IP Library Granted Patent US 11,558,365
Granted Patent B1
US 11,558,365 · App. 15/728,868 · Granted Jan 17, 2023

Multi-second factor authentication

Inventor: Bruce McCorkendale (Manhattan Beach, CA)
Assignee: NortonLifeLock Inc.
H04L63/083H04L63/0861H04L63/107H04L2463/082
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 11,558,365
App. No.
15/728,868
Granted
Jan 17, 2023
Kind
B1
Abstract

A method for securing and authorizing sensitive operations is described. A computing device may receive a first authentication factor from a second computing device based on a request from the second computing device to authorize an operation; upon validating the first authentication factor, send to at least the second computing device and a third computing device, a request for a second authentication factor; and authorize the operation based on validating the second authentication factor from the second computing device or from the third computing device, or from both.

Claims (58)

1. A method for securing and authorizing operations, the method being performed by one or more computing devices comprising at least one processor, the method comprising:

receiving, at a first computing device, a request from a second computing device to authorize an operation;

transmitting, by the first computing device and to the second computing device, a request for a first authentication factor based at least in part on receiving the request from the second computing device to authorize the operation;

receiving, at the first computing device associated with a first individual, the first authentication factor from the second computing device based at least in part on transmitting the request for the first authentication factor;

validating, by the first computing device, the received first authentication factor;

sending, by the first computing device and in response to validating the first authentication factor, a plurality of requests for a second authentication factor, the plurality of requests comprising a first request for the second authentication factor to the second computing device and a second request for the second authentication factor to a third computing device and a fourth computing device, wherein the second computing device is associated with a second individual, the third computing device is associated with a third individual, and the fourth computing device is associated with a fourth individual;

receiving the second authentication factor from the second computing device, the third computing device, and the fourth computing device, the second authentication factor different than the first authentication factor; and

authorizing, by the first computing device, the operation based at least in part on validating the second authentication factor received from the second computing device, the third computing device, and the fourth computing device.

2. The method of claim 1 , wherein the first authentication factor or the second authentication factor or both include at least one of a knowledge factor, a possession factor, a disconnected token, a connected token, or an inherence factor, or any combination thereof.

3. The method of claim 1 , wherein the second authentication factor is sent to three or more computing devices associated with a certain number of individuals predetermined as authorizers of the operation, the three or more computing devices including the second computing device, the third computing device, and the fourth computing device.

4. The method of claim 3 , wherein authorizing the operation is based at least in part on:

validating each second authentication factor received from the three or more computing devices; and

determining whether a response sent with each received second authentication factor indicates an affirmative response to permit the operation or indicates a rejection response to deny the operation.

5. The method of claim 1 , further comprising:

identifying a number of validated second authentication factors that affirm the operation; and

determining whether the number of validated second authentication factors that affirm the operation satisfies a predetermined threshold, wherein authorizing the operation is based at least in part on the satisfied predetermined threshold.

6. The method of claim 5 , further comprising:

upon determining the number of validated second authentication factors that affirm the operation satisfies the predetermined threshold, authorizing the operation; and

upon determining at least one of the number of validated second authentication factors received rejects the operation or upon determining the number of validated second authentication factors received that affirm the operation fails to satisfy the predetermined threshold, denying the operation.

7. The method of claim 4 , further comprising:

upon determining at least one of the validated second authentication factors rejects the operation, sending a denial notification to at least one of the first computing device, at least one of the three or more computing devices, or any combination thereof.

8. The method of claim 4 , further comprising:

upon determining at least one second authentication factors received from the three or more computing devices fails validation, performing a security action based at least in part on the determining.

9. The method of claim 8 , wherein performing the security action further comprises:

obtaining information associated with the at least one failed second authentication factor or a computing device that sent the at least one failed second authentication factor, or both; and

providing for display the obtained information to the first computing device, at least one of the three or more computing devices, a predetermined administrator, or any combination thereof.

10. The method of claim 3 , further comprising:

ranking the three or more computing devices based at least in part on a priority level associated with each of the three or more computing devices or an individual associated with each of the three or more computing devices, or both.

11. The method of claim 1 , wherein the operation is associated with at least one of access to a user account, access to a bank account, access to a trust fund, access to an inheritance, access to a service, access to a software application, access to a subscription, access to software code, access to firmware code, access to hardware code, access to remote procedure call middleware, access to database middleware, access to transaction middleware, access to embedded middleware, access to content-centric middleware, or any combination thereof.

12. The method of claim 1 , wherein the operation comprises at least one of a digital signing operation associated with at least one of software code or data, or both.

13. A computing device configured for securing and authorizing operations, further comprising:

one or more processors; and

memory in electronic communication with the one or more processors, wherein the memory stores computer executable instructions that when executed by the one or more processors cause the one or more processors to:

receive a request from a second computing device to authorize an operation;

transmit, to the second computing device, a request for a first authentication factor based at least in part on receiving the request from the second computing device to authorize the operation;

receive the first authentication factor associated with a first individual from the second computing device based at least in part on transmitting the request for the first authentication factor;

validating the received first authentication factor;

send, in response to validating the first authentication factor, a plurality of requests for a second authentication factor, the plurality of requests comprising a first request for the second authentication factor to the second computing device and a second request for the second authentication factor to a third computing device and a fourth computing device, wherein the second computing device is associated with a second individual, the third computing device is associated with a third individual, and the fourth computing device is associated with a fourth individual;

receive the second authentication factor from the second computing device, the third computing device, and the fourth computing device, the second authentication factor different than the first authentication factor; and

authorize the operation based at least in part on validating the second authentication factor received from the second computing device, the third computing device, and the fourth computing device.

14. The computing device of claim 13 , wherein the first authentication factor or the second authentication factor or both include at least one of a knowledge factor, a possession factor, a disconnected token, a connected token, or an inherence factor, or any combination thereof.

15. The computing device of claim 13 , wherein the second authentication factor is sent to three or more computing devices associated with a certain number of individuals predetermined as authorizers of the operation, the three or more computing devices including the second computing device, the third computing device, and the fourth computing device.

16. The computing device of claim 15 , wherein the instructions for authorizing the operation are further executable by the one or more processors to:

validate each second authentication factor received from the three or more computing devices; and

determine whether a response sent with each received second authentication factor indicates an affirmative response to permit the operation or indicates a rejection response to deny the operation.

17. A non-transitory computer-readable medium storing computer executable instructions that when executed by one or more processors of a first computing device cause the one or more processors to:

receive, at the first computing device, a request from a second computing device to authorize an operation;

transmit, by the first computing device and to the second computing device, a request for a first authentication factor based at least in part on receiving the request from the second computing device to authorize the operation;

receive, at the first computing device associated with a first individual, the first authentication factor from the second computing device based at least in part on transmitting the request for the first authentication factor;

validating, by the first computing device, the received first authentication factor;

send, by the first computing device and in response to validating the first authentication factor, a plurality of requests for a second authentication factor, the plurality of requests comprising a first request for the second authentication factor to the second computing device and a second request for the second authentication factor to a third computing device and a fourth computing device, wherein the second computing device is associated with a second individual, the third computing device is associated with a third individual, and the fourth computing device is associated with a fourth individual;

receive the second authentication factor from the second computing device, the third computing device, and the fourth computing device, the second authentication factor different than the first authentication factor; and

authorize, by the first computing device, the operation based at least in part on validating the second authentication factor received from the second computing device, the third computing device, and the fourth computing device.

18. The non-transitory computer-readable medium of claim 17 , wherein the first authentication factor or the second authentication factor or both include at least one of a knowledge factor, a possession factor, a disconnected token, a connected token, or an inherence factor, or any combination thereof.

19. The non-transitory computer-readable medium of claim 17 , wherein the second authentication factor is sent to three or more computing devices associated with a certain number of individuals predetermined as authorizers of the operation, the three or more computing devices including the second computing device, the third computing device, and the fourth computing device.

20. The non-transitory computer-readable medium of claim 19 , wherein the instructions for authorizing the operation are further executable by the one or more processors to:

validate each second authentication factor received from the three or more computing devices; and

determine whether a response sent with each received second authentication factor indicates an affirmative response to permit the operation or indicates a rejection response to deny the operation.

Assignments (5)
NOTICE OF SUCCESSION OF AGENCY (REEL 050926 / FRAME 0560) Recorded Sep 13, 2022
From: JPMORGAN CHASE BANK, N.A.
To: BANK OF AMERICA, N.A., AS COLLATERAL AGENT
Reel/Frame 061422/0371 →
SECURITY AGREEMENT Recorded Sep 13, 2022
From: NORTONLIFELOCK INC.
To: BANK OF AMERICA, N.A., AS COLLATERAL AGENT
Reel/Frame 062220/0001 →
CHANGE OF NAME Recorded Jan 30, 2020
From: SYMANTEC CORPORATION
To: NORTONLIFELOCK INC.
Reel/Frame 051759/0845 →
SECURITY AGREEMENT Recorded Nov 4, 2019
From: SYMANTEC CORPORATION; BLUE COAT LLC; LIFELOCK, INC,; SYMANTEC OPERATING CORPORATION
To: JPMORGAN, N.A.
Reel/Frame 050926/0560 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Oct 10, 2017
From: MCCORKENDALE, BRUCE
To: SYMANTEC CORPORATION
Reel/Frame 043824/0486 →