Method and system for user authentication with improved security

Abstract

A user authentication method in a distributed processing system commences by receiving, at a first processing unit (108), a request (1004) to initiate an authentication session, wherein the request includes a unique identifier of a user requiring authentication. The first processing unit acquires at least one item of authentication data (412, 1712), which is valid during the authentication session. The authentication data is transmitted (1006) to a second processing unit (106) which is associated with a terminal device operated by the user. The second processing unit transforms the authentication data using a transformation algorithm based upon one or more session-specific authentication factors (404, 1704), to generate transformed authentication data that is characteristic of the authentication session and of the user. The transformed authentication data is transmitted (1008) to a third processing unit (108) which verifies that the transformed authentication data corresponds with the user and with predetermined values of the one or more session-specific authentication factors. The third processing unit generates an authentication result (1010) of the authentication session based upon the verification.

1 - 15 . (canceled) 
     
     
         16 . A user authentication method comprising execution, by a distributed processing system, of the steps of:
 receiving, at a first processing unit, a request to initiate an authentication session, the request comprising a unique identifier of a user requiring authentication;   the first processing unit acquiring at least one item of authentication data, valid during the authentication session;   transmitting the authentication data to a second processing unit which is associated with a terminal device operated by the user;   the second processing unit automatically transforming the authentication data using a transformation algorithm parameterised by context-dependent values of one or more session-specific authentication factors, to generate transformed authentication data that is characteristic of the authentication session and of the user;   transmitting the transformed authentication data to a third processing unit;   the third processing unit verifying that the transformed authentication data corresponds with the user and with predetermined values of the one or more session-specific authentication factors; and   the third processing unit generating an authentication result of the authentication session based upon the verification.   
     
     
         17 . The method of  claim 16  wherein a secret keyword is associated with the user, the secret keyword consisting of an ordered sequence of symbols selected from a predetermined symbol set, and wherein:
 the at least one item of authentication data includes a security matrix comprising a mapping between each symbol within the symbol set and a code value which is specific to the authentication session and which is selected from a code set which is distinct from the symbol set; 
 the security matrix is transformed by the first processing unit using a transformation algorithm based upon the predetermined values of the one or more session-specific authentication factors, to generate a transformed security matrix comprising the symbol set and transformed code values; 
 the transformation algorithm of the second processing unit includes an inverse transformation algorithm configured to recover the code values of the security matrix, and a user input step for receiving a sequence of code values selected from the security matrix and input by the user, the code values corresponding with the secret keyword; and 
 the verifying step comprises validating the sequence of code values received in the user input step by comparison with an expected sequence of code values corresponding with the secret keyword and a mapping thereof to the code values in the security matrix. 
 
     
     
         18 . The method of  claim 16  wherein:
 the authentication data comprises a session-specific one-time code word which is encrypted by the first processing unit using a transformation algorithm parameterised by the predetermined values of the one or more session-specific authentication factors; 
 the transformation algorithm of the second processing unit includes an inverse transformation algorithm configured to decrypt the session-specific one-time code word, and a cryptographic signing step wherein a private cryptographic key of the user is applied to generate the transformed authentication data which comprises a signed copy of the session-specific one-time code word; 
 the verifying step comprises a cryptographic verification wherein a public cryptographic key of the user is applied to confirm that the signed copy of the session-specific one-time code word was generated by the second processing unit associated with the terminal device operated by the user. 
 
     
     
         19 . The method of  claim 16  wherein the one or more session-specific authentication factors comprises at least one of:
 a geographic location of the terminal device operated by the user; 
 one or more Service Set Identifiers (SSIDs) of wireless networks visible to the terminal device operated by the user; 
 an SSID of a wireless network to which the terminal device is connected; 
 identifying information of a mobile cellular carrier to which the terminal device is connected 
 a unique identifier associated with the terminal device operated by the user; 
 the unique identifier of the user; 
 a predetermined device- or user-specific key value; 
 a changing value generated according to a predetermined algorithm; 
 time and/or date; 
 data provided by a local beacon or network-attached device accessible to the terminal device; and 
 biometric data of the user. 
 
     
     
         20 . The method of  claim 16  wherein:
 the first processing unit comprises instruction code executing on a processor of a service provider computer system and/or a processor of an authentication server system; and 
 the second processing unit comprises instruction code executing on a processor of the terminal device operated by the user. 
 
     
     
         21 . The method of  claim 20  wherein the terminal device operated by the user is a portable device carried by the user. 
     
     
         22 . The method of  claim 16  wherein the third processing unit comprises instruction code executing on a processor of a service provider computer system and/or a processor of an authentication server system. 
     
     
         23 . An authentication system comprising:
 a processor;   a network interface, operatively associated with the processor; and   at least one computer-readable storage device, accessible by the processor,   wherein the storage device comprises instruction code executable by the processor and configured to cause the processor to implement a method comprising the steps of:
 receiving, via the network interface, a request to initiate an authentication session, the request comprising a unique identifier of a user requiring authentication; 
 acquiring at least one item of authentication data, valid during the authentication session; 
 transmitting, via the network interface, the authentication data to a processing unit associated with a terminal device operated by the user; and 
 receiving, via the network interface, transformed authentication data 
   automatically generated, using a transformation algorithm parameterised by context-dependent values of one or more session-specific authentication factors, by the processing unit associated with the terminal device operated by the user, wherein the transformed authentication data is characteristic of the authentication session and of the user,   wherein the transformed authentication data is configured to enable verification that it corresponds with the user and with predetermined values of the one or more session-specific authentication factors,   whereby an authentication result may be generated for the authentication session based upon the verification.   
     
     
         24 . The system of  claim 23  wherein the instruction code executable by the processor is configured to cause the processor to implement the step of acquiring the at least one item of authentication data by:
 generating a session-specific one-time code word; 
 retrieving, from the at least one computer-readable storage device, the predetermined values of the one or more session-specific authentication factors; and 
 encrypting the one-time code word using a transformation algorithm parameterised by the predetermined values of the one or more session-specific authentication factors. 
 
     
     
         25 . The system of  claim 24  wherein the transformed authentication data is configured to enable verification by confirming that it corresponds with the session-specific one-time code word that has been cryptographically signed using a private cryptographic key of the user. 
     
     
         26 . A portable personal authentication device comprising:
 a processor;   a network interface, operatively associated with the processor; and   at least one computer-readable storage device, accessible by the processor,   wherein the storage device comprises instruction code executable by the processor and configured to cause the processor to implement a method, in an authentication session of a user of the authentication device, comprising the steps of:
 receiving, via the network interface from an authentication system, 
   authentication data that is valid during the authentication session;
 automatically transforming the authentication data using a transformation algorithm parameterised by context-dependent values of one or more session-specific authentication factors, to generate transformed authentication data that is characteristic of the authentication session and of the user; 
 transmitting, via the network interface to the authentication system, the transformed authentication data, 
   wherein the transformed authentication data is configured to enable verification that it corresponds with the user and with predetermined values of the one or more session-specific authentication factors,   whereby an authentication result may be generated for the authentication session based upon the verification.   
     
     
         27 . The portable personal authentication device of  claim 26  wherein the authentication data comprises an encrypted session-specific one-time code word, and the instruction code executable by the processor is configured to cause the processor to implement the step of transforming the authentication data by:
 determining the context-dependent values of the one or more session-specific authentication factors that are based upon a current context of the portable personal authentication device; 
 applying an algorithm parameterised by the determined context-dependent values of the one or more session-specific authentication factors to decrypt the authentication data and recover the session-specific one-time code word; and 
 applying a private cryptographic key of the user, which is held in secure storage of the portable personal authentication device, to generate a signed copy of the session-specific one-time code word for transmission to the authentication system. 
 
     
     
         28 . The portable personal authentication device of  claim 27  wherein the one or more session-specific authentication factors comprises at least one of:
 a geographic location of the portable personal authentication device operated by the user; 
 one or more Service Set Identifiers (SSIDs) of wireless networks visible to the portable personal authentication device operated by the user; 
 an SSID of a wireless network to which the portable personal authentication device is connected; 
 identifying information of a mobile cellular carrier to which the portable personal authentication device is connected 
 a unique identifier associated with the portable personal authentication device operated by the user; 
 the unique identifier of the user; 
 a predetermined device- or user-specific key value; 
 a changing value generated according to a predetermined algorithm; 
 time and/or date; 
 data provided by a local beacon or network-attached device accessible to the portable personal authentication device; and 
 biometric data of the user. 
 
     
     
         29 . A tangible computer-readable medium comprising stored program instructions which, when executed by a processor of an authentication system, cause the authentication system to implement a method comprising the steps of:
 receiving, via a network interface of the authentication system, a request to initiate an authentication session, the request comprising a unique identifier of a user requiring authentication;   acquiring at least one item of authentication data, valid during the authentication session;   transmitting, via the network interface, the authentication data to a processing unit associated with a terminal device operated by the user; and   receiving, via the network interface, transformed authentication data automatically generated, using a transformation algorithm parameterised by context-dependent values of one or more session-specific authentication factors, by the processing unit associated with the terminal device operated by the user, wherein the transformed authentication data is characteristic of the authentication session and of the user,   wherein the transformed authentication data is configured to enable verification that it corresponds with the user and with predetermined values of the one or more session-specific authentication factors,   whereby an authentication result may be generated for the authentication session based upon the verification.   
     
     
         30 . A tangible computer-readable medium comprising stored program instructions which, when executed by a processor of a portable personal authentication device, cause the device to implement a method comprising the steps of:
 receiving, via a network interface of the device from an authentication system, authentication data that is valid during the authentication session;   automatically transforming the authentication data using a transformation algorithm parameterised by context-dependent values of one or more session-specific authentication factors, to generate transformed authentication data that is characteristic of the authentication session and of the user;   transmitting, via the network interface to the authentication system, the transformed authentication data,   wherein the transformed authentication data is configured to enable verification that it corresponds with the user and with predetermined values of the one or more session-specific authentication factors,   whereby an authentication result may be generated for the authentication session based upon the verification.