Secure authentication in a multi-party system
First Claim
1. A networked system capable of authenticating multiple different users to multiple different service providers, comprising:
- an authentication server configured to store (i) a provider identifier for each of the multiple different service providers in association with provider authentication policy requirements for the applicable service provider and (ii) a user identifier for each of the multiple different users in association with validation information for the application user;
a first software application configured to be downloaded to a first device operable by a first user of the multiple different users, and configured to transmit a login request to the first user of the multiple different service providers via the network;
the authentication server configured to receive from a first network server associated with a first service provider via the network, (i) a request for a random number and (ii) other information, wherein the authentication server is configured to transmit the random number to the first network server via the network after receiving the request for the random number, wherein the first software application is configured to receive from the first network server the transmitted random number; and
a second software application configured to be downloaded to a second device operable by the first user, and configured (i) to receive an input transferring the further transmitted random number to it from the first device, and (ii) to further transmit the input random number and a request of the first user to be authenticated to the authentication server via the network;
wherein the authentication server is further configured to transmit, after transmission by the second device of the random number and authentication request, the stored first provider identifier and the stored associated first provider authentication policy requirements, and to further transmit the transmitted other information, to the second device via the network;
wherein the second software application downloaded to the second device is further configured to transmit, in response to the transmitted first provider authentication policy requirements, a first user identifier and user input validation information to the authentication server via the network;
wherein the authentication server is further configured to match the transmitted first user identifier to the stored first user identifier, to determine that the transmitted validation information corresponds to the stored first service provider authentication policy requirements, and to compare the transmitted validation information with the validation information stored in association with the first user identifier to authenticate the first user;
wherein the second software application downloadable to the second device is further configured to transmit a message through the second device, including the transferred random number and the further transmitted other information, signed with a credential of the first user, to the authentication server via the network; and
wherein the authentication server is further configured to transmit notice of authentication of the first user and to further transmit the received signed message to the network server via the network.
6 Assignments
0 Petitions
Accused Products
Abstract
A user device transmits a login request. A provider server, receives a random number from and transmits other information to an authentication server. The provider server transmits the random number to the device. The random number is transferred to a second user device, which transmits it to the authentication server. The authentication server transmits provider authentication policy requirements and further transmits the other information to the second device. The second device transmits user validation information to the authentication server. The authentication server determines that the transmitted validation information corresponds to the service provider authentication policy requirements, compares the validation information with stored validation information for the user to authenticate the user. The second device transmits a message, including the random number and the other information, signed with a user credential to the authentication server. The authentication server transmits notice of authentication and the signed message to the provider server.
63 Citations
19 Claims
-
1. A networked system capable of authenticating multiple different users to multiple different service providers, comprising:
-
an authentication server configured to store (i) a provider identifier for each of the multiple different service providers in association with provider authentication policy requirements for the applicable service provider and (ii) a user identifier for each of the multiple different users in association with validation information for the application user; a first software application configured to be downloaded to a first device operable by a first user of the multiple different users, and configured to transmit a login request to the first user of the multiple different service providers via the network; the authentication server configured to receive from a first network server associated with a first service provider via the network, (i) a request for a random number and (ii) other information, wherein the authentication server is configured to transmit the random number to the first network server via the network after receiving the request for the random number, wherein the first software application is configured to receive from the first network server the transmitted random number; and a second software application configured to be downloaded to a second device operable by the first user, and configured (i) to receive an input transferring the further transmitted random number to it from the first device, and (ii) to further transmit the input random number and a request of the first user to be authenticated to the authentication server via the network; wherein the authentication server is further configured to transmit, after transmission by the second device of the random number and authentication request, the stored first provider identifier and the stored associated first provider authentication policy requirements, and to further transmit the transmitted other information, to the second device via the network; wherein the second software application downloaded to the second device is further configured to transmit, in response to the transmitted first provider authentication policy requirements, a first user identifier and user input validation information to the authentication server via the network; wherein the authentication server is further configured to match the transmitted first user identifier to the stored first user identifier, to determine that the transmitted validation information corresponds to the stored first service provider authentication policy requirements, and to compare the transmitted validation information with the validation information stored in association with the first user identifier to authenticate the first user; wherein the second software application downloadable to the second device is further configured to transmit a message through the second device, including the transferred random number and the further transmitted other information, signed with a credential of the first user, to the authentication server via the network; and wherein the authentication server is further configured to transmit notice of authentication of the first user and to further transmit the received signed message to the network server via the network. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17)
-
-
18. The network system of clam 1, wherein:
-
the authentication server is configured to receive an enrollment request and a public key of a private/public key pair of the first service provider via the network, the private key of the first service provider private/public key pair is known only to the network server; and the authentication server is further configured to (i) store the transmitted first provider public key, and (ii) transmit a certificate, including the first provider public key, signed with a private key of a private/public key pair of the authentication server to the network server via the network, the public key of the authentication server private/public key pair is known to the network server.
-
-
19. The network system of clam 18, wherein:
-
the second software application is further configured to transmit an enrollment request and a public key of a private/public key pair of the first user to the authentication server via the network, the private key of the first user private/public key pair is known only to the second device; and the authentication server is further configured to (i) store the transmitted first user public key, and (ii) transmit a certificate, including the first user public key, signed with the authentication server private key to the second device via the network, the public key of the authentication server private/public key pair is known to the second device.
-
Specification