Multi-party, secure multi-channel authentication
A method for using multiple channels to access a resource, wherein a first user requests a resource that requires an indication of approval from a second user, a token value is transmitted to the first user on the first channel, and the second user transmits the token value and a second authentication parameter over a second channel. The token value is used to associate the first authentication parameter to the second authentication parameter, whereby the first user is allowed access to the resource on the first. The first and second user may be independently authenticated in some implementations and not independently authenticated in other implementations.
1. A method of providing an unregistered user access to a resource that requires an indication of approval by an authenticated user who is registered to the resource, the method comprising:
receiving, by an authentication system, a request from the unregistered user to access the resource during a user session by supplying an identifier for the resource over a first channel;
creating, by the authentication system, a session record including the identifier and a token value for the user session;
transmitting, by the authentication system, the token value to the unregistered user over the first channel;
receiving, by the authentication system, the token value from the authenticated user over a second channel, wherein the token value is provided to the authenticated user by the unregistered user;
verifying, by the authentication system, that the identifier belongs to the authenticated user, wherein the identifier is retrieved from the session record by the authentication system based on the token value;
receiving, by the authentication system, the indication of approval from the authenticated user to allow the unregistered user to access the resource referenced by the identifier; and
upgrading, by the authentication system, the user session to indicate that the unregistered user is granted access to the resource.
2. The method of claim 1 wherein the authenticated user is authenticated based on an authentication parameter provided to the authentication system.
3. The method of claim 1 wherein the authenticated user is authenticated using a single channel or multi-channel authentication process.
4. The method of claim 1 wherein the identifier for the resource is an account number.
5. The method of claim 1 wherein the identifier is associated with the authenticated user.
6. The method of claim 2 wherein the authentication parameter is a user ID, a descriptive title, password, hard token, soft token, wireless applet, voiceprint, or any combination thereof.
7. The method of claim 2 wherein the unregistered user's access to the resource requires an indication of approval by at least one additional authenticated user.
8. The method of claim 7 , wherein the at least one additional authenticated user is authenticated based on an at least one additional authentication parameter provided to the authentication system over at least one additional channel, the additional authentication parameter comprising a user ID, a password, a partial password, a portion of the identifier, a portion of the authentication parameter, a combination of the identifier and the authentication parameter, a hard token, a soft token, a wireless applet, a voiceprint, or any combination thereof.
9. The method of claim 8 , wherein the at least one additional channel is not the first or second channel.
10. The method of claim 1 further comprising:
generating a credential for the session record with information that indicates whether the resource should be provided to the unregistered user without the indication of approval from the authenticated user.
11. The method of claim 10 , wherein the credential comprises:
a cookie, a permanent credential, a time-sensitive credential, a credential that expires after a pre-set number of user sessions, or any combination thereof.
12. The method of claim 10 , wherein the unregistered user has exited the user session and is attempting to begin a new session, the method comprising:
receiving, by the authentication system, a request for the resource over the first channel from the unregistered user, wherein access to the resource requires a second indication of approval from the authenticated user; and
processing, by the authentication system, information associated with the credential.
13. The method of claim 12 further comprising:
providing, by the authentication system, the resource if the information associated with the credential indicates that the resource should be provided to the unregistered user without the second indication of approval of the authenticated user.
14. The method of claim 10 further comprising authenticating the unregistered user for the resource based on the credential.
15. The method of claim 14 further comprising providing a second unregistered user access to the resource that requires an indication of approval by the unregistered user after the unregistered user is authenticated based on the credential.
16. A method of providing an unregistered user access to a resource that requires an indication of approval by an authenticated user who is registered to the resource, the method comprising:
receiving, by an authentication system, a request from the unregistered user to access the resource during a user session and user session information, wherein the request and the user session information are transmitted over a first channel;
creating, by the authentication system, a session record including the user session information and a token value for the user session;
transmitting, by the authentication system, the token value to the unregistered user over the first channel;
receiving, by the authentication system, the token value from the authenticated user over a second channel, wherein the token value and the user session information are provided to the authenticated user by the unregistered user;
displaying, by the authentication system, the user session information to the authenticated user, wherein the user session information is retrieved from the session record by the authentication system based on the token value;
receiving, by the authentication system, verification from the authenticated user that the user session information displayed matches the user session information provided to the authenticated user by the unregistered user;
receiving, by the authentication system, the resource selected by the authenticated user along with the indication of approval to allow the unregistered user to access the resource; and
upgrading, by the authentication system, the user session to indicate that the unregistered user is granted access to the resource.
17. The method of claim 16 wherein the user session information includes a description of the resource the unregistered user desires to access.
18. The method of claim 16 further comprising:
displaying, by the authentication system, a plurality of resources to which the authenticated user controls access after receiving verification from the authenticated user; and
receiving, by the authentication system, the indication of approval from the authenticated user to allow the unregistered user to access the resource, wherein the resource is selected by the authenticated user from the plurality of resources based on the user session information.