System and method for dynamic multifactor authentication
A method of authenticating a user. The method comprises the step of sending an authentication request to a remote authentication device and generating a first piece of authentication information. A mobile device receives the first piece of authentication information from either an access terminal or the remote authentication device. The mobile device of the user generating a second piece of authentication information which is at least partially based on the received first piece of authentication information. The second piece of authentication information is sent to the remote authentication devices and the second piece of authentication information validated. If the second piece of authentication information is successfully validated an authentication signal is generated.
1. A method for authenticating a user, the method comprising the steps of:
receiving, at a mobile device of the user, a first piece of authentication information from an access terminal that is a different device than the mobile device, wherein the first piece of authentication information contains transactional information related to a transaction which the user wishes to make and wherein the first piece of authentication information comprises an encoded and encrypted message and wherein the first piece of authentication information is presented as an image on a display of the access terminal and wherein said image is captured from said display using a digital camera of the mobile device;
generating, within the mobile device of the user, a second piece of authentication information which is at least partially based on the received first piece of authentication information;
receiving at a remote authentication device the second piece of authentication information;
validating the second piece of authentication information; and,
generating an authentication signal if the second piece of authentication information is successfully validated.
2. The method of claim 1 further comprising receiving at the remote authentication device an authentication request.
3. The method of claim 2 wherein the authentication request comprises the transactional information related to the transaction that the user wishes to make.
4. The method of claim 2 wherein the authentication request comprises personal information of the user.
5. The method of claim 1 further comprising the mobile device authenticating the source of the captured image.
6. The method of claim 1 further comprising communicating by the mobile device to the user a second message contained in the first piece of authentication information.
7. The method of claim 6 further comprising the mobile device signing said second message contained in the first piece of authentication information.
8. The method of claim 7 wherein said second message comprises said transactional information and the mobile device signing said message is conditional on the user accepting the transaction described in the message.
9. The method of claim 1 further comprising the mobile device signing a third message contained in the first piece of authentication information.
10. The method of claim 1 wherein the method further comprises the mobile device decrypting and decoding said message.
11. The method of claim 10 wherein said encrypted and encoded message comprises said transactional information.
12. The method of claim 10 further comprising communicating by the mobile device to the user said decrypted and decoded message.
13. The method of claim 10 further comprising the mobile device signing said message.
14. The method of claim 12 wherein said message comprises said transactional information and wherein the mobile device signs said message if the user accepts the transaction described in the message.
15. The method of claim 9 further comprising the mobile device sending said signed message to the remote authentication device.
16. The method of claim 1 wherein generating the second piece of authentication information comprises including in the second piece of authentication information a function of at least a portion of the first piece of authentication information.
17. The method of claim 1 , wherein generating the second piece of authentication information comprises using information specific to the mobile device of the user.
18. The method of claim 17 , wherein the information specific to the mobile device comprises a cryptographic key.
19. The method of claim 1 , wherein the second piece of authentication information comprises biometric data.
20. The method of claim 1 wherein validating the second piece of authentication information further comprises:
receiving information relating to the location of the mobile device; and
validating the second piece of authentication information only if the information relating to the location of the mobile device indicates that the mobile device is in a predetermined location.
21. The method of claim 1 wherein validating the second piece of authentication information further comprises:
receiving information relating to the location of the mobile device;
receiving information relating to the location of the access terminal;
comparing the location of the mobile device with the location of the access terminal; and
validating the second piece of authentication information only if the location of the mobile device matches the location of the access terminal.
22. A mobile device for authenticating a user, the mobile device comprising:
a digital camera;
a microcontroller for processing information input via the digital camera;
a first display for displaying information to the user;
whereby the mobile device is adapted to:
receive a first piece of authentication information which contains transactional information related to a transaction which the user wishes to make;
use the digital camera to capture, from a second display of an access terminal that is a different device than the mobile device, an image that is displayed on said second display of said access terminal;
process said image to obtain an encoded and encrypted message;
decode and decrypt said encoded and encrypted message to retrieve said transactional information related to a transaction which the user wishes to make;
display said transactional information to the user;
generate a second piece of authentication information which is at least partially based on the first piece of authentication information.
23. The mobile device of claim 22 comprising a dedicated hardware token.
24. The mobile device of claim 22 , wherein the mobile device is a mobile phone.
25. The mobile device of claim 22 further adapted to authenticate the source of said image.
26. The mobile device of claim 22 further adapted to generate said second piece of authentication information using information specific to the mobile device.
27. The mobile device of claim 26 wherein the information specific to the mobile device includes an encryption key.
28. The mobile device of claim 22 further adapted to sign said message.
29. The mobile device of claim 22 wherein the first piece of authentication information further comprises an authentication code.
30. The mobile device of claim 22 further adapted to display to the user a code comprised in the message.
31. The mobile device of claim 22 further adapted to send the second piece of authentication information to a remote authentication device.
32. The mobile device of claim 22 wherein the second piece of authentication information comprises biometric data.
33. The mobile device of claim 32 wherein the second piece of authentication information comprises at least a partial fingerprint of at least one of the user's fingers.
34. The mobile device of claim 22 further comprising a finger print scanner for scanning at least a part of a fingerprint of the user.
35. A system for authenticating a user, the system comprising:
a mobile device comprising a digital camera, microcontroller for processing information input via the digital camera, and a first display for displaying information to the user; whereby the mobile device is adapted to:
receive a first piece of authentication information which contains transactional information related to a transaction which the user wishes to make;
use the digital camera to capture, from a second display of an access terminal which is different than the mobile device, an image that is displayed on said second display of said access terminal;
process said image to obtain an encoded and encrypted message;
decode and decrypt said encoded and encrypted message to retrieve said transactional information related to a transaction which the user wishes to make;
display said transactional information to the user on said first display of the mobile device;
generate a second piece of authentication information which is at least partially based on the first piece of authentication information; and
a remote authentication device adapted to:
receive said second piece of authentication information;
validate the second piece of authentication information; and
generate an authentication signal if the second piece of authentication information is successfully validated.
36. The system of claim 35 wherein the remote authentication device is further adapted to generate the first piece of authentication information.
37. The system of claim 35 wherein the remote authentication device is further adapted to receive information relating to the location of the mobile device.
38. The system of claim 37 wherein the remote authentication device is further adapted to use said information related to the location of the mobile device when validating the second piece of authentication information.
39. The system of claim 38 wherein the remote authentication device is further adapted to further use a predetermined location when validating the second piece of authentication information.
40. The system of claim 39 wherein the remote authentication device is further adapted to validate the second piece of authentication information only if the information related to the location of the mobile device indicates that the mobile device is in said predetermined location.
41. The system of claim 37 wherein the remote authentication device is further adapted to receive information relating to the location of the access terminal.
42. The system of claim 41 wherein the remote authentication device is further adapted to use the information related to the location of the mobile device and the information related to the location of the access terminal when validating the second piece of authentication information.
43. The system of claim 41 wherein the remote authentication device is further adapted to compare the location of the mobile device with the location of the access terminal.
44. The system of claim 43 wherein the remote authentication device is further adapted to validate the second piece of authentication information only if the location of the mobile device matches the location of the access terminal.