System and method for secure remote access to a service on a server computer

• US 9,166,975 B2
• Filed: 06/19/2014
• Issued: 10/20/2015
• Est. Priority Date: 02/16/2012
• Status: Active Grant

• Current Assignee: inBay Technologies, Inc.
• Original Assignee: inBay Technologies, Inc.
• Inventors: Kuang, Randy, Xavier, Stanislus Kisito, Steklasa, Robert Frank, Wilson, Stephen George, Zhu, He
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): KAPLAN, BENJAMIN A
• Application Number:
  US14/309,369
• Publication Number:
  US 20140304780A1
• Time in Patent Office: 488 Days
• Field of Search: 726/4
• US Class Current: 1/1
• CPC Class Codes: H04L 2463/062 applying encryption of the keys cryptographic mechanisms or cryptographic arrangements for key distribution using key encryption key H04L9/0822
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04W 12/77 Graphical identity

Abstract

System and method for providing access to remote computing services in an application server are described, where the authentication and authorization processes are separated, excluding service access privileges from the authenticating process and transferring the privileges to the authorization process. A client device and a user are authenticated, and upon successful authentication, the authorization process is performed, including establishing an authorization connection between the client device and the server computer; at the server computer, detecting and verifying the authorization connection; and upon successful verification, allowing access of the client device to the service on the server computer. In one embodiment, upon detecting the authorization connection, a blocking process is created to block access to the service; and, upon successful verification of the authorization connection, the blocking process on the server computer is terminated, prior to the allowing the access of the client device to the service on the server computer.

Claims

1. A method for remotely accessing a service on a server computer, comprising:

separating authentication and authorization processes, comprising excluding service access privileges from the authenticating process and transferring the privileges to the authorization process, comprising;

(i) authenticating a client device; and

(ii) upon successful authenticating of the client device, performing the authorization process, comprising;

(ii-1) establishing an authorization connection between the client device and the server computer;

(ii-2) at the server computer, detecting the authorization connection, and verifying the authorization connection; and

(ii-3) upon successful verification of the authorization connection, allowing the access of the client device to the service on the server computer.

2. The method of claim 1, wherein:

the step (ii-2) further comprises, upon detecting the authorization connection, creating a blocking process to block access of the client device to the service on the server computer; and

the step (ii-3) further comprises, upon successful verification of the authorization connection, terminating the blocking process on the server computer, prior to the allowing the access of the client device to the service on the server computer.

3. The method of claim 2, wherein:

the establishing the authorization connection further comprises establishing a remote desktop connection; and

the creating the blocking process further comprises creating a blocking window on a desktop of the server computer.

4. The method of claim 3, wherein the creating the blocking window further comprises creating a modal dialog window.

5. The method of claim 2, wherein the creating the blocking process further comprises:

providing a QR code (Quick Response code) including a dynamic connection information for the authorization connection in a blocking window on a client terminal; and

at the client device, obtaining the dynamic connection information from the QR code.

6. The method of claim 1, further comprising:

at the client device, obtaining from a remote network location, an authorization software and an input information to the authorization software; and

wherein step (ii) further comprises;

(ii-4) executing the authorization software on the client device and the remote network location with the obtained input information; and

(ii-5) provided an output from the authorization software on the client device and the remote network location is the same, allowing the access to the service on the server computer.

7. The method of claim 6, wherein the remote network location is one of the following:

the server computer;

or

another authentication and authorization server computer.

8. The method of claim 6, wherein the authorization software is configured to perform an OTA (One-Time-Authorization).

9. The method of claim 8, further comprising performing the OTA using a one-way function and a dynamic connection information for the authorization connection as an input to the one-way function.

10. The method of claim 6, further comprising one or more of the following:

sharing an output from the authorization software on the client device and the server computer or a third party server computer via a shared clipboard;

or

sending the output from the authorization software on the client device to the server computer or the third party server computer via a secure channel;

or

copying the output from the authorization software on the client device to a clipboard, and pasting the output into a secure shell executing a blocking process to block access of the client device to the service on the server computer.

11. The method of claim 10, wherein the client device is one of the following:

a computing device having a processor;

or

a portable device having a memory, the portable device being different from the computing device, and being operably coupled to the computing device.

12. The method of claim 1, wherein the step (i) further comprises:

obtaining, from a remote network location, an authentication software, and causing the authentication software to obtain a user selectable PIN (Personal Identification Number), and a UID (unique identifier) of the client device;

forwarding the PIN, the UID and the authentication software to the remote network location for generating a user-personalized credential code using the PIN, the UID and the authentication software, comprising encrypting the user-personalized credential code;

at the client device, obtaining the user-personalized credential code from the remote network location, and verifying an authenticity of the user selectable PIN and the UID, without communicating over a network, comprising decrypting the user-personalized credential code; and

retrieving access credentials to the remote network location upon verifying the authenticity of the user selectable PIN and the UID.

13. The method of claim 12, wherein the remote network location is one of the following:

the server computer;

or

another authentication and authorization server computer.

14. The method of claim 12, wherein the authentication software is configured to perform an OTA (One-Time-Authorization).

15. The method of claim 1, further comprising:

automatically signing into the service in a remote desktop window on a client terminal using user account credentials; and

upon the user signing out of the service in the remote desktop window on the client terminal, closing the authorization connection on the server computer.

16. The method of claim 1, further comprising, upon successful verification, automatically forwarding access credentials for accessing the service on the server computer to a remote network location for authenticating with the remote network location.

17. The method of claim 16, wherein the access credentials comprise a one-time password, which is changed at each occasion when access to the service on the server computer is requested.

18. A system for remote access to a service on a server computer, comprising:

a client device having a processor;

a server computer; and

computer readable instructions stored in a memory of the client device and the server computer, causing the client device and the server computer to separate authentication and authorization processes, comprising excluding service access privileges from the authenticating process and transferring the privileges to the authorization process, comprising;

(i) authenticating the client device; and

(ii) upon successful authenticating of the client device, performing the authorization process, comprising;

(ii-1) establishing an authorization connection between the client device and the server computer;

(ii-2) at the server computer, detecting the authorization connection, and verifying the authorization connection; and

(ii-3) upon successful verification of the authorization connection, allowing the access of the client device to the service on the server computer.

19. The system of claim 18, wherein the computer readable instructions further cause, upon detecting the authorization connection, to create a blocking process to block access of the client device to the service on the server computer;

and

upon successful verification of the authorization connection, to terminate the blocking process on the server computer, prior to the allowing the access of the client device to the service on the server computer.

20. The system of claim 19, wherein the computer readable instructions further cause:

to establish a remote desktop connection; and

to create a blocking window on a desktop of the server computer.

21. The system of claim 20, wherein the computer readable instructions further cause to create a modal dialog window.

22. The system of claim 19, wherein the computer readable instructions further cause:

to provide a QR code (Quick Response code) including a dynamic connection information for the authorization connection in a blocking window on a client terminal; and

at the client device, to obtain the dynamic connection information from the QR code.

23. The system of claim 18, wherein the computer readable instructions further cause:

at the client device, to obtain from a remote network location, an authorization software and an input information to the authorization software; and

(ii-4) to execute the authorization software on the client device and the remote network location with the obtained input information; and

(ii-5) provided an output from the authorization software on the client device and the remote network location is the same, to allow the access to the service on the server computer.

24. The system of claim 23, wherein the remote network location is one of the following:

the server computer;

or

another authentication and authorization server computer.

25. The system of claim 23, wherein the authorization software is configured to perform an OTA (One-Time-Authorization).

26. The system of claim 25, wherein the computer readable instructions are further configured to perform the OTA using a one-way function and a dynamic connection information for the authorization connection as an input to the one-way function.

27. The system of claim 23, wherein the computer readable instructions further cause one or more of the following:

to share an output from the authorization software on the client device and the server computer or a third party server computer via a shared clipboard;

or

to send the output from the authorization software on the client device to the server computer or the third party server computer via a secure channel;

or

to copy the output from the authorization software on the client device to a clipboard, and to paste the output into a secure shell executing a blocking process to block access of the client device to the service on the server computer.

28. The system of claim 27, wherein the client device is one of the following:

a computing device having a processor;

or

a portable device having a memory, the portable device being different from the computing device, and being operably coupled to the computing device.

29. The system of claim 18, wherein the computer readable instructions further cause:

to obtain, from a remote network location, an authentication software, and cause the authentication software to obtain a user selectable PIN (Personal Identification Number), and a UID (unique identifier) of the client device;

to forward the PIN, the UID and the authentication software to the remote network location for generating a user-personalized credential code using the PIN, the UID and the authentication software, comprising encrypting the user-personalized credential code;

at the client device, to obtain the user-personalized credential code from the remote network location, and verify an authenticity of the user selectable PIN and the UID, without communicating over a network, comprising decrypting the user-personalized credential code; and

to retrieve access credentials to the remote network location upon verifying the authenticity of the user selectable PIN and the UID.

30. The system of claim 29, wherein the remote network location is one of the following:

the server computer;

or

another authentication and authorization server computer.

31. The system of claim 29, wherein the authentication software is configured to perform an OTA (One-Time-Authorization).

32. The system of claim 18, wherein the computer readable instructions further cause:

to automatically sign into the service in a remote desktop window on a client terminal using user account credentials;

upon the user signing out of the service in the remote desktop window on the client terminal, to close the authorization connection on the server computer.

33. The system of claim 18, wherein the computer readable instruction further cause, upon successful verification, to automatically forward access credentials for accessing the service on the server computer to a remote network location for authenticating with the remote network location.

34. The system of claim 33, wherein the access credentials comprise a one-time password, which is changed at each occasion when access to the service on the server computer is requested.