User-friendly multifactor authentication

Patent metadata

Field	Value
Publication number	US-10148629-B1
Application number	US-201314034527-A
Country	US
Kind code	B1
Filing date	Sep 23, 2013
Priority date	Sep 23, 2013
Publication date	Dec 4, 2018
Grant date	Dec 4, 2018

Abstract

An application executing on a user device can receive a request to access a remote computer system. The application can automatically obtain an authentication code that is generated based at least in part on a seed value, which can be stored in the user device. The application can automatically generate an authentication request based at least in part on the access information and the authentication code, and transmit the authentication request to remote computer system.

First claim

What is claimed is:

1. A computer-implemented method for secure access, the method comprising:
an automated process of multiple factor authentication, the process comprising:
storing, in a computer device, a seed value used to generate an authentication code for accessing a computer resource service, wherein the seed value is securely maintained via a self-contained security feature of the computer device;
receiving, via a user interface of the computer device, a request to access the computer resource service, wherein the request is associated with access information for obtaining access to the computer resource service, and wherein the access information comprises at least one of a user identifier;
obtaining the access information as a first authentication factor;
subsequent to receiving the request to access the computer resource service, automatically generating an authentication code as a second authentication factor based at least in part on the seed value, wherein said automatically generating the authentication code includes automatically generating the authentication code without requiring user interaction with the computer device between receiving the access request and generating of the authentication code;
automatically generating, by the computer device, an authentication request based at least in part on multiple independent factors including at least:
the access information,
the automatically generated authentication code, and
a signature based on a combination of the authentication code and the access information; and

providing the automatically generated authentication request for transmission to the computer resource service, wherein the automatically generated authentication request provided to the computer resource service includes at least the multiple independent factors of:
the access information,
the automatically generated authentication code that is based at least in part on the securely maintained seed value that is securely maintained via the self-contained security feature of the computer device, and
the signature.

2. The computer-implemented method of claim 1 , wherein providing the authentication request comprises:
displaying, on a display of the computer device, the authentication code, wherein the authentication code can be utilized to access the computer resource service from a second computer device.

3. The computer-implemented method of claim 1 , wherein the computer resource service is a web service and wherein the authentication request is transmitted via a password login web page.

4. A non-transitory computer readable medium storing instructions that cause one or more processors of a computer system to implement multiple factor authentication that causes the one or more processors to:
obtain, by an application executing on a user device, a request to access a remote computer system, wherein the request is associated with access information for obtaining access to the remote computer system;
obtain the access information as a first authentication factor, wherein the access information comprises at least one of a user identifier or a user secret;
subsequent to receiving the request to access the remote computer system, automatically generate, by the application, an authentication code as a second authentication factor based at least in part on a seed value, wherein the seed value is securely maintained via a self-contained security feature of the user device, wherein the automatically generated authentication code is automatically generated without requiring user interaction with the user device between the access request and generation of the authentication code;
automatically generate, by the application, an authentication request based at least in part on the access information and the automatically-generated authentication code, wherein the authentication request includes at least the multiple independent factors of:
at least one of the user secret or a signature based at least in part on the user secret,
the automatically generated authentication code, and
a signature based on a combination of the authentication code and the access information; and

transmit, by the application, the automatically-generated authentication request to a remote computer system, wherein the authentication request that is transmitted to the remote computer system includes:
the at least one of the user secret or the signature based at least in part on the user secret, and
the automatically generated authentication code that is based at least in part on the securely maintained seed value that is securely maintained via the self-contained security feature of the user device, and
the signature.

5. The non-transitory computer readable medium of claim 4 , further comprising instructions that cause the one or more processors of the computer system to:
generate the signature based at least in part on the user secret and the authentication code, wherein the signature is generated by an asymmetric signature algorithm or a symmetric signature algorithm.

6. The non-transitory computer readable medium of claim 4 , wherein the authentication code is generated by an Initiative For Open Authentication (OATH) HOTP algorithm or OATH TOTP algorithm.

7. The non-transitory computer readable medium of claim 4 , further comprising instructions that cause the one or more processors of the computer system to:
send, by the application to the remote computer system, a request for the seed value;
receive, by the application, the seed value; and
store, by the application, the seed value used to generate the authentication code.

8. The non-transitory computer readable medium of claim 7 , wherein the request for the seed value is part of a request to access the remote computer system.

9. The non-transitory computer readable medium of claim 7 ,
wherein the request for the seed value includes identity information of the application, and
wherein a security server verifies the identity information of the application prior to sending the seed value.

10. The non-transitory computer readable medium of claim 4 , further comprising instructions that cause the one or more processors of the computer system to:
generate, by the application, the seed value;
store, by the application, the seed value used to generate the authentication code; and
send, by the application, the seed value to the remote computer system.

11. The non-transitory computer readable medium of claim 4 , further comprising instructions that cause the one or more processors of the computer system to:
perform a key agreement protocol to establish a shared secret between the application and the remote computer system, wherein the seed value is based on the shared secret.

12. The non-transitory computer readable medium of claim 4 , wherein to obtain the authentication code the instructions cause the computer system to:
send, to a separate software resource of the user device, a request for the authentication code, wherein the separate software resource stores the seed value; and
receive, from the separate software resource, the authentication code.

13. The non-transitory computer readable medium of claim 12 , wherein the separate software resource is a software library.

14. The non-transitory computer readable medium of claim 4 , further comprising instructions that cause the one or more processors of the computer system to:
determine, by the application, a security policy governing access to the remote computer system, wherein the security policy comprises at least one of a location-based policy, a time-based policy, a device fingerprintin

Assignees

• Amazon Tech Inc

Inventors

• Roth Gregory Branchek
• Wesley-Smith Ian Nicholas
• Ilac Cristian M
• Ward Patrick James

Classifications

• H04L63/0838 Primary

  using one-time-passwords · CPC title

• H04L2463/081

  applying self-generating credentials, e.g. instead of receiving credentials from an authority or from another peer, the credentials are generated at the entity itself · CPC title

• H04L2463/082

  applying multi-factor authentication · CPC title

• H04L63/083

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• H04L63/08 Primary

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title