Multi factor user authentication on multiple devices

• US 9,871,791 B2
• Filed: 02/08/2017
• Issued: 01/16/2018
• Est. Priority Date: 02/24/2015
• Status: Active Grant

• Current Assignee: Go Daddy Operating Company LLC (GoDaddy, Inc.)
• Original Assignee: Go Daddy Operating Company LLC (GoDaddy, Inc.)
• Inventors: Blinn, Arnold Neil
• Primary Examiner(s): DOAN, TRANG T
• Application Number:
  US15/427,464
• Publication Number:
  US 20170149774A1
• Time in Patent Office: 342 Days
• Field of Search: None
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231

Abstract

Systems and methods of the present invention provide for a first and second client computer configured to receive and transmit an authentication credential and at least one additional authentication credential respectively. The authentication credentials may be selected from authentication credentials known only to a user, identifying a client computer and/or identifying a characteristic unique to the user. A server computer communicatively coupled to the network may be configured to receive the authentication credentials and verify the identity of the user via a match, in a database, of a first authentication credential, a second authentication credential and a third authentication credential.

Claims

1. A system, comprising a server computing device coupled to a network and comprising at least one processor executing specific computer-executable instructions that, when executed, cause the system to:

identify, in a first transmission from a first authentication user interface (UI) on a first client computing device operated by a user, a first authentication credential input by the user;

responsive to identifying, within a database coupled to the network, a user identifier associated with the first authentication credential, the database storing a public key and a biometric record signed by a private key and wherein the private key and the public key are configured to bind a first software code on a second client computing device with a second software code on the server computing device to establish an encryption channel;

generate a second authentication UI requesting a second authentication credential from the user;

transmit the second authentication UI to be displayed on the second client computing device operated by the user;

receive, via the encryption channel between the second client computing device and the server computing device, a second transmission from the second authentication UI on the second client computing device;

identify, in the second transmission the second authentication UI on the second client computing device, the second authentication credential input by the user; and

responsive to identifying, within the database, the user identifier associated with the second authentication credential input by the user, authenticate the user.

2. The system of claim 1, wherein the first authentication credential or the second authentication credential comprises a time-based one time password or a tap code.

3. The system of claim 1, wherein the computer-executable instructions further cause the server computing device to generate an alert to be displayed on the first client computing device or the second client computing device responsive to a determination that:

the first authentication credential or the second authentication credential is not associated with the user identifier in the database;

or

the second authentication credential, comprising a biometric input by the user, does not match the biometric record stored in the database.

4. The system of claim 1, wherein the computer executable instructions further cause the server computing device, responsive to a determination that the first client computing device and the second client computing device are the same device, to generate an alert to be displayed on the first client computing device or the second client computing device.

5. The system of claim 1, wherein the authentication of the user authorizes the user to access a domain name administration software, a bank account, a retail website, or at least one private health record.

6. The system of claim 5, wherein the second client computing device is configured to, without user input:

store a biometric data;

encrypt the biometric data using a private key; and

transmit the biometric data to the server computing device.

7. The system of claim 6, wherein, upon authentication of the user, the server computing device is configured to perform a requested action for which the authentication is required.

8. The system of claim 1, wherein the second authentication credential comprises a biometric data including a finger or thumb print, a capillary distribution, or a software identification of the user'"'"'s face, voice, retina, or DNA.

9. A method, comprising the steps of:

identifying, by a server computing device coupled to a network and comprising at least one processor executing specific computer-executable instructions, in a first transmission from a first authentication user interface (UI) on a first client computing device operated by a user, a first authentication credential input by the user;

responsive to identifying, by the server computing device, within a database coupled to the network, a user identifier associated with the first authentication credential, the database storing a public key and a biometric record signed by a private key and wherein the private key and the public key are configured to bind a first software code on a second client computing device with a second software code on the server computing device to establish an encryption channel;

generating, by the server computing device, a second authentication UI requesting a second authentication credential the user;

transmitting, by the server computing device, the second authentication UI to be displayed on the second computing device operated by the user;

receiving, via the encryption channel between the second client computing device and the server computing device, a second transmission the second authentication UI on the second client computing device;

identifying, by the server computing device, in the second transmission the second authentication UI on the second client computing device, the second authentication credential input by the user;

responsive to identifying, within the database, the user identifier associated with the second authentication credential input by the user, authenticating, by the server computing device, the user.

10. The method of claim 9, further comprising the step of decoding the first authentication credential or the second authentication credential as a time-based one time password or a tap code.

11. The method of claim 9, further comprising the step of generating, by the server computing device, an alert to be displayed on the first client computing device or the second client computing device responsive to a determination that:

the first authentication credential or the second authentication credential is not associated with the user identifier in the database;

or

the second authentication credential, comprising a biometric input by the user, does not match the biometric record stored in the database.

12. The method of claim 9, further comprising the step of:

responsive to a determination that the first client computing device and the second client computing device are the same device, generating, by the server computing device, an alert to be displayed on the first client computing device or the second client computing device.

13. The method of claim 9, wherein the authentication of the user authorizes the user to access a domain name administration software, a bank account, a retail website, or at least one private health record.

14. The method of claim 13, further comprising the steps of:

storing, by the second client computing device, a biometric data;

encrypting, by the second client computing device, the biometric data using a private key; and

transmitting, by the second client computing device, the biometric data to the server computing device.

15. The method of claim 14, further comprising the step of performing, by the server computing device, a requested action, upon authentication of the user, for which the authentication is required.

16. The method of claim 9, wherein the second authentication credential comprises a biometric data including a finger or thumb print, a capillary distribution, or a software identification of the user'"'"'s face, voice, retina, or DNA.