Access to vaulted credentials using login computer and mobile computing device

Patent metadata

Field	Value
Publication number	US-8959583-B2
Application number	US-201313759282-A
Country	US
Kind code	B2
Filing date	Feb 5, 2013
Priority date	Feb 5, 2013
Publication date	Feb 17, 2015
Grant date	Feb 17, 2015

Abstract

According to an example computer-implemented method, a password management server receives an access request message from a login computer at which a resource requiring vaulted credentials has been requested. The access request message identifies the requested resource and the login computer. A session identifier (ID) is generated for enabling release of the vaulted credentials. The session ID is linked to the login computer and to the requested resource. The session ID is transmitted to the login computer. Responsive to receiving a value indicative of the session ID from a mobile computing device, the password management server transmits the vaulted credentials to the login computer or to the mobile computing device.

First claim

What is claimed is:

1. A computer-implemented method comprising:
receiving, at a password management server, an access request message from a login computer at which a resource requiring vaulted credentials has been requested, the access request message identifying the requested resource and the login computer;
generating a session identifier (ID) for enabling release of the vaulted credentials, the session ID being linked to the login computer and to the requested resource;
transmitting the session ID to the login computer; and
responsive to receiving a value indicative of the session ID from a mobile computing device, transmitting the vaulted credentials to the login computer or to the mobile computing device.

2. The method of claim 1 , wherein said transmitting the session ID comprises transmitting an encoded image containing the session ID.

3. The method of claim 1 , wherein transmitting the vaulted credentials to the login computer or to the mobile computing device comprises:
transmitting the vaulted credentials to the login computer if the login computer supports automatic login to the requested resource; and
transmitting the vaulted credentials to the mobile computing device if the login computer does not support automatic login to the requested resource.

4. A computer-implemented method comprising:
transmitting an access request message from a login computer to a password management server, the access request message identifying a requested resource and the login computer;
receiving, responsive to the access request message, an access response from the password management server, the access response including a session identifier (ID) linked to the login computer and to the requested resource;
displaying an encoded image containing the session ID to a mobile computing device via a display of the login computer; and
receiving vaulted credentials from the password management server responsive to the password management server receiving a value indicative of the session ID, decoded from the encoded image, from the mobile computing device.

5. The method of claim 4 , further comprising:
performing, by the login computer, an automatic login using the vaulted credentials received from the password management server to obtain access to the requested resource.

6. The method of claim 4 , further comprising:
generating, by the login computer, the encoded image containing the session ID.

7. The method of claim 6 , wherein said generating the encoded image is repeated to generate a different encoded image for display responsive to a predetermined time period transpiring after display of the encoded image without receiving the vaulted credentials from the password management server.

8. The method of claim 4 , further comprising:
receiving, at the login computer, the encoded image containing the session ID from the password management server.

9. The method of claim 4 , wherein the encoded image includes at least one of a Quick Response (QR) code and a bar code.

10. A computer-implemented method comprising:
reading, by a mobile computing device, an encoded image from an electronic display of a login computer, the encoded image including a session identifier (ID) linked to the login computer and to a requested resource;
decoding, by the mobile computing device, the encoded image to obtain the session ID; and
transmitting, from the mobile computing device to a password management server, a value indicative of the session ID to release vaulted credentials for the requested resource to the login computer or to the mobile computing device.

11. The method of claim 10 , wherein said reading the encoded image using a mobile computing device comprises recording a copy of the encoded image via a camera of the mobile computing device.

12. A computing device comprising:
a transceiver in a password management server, and
a controller in the password management server, the controller being configured to:
receive, via the transceiver, an access request message from a login computer at which a resource requiring vaulted credentials has been requested, the access request message identifying the requested resource and the login computer;
generate a session identifier (ID) for enabling release of the vaulted credentials, the session ID being linked to the login computer and to the requested resource;
transmit, via the transceiver, the session ID to the login computer; and
responsive to receiving, via the transceiver, a value indicative of the session ID from a mobile computing device, transmit the vaulted credentials to the login computer or to the mobile computing device.

13. The computing device of claim 12 , wherein the controller is configured to transmit the session ID by transmitting, via the transceiver, an encoded image containing the session ID.

14. The computing device of claim 12 , wherein the controller is configured to transmit the vaulted credentials to the login computer or to the mobile computing device by being configured to:
transmit the vaulted credentials to the login computer if the login computer supports automatic login to the requested resource; and
transmit the vaulted credentials to the mobile computing device if the login computer does not support automatic login to the requested resource.

15. A computing device comprising:
a controller in a login computer, the controller being configured to:
transmit an access request message from the login computer to a password management server, the access request message identifying a requested resource and the login computer; and
receive, responsive to the access request message, an access response from the password management server, the access response including a session identifier (ID) linked to the login computer and to the requested resource; and

a display operatively connected to the login computer and configured to display an encoded image containing the session ID to a mobile computing device;
wherein the controller is further configured to:
receive vaulted credentials from the password management server responsive to the password management server receiving a value indicative of the session ID, decoded from the encoded image, from the mobile computing device.

16. The computing device of claim 15 , wherein the controller is further configured to:
perform an automatic login using the vaulted credentials received from the password management server to obtain access to the requested resource.

17. The computing device of claim 15 , wherein the controller is further configured to:
generate the encoded image containing the session ID.

18. The computing device of claim 17 , wherein the controller is configured to repeat the generation of the encoded image to generate a different encoded image for display responsive to a predetermined time period transpiring after display of the encoded image without receiving the vaulted credentials from the password management server.

19. The computing device of claim 15 , wherein the controller is further configured to:
receive the encoded image containing the session ID from the password management server.

20. The computing device of claim 15 , wherein the encoded image includes at least one of a Quick Response (QR) code and a bar code.

21. A computing device comprising:
a controller in a mobile computing device, the controller being configured to:
read an encoded image from an electronic display of a login computer, the encoded image including a session identifier (I

Assignees

• Ca Inc

Inventors

• Fadida Itzhak
• Balzam Guy
• Jerbi Amir

Classifications

• H04L63/083 Primary

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• G06F21/31

  User authentication · CPC title

• G06F21/35

  communicating wirelessly · CPC title

• H04W12/068

  using credential vaults, e.g. password manager applications or one time password [OTP] applications · CPC title

• H04L63/0853

  using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234) · CPC title