Securing remote authentication

Patent metadata

Field	Value
Publication number	US-10050963-B2
Application number	US-201615083935-A
Country	US
Kind code	B2
Filing date	Mar 29, 2016
Priority date	Mar 29, 2016
Publication date	Aug 14, 2018
Grant date	Aug 14, 2018

Abstract

Authenticating a secure session between a first user entity and an identity provider using a second user entity. The method includes receiving a request for a session from an entity that purports to be the first user entity. The method further includes sending authentication context from the request, and wherein the authentication context for the request arrives at the second user entity. The method further includes receiving an indication that the authentication context has been verified. As a result, the method further includes authenticating a secure session between a first user entity and an identity provider or approving a secure transaction.

First claim

What is claimed is:

1. A system comprising:
one or more processors; and
one or more computer-readable media having stored thereon instructions that are executable by the one or more processors to configure the computer system to authenticate a secure session between a primary entity of the user and an identity provider, by using a secondary entity of the user, including instructions that are executable to configure the computer system to perform at least the following:
receiving at an identity provider a request for a session from an entity that purports to be a primary entity of the user;
sending from the identity provider to the entity an authentication context based on the request;
receiving at the entity the authentication context;
sending the authentication context from the entity to a secondary entity of the user;
verifying at the secondary entity that the authentication context sent by the entity corresponds to the primary entity of the user, and that the entity that sent the request is in fact the primary entity of the user;
based on the verification, the secondary entity signing the authentication context and returning the signed authentication context to the entity;
the entity forwarding the signed authentication text to the identity provider; and
as a result, the identity provider authenticating a secure session or approving a secure transaction between the entity that has been verified as the primary entity of the user and the identity provider.

2. The system of claim 1 , wherein the authentication context comprises a location of the primary entity of the user.

3. The system of claim 1 , wherein the authentication context comprises at least one of an IP address for the primary entity of the user, or process flow information regarding authentication between the primary entity of the user and the identity provider.

4. In a computing environment a method of authenticating a secure session between a first user entity that is a primary entity of a user and an identity provider, by using a second user entity that is a secondary entity of the user, the method comprising:
receiving at an identity provider a request for a session from an entity that purports to be a first user entity that is a primary entity of the user;
sending from the identity provider to the entity an authentication context based on the request;
receiving at the entity the authentication context;
sending the authentication context from the entity to a second user entity that is a secondary entity of the user;
verifying at the second user entity that the authentication context sent by the entity corresponds to the first user entity that is the primary entity of the user, and that the entity that sent the request is in fact the primary entity of the user;
based on the verification, the second user entity signing the authentication context and returning the signed authentication context to the entity;
the entity forwarding the signed authentication text to the identity provider; and
as a result, the identity provider authenticating a secure session or approving a secure transaction between the entity that has been verified as the primary entity of the user and the identity provider.

5. The method of claim 4 , wherein the authentication context comprises a location of the first user entity.

6. The method of claim 4 , wherein the authentication context comprises an IP address for the first user entity.

7. The method of claim 4 , wherein the authentication context comprises process flow information regarding authentication between the first user entity and the identity provider.

8. The method of claim 4 , wherein the authentication context for the request arrives at the second user entity by being sent by the identity provider directly to the second user entity rather than being sent by the entity.

9. The method of claim 8 , wherein the authentication context is automatically sent to the second user entity as a result of the second user entity subscribing to receive notifications.

10. The method of claim 4 , wherein the authentication context for the request arrives at the second user entity by being sent by the identity provider directly to the first user entity, which then sends the authentication context to the second user entity.

11. The method of claim 4 , further comprising receiving the authentication context signed by the second user entity.

12. The method of claim 4 , wherein the authentication context has been verified at the second user entity by receiving at the second user entity user input indicating that the authentication context is valid.

13. The method of claim 4 , wherein the signed authentication context is sent directly to the identity provider rather than returning the signed authentication context to the first user entity.

14. In a computing environment a method of authenticating a secure session between a primary entity of the user and an identity provider, by using a secondary entity of the user, the method comprising:
at a primary entity of the user, sending to an identity provider a request for a secure session;
receiving at a secondary entity of the user an authentication context based on the request, wherein the authentication context is prepared by the identity provider;
the user verifying at the secondary entity of the user that the received authentication context corresponds to the primary entity of the user;
based on the verification, the secondary entity signing the authentication context;
receiving at the identity provider the signed authentication context; and
as a result, the identity provider authenticating a secure session or approving a secure transaction between the primary entity of the user and the identity provider.

15. The method of claim 14 , wherein the entity receives the authentication context from the primary entity.

16. The method of claim 15 , wherein the authentication context comprises one of a location of the primary entity of the user and an IP address for the primary entity of the user.

17. The method of claim 15 , wherein the authentication context is received by the second entity using one or more of near-field communication Bluetooth, a scanned QR code, Wi-Fi, Ethernet, ZigBee, or peer to peer.

18. The method of claim 14 , wherein the secondary entity receives the authentication context from the identity provider.

19. The method of claim 18 , wherein the authentication context comprises a location of the primary entity and the location is received from the identity provider to the second entity by one or more of an established notification channel, sms, or secure authenticated connection.

20. The method of claim 14 , wherein the authentication context comprises at least one of an IP address for the primary entity, a location of the primary entity, or process flow information regarding authentication between the primary entity and the identity provider.

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Kamel Tarek B
• Frei Adrian
• Chou James Shang Kai

Classifications

• H04L67/14

  Session management (for real-time applications in data packet communications networks H04L65/1066) · CPC title

• H04L63/0876 Primary

  based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint · CPC title

• H04L63/0853

  using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234) · CPC title

• H04L63/0492

  by using a location-limited connection, e.g. near-field communication or limited proximity of entities · CPC title

• G06F21/35 Primary

  communicating wirelessly · CPC title