Multifactor authentication for programmatic interfaces

• US 8,776,190 B1
• Filed: 11/29/2010
• Issued: 07/08/2014
• Est. Priority Date: 11/29/2010
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Cavage, Mark Joseph, Behm, Bradley Jeffery, Cabrera, Luis Felipe
• Primary Examiner(s): Gee, Jason K.
• Assistant Examiner(s): Ullah, Sharif E
• Application Number:
  US12/955,519
• Time in Patent Office: 1,317 Days
• Field of Search: 726/5, 380/255, 380/260, 380/276, 713/150, 713/155, 713/181
• US Class Current: 726/5
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time

Abstract

Systems and methods provide logic that validates a code generated by a user, and that executes a function of a programmatic interface after the user code is validated. In one implementation, a computer-implemented method performs a multifactor authentication of a user prior to executing a function of a programmatic interface. The method includes receiving, at a server, a user code through a programmatic interface. The server computes a server code in response to the user code, and compares the user code to the server code to determine that the user code corresponds to the server code. The server validates the user code and executes a function of the programmatic interface, after the user code is validated.

Claims

1. A computer-implemented method for authenticating a user, comprising:

receiving, at a server, an authentication credential of the user;

validating the authentication credential;

receiving, through a programmatic interface at the server, a user code generated by a code generation unit at a user device, wherein;

the user code comprises a predetermined number of characters, and

the user code was generated at a first time based on an application of a hashing algorithm to a user value and a user counter, the user value being obtained from the user device;

computing, at the server, a server code in response to the received user code at a second time, the computing comprising;

obtaining a server value and a server counter; and

applying the hashing algorithm to the server value and the server counter to generate the server code;

comparing the user code to the server code to determine that the user code corresponds to the server code;

validating the user code when the first time is within a threshold time period of the second time; and

executing a function of the programmatic interface, after the user code is validated.

2. The method of claim 1, wherein:

the user counter comprises a value of a login counter maintained by the user device; and

the server counter comprises a value of a login counter maintained by the server.

3. The method of claim 1, wherein the hashing algorithm comprises an HMAC based one-time password algorithm.

4. The method of claim 1, wherein:

the user counter comprises a system time associated with the user device; and

the server counter comprises a system time of the server.

5. The method of claim 1, wherein the hashing algorithm comprises a time-based one-time password algorithm.

6. The method of claim 1, wherein the function of the programmatic interface comprises a call to a web service accessible to the server, the service being configured to perform an operation.

7. The method of claim 6, wherein the service is associated with one or more of a data repository, an online retailer, a financial institution, an actuarial institution, an educational institution, a governmental institution, a news organization, a social networking application, or a provider of electronic content.

30. The method of claim 1, wherein the authentication server is associated with a node corresponding to a particular geographic region.

8. A computer-implemented method, comprising:

receiving, at a server, a user code through a programmatic interface, the user code generated at a user device by a code generation unit at a first time;

computing, at the server, a server code in response to the user code at a second time;

comparing the user code to the server code to determine that the user code corresponds to the server code;

validating the user code when the first time is within a threshold time period of the second time; and

executing a function of the programmatic interface, after the user code is validated.

9. The method of claim 8, further comprising:

receiving an authentication credential associated with the user, the authentication credential comprising one or more of a programmatic credential, a user identifier, or a password.

10. The method of claim 9, further comprising:

determining that the authentication credential is valid.

11. The method of claim 8, wherein the computing comprises:

obtaining a server value and a server counter; and

applying a hashing algorithm to the server value and the server counter to generate the server code.

12. The method of claim 11, wherein the obtaining comprises:

obtaining at least one of the server value or the server counter from a service accessible to the server.

13. The method of claim 12, wherein the service accessible to the server comprises a distributed hash table.

14. The method of claim 11, wherein the server counter comprises a value of a login counter maintained by the server, or a system time of the server.

15. The method of claim 11, wherein the hashing algorithm comprises a one-time password algorithm.

16. The method of claim 8, wherein:

the user code comprises a predetermined number of characters; and

the user code was generated based on an application of the hashing algorithm to a user value and a user counter.

17. The method of claim 16, wherein the user value is generated at the user device.

18. The method of claim 16, wherein the user counter comprises a value of a login counter maintained at the user device, or a value of a system time of the user device.

19. The method of claim 10, wherein the function of the programmatic interface comprises a call to a web service accessible to the server, the service being configured to perform an operation.

20. The method of claim 19, wherein the web service is associated with one or more of a data repository, an online retailer, a financial institution, an actuarial institution, an educational institution, a governmental institution, a news organization, a social networking application or a provider of electronic content.

21. An apparatus for authenticating a user, comprising:

a processor for executing program instructions; and

a memory storing the program instructions, the program instructions being executed by the processor to perform a process to;

receive a user code through a programmatic interface, the user code generated at a user device by a code generation unit at a first time;

compute a server code in response to the user code at a second time;

compare the user code to the server code to determine that the user code corresponds to the server code;

validate the user code when the first time is within a threshold time period of the second time; and

execute a function of the programmatic interface, after the user code is validated.

22. The apparatus of claim 21, wherein the program instructions executed by the processor to receive are further executed to:

receive an authentication credential associated with the user, the authentication credential comprising a programmatic credential, a user name, or a password.

23. The apparatus of claim 22, wherein the program instructions executed by the processor to receive are further executed to:

determine that the authentication credential is valid.

24. The apparatus of claim 21, wherein:

the user code comprises a predetermined number of characters; and

the user code was generated based on an application of a hashing algorithm to a user value and a user counter.

25. The apparatus of claim 24, wherein the user value is obtained from the user device.

26. The apparatus of claim 24, wherein the user counter comprises a value of a login counter maintained by the user device, or a value of a system time of the user device.

27. The apparatus of claim 21, wherein the program instructions executed by the processor to compute are further executed to:

obtain a server value and a server counter; and

apply a hashing algorithm to the server value and the server counter to generate the server code.

28. The apparatus of claim 27, wherein the server counter comprises a value of a login counter maintained by the server, or a system time of the server.

29. The apparatus of claim 21, wherein the function of the programmatic interface comprises a call to a service accessible to the server, the service being configured to perform an operation.