Keyfob for use with multiple authentication entities

• US 7,624,433 B1
• Filed: 02/24/2005
• Issued: 11/24/2009
• Est. Priority Date: 02/24/2005
• Status: Active Grant

• Current Assignee: Intuit, Inc.
• Original Assignee: Intuit, Inc.
• Inventors: Clark, Gilbert W., Graves, Michael J.
• Primary Examiner(s): Nalven; Andrew L
• Application Number:
  US11/067,199
• Time in Patent Office: 1,734 Days
• Field of Search: 726/9
• US Class Current: 726/9
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

A token generator such as a keyfob is used to access the computer of an authentication entity different from the authentication entity that issued the token generator. The token generator stores authentication entity identification information identifying the authentication entity that issued the token generator. The token generator causes a user computer to transmit an authentication request including such authentication entity identification information together with a token generated in synchronization with the authentication entity issuing the token generator, so that the authentication request can be routed to the appropriate authentication entity that issued the keyfob for validation. The authentication request can be sent directly to the authentication entity that issued the token generator. The authentication request can also be sent to the authentication entity that issued the token generator via another authentication entity to which the user computer attempts to access.

Claims

1. In a user computer with which a token generator communicates for accessing a first computer corresponding to a first authentication entity using the token generator for a second authentication entity, a computer-implemented method of authenticating the token generator, the method comprising:

obtaining a token from the token generator, the token being generated by the token generator in synchronization with the second authentication entity and having a limited duration of validity;

transmitting to the first authentication entity an authentication request including the token and authentication entity identification information identifying the second authentication entity;

responsive to determining that the first authentication entity is not an authentication entity associated with the authentication entity identification information, the authentication request being further transmitted to the second authentication entity associated with the authentication entity identification information; and

responsive to the second authentication entity validating the token generator based on the token, the first authentication entity allowing the user computer access to the first computer.

2. The computer-implemented method of claim 1, wherein the token generator is a keyfob.

3. The computer-implemented method of claim 1, wherein the authentication request is transmitted to the first authentication entity via Internet.

4. In a first authentication entity, a computer-implemented method of authenticating a token generator for a second authentication entity, the token generator communicating with a user computer for accessing a first computer corresponding to the first authentication entity, the method comprising:

receiving from the user computer an authentication request including a token and authentication entity identification information identifying the second authentication entity, the token being generated by the token generator in synchronization with the second authentication entity and having a limited duration of validity;

responsive to determining that the first authentication entity is not an authentication entity associated with the authentication entity identification information, transmitting the authentication request to the second authentication entity associated with the authentication entity identification information; and

responsive to the token generator being validated by the second authentication entity based on the token, allowing the user computer access to the first computer.

5. The computer-implemented method of claim 4, wherein the token generator is a keyfob.

6. The computer-implemented method of claim 4, wherein the authentication request is received from the user computer via Internet.

7. A computer-implemented method of authenticating a token generator communicating with a user computer for accessing a first computer corresponding to a first authentication entity, the method performed in a second authentication entity and comprising:

receiving via the first authentication entity an authentication request including a token and authentication entity identification information identifying the second authentication entity, the token being generated by the token generator in synchronization with the second authentication entity and having a limited duration of validity; and

validating the token generator based on the token in response to determining that the second authentication entity is an authentication entity associated with the authentication entity identification information, the user computer being allowed access to the first computer responsive to the token generator being validated.

8. The computer-implemented method of claim 7, wherein the token generator is a keyfob.

9. The computer-implemented method of claim 7, wherein the authentication request is received via the first authentication entity through Internet.

10. A token generator capable of communicating with a user computer for accessing a first computer corresponding to a first authentication entity using the token generator for a second authentication entity, the token generator comprising:

a communication module for communicating with the user computer;

a memory module storing authentication entity identification information identifying the second authentication entity and authentication software configured to cause the user computer to;

obtain a token from the token generator, the token generated by the token generator in synchronization with the second authentication entity and having a limited duration of validity; and

transmit to the first authentication entity an authentication request including the token and the authentication entity identification information, the authentication request being further transmitted to the second authentication entity associated with the authentication entity identification in response to determining that the first authentication entity is not an authentication entity associated with the authentication entity identification information, and the first authentication entity allowing the user computer access to the first computer in response to the second authentication entity validating the token generator based on the token.

11. The token generator of claim 10, wherein the communication module is a Universal Serial Bus (USB) interface.

12. The token generator of claim 10, wherein the token generator is a keyfob.