# US 2014/0157393 A1 · Proxy authentication network

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2014/0157393 A1
- Document ID: US20140157393A1
- Status: Published application
- Kind: A1
- Application number: 14/174,059
- Filed: 2014-02-06
- Published: 2014-06-05
- Earliest claimed: 2005-06-13
- Assignees: Iamsecureonline, Inc.
- Applicants: iamSecureOnline, Inc.
- Inventors: Michael J. Whitcomb
- Web page: https://patentgrep.com/patent/US20140157393A1

## CPC

- H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity}
- G06F 21/33: using certificates
- H04L 9/085: {Secret sharing or secret splitting, e.g. threshold schemes}
- H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords}
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- H04L 9/321: {involving a third party or a trusted authority}
- H04L 63/0407: {wherein the identity of one or more communicating identities is hidden (cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00)}
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)}
- H04L 2209/76: Proxy, i.e. using intermediary entity to perform cryptographic operations
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A Proxy Authentication Network includes a server that stores credentials for subscribers, along with combinations of devices and locations from which individual subscribers want to be authenticated. Data is stored in storage: the storage can be selected by the subscriber. The data stored in the storage, which can be personally identifiable information, can be stored in an encrypted form. The key used to encrypt such data can be divided between the storage and server. In addition, third parties can store portions of the encrypting key. Subscribers can be authenticated using their credentials from recognized device/location combinations; out-of-band authentication supports authenticating subscribers from other locations. Once authenticated, a party can request that the encrypted data be released. The portions of the key are then assembled at the storage. The storage then decrypts the data, generates a new key, and re-encrypts the data for transmission to the requester.

## Claims

### Claim 1

A method of authenticating via a computer server, comprising: the computer server receiving via a first communications channel an authentication token from a first authentication client; the computer server determining an authenticity of the authentication token; and in accordance with an outcome of the authenticity determining, the computer server transmitting a payload to a second authentication client via a second communications channel distinct from the first communications channel.

### Claim 2 (depends on 1)

The method according to claim 1, wherein the payload effects a completion of a transaction with a relying party server distinct from the computer server, the authentication token receiving comprises a first segment of the transaction, and the payload transmitting comprises a second segment of the transaction.

### Claim 3 (depends on 1)

The method according to claim 1, wherein the first authentication client is provided in a communication device, the authentication token is provided in a hardware token distinct from the communication device, and the authentication token receiving comprises the first authentication client requesting the authentication token from the hardware token, and the computer server receiving the requested authentication token from the first authentication client.

### Claim 4 (depends on 3)

The method according to claim 3, wherein the authenticity determining comprises the computer server verifying that the authentication token was generated by the hardware token.

### Claim 5 (depends on 1)

The method according to claim 1, wherein the first authentication client and the authentication token are provided in a common communication device, and the authentication token receiving comprises the computer server receiving the authentication token released from the communication device.

### Claim 6 (depends on 1)

The method according to claim 1, wherein the authentication token is provided in a credential server, and the authentication token receiving comprises the computer server receiving the authentication token from the credential server.

### Claim 7 (depends on 1)

The method according to claim 1, wherein the payload transmitting comprises the first authentication client specifying the second authentication client and the computer server directing the payload to the specified second authentication client.

### Claim 8 (depends on 1)

The method according to claim 1, wherein the payload transmitting comprises the computer server identifying the second authentication client after receipt of the authentication token, and the computer server directing the payload to the identified second authentication client.

### Claim 9 (depends on 1)

The method according to claim 1, wherein the payload transmitting comprises the computer server transmitting a session token to the first authentication client, receiving a payload request from the second authentication client, and transmitting the payload to the second authentication client in accordance with a correlation between the payload request and the session token.

### Claim 10 (depends on 9)

The method according to claim 9, wherein the payload transmitting further comprises the computer server establishing a secure communications channel with the second authentication client in accordance with the correlation, and transmitting the payload to the second authentication client over the secure communications channel, the second communications channel comprising the secure communications channel.

### Claim 11 (depends on 1)

The method according to claim 1, wherein the payload comprises an authentication payload for facilitating authentication of the second authentication client.

### Claim 12 (depends on 11)

The method according to claim 11, wherein the authentication payload comprises a session certificate.

### Claim 13 (depends on 1)

The method according to claim 1, wherein the payload comprises a command for execution by the second authentication client.

### Claim 14 (depends on 13)

The method according to claim 13, wherein the command comprises a form-fill command.

### Claim 15 (depends on 1)

A computer-readable medium comprising computer processing instructions stored thereon for execution by a computer, the computer processing instructions, when executed by the computer, causing the computer to perform the method of claim 1.

### Claim 16

A computer server comprising: an authentication client configured to determine an authenticity of an authentication token received at the computer server via a first communications channel, and to transmit a payload to a second authentication client via a second communications channel distinct from the first communications channel in accordance with an outcome of the authenticity determination.

### Claim 17 (depends on 16)

The computer server according to claim 16, wherein the first authentication client is provided in a communication device, the authentication token is provided in a hardware token distinct from the communication device, and the authentication client receives the authentication token from the first authentication client.

### Claim 18 (depends on 16)

The computer server according to claim 16, wherein the first authentication client and the authentication token are provided in a common communication device, and the authentication client receives the authentication token from the communication device.

### Claim 19 (depends on 16)

The computer server according to claim 16, wherein the authentication token is provided in a credential server, and the authentication client receives the authentication token from the credential server.

### Claim 20 (depends on 16)

The computer server according to claim 16, wherein the first authentication client specifies the second authentication client, and the authentication client is configured to direct the payload to the specified second authentication client.

### Claim 21 (depends on 16)

The computer server according to claim 16, wherein the authentication client is configured to identify the second authentication client after receipt of the authentication token, and to direct the payload to the identified second authentication client.

### Claim 22 (depends on 16)

The computer server according to claim 16, wherein the authentication client is configured to transmit a session token to the first authentication client, receive a payload request from the second authentication client, and transmit the payload to the second authentication client in accordance with a correlation between the payload request and the session token.

### Claim 23 (depends on 22)

The computer server according to claim 22, wherein the authentication client is configured to establish a secure communications channel with the second authentication client in accordance with the correlation, and transmit the payload to the second authentication client over the secure communications channel, the second communications channel comprising the secure communications channel.

### Claim 24

A method of authenticating to a computer server comprising: a first authentication client transmitting an authentication token to the computer server via a first communications channel; and a second authentication client receiving a payload from the computer server via a second communications channel distinct from the first communications channel in accordance with an outcome of a determination of authenticity of the authentication token by the computer server.

### Claim 25 (depends on 24)

The method according to claim 24, wherein the authentication clients are implemented in a common communication device.

### Claim 26 (depends on 24)

The method according to claim 24, wherein the authentication clients are implemented in separate communication devices.

### Claim 27 (depends on 24)

The method according to claim 24, wherein the first authentication client is provided in a communication device, the authentication token is provided in a hardware token distinct from the communication device, and the authentication token transmitting comprises the first authentication client requesting the authentication token from the hardware token and transmitting the requested authentication token to the computer server.

### Claim 28 (depends on 24)

The method according to claim 24, wherein the first authentication client and the authentication token are provided in a common communication device, and the authentication token transmitting comprises the communication device releasing the authentication token to computer server.

### Claim 29 (depends on 24)

The method according to claim 24, wherein the authentication token is provided in a credential server, and the authentication token transmitting comprises the first authentication client authorizing the credential server to transmit the authentication token to the computer server.

### Claim 30 (depends on 24)

The method according to claim 24, wherein the payload receiving comprises the first authentication client identifying the second authentication client to the computer server and the computer server directing the payload to the identified second authentication client.

### Claim 31 (depends on 24)

The method according to claim 24, wherein the second authentication client uses the payload to effect a completion of a transaction with a relying party server distinct from the computer server, the authentication token transmitting comprises a first segment of the transaction, and the payload receiving comprises a second segment of the transaction.

### Claim 32 (depends on 24)

The method according to claim 24, wherein the payload receiving comprises the first authentication client receiving a session token from the computer server, and the second authentication client transmitting a payload request to the computer server and receiving the payload from the computer server in accordance with a correlation between the payload request and the session token.

### Claim 33 (depends on 32)

The method according to claim 32, wherein the payload receiving further comprises the second authentication client establishing a secure communications channel with the computer server in accordance with the correlation, and receiving the payload over the secure communications channel, the second communications channel comprising the secure communications channel.

### Claim 34 (depends on 24)

The method according to claim 24, wherein the payload comprises an authentication payload, and the second authentication client authenticates itself using the authentication payload.

### Claim 35 (depends on 34)

The method according to claim 34, wherein the authentication payload comprises a session certificate.

### Claim 36 (depends on 24)

The method according to claim 24, wherein the payload comprises a command, and the second authentication client executes the received command.

### Claim 37 (depends on 36)

The method according to claim 36, wherein the command comprises a form-fill command.

### Claim 38

A communication device comprising: a first authentication client configured to transmit an authentication token to a computer server via a first communications channel; and a second authentication client configured to receive a payload from the computer server via a second communications channel distinct from the first communications channel in accordance with an outcome of a determination of authenticity of the authentication token by the computer server.