Code-based authorization of mobile device

Patent metadata

Field	Value
Publication number	US-2017188237-A1
Application number	US-201715461591-A
Country	US
Kind code	A1
Filing date	Mar 17, 2017
Priority date	Aug 9, 2012
Publication date	Jun 29, 2017
Grant date	—

Abstract

A system and method for authenticating mobile communications devices. The method comprises: generating a code corresponding to a user configured to be rendered on a rendering device to produce a rendered code, the rendered code being readable by a mobile communications device having a code reading device, the rendered code comprising a secret token; storing the secret token along with information identifying the user on a first storage device; providing the code to the user; receiving, at the authentication server, a setup message from the mobile device, the message includes a device identifier and the secret token; comparing the received secret token and the secret token stored on the first storage device; if the received secret token matches the secret token stored on the first storage device, storing, on a second storage device, information identifying the user and a trusted device value corresponding to the device identifier.

First claim

What is claimed is:

1 . A method, comprising:
storing a credential associated with a user on a first storage device associated with an authentication server; generating, at the authentication server, a code corresponding to a user and comprising the credential; sending, by the authentication server, the code to a first electronic device; and receiving, at the authentication server, at least one authentication message from a second electronic device, wherein the second electronic device was provided the code by the first electronic device, and wherein the at least one authentication message comprises the credential and authentication information, wherein the second electronic device obtained the credential from the code.

2 . The method of claim 1 , wherein the authentication information comprises information identifying the user associated with the credential.

3 . The method of claim 2 , wherein the authentication information further comprises a password associated with the user.

4 . The method of claim 1 , further comprising:
authenticating, by the authentication server, the user based on one or more of the credential and the authentication information included in the at least one authentication message.

5 . The method of claim 4 , wherein the authentication information comprises one or more of information identifying the user associated with the credential, and a password associated with the user, and
wherein the authenticating of the user comprises:
authenticating, by the authentication server, the user using one or more of the credential, the information identifying the user associated with the credential, and the password associated with the user.

6 . The method of claim 4 , wherein the authenticating of the user further comprises:
determining, by the authentication server, whether the credential and the authentication information included in the at least one authentication message matches the information identifying the user and the credential associated with information identifying the user that is stored on the first storage device associated with the authentication server.

7 . The method of claim 6 , in response to determining that the credential and the authentication information included in the at least one authentication message matches the information identifying the user and the credential associated with information identifying the user that is stored on the first storage device associated with the authentication server, storing, on a second storage device associated with the authentication server, information identifying the user and a trusted electronic device value corresponding to an electronic device identifier that is transmitted in the at least one authentication message.

8 . The method of claim 7 , further comprising:
receiving, at the authentication server, information pertaining to a request by a requesting electronic device for access to a web service, the information comprising a requesting electronic device identifier; determining whether the requesting electronic device identifier corresponds to the trusted electronic device value stored on the second storage device; and denying access to the web service if the requesting electronic device identifier does not correspond to the trusted electronic device value.

9 . The method of claim 1 , wherein the code comprises an identifier of a server for sending the at least one authentication message.

10 . The method of claim 1 , wherein providing the code to the second electronic device by the first electronic device comprises one or more of:
displaying the code on a display unit; and reproducing the code on a readable medium.

11 . The method of claim 1 , wherein the code is a Quick Response (QR) code.

12 . A system, comprising:
an authentication server; a first storage device associated with the authentication server; and a second storage device associated with the authentication server, the authentication server comprising at least one processor, the at least one processor configured to:
store a credential associated with a user on the first storage device associated with the authentication server;
generate a code corresponding to a user and comprising the credential;
sending the code to a first electronic device; and
receive at least one authentication message from the a second electronic device, the at least one authentication message comprising the credential and authentication information, wherein the second electronic device received the code from the first electronic device and obtained the credential from the code.

13 . The system of claim 12 , wherein the authentication information comprises information identifying the user associated with the credential.

14 . The system of claim 13 , wherein the authentication information further comprises a password associated with the user.

15 . The system of claim 12 , wherein the at least one processor is further configured to:
authenticate the user based on one or more of the credential and the authentication information included in the at least one authentication message.

16 . The system of claim 15 , wherein the authentication information comprises one or more of information identifying the user associated with the credential, and a password associated with the user, and
wherein the at least one processor is further configured to authenticate the user using one or more of the credential, the information identifying the user associated with the credential, and the password associated with the user.

17 . The system of claim 15 , wherein the at least one processor is further configured to determine whether the credential and the authentication information included in the at least one authentication message matches the information identifying the user and the credential associated with information identifying the user that is stored on the first storage device associated with the authentication server.

18 . The system of claim 17 , wherein the at least one processor is further configured to, in response to determining that the credential and the authentication information included in the at least one authentication message matches the information identifying the user and the credential associated with information identifying the user that is stored on the first storage device associated with the authentication server, store, on the second storage device associated with the authentication server, information identifying the user and a trusted electronic device value corresponding to an electronic device identifier that is transmitted in the at least one authentication message.

19 . The system of claim 18 , wherein the at least one processor is further configured to:
receive information pertaining to a request by a requesting electronic device for access to a web service, the information comprising a requesting electronic device identifier, determine whether the requesting electronic device identifier corresponds to the trusted electronic device value stored on the second storage device, and deny access to the web service if the requesting electronic device identifier does not correspond to the trusted electronic device value.

20 . The system of claim 12 , wherein the code comprises an identifier of a server for sending the at least one authentication message.

Assignees

• D2L Corp

Inventors

• Auger Jeremy

Classifications

• G06F21/36

  by graphic or iconic representation · CPC title

• H04W12/06 Primary

  Authentication · CPC title

• G06K7/1417

  2D bar codes · CPC title

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title

• H04L63/0853

  using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234) · CPC title