Binding to a user device

Patent metadata

Field	Value
Publication number	US-2016277383-A1
Application number	US-201615004297-A
Country	US
Kind code	A1
Filing date	Jan 22, 2016
Priority date	Mar 16, 2015
Publication date	Sep 22, 2016
Grant date	—

Abstract

Providing access to a protected resource includes obtaining a first authentication factor for a user that is accessing the resource using a computing device, prompting the user to provide a second authentication factor, accessing the second authentication factor using a pairing code, determining if the second authentication factor is bound to the computing device, and allowing the user to access the protected resource in response to the first and second authentication factors being valid and the second authentication factor being bound to the computing device. The user may be prompted to tap a card to provide the second authentication factor. The first authentication factor may be a login id and password combination. The login id and password may be cached in the computing device. The second authentication factor may be a security card. Information on the security card may be encrypted and may be accessible using a pairing code.

First claim

What is claimed is:

1 . A method of providing access to a protected resource, comprising:
obtaining a first authentication factor for a user that is accessing the resource using a computing device; prompting the user to provide a second authentication factor; accessing the second authentication factor using a pairing code; determining if the second authentication factor is bound to the computing device; and allowing the user to access the protected resource in response to the first and second authentication factors being valid and the second authentication factor being bound to the computing device.

2 . A method, according to claim 1 , wherein the user is prompted to tap a card to provide the second authentication factor.

3 . A method, according to claim 1 , wherein the first authentication factor is a login id and password combination.

4 . A method, according to claim 3 , wherein at least one of: the login id, the password, and a corresponding ticket is cached in the computing device.

5 . A method, according to claim 1 , wherein the second authentication factor is a security card.

6 . A method, according to claim 5 , wherein information on the security card is encrypted and is accessible using a pairing code.

7 . A method, according to claim 6 , wherein the information on the security card includes at least one of: a one time password and a serial number for the card.

8 . A method, according to claim 7 , wherein the information on the security card is protected for integrity and authenticated.

9 . A method, according to claim 7 , further comprising:
binding the security card to the computing device by storing data that includes at least one of: the serial number for the card and a serial number for the computing device.

10 . A method, according to claim 7 , further comprising:
binding the security card to a user by storing data that includes at least one of: the serial number for the card and an identifier for the user.

11 . A method, according to claim 1 , wherein allowing the user to access the protected resource includes generating an ADFS token for the user and wherein the AFDS token allows access to the resource.

12 . A method, according to claim 1 , wherein the second authentication factor is one of: a cell phone and a security token having wireless communication capability.

13 . A non-transitory computer-readable medium containing software that provides access to a protected resource, the software comprising:
executable code that obtains a first authentication factor for a user that is accessing the resource using a computing device; executable code that prompts the user to provide a second authentication factor; executable code that accesses the second authentication factor using a pairing code; executable code that determines if the second authentication factor is bound to the computing device; and executable code that allows the user to access the protected resource in response to the first and second authentication factors being valid and the second authentication factor being bound to the computing device.

14 . A non-transitory computer-readable medium, according to claim 13 , wherein the user is prompted to tap a card to provide the second authentication factor.

15 . A non-transitory computer-readable medium, according to claim 13 , wherein the first authentication factor is a login id and password combination.

16 . A non-transitory computer-readable medium, according to claim 15 , wherein at least one of: the login id, the password, and a corresponding ticket is cached in the computing device.

17 . A non-transitory computer-readable medium, according to claim 13 , wherein the second authentication factor is a security card.

18 . A non-transitory computer-readable medium, according to claim 17 , wherein information on the security card is encrypted and is accessible using a pairing code.

19 . A non-transitory computer-readable medium, according to claim 18 , wherein the information on the security card includes at least one of: a one time password and a serial number for the card.

20 . A non-transitory computer-readable medium, according to claim 19 , wherein the information on the security card is protected for integrity and authenticated.

21 . A non-transitory computer-readable medium, according to claim 19 , the software further comprising:
executable code that binds the security card to the computing device by storing data that includes at least one of: the serial number for the card and a serial number for the computing device.

22 . A non-transitory computer-readable medium, according to claim 19 , the software further comprising:
executable code that binds the security card to a user by storing data that includes at least one of: the serial number for the card and an identifier for the user.

23 . A non-transitory computer-readable medium, according to claim 13 , wherein allowing the user to access the protected resource includes generating an ADFS token for the user and wherein the AFDS token allows access to the resource.

24 . A non-transitory computer-readable medium, according to claim 13 , wherein the second authentication factor is one of: a cell phone and a security token having wireless communication capability.

Assignees

• Assa Abloy Ab

Inventors

• Guyomarc'H Francois-Eric Michel
• Holland James William

Classifications

• H04W12/06

  Authentication · CPC title

• H04L63/0853

  using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234) · CPC title

• H04L63/083 Primary

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• H04W12/50

  Secure pairing of devices · CPC title

• H04L2463/082

  applying multi-factor authentication · CPC title