SECURE AUTHENTICATION IN A MULTI-PARTY SYSTEM
First Claim
1. A networked system capable of authenticating multiple different users to multiple different service providers, comprising:
- an authentication server configured to store (i) a provider identifier for each of the multiple different service providers in association with provider authentication policy requirements for the applicable service provider and (ii) a user identifier for each of the multiple different users in association with validation information for the application user;
a first software application configured to be downloaded to a first device operable by a first user of the multiple different users, and configured to transmit a login request to the first user of the multiple different service providers via the network;
the authentication server configured to receive from a first network server associated with the first service provider via the network, (i) a request for a random number and (ii) other information, wherein the authentication server is configured to transmit the random number to the first network server via the network after receiving the request for the random number, wherein the first software application is configured to receive from the first network server the transmitted random numbera second software application configured to be downloaded to a second device operable by the first user, and configured (i) to receive an input transferring the further transmitted random number to it from the first device, and (ii) to further transmit the input random number and a request of the first user to be authenticated to the authentication server via the network;
wherein the authentication server is further configured to transmit, after transmission by the second device of the random number and authentication request, the stored first provider identifier and the stored associated first provider authentication policy requirements, and to further transmit the transmitted other information, to the second device via the network;
wherein the second software application downloadable to the second device is further configured to transmit, in response to the transmitted first provider authentication policy requirements, a first user identifier and user input validation information to the authentication server via the network;
wherein the authentication server is further configured to match the transmitted first user identifier to the stored first user identifier, to determine that the transmitted validation information corresponds to the stored first service provider authentication policy requirements, and to compare the transmitted validation information with the validation information stored in association with the first user identifier to authenticate the first user;
wherein the second software application downloadable to the second device is further configured to transmit a message through the second device, including the transferred random number and the further transmitted other information, signed with a credential of the first user, to the authentication server via the network; and
wherein the authentication server is further configured to transmit notice of authentication of the first user and to further transmit the received signed message to the network server via the network.
6 Assignments
0 Petitions
Accused Products
Abstract
A user device transmits a login request. A provider server, receives a random number from and transmits other information to an authentication server. The provider server transmits the random number to the device. The random number is transferred to a second user device, which transmits it to the authentication server. The authentication server transmits provider authentication policy requirements and further transmits the other information to the second device. The second device transmits user validation information to the authentication server. The authentication server determines that the transmitted validation information corresponds to the service provider authentication policy requirements, compares the validation information with stored validation information for the user to authenticate the user. The second device transmits a message, including the random number and the other information, signed with a user credential to the authentication server. The authentication server transmits notice of authentication and the signed message to the provider server.
28 Citations
19 Claims
-
1. A networked system capable of authenticating multiple different users to multiple different service providers, comprising:
-
an authentication server configured to store (i) a provider identifier for each of the multiple different service providers in association with provider authentication policy requirements for the applicable service provider and (ii) a user identifier for each of the multiple different users in association with validation information for the application user; a first software application configured to be downloaded to a first device operable by a first user of the multiple different users, and configured to transmit a login request to the first user of the multiple different service providers via the network; the authentication server configured to receive from a first network server associated with the first service provider via the network, (i) a request for a random number and (ii) other information, wherein the authentication server is configured to transmit the random number to the first network server via the network after receiving the request for the random number, wherein the first software application is configured to receive from the first network server the transmitted random number a second software application configured to be downloaded to a second device operable by the first user, and configured (i) to receive an input transferring the further transmitted random number to it from the first device, and (ii) to further transmit the input random number and a request of the first user to be authenticated to the authentication server via the network; wherein the authentication server is further configured to transmit, after transmission by the second device of the random number and authentication request, the stored first provider identifier and the stored associated first provider authentication policy requirements, and to further transmit the transmitted other information, to the second device via the network; wherein the second software application downloadable to the second device is further configured to transmit, in response to the transmitted first provider authentication policy requirements, a first user identifier and user input validation information to the authentication server via the network; wherein the authentication server is further configured to match the transmitted first user identifier to the stored first user identifier, to determine that the transmitted validation information corresponds to the stored first service provider authentication policy requirements, and to compare the transmitted validation information with the validation information stored in association with the first user identifier to authenticate the first user; wherein the second software application downloadable to the second device is further configured to transmit a message through the second device, including the transferred random number and the further transmitted other information, signed with a credential of the first user, to the authentication server via the network; and wherein the authentication server is further configured to transmit notice of authentication of the first user and to further transmit the received signed message to the network server via the network. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19)
-
Specification