Method and system for establishing trusted communication using a security device

• US 9,736,149 B2
• Filed: 05/31/2016
• Issued: 08/15/2017
• Est. Priority Date: 02/03/2009
• Status: Active Grant

• Current Assignee: inBay Technologies, Inc.
• Original Assignee: inBay Technologies, Inc.
• Inventors: Bettenburg, Nicolas Johannes Sebastian, Kuang, Randy
• Primary Examiner(s): LEE, JASON T
• Application Number:
  US15/168,850
• Publication Number:
  US 20170019396A1
• Time in Patent Office: 441 Days
• Field of Search: 726 5
• CPC Class Codes: G06F 16/9554 by using bar codes
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: G06F 21/42 using separate channels for security data
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06F 2221/2117 User registration
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06K 7/1417 2D bar codes
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04W 12/77 Graphical identity

Abstract

Methods and systems for authenticating a security device for establishing trusted email communication. The security device is authenticated by installing private security software on the security device. In order to authorize an email transaction, a transaction authorization is performed using the security device by display a QR (Quick Response) code from an authorization server on a user terminal and scanning the QR code into the security device. After scanning the QR code, an OTA (One-Time-Authorization) code is sent from the security device to the authorization server for verifying the transaction. Embodiments of the present invention provide trusted email communication. A corresponding system for authenticating a security device and preforming trusted email communication is also provided.

Claims

1. A method for providing a secure access from a security device at a local network location to a remote network application, the method comprising:

at the security device, having a global unique identifier (UID), a processor, and a memory;

obtaining, from a remote network location, a private security software, and causing the private security software to obtain a user selectable personal identification number (PIN), and the UID of the security device, the UID uniquely identifying the security device;

forwarding the PIN, the UID and the private security software to the remote network location for generating a user-personalized credential code using the PIN, the UID and the private security software, comprising encrypting the user-personalized credential code;

at the security device, obtaining the user-personalized credential code from the remote network location, and verifying an authenticity of the user selectable PIN and the UID, without communicating over a network, comprising decrypting the user-personalized credential code;

retrieving access credentials to the remote network application upon verifying the authenticity of the user selectable PIN and the UID; and

authorizing access to the remote network application using the retrieved access credentials.

2. The method of claim 1 wherein the authorizing access to the remote network application comprises:

sending a request for a QR (Quick Response) code from a transaction server to an authorization server at the remote network location;

sending the QR code from the authorization server to the transaction server;

sending the QR code to a user terminal from the transaction server and displaying the QR code on the user terminal; and

scanning the QR code into the security device using a QR code scanner in the security device.

3. The method of claim 1 wherein the authorizing access to the remote network application comprises authorizing access to a sending server.

4. The method of claim 3 wherein the authorizing access to the remote network application comprises authorizing access to an email sending server.

5. The method of 3 further comprising:

authorizing access of a user to a client application using the security device;

adding an identity token to a message;

sending the message from the client application to the sending server;

verifying the message at the sending server using the identity token within the message;

sending the message from the sending server to a receiving server; and

verifying the message at the receiving server using the identity token within the message.

6. The method of claim 5 wherein the authorizing access of the user to the client application comprises:

presenting a challenge to the user by the client application;

receiving the challenge by the user using the security device;

generating a response to the challenge; and

verifying an identity of the user based on the response.

7. The method of claim 5 wherein the adding the identity token to the message comprises calculating a hash of a body of the message.

8. The method of claim 5 wherein the verifying the message at the sending server comprises:

checking for a presence of the identity token in the message;

verifying the identity of the user based on the identity token in the message;

adding to the message an indication that verifying the message has been carried out; and

adding to the message an indication of a status of the verifying of the message.

9. The method of claim 5 wherein the verifying the message at the receiving server comprises:

checking for a presence of the identity token in the message;

verifying the identity of the user based on the identity token in the message;

adding to the message an indication that verifying the message has been carried out; and

adding to the message an indication of a status of the verifying of the message.

10. The method of claim 5 further comprising

sending the message from the receiving server to a receiver, provided the verifying of the message at the receiving server is successful.

11. A system for providing a secure access from a security device at a local network location to a remote network application, the system comprising:

a remote server computer at the remote network location; and

a security device at the local network location, the security device having a global unique identifier (UID), a processor, and a memory having computer readable instructions stored thereon, causing the processor to;

obtain, from a remote network location, a private security software, and causing the private security software to obtain a user selectable personal identification number (PIN), and the UID of the security device, the UID uniquely identifying the security device;

forward the PIN, the UID and the private security software to the remote network location for generating a user-personalized credential code using the PIN, the UID and the private security software, comprising encrypting the user-personalized credential code;

obtain, at the security device, the user-personalized credential code from the remote network location, and verifying an authenticity of the user selectable PIN and the UID, without communicating over a network, comprising decrypting the user-personalized credential code;

retrieve access credentials to the remote network application upon verifying the authenticity of the user selectable PIN and the UID; and

authorize access to the remote network application using the retrieved access credentials.

12. The system of claim 11 wherein the computer readable instructions further cause the processor to:

send a request for a QR (Quick Response) code from a transaction server to an authorization server at the remote network location;

send the QR code from the authorization server to the transaction server;

send the QR code to a user terminal from the transaction server and displaying the QR code on the user terminal; and

scan the QR code into the security device using a QR code scanner in the security device.

13. The system of claim 11 wherein the computer readable instructions that cause the processor to the authorize access to the remote network application further cause the processor to authorize access to a sending server.

14. The system of claim 13 wherein the computer readable instructions that cause the processor to authorize access to the remote network application further cause the processor to authorize access to an email sending server.

15. The system of 13 wherein the computer readable instructions further cause the processor to:

authorize access of a user to a client application using the security device;

add an identity token to a message;

send the message from the client application to the sending server;

verify the message at the sending server using the identity token within the message;

send the message from the sending server to a receiving server; and

verify the message at the receiving server using the identity token within the message.

16. The system of claim 15 wherein the computer readable instructions that cause the processor to authorize access of the user to the client application further cause the processor to:

present a challenge to the user by the client application;

receive the challenge by the user using the security device;

generate a response to the challenge; and

verify an identity of the user based on the response.

17. The system of claim 15 wherein the computer readable instructions that cause the processor to add the identity token to the message further cause the processor to calculate a hash of a body of the message.

18. The system of claim 15 wherein the computer readable instructions that cause the processor to verify the message at the sending server further cause the processor to:

check for a presence of the identity token in the message;

verify the identity of the user based on the identity token in the message;

add to the message an indication that verifying the message has been carried out; and

add to the message an indication of a status of the verifying of the message.

19. The system of claim 15 wherein the computer readable instructions that cause the processor to verify the message at the receiving server further cause the processor to:

check for a presence of the identity token in the message;

verify the identity of the user based on the identity token in the message;

add to the message an indication that verifying the message has been carried out; and

add to the message an indication of a status of the verifying of the message.

20. The system of claim 15 wherein the computer readable instructions further cause the processor to send the message from the receiving server to a receiver, provided the message is successfully verified at the receiving server.