Method and system for improved security
View Patent ↗An improved authentication method and system is provided where a user securely accesses a variety of target servers for online email, online banking, credit card purchases, ecommerce, brokerage services, corporate databases, and online content (movies, music and software). The method involves a bridge server performing authentication tasks that allow a user to access a server or a group of servers with multiple security levels. The method eliminates the need for the user to remember multiple usernames/passwords for each target server. The method also allows one bridge server and one set of security devices to be used to authenticate the user for multiple servers, thereby reducing security costs and increasing user convenience. A location-based password-ID generating device is also described for secure location-based access.
1. A method of providing secure access to a first server for a user, the first server providing a plurality of sets of services, each set of services in the plurality of sets of services requiring user authentication at a corresponding security level, the method comprising:
at a second server different than the first server:
receiving, from the first server, a list of said plurality of sets of services and the corresponding security levels;
receiving a request to authenticate the user for accessing the first server;
providing the list of the plurality of sets of services of the first server to the user;
receiving a selection of a particular security level to use a corresponding set of services provided by the first server;
receiving a set of security information to authenticate the user for the selected particular security level;
validating the received set of security information by the second server; and
sending a set of credentials from the second server to the first server to authenticate the user on the first server for using the set of services corresponding to the selected particular security level.
2. The method of claim 1 , wherein receiving the request to authenticate the user for accessing the first server comprises:
displaying a list of a set of servers comprising the first server; and
receiving a selection of the first server as a server to be accessed by the user.
3. The method of claim 1 , wherein receiving the selection of the particular security level comprises:
displaying the plurality of sets of services and the corresponding security levels; and
receiving the selection of the particular security level based on the displayed sets of services.
4. The method of claim 1 further comprising directing the user to the first server when the received set of security information is validated by the second server.
5. The method of claim 1 , wherein sending the set of credentials from the second server to the first server comprises sending a dynamically changing user identification and password corresponding to the user.
6. The method of claim 1 further comprising:
after sending the set of credentials from the second server to the first server, dynamically updating the set of credentials for use in a future authentication of the user by the second server with the first server; and
sending the updated set of credentials from the second server to the first server.
7. The method of claim 1 further comprising:
requesting a server identification from the first server;
receiving the server identification at the second server from the first server; and
authenticating the first server based on the received server identification before sending the set of credentials from the second server to the first server to authenticate the user on the first server.
8. The method of claim 7 further comprising:
dynamically updating the server identification for the first server; and
sending the updated server identification from the second server to the first server for a future authentication of the first server by the second server.
9. The method of claim 1 , wherein the particular security level is a first security level, wherein the set of security information is a first set of security information, wherein the set of credentials are a first set of credentials, the method further comprising:
directing the user to the first server after sending the first set of credentials from the second server to the first server;
receiving a request to authenticate the user for accessing a set of services of the first server based on a second security level that is higher than the first security level;
receiving a second set of security information to authenticate the user for the second security level, the second set of security information different than the first set of security information;
validating the second set of security information by the second server; and
sending a second set of credentials from the second server to the first server to authenticate the user on the first server for using the services corresponding to the second security level.
10. The method of claim 1 , wherein sending the set of credentials from the second server to the first server comprises:
establishing a secure network among the first server, the second server, and a device used by the user; and
sending the set of credentials from the second server to the first server through the secure network.
11. The method of claim 1 , wherein sending the set of credentials from the second server to the first server comprises:
establishing an encrypted communication link between the second server and a device used by the user;
sending the set of credentials from the second server to the device through the established encrypted communication link; and
sending the set of credentials from the device to the first server.
12. The method of claim 1 , wherein receiving the request to authenticate the user for accessing the first server comprises:
receiving a request at the first server to authenticate the user; and
redirecting the user from the first server to the second server for authentication of the user by the second server.
13. A non-transitory computer readable medium storing a computer program for authenticating a user, the computer program executable by a processing unit of an authentication server, the computer program comprising sets of instructions for:
displaying a list of a set of servers to the user;
receiving a selection of a particular server from the displayed list of the set of servers;
receiving information for authenticating the user to access the particular server;
validating the information received for authenticating the user;
validating an identity of the particular server using an identification code mutually recognized by the authentication server and the particular server; and
sending, after (i) validating the information received for authenticating the user and (ii) validating the identity of the particular server, a set of credentials to the particular server to enable the user to access the particular server.
14. The non-transitory computer readable medium of claim 13 , wherein the computer program further comprises sets of instructions for:
updating, without interaction from the user, the set of credentials for enabling the user to access the particular server each time the user is authenticated by the authentication server; and
sending the updated credentials to the particular server for future authentication of the user on the particular server.
15. The non-transitory computer readable medium of claim 13 , wherein the computer program further comprises sets of instructions for:
updating the set of credentials for enabling the user to access the particular server after a pre-determined time has elapsed since a previous update of said credentials; and
sending the updated credentials to the particular server for future authentication of the user on the particular server.
16. The non-transitory computer readable medium of claim 13 , wherein the computer program further comprises sets of instructions for:
displaying a plurality of sets of services provided by the particular server, each set of services in the plurality of sets of services associated with a security level in a set of security levels; and
receiving a selection of a particular security level in the set of security levels,
wherein the information for authenticating the user to access the particular server is based on the selected security level, wherein the information for authenticating the user based on the particular security level is different from the information for authenticating the user based on the at least one other security level.
17. The non-transitory computer readable medium of claim 16 , wherein the information for authenticating the user based on a selected security level comprises one of a finger print, a result of a retinal scan, a voice signature, a media access control address (MAC address) of a WiFi access point communicatively couple to a device utilized by the user, and a current location of the user.
18. The non-transitory computer readable medium of claim 13 , wherein the computer program further comprises sets of instructions for:
requesting a server identification from the particular server;
receiving the server identification from the particular server; and
authenticating the particular server based on the received server identification before sending the set of credentials to the particular server to authenticate the user on the particular server.
19. The non-transitory computer readable medium of claim 13 , wherein the set of instructions for receiving the information for authenticating the user to access the particular server comprises a set of instructions to receive one of a finger print, a result of a retinal scan, a voice signature, a media access control address (MAC address) of a WiFi access point communicatively couple to a device utilized by the user, and a current location of the user.
20. A non-transitory computer readable medium storing a computer program for providing secure access to a first server for a user by authenticating the user by a second server different than the first server, the first server providing a plurality of sets of services, each set of services in the plurality of sets of services requiring user authentication at a corresponding security level, the computer program executable by a processing unit of the second server, the computer program comprising sets of instructions for:
receiving, from the first server, a list of said plurality of sets of services and the corresponding security levels;
receiving a request to authenticate the user by the second server for accessing the first server;
providing the list of the plurality of sets of services of the first server to the user;
receiving a selection of a particular security level to use a corresponding set of services provided by the first server;
receiving a set of security information to authenticate the user for the selected particular security level;
validating the received set of security information by the second server; and
sending a set of credentials from the second server to the first server to authenticate the user on the first server for using the set of services corresponding to the selected particular security level.
21. The non-transitory computer readable medium of claim 20 , wherein the set of instructions for receiving the request to authenticate the user for accessing the first server comprises sets of instructions for:
displaying a list of a set of servers comprising the first server; and
receiving a selection of the first server as a server to be accessed by the user.
22. The non-transitory computer readable medium of claim 20 , wherein the set of instructions for receiving the selection of the particular security level comprises sets of instructions for:
displaying a plurality of sets of services and the corresponding security levels; and
receiving the selection of the particular security level based on the displayed sets of services.
23. The non-transitory computer readable medium of claim 20 , the computer program further comprising a set of instructions for directing the user to the first server when the received set of security information is validated by the second server.
24. The non-transitory computer readable medium of claim 20 , wherein the set of instructions for sending the set of credentials from the second server to the first server comprises a set of instructions for sending a dynamically changing user identification and password corresponding to the user.
25. The non-transitory computer readable medium of claim 20 , the computer program further comprising sets of instructions for:
dynamically updating the set of credentials for use in a future authentication of the user by the second server with the first server after sending the set of credentials from the second server to the first server; and
sending the updated set of credentials from the second server to the first server.
26. The non-transitory computer readable medium of claim 20 , the computer program further comprising sets of instructions for:
requesting a server identification from the first server;
receiving the server identification at the second server from the first server; and
authenticating the first server based on the received server identification before sending the set of credentials from the second server to the first server to authenticate the user on the first server.
27. The non-transitory computer readable medium of claim 26 , the computer program further comprising sets of instructions for:
dynamically updating the server identification for the first server; and
sending the updated server identification from the second server to the first server for a future authentication of the first server by the second server.
28. The non-transitory computer readable medium of claim 20 , wherein the particular security level is a first security level, wherein the set of security information is a first set of security information, wherein the set of credentials are a first set of credentials, the computer program further comprising sets of instructions for:
directing the user to the first server after sending the first set of credentials from the second server to the first server;
receiving a request to authenticate the user for accessing a set of services of the first server based on a second security level that is higher than the first security level;
receiving a second set of security information to authenticate the user for the second security level, the second set of security information different than the first set of security information;
validating the second set of security information by the second server; and
sending a second set of credentials from the second server to the first server to authenticate the user on the first server for using the services corresponding to the second security level.
29. The non-transitory computer readable medium of claim 20 , wherein the set of instructions for sending the set of credentials from the second server to the first server comprises sets of instructions for:
establishing a secure network among the first server, the second server, and a device used by the user; and
sending the set of credentials from the second server to the first server through the secure network.
30. The non-transitory computer readable medium of claim 20 , wherein the set of instructions for sending the set of credentials from the second server to the first server comprises sets of instructions for:
establishing an encrypted communication link between the second server and a device used by the user;
sending the set of credentials from the second server to the device through the established encrypted communication link; and
sending the set of credentials from the device to the first server.
31. The non-transitory computer readable medium of claim 20 , wherein the set of instructions for receiving the request to authenticate the user for accessing the first server comprises sets of instructions for:
receiving a request at the first server to authenticate the user; and
redirecting the user from the first server to the second server for authentication of the user by the second server.