# US 8,789,150 B2 · System and method for user authentication > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,789,150 B2 - Document ID: US8789150B2 - Status: Granted - Kind: B2 - Application number: 13/623,641 - Filed: 2012-09-20 - Published: 2013-03-28 - Granted: 2014-07-22 - Earliest claimed: 2011-09-22 - Assignees: Kinesis Identity Security System Inc. - Applicants: Kinesis Identity Security System Inc. - Inventors: Jonathan G. Bell; Kenneth W. Jennings - Web page: https://patentgrep.com/patent/US8789150B2 ## CPC - H04W 12/06: Authentication - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/0846: {using time-dependent-passwords, e.g. periodically changing passwords} - H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)} - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity} - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system and method for providing authentication of a user is disclosed. The use of a non-confidential and unique user identification number and a temporary access code separates authentication of the user from transmission of any user passwords or user-identifiable data, as well as provides a ubiquitous means to authenticate the user with unrelated organizations, without any information passing between those organizations. ## Claims ### Claim 1 A computer-implemented method of authenticating a user, the method comprising: generating at a validation server a unique user ID number and matching encryption key corresponding to the user; transmitting the unique user ID number and matching encryption key to a user device; generating a temporary access code based on the encryption key on the user device; providing the unique user ID number and temporary access code to at least one organization server adapted to run on at least one computer separately maintained by independent host organizations; transmitting the unique user ID number and temporary access code from the at least one organization server to the validation server; generating the encryption key matching the unique user ID number and generating a second code on the validation server in the same fashion as the temporary access code was generated; performing on the validation server a verification of the unique user ID number and temporary access code by comparing the second code and the temporary access code to obtain a validation result; transmitting the validation result to the at least one organization server; and authenticating the user at the at least one organization based on the validation result, wherein the validation server is adapted to run on at least one computer that is maintained by a first organization that is independent and separate from the independent host organizations and their respective organization servers, and wherein the unique user ID is non-secret and shared with each of the independent host organizations. ### Claim 2 (depends on 1) The method of claim 1, further comprising modifying a client database of the at least one organization server to provide a field for a unique user ID number for user records. ### Claim 3 (depends on 1) The method of claim 1, further comprising providing to the user, from the at least one organization server, instructions to download client-based security software operable on the user device. ### Claim 4 (depends on 1) The method of claims 1, further comprising performing a time synchronization between the validation server and the user device. ### Claim 5 A computer system for authenticating a user, the system comprising: a client-based security software component operable on at least one user device operable by the user; a server-based validation software component operable on at least one validation server adapted to run on at least one computer that is maintained by a first organization; and at least one host organization server adapted to run on at least one computer separately maintained by independent host organizations, wherein the server-based validation software component communicates with the client-based security software component to provide the user on the at least one user device with a unique user ID number and a corresponding encryption key, wherein the client-based security software component generates a temporary access code based on the unique user ID number and the corresponding encryption key, wherein the user provides the unique user ID number and temporary access code to the at least one host organization server, wherein the at least one host organization server authenticates the user by transmitting an authentication request comprising the user ID number and temporary access code to the at least one validation server, wherein the server-based validation software component generates the encryption key matching the unique user ID number and generates a second code on the validation server in the same fashion as the temporary access code was generated, wherein the server-based validation software component generates a validation result from comparing the second code and the temporary access code, wherein the validation result is transmitted from the validation server to the at least one host organization server, wherein the at least one computer maintained by the first organization is independent and separate from the independent host organizations and their respective organization servers, and wherein the unique user ID is non-secret and shared with each of the independent host organizations and their respective host organization servers. ### Claim 6 (depends on 5) The system of claim 5, wherein the host organization server runs a communication software component that communicates with the server-based validation software component. ### Claim 7 (depends on 5) The system of claim 5, wherein the at least one device is a mobile device with computing and communication capability sufficient to operate the client-based security software component. ### Claim 8 (depends on 5) The system of claim 5, wherein the device is selected from the group comprising: a smartphone, a tablet computer, a laptop computer, a personal media player, a personal entertainment system, a kiosk and a smart terminal. ### Claim 9 A non-transitory computer readable memory storing instructions that, when executed on one or more computers, causes the computers to perform a method of authenticating a user, wherein said method comprises: generating at a validation server a unique user ID number and matching encryption key corresponding to the user; transmitting the unique user ID number and matching encryption key to a user device; generating a temporary access code based on the encryption key on the user device; providing the unique user ID number and temporary access code to at least one organization server adapted to run on at least one computer separately maintained by independent host organizations; transmitting the unique user ID number and temporary access code from the at least one organization server to the validation server; generating the encryption key matching the unique user ID number and generating a second code on the validation server in the same fashion as the temporary access code was generated; performing on the validation server a verification of the unique user ID number and temporary access code by comparing the second code and the temporary access code to obtain a validation result; transmitting the validation result to the at least one organization server; and authenticating the user at the at least one organization based on the validation result, wherein the validation server is adapted to run on at least one computer that is maintained by a first organization that is independent and separate from the independent host organizations and their respective organization servers, and wherein the unique user ID is non-secret and shared with each of the independent host organizations. ### Claim 10 (depends on 9) The non-transitory computer readable memory of claim 9, wherein said method further comprises modifying a client database of the at least one organization server to provide a field for a unique user ID number for user records. ### Claim 11 (depends on 9) The non-transitory computer readable memory of claim 9, wherein said method further comprises providing to the user, from the at least one organization server, instructions to download client-based security software operable on the user device.