Securing multifactor authentication

Patent metadata

Field	Value
Publication number	US-9639825-B1
Application number	US-201113159840-A
Country	US
Kind code	B1
Filing date	Jun 14, 2011
Priority date	Jun 14, 2011
Publication date	May 2, 2017
Grant date	May 2, 2017

Abstract

In certain embodiments, a system receives a request sent by a device to authorize an operation. The system initiates display of an image encoding a challenge code to allow the device to capture the image and extract the challenge code. The device calculates a response using the challenge code and a seed, and sends the response to the system. In certain examples, the device may send the request over a first channel and the response over a second channel distinct from the first channel. In other examples, the device displays the response and a user inputs the response into a computing system to send to the system.

First claim

What is claimed is:

1. A system comprising:
one or more memories that store an image comprising an optical machine-readable representation of a challenge code; and
one or more processing units cause the system to:
receive a request sent by a computing system to authorize an operation, the request received over a first channel, the computing system having a seed;
provide to the computing system information configured to cause the computing system to display the image and to allow a communications device to capture a challenge code from the image, the image comprising the optical machine-readable representation of the challenge code that can be extracted from the image by the communications device, the communications device including a networking interface for communicating with the system over a second channel; and
receive, from the communications device, a response authorizing the operation, the response calculated using the challenge code captured by the communications device and the seed, the response received over the second channel distinct from the first channel.

2. The system of claim 1 , wherein the one or more processing units further:
initiate, by the computing system, display of a confirmation screen describing the operation.

3. The system of claim 1 , wherein the one or more processing units further:
request, in response to the response authorizing the operation received from the communications device, user authentication information to be input into the communications device; and
receive confirmation that the user authentication information has been input into the communications device.

4. The system of claim 3 , wherein receiving confirmation that the user authentication information has been input into the device further comprises a user response received from the device, the user response including user input into the device.

5. The system of claim 1 , wherein the one or more processing units further:
provide to the computing system, an initial image comprising authentication information configured to allow the communications device to obtain the seed by at least capturing the authentication information from the image.

6. The system of claim 1 , wherein the one or more processing units further:
provide to the computing system, an initial image comprising key information configured to allow the communications device to obtain the seed by at least:
capturing the key information from the image; and
determining the seed based at least in part on the captured key information.

7. The system of claim 1 , wherein the communications device comprising at least one of the following:
a general computing device;
a mobile device; or
a dedicated authentication device.

8. The system of claim 1 , wherein the one or more processing units further provide an authorization request to the computing system, the authorization request requesting the response authorizing the operation from the device and provided in response to the received request sent by the computing system to authorize the operation.

9. The system of claim 1 , wherein the response is calculated, at least in part, by applying a mathematical function to the seed and a parameter that changes.

10. The system of claim 9 , wherein the parameter that changes is a time value, a counter value, a previous passcode, or a challenge code.

11. A computer-implemented method under the control of one or more computing systems comprising:
receiving a request sent by a computing system to authorize an operation, the computing system having a seed and associated with a user, the request transmitted over a first communication channel;
providing the computing system with information configured to cause the computing system to initiate display of an image, the image comprising an optical machine-readable representation of a challenge code and to allow a device to capture the image and extract the challenge code, the device including a communications interface for transmitting information over a second communications channel different from the first communications channel; and
receiving, from the device over the second communications, a response authorizing the operation, the response calculated using the challenge code captured by the device and the seed.

12. The method of claim 11 , further comprising:
initiating display of a confirmation screen by the computing system, the confirmation screen describing a process for authorization of the operation.

13. The method of claim 11 , further comprising:
in response to receiving the request from the computing system, requesting the response authorizing the operation.

14. The method of claim 11 , further comprising:
transmitting a request to the device requesting user authentication information to be inputted into a user input device of the device; and
receiving confirmation that the user authentication information has been inputted into the device.

15. The method of claim 11 , further comprising:
transmitting a command to the computing system configured to cause the computing system to initiate display of an initial image communicating authentication information to allow the device to obtain the seed by at least capturing the initial image and extracting the seed from the initial image.

16. The method of claim 15 , further comprising:
obtaining, from the device, confirmation that the device has extracted the seed from the initial image.

17. The method of claim 11 , further comprising:
transmitting a command to the device configured to cause the device to initiate initiating display of an initial image communicating key information to allow the computing system to obtain the seed.

18. The method of claim 11 , wherein the device comprising at least one of the following:
a general computing device;
a mobile device; or
a dedicated authentication device.

19. The method of claim 11 , wherein the response is calculated, at least in part, by applying a mathematical function to the seed and a parameter that changes.

20. The method of claim 19 , wherein the parameter that changes is a time value, a counter value, a previous passcode, or a challenge code.

21. A set of one or more non-transitory computer-readable storage media having stored thereon executable instructions that, as a result of being executed by one or more processors of a first computing system and a second computing system, cause the first computing systems and the second computing system to perform operations comprising:
sending, by the second computing system to a server, a request to authorize an operation that requires information from the first computing system to be provided to the server, the second computing system having a seed and the request being transmitted over a first communications channel;
capturing an image, displayed by the second computing system, comprising an optical machine-readable representation of a challenge code, the image displayed by the second computing system in response to the request;
extracting the challenge code from the image;
calculating a response authorizing the operation using the challenge code and the seed; and
providing, using a communications interface of the first computing device, the response to the server over a second communications channel distinct from the first communications channel.

22. The set of one or more non-transitory computer-readable storage media of claim 21 , wherein providing the response to the server further comprising:

Assignees

• Roth Gregory B
• Fitch Nathan R
• Baer Graeme D
• Amazon Tech Inc

Inventors

• Roth Gregory B
• Fitch Nathan R
• Baer Graeme D

Classifications

• G06Q20/10

  specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems · CPC title

• H04L63/0838

  using one-time-passwords · CPC title

• G06F21/34

  involving the use of external additional devices, e.g. dongles or smart cards · CPC title

• H04L9/3215

  using a plurality of channels (network architectures or network communication protocols using different networks H04L63/18) · CPC title

• G06Q10/10 Primary

  Office automation; Time management · CPC title