Email-based authentication for sign in and security
The present invention is related to systems and methods that improve the security of computer networks. These systems and methods may be utilized in various applications such as electronic commerce, secure document access, and electronic authentication. The systems and methods include methods for accessing secure accounts without the use of passwords in order to eliminate the need for passwords. In addition, systems and methods further deter automated attacks online using email authentication.
1 . A method for improving security of a computer network by utilizing Simple Mail Transfer Protocol (SMTP), the method comprising:
receiving, via SMTP, a message that requests authentication of a user from a customer device, wherein the message contains a token;
authenticating a sender of the message as an authenticated sender utilizing at least one of DomainKeys Identified Mail (DKIM), Domain-based Message Authentication, Reporting & Conformance (DMARC), and/or Sender Policy Framework (SPF) protocols;
decoding the token contained in the message to form a decoded token;
determining that the user is authenticated based on the decoded token and the authenticated sender;
generating, by an authentication system, an authentication assertion responsive to determining that the user is authenticated, wherein the authentication assertion is cryptographically verifiable as originating from the authentication system and includes (i) a user identifier, and (ii) an expiration time;
storing an authentication status in the authentication system for the user, wherein the authentication status comprises the authentication assertion and is valid across a plurality of different third-party vendor systems that subscribe to a shared authentication service provided by the authentication system;
receiving, from a given third-party vendor;
system of the plurality of different third-party vendor systems, a request that identifies the given third-party vendor system and the user;
providing, by the authentication system to the given third-party vendor system in response to the request, the authentication assertion or a vendor-specific authentication assertion derived from the authentication assertion; and
authenticating the user to the given third-party vendor system without requiring the user to re-enter a password, including the given third-party vendor system verifying the cryptographically verifiable authentication assertion.
2 . The method of claim 1 , wherein the authenticating the user grants the user access to a secure webpage hosted by the given third-party vendor system.
3 . The method of claim 1 , further comprising
performing additional security checks when the decoded token indicates that the message was generated via a copy and paste routine.
4 . The method of claim 3 , wherein the additional security checks include performing a multi-factor authentication.
5 . The method of claim 1 , wherein authenticating the user generates an Oauth token.
6 . The method of claim 5 , wherein the Oauth token grants the user access to a secure webpage hosted by the given third-party vendor system, and wherein the Oauth token is audience-restricted to the given third-party vendor system.
7 . A system for improving security of a computer network utilizing Simple Mail Transfer Protocol (SMTP), the system comprising:
a memory;
a communication interface that is communicatively coupled to a client device via a network; and
a processor that is communicatively coupled to the memory and the communication interface,
wherein the processor is configured to:
receive, via the communication interface, a message that requests authentication of a user from a customer device via SMTP, wherein the message contains a token;
authenticate a sender of the message utilizing at least one of DomainKeys Identified Mail (DKIM), Domain-based Message Authentication, Reporting & Conformance (DMARC), and/or Sender Policy Framework (SPF) protocols;
decode the token contained in the message to form a decoded token;
determine that the user is authenticated based on the decoded token and the authenticated sender;
generate an authentication assertion responsive to determining that the user is authenticated, wherein the authentication assertion is cryptographically verifiable as originating from the system and includes (i) a user identifier and (ii) an expiration time;
store, in the memory, an authentication state for the user that is valid across a plurality of vendor systems that subscribe to a shared authentication service, wherein the authentication state comprises the authentication assertion;
receive, from a given vendor system, of the plurality of vendor systems, a request that identifies the given vendor system and the user;
in response to the request, provide to the given vendor system the authentication assertion or a vendor-specific authentication assertion derived from the authentication assertion; and
grant the user access to the given vendor system without requiring a password entry by the user, including the given vendor system verifying the cryptographically verifiable authentication assertion.
8 . The system of claim 7 , wherein the user is granted access to a secure webpage hosted by the given vendor system when the user is authenticated.
9 . The system of claim 7 , wherein the processor is further configured to:
perform additional security checks when the decoded token indicates that the message was generated via a copy and paste routine.
10 . The system of claim 9 , wherein the additional security checks include performing a multi-factor authentication.
11 . The system of claim 7 , wherein an Oauth token is generated when the user is authenticated.
12 . The system of claim 11 , wherein the Oauth token grants the user access to webpages hosted by the given vendor system, and wherein the Oauth token is audience-restricted to the given vendor system.
13 . A non-transitory computer readable storage medium that stores instructions for improving security of a computer networking by utilizing Simple Mail Transfer protocol, wherein the instructions when executed by a processor, cause the processor to execute a method, the method comprising:
receiving, via SMTP, a message that requests authentication of a user from a customer device, wherein the message contains a token;
authenticating a sender of the message as an authenticated sender utilizing at least one of DomainKeys Identified Mail (DKIM), Domain-based Message Authentication, Reporting & Conformance (DMARC), and/or Sender Policy Framework (SPF) protocols;
decoding the token contained in the message to form a decoded token;
determining that the user is authenticated based on the decoded token and the authenticated sender;
generating, by an authentication system, an authentication assertion responsive to determining that the user is authenticated, wherein the authentication assertion is cryptographically verifiable as originating from the authentication system and includes (i) a user identifier, and (ii) an expiration time;
storing an authentication status in the authentication system for the user, wherein the authentication status comprises the authentication assertion and is valid across a plurality of different third-party vendor systems that subscribe to a shared authentication service provided by the authentication system;
receiving, from a given third-party vendor;
system of the plurality of different third-party vendor systems, a request that identifies the given third-party vendor system and the user;
providing, by the authentication system to the given third-party vendor system in response to the request, the authentication assertion or a vendor-specific authentication assertion derived from the authentication assertion; and
authenticating the user to the given third-party vendor system without requiring the user to re-enter a password, including the given third-party vendor system verifying the cryptographically verifiable authentication assertion.
14 . The non-transitory computer readable storage medium of claim 13 , wherein authenticating the user grants the user access to a secure webpage hosted by the given third-party vendor system.
15 . The non-transitory computer readable storage medium of claim 13 , wherein the method further comprises:
performing additional security checks when the decoded token indicates that the message was generated via a copy and paste routine.
16 . The non-transitory computer readable storage medium of claim 15 , wherein the additional security checks include performing a multi-factor authentication.
17 . The non-transitory computer readable storage medium of claim 13 , wherein authenticating the user generates an Oauth token.
18 . The non-transitory computer readable storage medium of claim 17 , wherein the Oauth token grants the user access to a secure webpage hosted by the given third-party vendor
system, and wherein the Oauth token is audience-restricted to the given third-party vendor system.
19 . The method of claim 1 , wherein providing the authentication assertion comprises providing, to the at least one of the plurality of different third-party vendor systems, an OAuth authorization response that includes an identifier of the at least one third-party vendor system as a client_id, and wherein the authentication system validates that a redirect_uri in the OAuth authorization response matches a redirect uniform resource identifier registered for the at least one third-party vendor system.
20 . The system of claim 7 , wherein the processor is further configured to, prior to granting the user access to the given vendor system, validate that (i) a client_id associated with the given vendor system is authorized to request authentication assertions from the shared authentication service and (ii) a redirect_uri associated with the given vendor system matches a redirect uniform resource identifier stored in a vendor registration record maintained by the shared authentication service.