System and method for converting one-time passcodes to app-based authentication

Patent metadata

Field	Value
Publication number	US-2016197914-A1
Application number	US-201514962294-A
Country	US
Kind code	A1
Filing date	Dec 8, 2015
Priority date	Jan 6, 2015
Publication date	Jul 7, 2016
Grant date	—

Abstract

A method comprising includes detecting, in response to a user access attempt on an electronic access device, a one-time passcode authentication event; receiving, at an electronic authenticating device, notification of the one-time passcode authentication event; retrieving, in response to the notification, a one-time passcode from the authenticating device; transmitting the one-time passcode from the authenticating device to a facilitator software instance operating on the access device; and enabling population, using the facilitator software instance, of a one-time passcode entry form with the one-time passcode.

First claim

What is claimed is:

1 . A method comprising:
detecting, in response to a user access attempt on a first electronic device, a one-time passcode authentication event; wherein detecting the event comprises detecting web content referencing a one-time passcode using a browser extension operating on the first electronic device; wherein detecting the event further comprises detecting an identity of an outside service for which access is attempted; identifying, using the outside service identity and a user identity, a second electronic device as an authenticating device; wherein the user identity is associated with the browser extension; transmitting a notification of the one-time password authentication event from the first electronic device to the authenticating device; wherein the notification comprises OTP retrieval information; retrieving, in response to the notification and according to the OTP retrieval information, a one-time passcode from the authenticating device; transmitting the one-time passcode from the authenticating device to the browser extension operating on the first electronic device; and populating, using the browser extension, a one-time passcode entry form with the one-time passcode.

2 . The method of claim 1 , wherein transmitting the notification of the one-time password authentication event from the first electronic device to the authenticating device comprises transmitting the notification from the first electronic device to a cloud relay and transmitting the notification from the cloud relay to the authenticating device; wherein transmitting the one-time passcode from the authenticating device to the browser extension comprises transmitting the one-time passcode from the authenticating device to the cloud relay and transmitting the one-time passcode from the cloud relay to the first electronic device; wherein identifying the second electronic device as the authenticating device comprises identifying the second electronic device at the cloud relay using a database accessible to the cloud relay.

3 . The method of claim 2 , further comprising requesting user approval on the authenticating device; wherein transmitting the one-time passcode comprises transmitting the one-time passcode only after receiving user approval.

4 . The method of claim 3 , further comprising retrieving a set of stored primary credentials, the set associated with the user identity and the outside service identity; transmitting the set of stored primary credentials to the browser extension; and populating, using the browser extension, at least one primary credential field with the set of stored primary credentials.

5 . The method of claim 4 , wherein receiving user approval comprises displaying an approval interface on a display of the authenticating device; wherein the approval interface comprises information pertaining to the outside service identity and a selectable approval indicator; and detecting user selection of the selectable approval indicator.

6 . The method of claim 5 , wherein the OTP retrieval information comprises information enabling the generation of the one-time passcode; the method further comprising, in response to receiving user approval, generating the one-time passcode based on the OTP retrieval information.

7 . A method comprising:
detecting, in response to a user access attempt on an electronic access device, a one-time passcode authentication event; receiving, at an electronic authenticating device, notification of the one-time passcode authentication event; retrieving, in response to the notification, a one-time passcode from the authenticating device; transmitting the one-time passcode from the authenticating device to a facilitator software instance operating on the access device; and enabling population, using the facilitator software instance, of a one-time passcode entry form with the one-time passcode.

8 . The method of claim 7 , wherein the access device is also the authentication device.

9 . The method of claim 7 , wherein detecting the one-time passcode authentication event comprises monitoring incoming communications at the authenticating device, analyzing the incoming communications at the authenticating device for OTP authentication information, and detecting the one-time passcode authentication event, at the authenticating device, from the OTP authentication information; wherein the incoming messages are sent from an outside service.

10 . The method of claim 9 , further comprising identifying the access device based on at least one of an identity of the outside service and user input at the authenticating device.

7 . method of claim 7 , wherein detecting the one-time passcode authentication event comprises detecting, using the facilitator software instance, the one-time passcode authentication event at the access device.

12 . The method of claim 11 , wherein detecting the one-time passcode authentication event comprises monitoring user web browser usage; analyzing web content; and identifying the one-time passcode authentication event based on the web content.

13 . The method of claim 11 , wherein detecting the one-time passcode authentication event comprises receiving manual notification from a user that the one-time passcode authentication event has occurred.

14 . The method of claim 11 , further comprising requesting user approval on the authenticating device; wherein transmitting the one-time passcode comprises transmitting the one-time passcode only after receiving user approval on the authenticating device.

15 . The method of claim 14 , wherein receiving user approval comprises receiving a biometric identifier of an authorized user of the authenticating device.

16 . The method of claim 11 , further comprising generating, based on the notification, the one-time passcode at the authenticating device.

17 . The method of claim 11 , further comprising transmitting the notification from the access device to a cloud relay and transmitting the notification from the cloud relay to the authenticating device; wherein transmitting the one-time passcode from the authenticating device to the facilitator software instance comprises transmitting the one-time passcode from the authenticating device to the cloud relay and transmitting the one-time passcode from the cloud relay to the facilitator software instance.

18 . The method of claim 11 , further comprising identifying the authenticating device based on at least one of user input and a database, the database accessible by and linked to the facilitator software instance.

19 . The method of claim 11 , wherein retrieving the one-time passcode comprises monitoring incoming communications at the authenticating device, analyzing the incoming communications at the authenticating device for the one-time passcode, and retrieving the one-time passcode from at least one of the incoming communications.

20 . The method of claim 11 , wherein retrieving the one-time passcode comprises opening an OTP generating application and retrieving the one-time passcode from the OTP generating application.

21 . The method of claim 11 , wherein enabling population comprises storing the one-time passcode in a copy-paste clipboard of the access device.

22 . The method of claim 11 , wherein enabling population comprises prompting a user of the access device to select a field for OTP entry and automatically filling the field with the one-time passcode after user selection.

23

Assignees

• Duo Security Inc

Inventors

• Oberheide Jon
• Goodman Adam
• Czub Chris
• Garrity Patrick

Classifications

• H04W12/04

  Key management, e.g. using generic bootstrapping architecture [GBA] · CPC title

• H04L63/0838 Primary

  using one-time-passwords · CPC title

• H04L63/0853

  using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234) · CPC title

• H04L63/0869

  for achieving mutual authentication (cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273) · CPC title

• H04L63/18

  using different networks or channels, e.g. using out of band channels (cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215) · CPC title