User authentication system
View Patent ↗An ID vault computer control program detects when a user's browser navigates to a third-party website that requires a user ID and password. If it hasn't done so already, it automatically requests a decryption key for a local encrypted vault file from a network server by supplying a personal identification number (PIN) from the user through the input device, a copy of the GUID, and a signature of GUID using a private key for the root certificate. If a decryption key is returned from the network server, the local encrypted vault file is unlocked and automatically supplies a corresponding user ID and password to log-on to the third-party website without the user.
1. An improved user authentication system, comprising:
a user client computer including a network interface, an operating system, a processor and memory, a browser, and an input device;
the improvement comprising:
a root certificate attached to the operating system;
a globally unique identifier (GUID) disposed within the root certificate;
a local encrypted vault file for storing user ID's and passwords corresponding to third-party websites, and that is normally locked; and
an ID vault computer control program attached to the operating system and for execution by the processor and memory;
wherein, the ID vault computer control program detects when the browser navigates to a third-party website that requires a user ID and password, and automatically requests a decryption key for the local encrypted vault file from a network server by supplying a personal identification number (PIN) from the user through the input device, a copy of the GUID, and a signature of GUID using a private key for the root certificate; and
wherein, if said decryption key is returned from said network server, the local encrypted vault file is unlocked and automatically supplies a corresponding user ID and password to log-on to the third-party website without the user.
2. The improved user authentication system of claim 1 , further comprising:
a client-copy of a trusted network (TN) database that includes sign-on protocols and scripts for answering a third party website's invitation to log-on with a corresponding user ID and password of a previously registered user.
3. The improved user authentication system of claim 1 , further comprising:
a server-copy of a trusted network (TN) database that includes protocols and scripts necessary for logging on to third party websites; and
a communications mechanism for periodically downloading a copy of said trusted network (TN) database to a client.
4. The improved user authentication system of claim 1 , further comprising:
a sign-on algorithm comprising a step-by-step procedure for recognizing an invitation by a third-party website to log-on, and to supply a corresponding user ID and password to that third-party website from the local encrypted vault file.
5. A method for strong authentication of a user, comprising:
accepting a personal identification number (PIN) into a client computer that will thereafter be used as a first authentication factor to a network server;
generating a globally unique identifier (GUID) only once with said client computer, and digitally encrypting it with an asymmetric encryption algorithm that uses a public key and a private key, wherein the encrypted GUID is digitally stored in said client computer and is thereafter used as a second authentication factor to said network server;
authenticating a user to said network server by forwarding a PIN input collected and said encrypted GUID and said public key to said network client;
returning a secret key from said network server to said client computer if said PIN input collected and encrypted GUID pass a test; and
unlocking a local, symmetrically encrypted file with said secret key, wherein the contents are then accessible for use by said client computer.
6. The method of claim 5 , further comprising:
storing user ID and password information for third-party websites in said symmetrically encrypted file.
7. The method of claim 5 , further comprising:
registering said user together with said client computer with said network server and storing a PIN input collected, said public key, and said encrypted GUID in a PIN database for user authentication tests later.
8. An improved user authentication system, comprising:
a user client computer including a network interface, an operating system, a processor and memory, a browser, an input device for a user to enter a PIN, and a local, secure encrypted file with protected data;
a globally unique identifier (GUID) and a root certificate disposed in the user client computer;
a public key infrastructure (PKI) encryption and decryption process disposed in the user client computer, and that includes a private key and a public key (key- 1 ) bound to the GUID and a root certificate;
a symmetric encryption and decryption process that uses a secret key for encryption and decryption;
a network server including a PIN verification process and a user registration database;
the improvement comprising:
a user registration process that self-generates the GUID, that uses the PKI encryption process to encode the GUID and root certificate, that sends to the network server the root certificate's public key (key- 1 ), the self-generated GUID, and a PIN chosen by the user and entered at the input device, that causes the network server to generates a symmetric key (key- 2 ), and then encrypts key- 2 with the supplied key- 1 , producing a key- 3 , and that causes the network server to store key- 3 and all the information passed from the client computer in the registration database, wherein access to key- 2 requires the certificate's private key to decrypt the key- 3 stored in the registration database; and
a user authentication process that sends the GUID, a signature of the GUID using the root certificate's private key, and a freshly acquired PIN entered, wherein the network server makes tests described above, and sends back key- 3 to the user client computer which decrypts it to recover key- 2 , and then accesses the protected data in the vault secure file using key- 2 ;
wherein, only a machine holding the correct root certificate can decrypt key- 3 because key- 3 was created by using the root certificate's public key.
9. The improved user authentication system of claim 8 , further comprising:
a client-copy of a trusted network (TN) database that includes sign-on protocols and scripts for answering a third party website's invitation to log-on with a corresponding user ID and password of a previously registered user.
10. The improved user authentication system of claim 8 , further comprising:
a server-copy of a trusted network (TN) database that includes protocols and scripts necessary for logging on to third party websites; and
a communications mechanism for periodically downloading a copy of said trusted network (TN) database to a client.
11. The improved user authentication system of claim 8 , further comprising:
a sign-on algorithm comprising a step-by-step procedure for recognizing an invitation by a third-party website to log-on, and to supply a corresponding user ID and password to that third-party website from the local encrypted vault file.
12. The improved user authentication system of claim 8 , wherein the user authentication process is configured to sign a PIN and a GUID with a user certificate's private key stored in the windows certificate store, and sent to the network server, and wherein the server verifies the signature using the certificate's public key and tests for the correct PIN as verifiable by the registration database.