising:

receiving, by at least one processor on a server, a registration request, the registration request comprising a representation of a username and a password;

verifying, by the at least one processor, the username and the password and transmitting a one-time-use password;

receiving, by the at least one processor, the one-time-use password and first device identifier information from a mobile computing device;

receiving, by the at least one processor, an access request from the mobile computing device comprising the representation of the username and the password, second device identifier information, and application key information;

verifying, by the at least one processor, the username, the password, the second device identifier information, and the application key information at the server;

transmitting a token to the mobile computing device responsive to verification of the username, the password, the second device identifier information, and the application key information;

receiving, by the at least one processor, a resource request from the mobile computing device comprising the token and third device identifier information;

verifying the token and the third device identifier information; and

transmitting a representation of the requested resource to the mobile computing device.

12. The method of claim 11, further comprising:

storing the first device identifier information in a memory, the first device identifier information comprising a first device identifier and a first device identifier secret.

13. The method of claim 12, wherein the second device identifier information comprises a second device hash-based message authentication code.

14. The method of claim 13, further comprising:

performing a cryptographic hash function on the first device identifier and the first device identifier secret to obtain a first device hash-based message authentication code; and

comparing the first device hash-based message authentication code with the second hash-based message authentication code to verify the second device identifier information.

15. The method of claim 12, wherein the third device identifier information comprises a third device hash-based message authentication code.

16. The method of claim 15, further comprising:

performing a cryptographic hash function on the first device identifier and the first device identifier secret to obtain a first device hash-based message authentication code;

comparing the first device hash-based message authentication code with the third device hash-based message authentication code to determine that the resource request is valid;

transmitting a representation of a resource associated with the resource request to the mobile computing device.

17. The method of claim 15, further comprising:

performing a cryptographic hash function on the first device identifier and the first device identifier secret to obtain a first device hash-based message authentication code;

comparing the first device hash-based message authentication code with the third hash-based message authentication code to determine that the resource request is invalid; and

transmitting an indication that the resource request is invalid to the mobile computing device.

18. The method of claim 11, wherein the application key information comprises a first application hash-based message authentication code based on an application key and an application key secret.

19. The method of claim 12, further comprising:

disabling at least one of the first device identifier and the first device identifier secret; and

denying the resource request from the mobile computing device.

20. The method of claim 12, further comprising:

deleting at least one of the first device identifier and the first device identifier secret; and

denying the resource request from the mobile computing device.

21. A non-transitory computer-readable medium having instructions stored thereon that, when executed by at least one processor on a server, cause the at least one processor to perform operations comprising:

receiving a registration request, the registration request comprising a representation of a username and a password;

verifying the username and the password and transmitting a one-time-use password;

receiving the one-time-use password and first device identifier information from a mobile computing device;

receiving an access request from the mobile computing device comprising the representation of the username and the password, second device identifier information, and application key information;

verifying the username, the password, the second device identifier information, and the application key information at the server;

transmitting a token to the mobile computing device responsive to verification of the username, the password, the second device identifier information, and the application key information;

receiving a resource request from the mobile computing device comprising the token and third device identifier information;

verifying the token and the third device identifier information; and

transmitting a representation of the requested resource to the mobile computing device.

22. The non-transitory computer-readable medium of claim 21, the operations further comprising:

storing the first device identifier information in a memory, the first device identifier information comprising a first device identifier and a first device identifier secret.

23. The non-transitory computer-readable medium of claim 22, wherein the second device identifier information comprises a second device hash-based message authentication code.

24. The non-transitory computer-readable medium of claim 23, the operations further comprising:

performing a cryptographic hash function on the first device identifier and the first device identifier secret to obtain a first device hash-based message authentication code; and

comparing the first device hash-based message authentication code with the second hash-based message authentication code to verify the second device identifier information.

25. The non-transitory computer-readable medium of claim 22, wherein the third device identifier information comprises a third device hash-based message authentication code.

26. The non-transitory computer-readable medium of claim 25, the operations further comprising:

performing a cryptographic hash function on the first device identifier and the first device identifier secret to obtain a first device hash-based message authentication code;

comparing the first device hash-based message authentication code with the third device hash-based message authentication code to determine that the resource request is valid;

transmitting a representation of a resource associated with the resource request to the mobile computing device.

27. The non-transitory computer-readable medium of claim 25, the operations further comprising:

performing a cryptographic hash function on the first device identifier and the first device identifier secret to obtain a first device hash-based message authentication code;

comparing the first device hash-based message authentication code with the third hash-based message authentication code to determine that the resource request is invalid; and

transmitting an indication that the resource request is invalid to the mobile computing device.

28. The non-transitory computer-readable medium of claim 21, wherein the application key information comprises a first application hash-based message authentication code based on an application key and an application key secret.

29. The non-transitory computer-readable medium of claim 22, the operations further comprising:

disabling at least one of the first device identifier and the first device identifier secret; and

denying the resource request from the mobile computing device.

30. The non-transitory computer-readable medium of claim 22, the operations further comprising:

deleting at least one of the first device identifier and the first device identifier secret; and

denying the resource request from the mobile computing device.