CENTRALIZED AUTHENTICATION SYSTEM WITH SAFE PRIVATE DATA STORAGE AND METHOD

• US 20100199089A1
• Filed: 11/09/2009
• Published: 08/05/2010
• Est. Priority Date: 02/05/2009
• Status: Active Grant

• Current Assignee: WwPass Corp.
• Original Assignee: WwPass Corp.
• Inventors: Shablygin, Eugene, Vysogorets, Mikhail
• Granted Patent: US 8,327,141 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards

Abstract

A token-based centralized authentication method for providing access to a service provider to user information associated with a user'"'"'s relationship with the service provider includes the steps of: authenticating a user presenting a user token at a user terminal, the user token having stored thereon a user ID; deriving a resource identifier using at least two data input elements, the at least two data input elements including the user ID of the user and a service provider ID of the service provider, wherein the user information is stored in a storage network and the resource identifier is associated with the user information; retrieving the user information from the storage network using the resource identifier; and providing the retrieved user information to the service provider.

Claims

1. A token-based centralized authentication method for providing access to a service provider to user information associated with a user'"'"'s relationship with the service provider, comprising the steps of:

authenticating a user presenting a user token at a user terminal, the user token having stored thereon a user ID;

deriving a resource identifier using at least two data input elements, the at least two data input elements including the user ID of the user and a service provider ID of the service provider, wherein the user information is stored in a storage network and the resource identifier is associated with the user information;

retrieving the user information from the storage network using the resource identifier; and

providing the retrieved user information to the service provider.

2. The method of claim 1, wherein the storage network is a dispersed storage network comprising a plurality of storage nodes, wherein the user information is stored in the storage network in accordance with an information dispersal algorithm (IDA).

3. The method of claim 2, wherein the storage network has stored therein for each user token a data container including a status of the user token and one or more encryption keys specific to the user token.

4. The method of claim 2, further comprising the steps of deriving a second resource identifier using at least an ID specific to the user token and a second data element that is not specific to the user token, and retrieving the data container using the second resource identifier.

5. The method of claim 2, wherein the user information retrieving step includes the step of reconstructing the user information from the plurality of storage nodes, wherein the reconstructed user information is provided to the service provider.

6. The method of claim 1, wherein the deriving step includes the step of deriving the resource identifier using a one way function.

7. The method of claim 1, wherein the user ID and service provider ID are separately received by an authentication system in communication with the storage network, wherein the authentication system performs the step of deriving the resource identifier using the user ID and service provider ID.

8. The method of claim 7, further comprising the steps of:

issuing from the authentication system a temporary transaction identifier to one of the user terminal and a service provider agent, the temporary transaction identifier being associated with an access or authentication request;

receiving the temporary transaction identifier from the other of the user terminal and the service provider agent; and

performing the resource identifier deriving step after receiving the temporary transaction identifier at the authentication system.

9. The method of claim 8, further comprising the step of the one of the user terminal and a service provider agent forwarding the temporary transaction identifier to the other of the user terminal and the service provider agent.

10. The method of claim 9, wherein the authentication system issues the temporary transaction identifier to the user terminal, the method further comprising the step of authenticating the service provider after the user terminal forwards the temporary transaction identifier to the service provider agent.

11. The method of claim 9, wherein the authentication system issues the temporary transaction identifier to the service provider agent, the method further comprising the step of authenticating the service provider before authenticating the user.

12. The method of claim 1, wherein the resource identifier deriving step is performed by the token, the method further comprising the steps of:

receiving at an authentication system the resource identifier from the user terminal; and

using the received resource identifier in performing the retrieving step.

13. The method of claim 12, further comprising the steps of:

issuing from the authentication system a temporary transaction identifier to the service provider agent, the temporary transaction identifier being associated with an access or authentication request; and

thereafter receiving the temporary transaction identifier at the authentication system from the user terminal.

14. The method of claim 13, further comprising the step of the service provider agent forwarding the temporary transaction identifier to the user terminal, wherein the token performs the resource identifier deriving step after receiving the temporary transaction identifier.

15. The method of claim 1, further comprising the steps of:

issuing from an authentication system a temporary transaction identifier to a service provider agent, the temporary transaction identifier being associated with an access or authentication request, the temporary transaction identifier including a name identifier associated with the service provider;

transmitting the temporary transaction identifier to the user terminal from the service provider agent for display of the name identifier to the user using the token;

receiving a consent indication from the user;

after receipt of the consent indication, receiving the temporary transaction identifier from the user terminal; and

performing the resource identifier deriving step after receiving the temporary transaction identifier at the authentication system.

16. The method of claim 1, wherein the storage network stores a plurality of separate sets of user information associated with the user, each set being associated with a respective user/service provider pair, wherein each set of user information is retrievable using a respective resource identifier derived using the user ID and a respective service provider ID.

17. The method of claim 1, wherein the user token is a hardware token.

18. The method of claim 1, further comprising the step of, after providing the retrieved user information to the service provider, receiving a set of user data for the user from the service provider for storage in the storage network in association with the resource identifier, wherein the storage network serves as the service provider'"'"'s permanent storage of the received user data.

19. The method of claim 1, wherein the user data is all or part of the user'"'"'s customer profile with the service provider.

20. The method of claim 1, wherein the step of deriving the resource identifier includes the steps of:

combining the user ID and service provider ID to provide a data element; and

encrypting the data element with a public key of a public/private key encryption pair.

21. A method of providing secure data storage and access to stored data, comprising the steps of:

receiving user information;

storing the user information in a dispersed storage network comprising a plurality of storage nodes in accordance with an information dispersal algorithm (IDA); and

associating the user information with a resource identifier for use in retrieving the user information from the dispersed storage network;

receiving the resource identifier and retrieving the user information from the dispersed storage network using the resource identifier, wherein the resource identifier is derived from an output of a one way function using at least two data input elements.

22. The method of claim 21, wherein the user information retrieving step includes the step of reconstructing the user information from the plurality of storage nodes.

23. The method of claim 21, wherein the at least two data input elements comprise a user ID and a service provider ID, wherein the user information is associated with a user'"'"'s relationship with a service provider, the method further comprising the step of providing the retrieved user information to the service provider.

24. The method of claim 23, further comprising the steps of:

receiving the user ID and the service provider ID at an authentication system; and

deriving the resource identifier with the authentication system.

25. The method of claim 23, further comprising the steps of:

receiving the resource identifier at an authentication system from a user terminal.

26. The method of claim 25, further comprising the steps of:

receiving a service provider ID at the user terminal;

deriving the resource identifier with a token in communication with the user terminal; and

transmitting the resource identifier from the user terminal to the authentication system.

27. The method of claim 21, further comprising the steps of:

issuing, from an authentication system and to one of a user terminal and a service provider agent, a temporary transaction identifier, the temporary transaction identifier being associated with an access or authentication request; and

receiving the temporary transaction identifier from the other of the user terminal and the service provider agent.

28. A token-based centralized authentication system for providing access to a service provider to user information associated with a user'"'"'s relationship with the service provider, comprising:

an authentication and data storage management system in network communication with a service provider agent and a user terminal, including;

a user front end, the user front end configured to communicate with a user token through the user terminal for authenticating a user, the user token having stored thereon a user ID;

a service provider front end, the service provider front end configured to communicate with the service provider agent processor for authenticating a service provider; and

a data storage management engine in communication with the user front end, the service provider front end and a storage network having stored therein the user information, the data storage management engine configured to receive a resource identifier and retrieve the user information from the storage network using the resource identifier and provide the retrieved user information for communication to the service provider agent,

wherein the resource identifier is derived using a function having at least two data input elements, the at least two data input elements including the user ID and a service provider ID of the service provider.

29. The system of claim 28,

wherein the storage network is a dispersed storage network comprising a plurality of storage nodes, wherein the user information is stored in the storage network in accordance with an information dispersal algorithm (IDA),

wherein the data storage management engine includes a data collector configured to retrieve and reconstruct the user information from the plurality of storage nodes, wherein the reconstructed user information is provided to the service provider.

30. The system of claim 28, wherein the data storage management engine is configured to derive the resource identifier using a one way function.

31. The system of claim 28,

wherein the user front end is configured to issue a temporary transaction identifier to the user terminal, the temporary transaction identifier being associated with an access or authentication request, and the service provider front end is configured to receive the temporary transaction identifier from the service provide agent and authenticate the service provider after receipt of the temporary transaction identifier, or

wherein the service provider front end is configured to issue the temporary transaction identifier to the service provider agent, and the user front end is configured to receive the temporary transaction identifier from the user terminal and authenticate the user after receipt of the temporary transaction identifier.

32. The system of claim 28, wherein the data storage management engine is configured to receive the resource identifier from the user terminal.

33. The system of claim 28, wherein the storage network stores a plurality of separate sets of user information associated with the user, each set being associated with a respective user/service provider pair, wherein each set of user information is retrievable using a respective resource identifier derived using the user ID and a respective service provider ID.

34. The system of claim 28, wherein the function combines the at least two data input elements into a data element and encrypts the data element with a public key of a public/private key encryption pair.

35. A system for providing secure data storage and access to stored data, comprising:

a dispersed storage network comprising a plurality of storage nodes; and

a data storage management system configured to receive user information and store the user information in the dispersed storage network in accordance with an information dispersal algorithm (IDA), wherein the user information is associated with a resource identifier for use in retrieving the user information from the dispersed storage network and wherein the resource identifier is derived from an output of a one way function using at least two data input elements, wherein the data storage management system includes a data collector for retrieving the user information from the dispersed storage network using the resource identifier by reconstructing the user information from the plurality of storage nodes.

36. The system of claim 35, wherein the at least two data input elements comprise a user ID and a service provider ID, wherein the user information is associated with a user'"'"'s relationship with a service provider, wherein the data storage management system is further configured to provide the retrieved user information for communication to a service provider agent.

37. The system of claim 36, wherein the data storage management system is further configured to receive the user ID and the service provider ID and derive the resource identifier with the authentication system.

38. The system of claim 35, wherein the data storage management system includes an authentication system configured to issue to one of a user terminal and a service provider agent a temporary transaction identifier, the temporary transaction identifier being associated with an access or authentication request, and receive the temporary transaction identifier from the other of the user terminal and the service provider agent.