System and method for user authentication by means of web-enabled personal trusted device

• US 20120192260A1
• Filed: 01/20/2011
• Published: 07/26/2012
• Est. Priority Date: 01/19/2010
• Status: Active Grant

• Current Assignee: Adjoy, Inc., TOP, Inc.
• Original Assignee: Envlzio Incorporated
• Inventors: Kontsevich, Leonid
• Granted Patent: US 8,914,866 B2
• Time in Patent Office: Days
• US Class Current: 726/9
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/42 using separate channels for security data
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853

Abstract

A system of token-based user authentication for the purpose of authorizing user access to protected resources, such as web applications, computer systems or computer controlled devices. The system utilizes a personal trusted device (PTD), which is owned and operated by one specific user, to establish secure communication channels that are subsequently used to pass user credentials to authentication service. Association of a PTD with servers controlling access to resources is performed by publishing and capturing unique tokens via sensors embedded in PTD, such as an optical camera.

Claims

1. A token-based user authentication system comprised of:

Personal Trusted Device (PTD), possessing a unique device identifier (UDID), capable of capturing short digital sequences (tokens) via digital signal processing of optical, audio, or radio-frequency input;

accepting user input needed for user authentication with embedded keyboard, touch sensors, optical sensor, or voice recognition;

transmitting and receiving messages via network connection.

Plurality of Token Presentation Devices that allow users to capture tokens, supplied by Authentication Service, with a PTD.

Plurality of network-connected Action Servers that act on behalf of users and require the said users to be identified and authenticated.

Network-connected Token Management Service that facilitates token-based authentication by;

generating unique tokens upon requests coming from an Authentication Service on behalf of the Action Servers;

receiving messages from PTDs that contain PTDs'"'"' UDIDs and the tokens captured by PTDs from Token Presentation Devices;

establishing links between said tokens and UDIDs of the PTDs that sent the messages with the tokens;

notifying the Authentication Service about the newly established links.

Authentication Service that;

communicates with PTDs and authenticates users with plurality of the authentication methods;

maintains a database of the user records, containing a unique user identifier, UDID'"'"'s of the PTDs owned by the user, the user credentials, and the user identifiers for various Action Servers;

provides an interface to the Action Servers that allows association of the user identifier on an Action Server with user record in the database;

provides an interface to the Action Servers that allows initiation of token-based authentication;

notifies an Action Server in the event when token-based authentication previously initiated on behalf of that Action Server has been successfully completed by user via combination of the user credentials and the use of PTD associated with user'"'"'s record.

2. The token-based user authentication system of claim 1, wherein the Personal Trusted Device is a mobile phone, tablet PC, Personal Digital Assistant (PDA), or portable media player device connected to IP network via WiFi or carrier network or both.

3. The token-based user authentication system of claim 2, wherein the token is transmitted to the PTD with embedded camera via optical channel (including but not limited to static or dynamic one-dimensional or two-dimensional bar codes).

4. The token-based user authentication system of claim 2, wherein the token is transmitted to the PTD with embedded microphone via audio channel.

5. The token-based user authentication system of claim 2, wherein the token is transmitted to the PTD with embedded near-field communication device via radio frequency.

6. The token-based user authentication system of claim 3, wherein a Token Presentation Device is a monitor controlled by a computer, mobile phone, tablet PC, PDA, portable media player, TV set, point of sale terminal, digital projection system or other display device capable of presenting an optical representation of the token.

7. The token-based user authentication system of claim 3, wherein a Token Presentation Device is a hard copy of the token optical representation.

8. The token-based user authentication system of claim 1, wherein a network-connected Action Server is a computer system serving web applications that require user authentication.

9. The token-based user authentication system of claim 1, wherein a network-connected Action Server is a login subsystem of a computer operating system.

10. The token-based user authentication system of claim 1, wherein a network-connected Action Server is a software program that requires user authentication.

11. The token-based user authentication system of claim 1, wherein a network-connected Action Server is an actuator of a physical process including but not limited to operation of locks, switches, alarm systems, industrial equipment and machinery, and other automation systems.

12. The token-based user authentication system of claim 1, wherein a network-connected Action Server controls access to weapon systems.

13. A method of authenticating user by the system of claim 1, comprising of the combination of one or more of the following methods:

UDID of user'"'"'s PTD, personal identification number (PIN), password, challenge question, biometrics (including but not limited to voice print, palm scan, face recognition, iris scan, and finger print), geographic location and IP address.