Mobile out-of-band authentication service
AssigneeSap SE
InventorTobias Queck
Life of this patent
Estimating the term…
Abstract
Certain embodiments enable authentication of an application session at a client machine by using authentication values and user-identification values that are received from a mobile communication device. The mobile communication device provides an out-of-band channel for validating the session and enables secure authentication for a variety of applications.
Claims19
A method of authenticating an application session at a client machine, the method comprising:
- receiving a request for the application session from the client machine;
- sending an authentication token to the client machine after receiving the request from the client machine;
- receiving values for the authentication token and values for user identification from a mobile communication device after sending the authentication token to the client machine;
- using the user-identification values to identify a registered user of the mobile communication device with a mobile service provider corresponding to the mobile communication device;
- verifying the authentication-token values relative to the authentication token;
- verifying the user-identification values by verifying that the registered user corresponds to at least one of the request or a user account of an application service corresponding to the application session, the registered user being identified by the user-identification values received from the mobile communication device, and the request for the application session being received from the client machine;
- and
- initiating the application session at the client machine after verifying the authentication-token values and the user-identification values.
A non-transitory computer-readable medium that stores a computer program for authenticating an application session at a client machine, wherein the computer program includes instructions that, when executed by a computer, cause the computer to perform operations comprising:
- receiving a request for the application session from the client machine;
- sending an authentication token to the client machine after receiving the request from the client machine;
- receiving values for the authentication token and values for user identification from a mobile communication device after sending the authentication token to the client machine;
- using the user-identification values to identify a registered user of the mobile communication device with a mobile service provider corresponding to the mobile communication device;
- verifying the authentication-token values relative to the authentication token;
- verifying the user-identification values by verifying that the registered user corresponds to at east one of the request or a user account of an application service corresponding to the application session, the registered user being identified by the user-identification values received from the mobile communication device, and the request for the application session being received from the client machine;
- and
- initiating the application session at the client machine after verifying the authentication-token values and the user-identification values.
An apparatus to authenticate an application session at a client machine, the apparatus comprising at least one computer configured to perform operations for computer-implemented modules including:
- a request-receiving module to receive a request for the application session from the client machine;
- a token-sending module to send an authentication token to the client machine after receiving the request from the client machine;
- a value-receiving module to receive values for the authentication token and values for user identification from a mobile communication device after sending the authentication token to the client machine, the value-receiving module performing operations including:
- using the user-identification values to identify registered user of the mobile communication device with a mobile service provider corresponding to the mobile communication device,
- verifying the authentication-token values relative to the authentication token, and
- verifying the user-identification values by verifying that the registered user corresponds to at least one of the request or a user account of an application service corresponding to the application session, the registered user being identified by the user-identification values received from the mobile communication device, and the request for the application session being received from the client machine;
- and
- a session-initiating module to initiate the application session at the client machine after verifying the authentication-token values and the user-identification values.
Dependencies are inferred from the claim text.