Authenticating a user device associated with a user to communicate via a wireless network in a secure web-based environment

• US 10,778,682 B1
• Filed: 10/01/2019
• Issued: 09/15/2020
• Est. Priority Date: 01/26/2015
• Status: Active Grant

• Current Assignee: Gemini IP LLC (IPNav)
• Original Assignee: Winklevoss IP LLC
• Inventors: Laucius, Andrew, Paya, Cem, Winer, Eric Neiman
• Primary Examiner(s): Plecha, Thaddeus J
• Application Number:
  US16/589,679
• Time in Patent Office: 350 Days
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 9/0637 Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

Particular systems, methods, and program products for web-based security systems for user authentication and processing in a distributed computing environment are disclosed. A computing sub-system may receive an electronic processing request and a first signed data packet having a first payload that was hashed and encrypted using a first private key. The first payload may comprise first processing output and a first timestamp. The sub-system may verify the first signed data packet by decrypting it using a first public key. The sub-system may execute computing operations to satisfy the electronic processing request, producing second processing output. The sub-system may configure a data packet with a second payload comprising at least the second processing output and a second timestamp. The sub-system may encrypt the second payload using a second private key producing a second signed data packet. The sub-system may transmit to a second sub-system the second signed data packet.

Claims

1. A computer system comprising:

(a) a web server associated with a first ip address;

(b) a server sub-system operatively connected to the web server and associated with a second ip address; and

(c) an identity provider sub-system operatively connected to the web server,

wherein the identity provider sub-system is associated with the first ip address, and

wherein the identity provider sub-system is configured to perform the following steps;

(1) receiving, at the identity provider sub-system via a secure transmission over a wireless network, from a user device associated with a user, an electronic login request comprising login credential data comprising an alphanumeric text sequence,

wherein the electronic login request is received by the web server, and

wherein the electronic login request is communicated from the user device to the identity provider sub-system via the web server;

(2) verifying, by the identity provider subsystem, that the login credential data is valid login credential data,

wherein the login credential data is verified if the login credential data is valid login credential data;

(3) in the case where the login credential data is verified, generating, at the identity provider sub-system;

(A) a first payload comprising login credential verification information and a first session identifier; and

(B) a first digital signature of the identity provider sub-system comprising a first hash of the first payload, the first hash being encrypted using a first identity provider sub-system private key;

(4) transmitting, from the identity provider sub-system to the user device via the secure transmission over the wireless network, the first payload and the first digital signature,

wherein the first payload and the first digital signature are communicated by the identity provider sub-system to the user device via the web server;

(5) receiving, from the user device via the secure transmission over the wireless network at the identity provider sub-system;

(A) a second payload comprising the first session identifier and a first one-time token generated by the user device using a shared secret seed; and

(B) a second digital signature of the user device comprising a second hash of the second payload,

wherein the second payload and the second digital signature are communicated by the user device to the identity provider sub-system via the web server;

(6) verifying, by the identity provider sub-system, the second payload;

(7) in the case where the second payload is verified, authorizing, by the identity provider sub-system, the user device to communicate with the server sub-system associated with the second ip address via the identity provider sub-system; and

(8) transmitting, from the user device via the secure transmission over the wireless network to the server sub-system, a third payload, and a third digital signature,

wherein the third payload and third digital signature are communicated by the user device to the server sub-system via the identity provider sub-system and the web server.

2. The computer system of claim 1, wherein the alphanumeric text sequence comprises a phone number associated with the user device associated with the user.

3. The computer system of claim 1, wherein the alphanumeric text sequence comprises user device information, the user device information being associated with the user device.

4. The computer system of claim 3, wherein the user device information comprises a serial number of the user device.

5. The computer system of claim 1, wherein the secure transmission is using secure socket protocol.

6. The computer system of claim 1, wherein the first session identifier comprises time stamp information.

7. The computer system of claim 1, wherein the first session identifier is generated by the identity provider sub-system using time stamp information.

8. The computer system of claim 7, wherein the time stamp information comprises a time at which the first payload was generated.

9. The computer system of claim 7, wherein the time stamp information comprises a time at which the first payload was configured.

10. The computer system of claim 7, wherein the time stamp information comprises a time at which the electronic request was received.

11. The computer system of claim 1, wherein the third payload comprises the first session identifier, the first one-time token, and a second one-time token generated by the user device using the shared secret seed.