Methods for the secure use of one-time passwords

• US 8,474,014 B2
• Filed: 08/16/2011
• Issued: 06/25/2013
• Est. Priority Date: 08/16/2011
• Status: Active Grant

• Current Assignee: Samsung Electronics Co. Ltd.
• Original Assignee: Veritrix, Inc.
• Inventors: Headley, Paul
• Primary Examiner(s): Song, Hosuk
• Application Number:
  US13/211,230
• Publication Number:
  US 20130047223A1
• Time in Patent Office: 679 Days
• Field of Search: 726 1- 7, 726/10, 713/150, 713/154, 713/156, 713/162, 713168-171, 713/176, 380/270, 380/44
• US Class Current: 726/2
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215

Abstract

Methods for authentication over unsecure networks using one-time passwords methods are provided. The methods establish a connection over a first channel between an authentication system and a user'"'"'s computing system, then the authentication system determines information based on the connection over the first channel, such as the IP address and other information that can be readily found once the IP address is known. The information derived from the connection is then provided to the user over a second channel, and the user is given an opportunity to review the information before deciding whether to continue the login. If the information returned to the user over the second channel is suspicious, this can indicate to the user that the connection over the first channel has been compromised.

Claims

1. An authentication method comprising:

connecting to an authentication server over a first channel;

submitting a request including a user ID;

receiving connection verification information over a second channel from the authentication server;

deciding to continue based on the connection verification information; and

submitting a one-time password.

2. The method of claim 1 wherein connecting to the authentication server over the first channel includes launching an application.

3. The method of claim 1 wherein receiving connection verification information includes receiving information determined based on an IP address of the user computing system.

4. The method of claim 3 wherein the information determined based on the IP address comprises a geographical location of the user computing system.

5. The method of claim 1 wherein receiving connection verification information includes receiving information determined based on a system signature of the user computing system.

6. The method of claim 1 wherein receiving the connection verification information over the second channel includes receiving the connection verification information with a cellular phone.

7. The method of claim 1 further comprising generating the one-time password prior to submitting the one-time password.

8. The method of claim 1 further comprising receiving, with the connection verification information, a prompt to submit the one-time password.

9. The method of claim 1 wherein submitting the one-time password is performed after deciding to continue based on the connection verification information.

10. The method of claim 1 wherein submitting the one-time password is performed before deciding to continue based on the connection verification information.

11. The method of claim 10 further comprising sending a response to continue, over a channel other than the first channel, after deciding to continue based on the connection verification information.

12. An authentication method comprising:

accepting a connection over a first channel, the connection characterized by an IP address of a user computing system;

serving a login page to the IP address;

receiving a request including a claimant target;

determining connection verification information;

communicating the connection verification information over a second channel; and

receiving a one-time password.

13. The method of claim 12 wherein determining the connection verification information is performed based on the IP address.

14. The method of claim 13 wherein determining the connection verification information includes determining a geographical location associated with the IP address.

15. The method of claim 13 wherein determining connection verification information includes comparing the IP address to a prior IP address from an earlier successful login.

16. The method of claim 13 wherein determining connection verification information includes querying a domain name registrar.

17. The method of claim 12 further comprising receiving a system signature, wherein determining the connection verification information is based on the system signature.

18. The method of claim 12 wherein communicating the connection verification information over the second channel includes sending a SMS message.

19. The method of claim 12 wherein communicating the connection verification information over the second channel includes sending a prompt.

20. The method of claim 12 wherein communicating the connection verification information over the second channel includes sending the one-time password.

21. The method of claim 20 further comprising generating the one-time password.

22. The method of claim 12 further comprising querying a database using the claimant target to determine a device address for communicating the connection verification information over the second channel.

23. The method of claim 12 wherein the OTP is received over the first channel.

24. The method of claim 12 wherein the one-time password is received after the connection verification information is communicated.

25. The method of claim 12 wherein the one-time password is received before the connection verification information is communicated.

26. The method of claim 15 further comprising receiving, over a channel other than the first channel, a response to continue after communicating the connection verification information.

27. The method of claim 12 wherein determining the connection verification information includes determining an ISP identity, a channel type, or a WiFi hotspot identity.

28. An authentication system comprising:

an authentication server configured to

accept a connection to an IP address over a first channel;

serve a login page to the IP address;

receive a request including a claimant target from the IP address;

determine connection verification information;

communicate the connection verification information over a second channel to a device address associated with the claimant target; and

receive a one-time password.

29. The authentication system of claim 28 wherein the authentication server is further configured to generate the one-time password.

30. The authentication system of claim 29 wherein the authentication server is further configured to communicate the one-time password with the connection verification information over the second channel to the device address.

31. The authentication system of claim 29 wherein the authentication server is configured to determine the connection verification information based on the IP address.

32. The authentication system of claim 29 wherein the authentication server is configured to receive a system signature and to determine the connection verification information based on system signature.

33. The authentication system of claim 29 wherein the authentication server is configured to receive the one-time password with the request including the claimant target and further configured to receive a response over a channel other than the first channel after communicating the connection verification information.

34. The authentication system of claim 29 wherein the authentication server is configured to receive the one-time password after communicating the connection verification information over the second channel.