US 10,592,656 B2Granted

Automatic upgrade from one step authentication to two step authentication via application programming interface

AssigneeInternational Business Machines Corporation

InventorsLarry A. Brocious, Michael J. Howland, Paul E. Rogers

Life of this patent

Estimating the term…

Loading patent…

Abstract

A client transmits a user identifier and a password to a server via an application programming interface (API). The client establishes an authenticated session with the server in which the client has a first set of permissions for operations associated with the API. The client receives, responsive to a verification of the user identifier and password by the server, a logon response and a shared secret. The client generates a one time passcode (OTP) based upon the shared secret. The client sends the OTP to the server via the API. Responsive to the server validating the OTP against the shared secret, the server grants a second set of permissions for operations associated with the API.

Claims7

Dependent claims

A method comprising:

transmitting, by a client, a user identifier and a password to a server via an application programming interface (API);
establishing an authenticated session with the server, the client having a first set of permissions for operations associated with the API;
receiving, responsive to a verification of the user identifier and password by the server, a logon response a shared secret,
wherein the server determines whether the user identifier is to be upgraded from one step authentication to two step authentication after successful verification of the user identifier and the password and grants the client limited permission with respect to permitted API operations and requires the two step authentication for each subsequent logon attempt;
generating, by the client, a one time passcode (OTP) based upon the shared secret;
sending the OTP to the server via the API;
granting, responsive to the server validating the OTP against the shared secret, a second set of permissions for operations associated with the API;
and
transmitting the user ID, the password, and a current OTP generated based upon the shared secret to the server in a subsequent logon operation.

6 more elements

Dependencies are inferred from the claim text.

Facts

Application: 15/813,712Filed 15 Nov 2017 · continuation
Priority: 29 Aug 2017
Published: US 2019/0065730 A128 Feb 2019
Granted: 17 Mar 2020
Term ends: Not estimatedThe source records don’t support an estimate.

Classification11 codes

G06F 21/40
User authentication: by quorum, i.e. whereby two or more security principals are required
G06F 21/31
Authentication, i.e. establishing the identity or authorisation of security principals: user authentication
H04L 9/0838
Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for…:…
H04L 9/0863
Generation of secret information including derivation or calculation of cryptographic keys or passwords: involving passwords or one-time passwords

Family

Application15/689,073Parent of this continuation · filed 29 Aug 2017
US 2019/0065731 A1Pre-grant publication · published 28 Feb 2019
US 10,586,033 B2Related patent
US 2019/0065730 A1Published application
US 10,592,656 B2This patent

From the US filing history. Foreign family members aren’t listed.