# US 2021/0344673 A1 · Methods and systems for blocking malware attacks

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2021/0344673 A1
- Document ID: US20210344673A1
- Status: Published application
- Kind: A1
- Application number: 17/374,171
- Filed: 2021-07-13
- Published: 2021-11-04
- Earliest claimed: 2015-08-10
- Inventors: Laurence Hamid
- Web page: https://patentgrep.com/patent/US20210344673A1

## CPC

- H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)}
- G06F 21/31: User authentication
- G06F 21/43: wireless channels
- G06F 21/606: {by securing the transmission between two devices or processes}
- H04L 9/0844: {with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys}
- H04L 63/18: {using different networks or channels, e.g. using out of band channels (cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215)}
- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- H04L 63/0869: {for achieving mutual authentication (cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273)}
- H04W 12/77: Graphical identity
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

User identities, password, etc. represent the barrier between a user's confidential data and any other third party seeking to access this data. As multiple software applications, web applications, web services, etc. embody this confidential data it is a tradeoff between easy recollection of said identities, passwords, etc. and data security. However, malware by intercepting user credentials provides third parties access to even complex passwords, user credentials, security keys etc. even where these are changed/updated regularly. Within the prior art substantial work has gone into addressing malware. However, in many instances the user is at or very near the computer with a software application executing a transaction requiring credentials/authorisation with a portable electronic device or another device. Accordingly, it would be beneficial to provide users with an out-of-band communications channel for exchanging credentials and/or keys etc.

## Claims

### Claim 1

A method comprising:
providing a microprocessor forming part of an electronic device associated with a user;
executing with the microprocessor a software application and injector agent application;
establishing by the user a transaction with the injector agent application; and
establishing an authorization for the transaction.

### Claim 2 (depends on 1)

The method according to claim 1, further comprising
providing an authentication server in communication with the electronic device via a network;
providing an injector application upon another electronic device associated with the user also in communication with the authentication server via the network; wherein
the verification is performed in dependence upon communications between the software application, the authentication server, and the another electronic device associated with the user;
the user initiates the transaction upon the electronic device and authorizes the transaction upon the another electronic device with the injector application in execution upon the another electronic device;
the injector application only communicates with an injector agent application in execution upon the electronic device; and
the injector agent application communicates only with the software application, the injector agent application and the authentication server.

### Claim 3 (depends on 1)

The method according to claim 1, further comprising
providing an authentication server in communication with the electronic device via a network;
providing an injector application upon another electronic device associated with the user also in communication with the authentication server via the network; wherein
the verification is performed in dependence upon communications between the software application, the authentication server, and the another electronic device associated with the user;
the injector application only communicates with an injector agent application in execution upon the electronic device; and
the injector agent application communicates only with the software application, the injector agent application and the authentication server; and
the verification of the transaction comprises:
establishing with the software application the requirement for authorization of the transaction initiated by the user;
communicating with the software application transaction details of the transaction to the injector agent application;
transmitting with the injector agent application a hashed copy of the transaction details to the authentication server;
creating with the authentication server an authentication challenge in dependence upon the data stored within a memory accessible to the authentication server comprising a plurality of authentication challenges and valid user responses to the plurality of authentication challenges;
returning to the injector agent application from the authentication server an authentication request comprising the authentication challenge;
transmitting to the injector application from the injector agent application the authentication challenge;
requesting via the injector application user consent wherein the injector agent application provides to the injector application as part of the authentication request for user consent the authentication challenge and the transaction details;
obtaining upon the injector application a user signing of the authentication challenge, wherein the signing of the authentication challenge is an authentication response provided by the user to the authentication challenge;
returning with the injector application to the injector agent application the user's authentication response to the injector agent application;
transmitting with the injector agent application the received authentication response to the authentication challenge to the authentication server;
verifying with the authentication server the received authentication response to the authentication challenge in dependence upon the data stored within the memory accessible to the authentication server comprising the valid user response to the authentication challenge;
upon determination of a valid authentication response to the authentication challenge transmitting with the authentication server to the injector agent application a signed server response authorizing the transaction;
communicating with the injector agent application the signed server response to the software application; and
verifying and performing with the software application the transaction.

### Claim 4 (depends on 1)

The method according to claim 1, further comprising
providing an authentication server in communication with the electronic device via a network;
providing an injector application upon another electronic device associated with the user also in communication with the authentication server via the network; wherein
the verification is performed in dependence upon communications between the software application, the authentication server, and the another electronic device associated with the user;
the user initiates the transaction upon the electronic device and authorizes the transaction upon the another electronic device with the injector application in execution upon the another electronic device;
the injector application only communicates with the authentication server; and
the injector agent application communicates only with the software application and the authentication server.

### Claim 5 (depends on 1)

The method according to claim 1, further comprising
providing an authentication server in communication with the electronic device via a network;
providing an injector application upon another electronic device associated with the user also in communication with the authentication server via the network; wherein
the verification is performed in dependence upon communications between the software application, the authentication server, and the another electronic device associated with the user;
the user initiates the transaction upon the electronic device and authorizes the transaction upon the another electronic device with an injector application in execution upon the another electronic device;
the injector application only communicates with the authentication server;
the injector agent application communicates only with the software application and the authentication server; and
the verification of the transaction comprises:
establishing with the software application the requirement for authorization of the transaction initiated by the user;
communicating with the software application transaction details of the transaction to the injector agent application;
transmitting with the injector agent application a hashed copy of the transaction details to the authentication server;
creating with the authentication server an authentication challenge in dependence upon the data stored within a memory accessible to the authentication server comprising a plurality of authentication challenges and valid user responses to the plurality of authentication challenges;
transmitting to the injector application from the authentication server an authentication request;
requesting via the injector application user consent wherein the authentication server provides to the injector application the authentication challenge and the transaction details as part of the authentication request for user consent;
obtaining upon the injector application a user signing of the authentication challenge, wherein the signing of the authentication challenge is an authentication response provided by the user to the authentication challenge;
returning with the injector application to the authentication server the user's authentication response to the injector agent application;
verifying with the authentication server the received authentication response to the authentication challenge in dependence upon the data stored within the memory accessible to the authentication server comprising the valid user response to the authentication challenge;
upon determination of a valid authentication response to the authentication challenge transmitting with the authentication server to the injector agent application a signed server response authorizing the transaction;
communicating with the injector agent application the signed server response to the software application; and
verifying and performing with the software application the transaction.

### Claim 6 (depends on 1)

The method according to claim 1, further comprising
providing an authentication server in communication with the electronic device via a network;
providing an injector application upon another electronic device associated with the user also in communication with the authentication server via the network; wherein
the verification is performed in dependence upon communications between the software application, the authentication server, and the another electronic device associated with the user;
the user initiates the transaction upon the electronic device and authorizes the transaction upon the another electronic device with an injector application in execution upon the another electronic device;
the injector application only communicates with the authentication server;
the injector agent application communicates only with the software application and the authentication server; and
the verification of the transaction comprises:
establishing with the software application the requirement for authorization of the transaction initiated by the user;
communicating with the software application transaction details of the transaction to the injector agent application;
transmitting with the injector agent application a hashed copy of the transaction details to the authentication server;
creating with the authentication server an authentication challenge in dependence upon the data stored within a memory accessible to the authentication server comprising a plurality of authentication challenges and valid user responses to the plurality of authentication challenges;
transmitting to the injector application from the authentication server an authentication request;
requesting via the injector application user consent wherein the authentication server provides to the injector application the authentication challenge and the transaction details as part of the authentication request for user consent;
obtaining upon the another electronic device an authentication of the user;
obtaining upon the injector application a user signing of the authentication challenge, wherein the signing of the authentication challenge is an authentication response provided by the user to the authentication challenge;
returning with the injector application to the authentication server the user's authentication response to the injector agent application;
verifying with the authentication server the received authentication response to the authentication challenge in dependence upon the data stored within the memory accessible to the authentication server comprising the valid user response to the authentication challenge;
upon determination of a valid authentication response to the authentication challenge transmitting with the authentication server to the injector agent application a signed server response authorizing the transaction;
communicating with the injector agent application the signed server response to the software application; and
verifying and performing with the software application the transaction.

### Claim 7 (depends on 1)

The method according to claim 1, further comprising
providing an authentication server in communication with the electronic device via a network;
providing an injector application upon another electronic device associated with the user also in communication with the authentication server via the network; wherein
the verification is performed in dependence upon communications between the software application, the authentication server, and the another electronic device associated with the user;
the user initiates the transaction upon the electronic device and authorizes the transaction upon the another electronic device with the injector application in execution upon the another electronic device;
the injector application only communicates with the authentication server; and
the software application communicates only with the authentication server.

### Claim 8 (depends on 1)

The method according to claim 1, further comprising
providing an authentication server in communication with the electronic device via a network;
providing an injector application upon another electronic device associated with the user also in communication with the authentication server via the network; wherein
the verification is performed in dependence upon communications between the software application, the authentication server, and the another electronic device associated with the user;
the user initiates the transaction upon the electronic device and authorizes the transaction upon the another electronic device with the injector application in execution upon the another electronic device;
the injector application only communicates with the authentication server;
the software application communicates only with the authentication server; and
the verification of the transaction comprises:
establishing with the software application the requirement for authorization of the transaction initiated by the user;
communicating with the software application a hashed copy of transaction details of the transaction to the authentication server;
creating with the authentication server an authentication challenge in dependence upon the data stored within a memory accessible to the authentication server comprising a plurality of authentication challenges and valid user responses to the plurality of authentication challenges;
transmitting to the injector application from the authentication server an authentication request;
requesting via the injector application user consent wherein the authentication server provides to the injector application the authentication challenge and the transaction details as part of the authentication request for user consent;
obtaining upon the another electronic device an authentication of the user;
obtaining upon the injector application a user signing of the authentication challenge, wherein the signing of the authentication challenge is an authentication response provided by the user to the authentication challenge;
returning with the injector application to the authentication server the user's authentication response to the injector agent application;
verifying with the authentication server the received authentication response to the authentication challenge in dependence upon the data stored within the memory accessible to the authentication server comprising the valid user response to the authentication challenge;
upon determination of a valid authentication response to the authentication challenge transmitting with the authentication server to the software application a signed server response authorizing the transaction;
verifying and performing with the software application the transaction.

### Claim 9 (depends on 1)

The method according to claim 1, further comprising
providing an injector application upon another electronic device associated with the user; wherein
the verification is performed in dependence upon communications between the software application and the injector application;
the user initiates the transaction upon the electronic device and authorizes the transaction upon the another electronic device with the injector application in execution upon the another electronic device; and
the injector application only communicates with the software application.

### Claim 10 (depends on 1)

The method according to claim 1, further comprising
providing an injector application upon another electronic device associated with the user; wherein
the verification is performed in dependence upon communications between the software application and the injector application;
the user initiates the transaction upon the electronic device and authorizes the transaction upon the another electronic device with the injector application in execution upon the another electronic device;
the injector application only communicates with the software application; and
the verification of the transaction comprises:
establishing with the software application the requirement for authorization of the transaction initiated by the user;
established with the software application a hashed copy of transaction details of the transaction;
creating with the software application an authentication challenge in dependence upon the data stored within a memory accessible to the software application comprising a plurality of authentication challenges and valid user responses to the plurality of authentication challenges;
transmitting to the injector application a request for user consent wherein the software application provides to the injector application the authentication challenge and the hashed copy of the transaction details;
obtaining upon the another electronic device an authentication of the user;
obtaining upon the injector application a user signing of the authentication challenge, wherein the signing of the authentication challenge is an authentication response provided by the user to the authentication challenge;
returning with the injector application to the software application the user's authentication response;
verifying with the software application the received authentication response to the authentication challenge in dependence upon the data stored within the memory accessible to the software application comprising the valid user response to the authentication challenge;
upon determination of a valid authentication response to the authentication challenge verifying and performing with the software application the transaction.

### Claim 11 (depends on 1)

The method according to claim 1, further comprising
providing a phone relay service in communication with the electronic device via a network;
providing an injector application upon another electronic device associated with the user also in communication with the phone relay service via the network; wherein
the verification is performed in dependence upon communications between the software application, the phone relay service, and the another electronic device associated with the user;
the user initiates the transaction upon the electronic device and authorizes the transaction upon the another electronic device with the injector application in execution upon the another electronic device;
the injector application communicates with the phone relay service and the software application; and
the software application communicates with the phone relay service and the injector application.

### Claim 12 (depends on 1)

The method according to claim 1, further comprising
providing a phone relay service in communication with the electronic device via a network;
providing an injector application upon another electronic device associated with the user also in communication with the phone relay service via the network; wherein
the verification is performed in dependence upon communications between the software application, the phone relay service, and the another electronic device associated with the user;
the user initiates the transaction upon the electronic device and authorizes the transaction upon the another electronic device with the injector application in execution upon the another electronic device;
the injector application communicates with the phone relay service and the software application; and
the software application communicates with the phone relay service and the injector application; and
the verification of the transaction comprises:
establishing an out-of-band channel initialization between the software application and the injector application employing a scanned machine readable code to communicate channel parameters comprising at least a security key and a seed for a hashing process to the software application from the injector application;
connecting the software application to the phone relay service using a subset of the channel parameters;
connecting the phone relay service to the injector application using another subset of the channel information;
requesting with the software application at least a credential from the injector application via the phone relay service using the connections established between the software application and the phone relay service and the phone relay service and the injector application;
obtaining upon the another electronic device an authentication of the user in response to the request for the at least the credential;
retrieving from the injector application a response to the requested at least the credential from the injector application in dependence upon a positive authentication of the user upon the another electronic device;
returning with the injector application to the software application via the phone relay service the response to the requested at least the credential;
verifying with the software application the received response to the requested at least the credential in dependence upon the data stored within the memory accessible to the software application comprising the valid response to the requested at least the credential;
upon determination of a received response to the requested at least the credential verifying and performing with the software application the transaction.

### Claim 13 (depends on 12)

The method according to claim 12, wherein
the request for the at least the credential transmitted to the injector application includes a hashed copy of the transaction which is extracted and rendered to the user upon the another electronic device by the injector application; and
the extraction is performed in dependence upon the seed provided within the channel parameters transferred during the out-of-band channel initialization.

### Claim 14 (depends on 1)

The method according to claim 1, further comprising
providing a phone relay service in communication with the electronic device via a network;
providing an injector application upon another electronic device associated with the user also in communication with the phone relay service via the network; wherein
the verification is performed in dependence upon communications between the software application, the phone relay service, and the another electronic device associated with the user;
the user initiates the transaction upon the electronic device and authorizes the transaction upon the another electronic device with the injector application in execution upon the another electronic device;
the injector application communicates with the phone relay service and the software application; and
the software application communicates with the phone relay service and the injector application; and
the verification of the transaction comprises:
initiating an out-of-band channel initialization using the injector application upon the another electronic device wherein the injector application renders to the user upon the another electronic device one or more codes;
establishing the out-of-band channel initialization between the software application and the injector application in dependence upon the user entering the one or more codes into the software application wherein the software application establishes channel parameters comprising at least a security key and a seed for a hashing process in dependence upon the one or more codes;
connecting the software application to the phone relay service using a subset of the channel parameters;
connecting the phone relay service to the injector application using another subset of the channel information;
requesting with the software application at least a credential from the injector application via the phone relay service using the connections established between the software application and the phone relay service and the phone relay service and the injector application;
obtaining upon the another electronic device an authentication of the user in response to the request for the at least the credential;
retrieving from the injector application a response to the requested at least the credential from the injector application in dependence upon a positive authentication of the user upon the another electronic device;
returning with the injector application to the software application via the phone relay service the response to the requested at least the credential;
verifying with the software application the received response to the requested at least the credential in dependence upon the data stored within the memory accessible to the software application comprising the valid response to the requested at least the credential;
upon determination of a received response to the requested at least the credential verifying and performing with the software application the transaction.

### Claim 15 (depends on 14)

The method according to claim 14, wherein
the request for the at least the credential transmitted to the injector application includes a hashed copy of the transaction which is extracted and rendered to the user upon the another electronic device by the injector application; and
the extraction is performed in dependence upon the seed provided within the channel parameters transferred during the out-of-band channel initialization.

### Claim 16 (depends on 1)

The method according to claim 1, wherein
the process employs a credential management process exploiting an Internet relay service for providing user credentials to the software application upon the electronic device from the injector application upon the another electronic device without exposing them to malware.

### Claim 17 (depends on 1)

The method according to claim 1, wherein
the process comprises a first secure workflow process and a second secure workflow process: and
the first secure workflow process comprises:
requesting a new communications channel be established with the software application to the Internet relay service;
returning to the software application from the Internet relay service a channel identity of the new communications channel generated by the Internet relay service;
generating upon the software application a random session password;
generating with the software application a machine readable code comprising the channel identity, the random session password and a user verifiable code;
scanning the machine readable code rendered upon the electronic device by the software application with an injector application upon the another electronic device;
extracting and rendering the user verifiable code upon the another electronic device with the injector application;
providing the channel identity to the Internet relay service to initiate a connection between the injector application upon the another electronic device and the software application via the Internet relay service in dependence upon the user verifying the user verifiable code to the injector application;
establishing a first channel between the Internet relay service and the software application upon receipt of the channel identity by the Internet relay service from the injector application;
establishing a second channel between the Internet relay service and the injector application.

### Claim 18 (depends on 17)

The method according to claim 17, wherein
the second secure workflow process comprises:
generating with the software application a first pseudo-random value;
generating a first code in dependence upon the first pseudo-random value with the software application and transmitting to the injector application via the Internet relay service;
generating with the injector application a second pseudo-random value;
generating a second code in dependence upon the second pseudo-random value with the injector application and transmitting to the software application via the Internet relay service;
generating a first session key with the software application in dependence upon the first pseudo-random value and the second code;
generating a second session key with the injector application in dependence upon the second pseudo-random value and the first code;
generating a first hashed code with the software application using the first session key and a password and transmitting it to the injector application;
generating a second hashed code with the injector application using the second session key and the password and transmitting it to the software application;
verifying with the injector application the password in dependence upon the first hashed code and the second hashed code;
verifying with the software application the password in dependence upon the first hashed code and the second hashed code; and
establishing an encrypted mutually authenticated secure channel between the software application and the injector application via the Internet relay service in dependence upon the verification of the password by each of the software application and the injector application; and
performing authentication of the transaction with the injector application using the encrypted mutually authenticated secure channel.

### Claim 19 (depends on 18)

The method according to claim 18, wherein
the first code is transmitted to the injector application through a further process comprising:
generating a machine readable code comprising the first code;
rendering the machine readable code upon a display of the electronic device; and
capturing an image of the machine readable code upon the another electronic device; and
the second code is transmitted to the software application though another process comprising:
generating another machine readable code comprising the second code;
rendering the another machine readable code upon a display of the another electronic device; and
capturing an image of the another machine readable code upon the electronic device.

### Claim 20 (depends on 1)

The method according to claim 1, wherein
the software application is an online resource provided by an Internet based service provider (INTSERP);
communications between the INTSERP and the injector application are handled via a relay service (RES); and
the process comprises:
making a request via the RES to an identity provider comprising one or more claims for the user;
making a request by the identity provider via the RES to the injector application with the one or more claims;
rendering with the injector application upon the another electronic device the one or more claims for the user to either consent to or authenticate;
retrieving with the injector application in dependence upon the user either consenting or authenticating a credential;
transmitting the retrieved credential to the identity provider via the RES;
providing a response with the one or more claims to the INTSERP by the identity provider upon receipt of the credential; and
verifying with the INTSERP the response and proceeding to perform the transaction.

### Claim 21 (depends on 20)

The method according to claim 20, wherein
the request to the identity provider and the verification by the INTSERP of the response from the identity provider are performed using at least one of a Security Token Service and a Security Assertion Markup Language (SAML);
the retrieved credential comprises personal identifying information (PII) of the user; and
the PII is not provided to the INTSERP.