Authentication method and system using password as the authentication key
A computer implemented user authentication method, according to which a mobile application is installed on the mobile terminal device of the user and when the user inputs his username and password, the mobile application creates a private and public encryption keys and encrypts the password with the public key. Data including the encrypted password, the username and the public key is sent to a dedicated server and stored therein as an encrypted file under the username, along with information required for contacting the user's mobile terminal device. The user to selects, and enrolls to, an advanced authentication mechanism, which creates an authentication key for validating the identity of the user and encrypting the private key. The encrypted private key is stored on the user's terminal device. Upon launching the mobile application, the user selects a preferred advanced authentication mechanism which returns an authentication key upon successful authentication of the user. The authentication key is used to decrypt the encrypted private key. Then the encrypted password for the user is retrieved and the private key is used to decrypt the user's password. The user's username and password are then forwarded to the mobile application, to complete the authentication.
1. A computer implemented user web authentication method, comprising:
a) installing a mobile application on the mobile terminal device of said user;
b) allowing said user to input his username and password to said mobile application;
c) creating a private and public encryption keys and encrypts said password with said public key;
d) sending data including the encrypted password, the username and the public key to a dedicated server;
e) storing said data as an encrypted file in said dedicated server under said username, along with information required for contacting the user's terminal device;
f) allowing said user to select an advanced authentication mechanism and enrolls to said advanced authentication mechanism, to create an authentication key, for validating the identity of the user;
g) allowing the user to access a website and authenticate according to a selected authentication mechanism, using his mobile terminal device;
h) when the user accesses the website, displaying to said user an option to log in with the mobile application, to be selected;
i) upon selecting said option by said user, said website sends the username to said dedicated server, which verifies that the user has a registered mobile device;
k) said dedicated server sends a push notification to the device which is registered for that username;
l) said user to opens the authentication mobile application on the mobile device and when the mobile application is launched connecting to said dedicated server and receiving a pending authentication request;
m) a dedicated SDK retrieves the symmetric encryption key from said dedicated server and presents several available advanced authentication options;
n) the user selects an authentication option to authenticate;
o) the advanced authentication mechanism returns an authentication key upon successful authentication;
p) capturing the authentication key and using said authentication key to decrypt the encrypted private key;
q) retrieving the encrypted password for said user and using the private key to decrypt the user's password;
r) encrypting the password with the symmetric key received from the dedicated server and pushing the encrypted password to the dedicated server; and
s) the dedicated server pushes the encrypted password to the website, which decrypts it using said symmetric key, for allowing the website to complete the authentication process with the username and password.
2. A user authentication method according to claim 1 , wherein the advanced authentication mechanism is selected from the group of:
a fingerprint scanner;
a pattern drawing;
a PIN code; and
face recognition.