Credential-free identification and authentication
A method of authenticating a user so that the user can access a website without entering a unique user credential. A user accesses a target and is presented with an authentication code and an address, and the user sends a message containing the authentication code to that address. Alternatively, the user is pre-supplied with an address and is presented only with an authentication code when the user accesses the target. The user's identity is authenticated by comparing an aspect of the metadata of the message with known metadata aspects, and the user is authenticated by comparing the authentication key presented to the user with the one received in the message. Both the user and the user's identity are authenticated in a single step without requiring the user to input any unique user credential.
1. A system for authenticate a user with respect to a target service via a user-operated device, comprising:
a database that stores user credentials associated with a plurality of users; and
an authentication engine comprising a processor and memory storing software instructions that when executed by the processor causing the process to perform the following steps:
instructing a target user interface associated with the target service to present an authentication passkey and an authentication address without first requiring the user to provide a unique user credential,
receiving, from the user-operated device, a message addressed to the authentication address, and comprising a test passkey and a device identifier,
detecting a similarity between the test passkey and the authentication passkey,
identifying the user-operated device as an authorized device by comparing the device identifier against a stored set of identifiers,
retrieving user credentials associated with the user by querying a user database using solely the device identifier, wherein the user credentials comprise at least a user identifier and a password, and
submitting the retrieved user credentials to the target user interface for accessing the target service.
2. The system of claim 1 , wherein the authentication engine is further programmed to perform a step of generating, upon receipt of a request, the authentication passkey without first requiring the user to provide a unique user credential.
3. The system of claim 2 , wherein the step of generating the authentication passkey comprises a step of generating an authentication passkey that is unique to the target user interface.
4. The system of claim 2 , wherein the request comprises a username associated with the user.
5. The system of claim 1 , wherein the authentication passkey is user agnostic.
6. The system of claim 1 , wherein the authentication engine is further programmed to perform a step of associating the target service with the user based on the device identifier.
7. The system of claim 1 , wherein the authentication engine is further programmed to perform a step of associating the target service with different users based on different device identifiers.
8. The system of claim 1 , wherein the target user interface comprises an ATM machine.
9. The system of claim 8 , wherein the step of authorizing the target user interface to access the target service comprises initiating a transaction with a bank account associated with the user.
10. The system of claim 1 , wherein the target service comprises at least one of a web service, a phone network, an appliance, and entry to an enclosed space.
11. The system of claim 1 , wherein the user-operated device comprises a cell phone.
12. The system of claim 1 , wherein the authenticating address comprises at least one of a URL, an SMS short code, and a phone number.
13. The system of claim 1 , wherein the authenticating address is rotated, and selected from a pool of available addresses.
14. The system of claim 1 , wherein the device identifier comprises at least one of a phone number, a MAC address, and a UDID number.