# US 8,474,028 B2 · Multi-party, secure multi-channel authentication > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,474,028 B2 - Document ID: US8474028B2 - Status: Granted - Kind: B2 - Application number: 11/752,269 - Filed: 2007-05-22 - Published: 2008-04-10 - Granted: 2013-06-25 - Earliest claimed: 2006-10-06 - Assignees: Fmr LLC - Applicants: Rajandra Laxman Kulkarni; Adam Greenberg; Anthony M. Marotto; William A. Thornton, III - Inventors: Rajandra Laxman Kulkarni; Adam Greenberg; Anthony M. Marotto; William A. Thornton, III - Web page: https://patentgrep.com/patent/US8474028B2 ## CPC - H04L 9/3215: {using a plurality of channels (network architectures or network communication protocols using different networks H04L63/18)} - H04L 9/3234: {involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853)} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/18: {using different networks or channels, e.g. using out of band channels (cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215)} - H04L 2209/56: Financial cryptography, e.g. electronic payment or e-cash - H04L 2209/80: Wireless - H04L 2463/082: applying multi-factor authentication - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method for using multiple channels to access a resource, wherein a first user requests a resource that requires an indication of approval from a second user, a token value is transmitted to the first user on the first channel, and the second user transmits the token value and a second authentication parameter over a second channel. The token value is used to associate the first authentication parameter to the second authentication parameter, whereby the first user is allowed access to the resource on the first. The first and second user may be independently authenticated in some implementations and not independently authenticated in other implementations. ## Claims ### Claim 1 A method of providing an unregistered user access to a resource that requires an indication of approval by an authenticated user who is registered to the resource, the method comprising: receiving, by an authentication system, a request from the unregistered user to access the resource during a user session by supplying an identifier for the resource over a first channel; creating, by the authentication system, a session record including the identifier and a token value for the user session; transmitting, by the authentication system, the token value to the unregistered user over the first channel; receiving, by the authentication system, the token value from the authenticated user over a second channel, wherein the token value is provided to the authenticated user by the unregistered user; verifying, by the authentication system, that the identifier belongs to the authenticated user, wherein the identifier is retrieved from the session record by the authentication system based on the token value; receiving, by the authentication system, the indication of approval from the authenticated user to allow the unregistered user to access the resource referenced by the identifier; and upgrading, by the authentication system, the user session to indicate that the unregistered user is granted access to the resource. ### Claim 2 (depends on 1) The method of claim 1 wherein the authenticated user is authenticated based on an authentication parameter provided to the authentication system. ### Claim 3 (depends on 1) The method of claim 1 wherein the authenticated user is authenticated using a single channel or multi-channel authentication process. ### Claim 4 (depends on 1) The method of claim 1 wherein the identifier for the resource is an account number. ### Claim 5 (depends on 1) The method of claim 1 wherein the identifier is associated with the authenticated user. ### Claim 6 (depends on 2) The method of claim 2 wherein the authentication parameter is a user ID, a descriptive title, password, hard token, soft token, wireless applet, voiceprint, or any combination thereof. ### Claim 7 (depends on 2) The method of claim 2 wherein the unregistered user's access to the resource requires an indication of approval by at least one additional authenticated user. ### Claim 8 (depends on 7) The method of claim 7, wherein the at least one additional authenticated user is authenticated based on an at least one additional authentication parameter provided to the authentication system over at least one additional channel, the additional authentication parameter comprising a user ID, a password, a partial password, a portion of the identifier, a portion of the authentication parameter, a combination of the identifier and the authentication parameter, a hard token, a soft token, a wireless applet, a voiceprint, or any combination thereof. ### Claim 9 (depends on 8) The method of claim 8, wherein the at least one additional channel is not the first or second channel. ### Claim 10 (depends on 1) The method of claim 1 further comprising: generating a credential for the session record with information that indicates whether the resource should be provided to the unregistered user without the indication of approval from the authenticated user. ### Claim 11 (depends on 10) The method of claim 10, wherein the credential comprises: a cookie, a permanent credential, a time-sensitive credential, a credential that expires after a pre-set number of user sessions, or any combination thereof. ### Claim 12 (depends on 10) The method of claim 10, wherein the unregistered user has exited the user session and is attempting to begin a new session, the method comprising: receiving, by the authentication system, a request for the resource over the first channel from the unregistered user, wherein access to the resource requires a second indication of approval from the authenticated user; and processing, by the authentication system, information associated with the credential. ### Claim 13 (depends on 12) The method of claim 12 further comprising: providing, by the authentication system, the resource if the information associated with the credential indicates that the resource should be provided to the unregistered user without the second indication of approval of the authenticated user. ### Claim 14 (depends on 10) The method of claim 10 further comprising authenticating the unregistered user for the resource based on the credential. ### Claim 15 (depends on 14) The method of claim 14 further comprising providing a second unregistered user access to the resource that requires an indication of approval by the unregistered user after the unregistered user is authenticated based on the credential. ### Claim 16 A method of providing an unregistered user access to a resource that requires an indication of approval by an authenticated user who is registered to the resource, the method comprising: receiving, by an authentication system, a request from the unregistered user to access the resource during a user session and user session information, wherein the request and the user session information are transmitted over a first channel; creating, by the authentication system, a session record including the user session information and a token value for the user session; transmitting, by the authentication system, the token value to the unregistered user over the first channel; receiving, by the authentication system, the token value from the authenticated user over a second channel, wherein the token value and the user session information are provided to the authenticated user by the unregistered user; displaying, by the authentication system, the user session information to the authenticated user, wherein the user session information is retrieved from the session record by the authentication system based on the token value; receiving, by the authentication system, verification from the authenticated user that the user session information displayed matches the user session information provided to the authenticated user by the unregistered user; receiving, by the authentication system, the resource selected by the authenticated user along with the indication of approval to allow the unregistered user to access the resource; and upgrading, by the authentication system, the user session to indicate that the unregistered user is granted access to the resource. ### Claim 17 (depends on 16) The method of claim 16 wherein the user session information includes a description of the resource the unregistered user desires to access. ### Claim 18 (depends on 16) The method of claim 16 further comprising: displaying, by the authentication system, a plurality of resources to which the authenticated user controls access after receiving verification from the authenticated user; and receiving, by the authentication system, the indication of approval from the authenticated user to allow the unregistered user to access the resource, wherein the resource is selected by the authenticated user from the plurality of resources based on the user session information.