Method and system of providing authentication of user access to a computer resource via a mobile device using multiple separate security factors
AssigneeHoverkey Ltd.
InventorArnold Yau
Life of this patent
Estimating the term…
Abstract
A method and system of authenticating a computer resource such as an application or data on a mobile device uses a contactless token to provide multi-factor user authentication. User credentials are stored on the token in the form of private keys, and encrypted data and passwords are stored on the device. When application user requires access to the resource an encrypted password is transmitted to and decrypted on the token using a stored private key. An unencrypted data encryption key or password is then transmitted back to the device under the protection of a cryptographic session key which is generated as a result of strong mutual authentication between the device and the token.
Claims27
A method of authenticating access to a computer resource via a mobile device comprising:
- storing an encrypted resource authorization that is associated with access to or use of the computer resource on the mobile device, wherein the computer resource comprises an application running or stored on the mobile device, or accessible therefrom;
- transmitting the encrypted resource authorization to a separate portable security token in response to a request to access or use the application;
- on the token, decrypting the encrypted resource authorization and generating at least partially therefrom an unlock response;
- wherein the mobile device is configured to store and transmit, and the token is configured to decrypt, any of a password, PIN and cryptographic key, and wherein the token is configured to verify a PIN code on the token to authorize generation of the unlock response;
- wherein at least a portion of the unlock response comprises a decrypted password for the computer resource on the mobile device and corresponds to the encrypted resource authorization that was previously stored for that computer resource;
- securely transmitting the unlock response to the mobile device;
- requiring a user to authenticate separately on the mobile device;
- unlocking the resource if the required unlock response and the separate authentication are both valid.
A system of authenticating access to a computer resource via a mobile device with a portable security token, comprising:
- a mobile device;
- a stored encrypted authorization that is associated with access to or use of the computer resource on the mobile device, wherein the computer resource comprises an application running or stored on the mobile device, or accessible therefrom;
- a token that is portable and separate from the mobile device, and including a token communications system and a token processor providing cryptographic functions;
- and wherein in use the encrypted authorization is transmitted by the mobile device to the token in response to a request to use the application;
- is decrypted on the token;
- the token generating at least partially therefrom an unlock response, the unlock response being securely transmitted by the token communications system to the mobile device;
- requiring a user to authenticate separately on the mobile device;
- and unlocking the resource if the required unlock response and the separate authentication are both valid;
- wherein at least a portion of the unlock response comprises a decrypted password for the computer resource on the mobile device and corresponds to the encrypted resource authorization that was previously stored for that computer resource;
- wherein the mobile device is configured to store and transmit, and the token is configured to decrypt, any of a password, PIN and cryptographic key, and wherein the token is configured to verify a PIN code on the token to authorize generation of the unlock response.
Dependencies are inferred from the claim text.