Method and system for authenticated login using static or dynamic codes
Method of authentication including sending a login web page to a first device of a user including a scannable code having an envelope ID and a login challenge. The envelope ID generated by an identity manager is associated with a first envelope of data including a session ID. A confirmation login request is received from a second device associated with the user, and includes a second envelope of data comprising the session ID, a user ID, and a seal of the user ID registering the user ID with the identity manager. The confirmation login request to the login challenge is verified using the session ID, and the user is verified using the user ID and seal. User login is authorized upon successful verification of the login challenge and user, and a communication session having the session ID is established between the web server and the first device.
1. A method of authentication, comprising:
at a web server, sending a login web page to a first device associated with a user, wherein the login web page includes a scannable code comprising an envelope ID and a login challenge, wherein the envelope ID is associated with a first envelope of data comprising a session ID, wherein the envelope ID is generated by an identity manager at a request of the web server;
receiving a confirmation login request responding to the login challenge from a second device associated with the user, wherein the confirmation login request includes a second envelope of data comprising the session ID, a user ID, and a seal of the user ID registering the user ID;
verifying the confirmation login request to the login challenge using the session ID from the confirmation login request;
verifying the user ID based on the seal of the user ID, including:
extracting a transaction number from the seal of the user ID;
accessing transaction data from a blockchain using the transaction number, wherein the transaction data comprises a public key of the user and a first signature of a first hash of the user ID, wherein the first signature is generated using a private key of the user;
generating a second hash of the user ID by hashing the user ID from the second envelope of data;
signing the second hash using the public key of the user to generate a second signature; and
confirming the user when the first signature matches the second signature;
authorizing user login upon successful verification of the login challenge and user ID; and
establishing a communication session having the session ID between the web server and the first device.
2. The method of claim 1 , further comprising:
receiving a request for the login web page from the first device at the web server;
generating the session ID in response to the request for the login web page;
generating the first envelope of data;
sending the first envelope of data to the identity manager over a network, wherein the identity manager generates the envelope ID corresponding to the first envelope of data;
receiving the envelope ID from the identity manager;
generating the scannable code including the envelope ID and the login challenge; and
generating the login web page including the scannable code.
3. The method of claim 1 , wherein the scannable code is scanned by a second device of the user to obtain the envelope ID, wherein the second device retrieves the first envelope from the identity manager using the envelope ID, wherein the second device accesses the Session ID from the first envelope.
4. The method of claim 1 , further comprising:
generating a digital signature by signing the data to be included within the first envelope with a private key of the web server; and
including the digital signature of the data and a public key of the web server within the first envelope of data so that the first envelope of data can be trusted.
5. The method of claim 1 , wherein the receiving a response comprises:
decrypting the second envelope of data using a private key of the web server, wherein the second envelope of data is encrypted using a public key of the web server.
6. The method of claim 1 , wherein the verifying the confirmation login request further comprises:
verifying the session ID in the confirmation login request is valid; and
confirming that the session ID has not timed-out.
7. The method of claim 6 , wherein the verifying the session ID further comprises:
determining that the session ID in the confirmation login request is valid when it matches the session ID in the first envelope of data.
8. The method of claim 1 , wherein the verifying the user ID further comprises:
certifying the user using the user ID and a certification seal included in the second envelope of data.
9. The method of claim 1 , wherein the scannable code comprises one of a QR code, bar code, and PDF417 code.
10. The method of claim 1 , wherein the user ID comprises a public key of the user.
11. A method for authentication, comprising:
on a second device associated with a user, scanning a first scannable code on a login web page of a web server displayed on a first device associated with the user, wherein the first scannable code comprises an envelope ID and a login challenge, wherein the envelope ID is associated with a first envelope of data generated by the web server and comprising a session ID, wherein the envelope ID is generated by an identity manager at the request of the web server, wherein the envelope ID is used to request the first envelope of data from the identity manager;
generating a challenge envelope of data comprising a shared-string generated by the second device, a first digital signature of a hash of the shared-string using a private key of the user, and a user ID;
sending the challenge envelope of data to the web server over a network;
on the second device, scanning a second scannable code on an updated login web page displayed on the first device, wherein the second scannable code comprises a challenge response including the shared-string and a second digital signature of the hash of the shared-string using a private key of the web server;
verifying the second digital signature using a public key of the web server;
at the second device, generating a confirmation login request responding to the login challenge, wherein the confirmation login request includes a second envelope of data comprising the shared-string, the session ID, the user ID, and a seal of the user ID registering the user ID with the identity manager; and
sending the confirmation login request to the web server via the identity manager for authentication and login of the user with the web server.
12. The method of claim 11 , further comprising:
encrypting the challenge envelope of data using the public key of the web server.
13. The method of claim 11 , wherein the web server verifies the confirmation login request using the session ID from the confirmation login request, wherein the web server verifies the user using the user ID and seal, wherein the web server authorizes user login upon successful verification of the login challenge and user, and wherein a communication session having the session ID is established between the web server and the first device.
14. The method of claim 11 , further comprising:
sending a request to the identity manager for the first envelope of data, wherein the request includes the envelope ID; and
receiving the first envelope of data from the identity manager.
15. The method of claim 11 , further comprising:
decrypting the challenge response including the shared-string and a second digital signature using a private key of the user, wherein the challenge response is encrypted using the public key of the user by the web server.
16. The method of claim 11 , wherein the first scannable code comprises one of a QR code, bar code, and pdf 417 code.