Multi-factor authentication methods and related systems
The present disclosure provides various embodiments of systems and methods to securely authenticate a user. More specifically, the present disclosure provides embodiments of multi-factor authentication methods that improve both security and user convenience by using trusted secondary devices or peripherals (hereinafter “trusted devices”) to provide additional authentication factor(s) for verifying user presence/identity after an initial authentication factor has been used to verify user presence/identity. Unlike conventional multi-factor authentication methods, the additional authentication factor(s) provided by the trusted devices do not require user input or intervention.
1. A system for securely authenticating a user, the system comprising:
an information handling system (IHS) coupled to receive user login information from the user when the user initiates login to a protected resource, wherein the user login information is used as an initial authentication factor to verify a presence or identity of the user; and
at least one trusted device communicatively coupled to the IHS via a local network, wherein the at least one trusted device includes one or more sensors for obtaining sensor data;
wherein if the initial authentication factor successfully verifies the presence or identity of the user, the IHS generates and communicates a challenge to the at least one trusted device, which uses the sensor data obtained by the one or more sensors to generate and communicate a response; and
wherein the challenge and the response provide an additional authentication factor, which is used to further verify the presence or identity of the user without user input or intervention.
2. The system as recited in claim 1 , wherein the at least one trusted device comprises a plurality of trusted devices, wherein the challenge generated by the IHS is communicated synchronously to each of the plurality of trusted devices, and wherein the responses generated by the plurality of trusted devices are communicated synchronously back to the IHS or to a cloud-based server.
3. The system as recited in claim 1 , wherein the challenge includes an authentication request to collect, access and/or use the sensor data obtained by the one or more sensors included within the at least one trusted device.
4. The system as recited in claim 3 , wherein upon receiving the challenge from the IHS, the at least one trusted device uses the sensor data obtained from the one or more sensors included therein to generate and communicate the response to the authentication request.
5. The system as recited in claim 1 , wherein the IHS comprises a first set of program instructions stored within a computer-readable medium of the IHS, wherein if the initial authentication factor successfully verifies the presence or identity of the user, the first set of program instructions are executed by a processing device of the IHS to:
generate a timestamp token to capture a first timestamp of the time the user initiated login to the protected resource;
store the timestamp token within the IHS;
send the timestamp token to the at least one trusted device; and
generate and communicate the challenge to the at least one trusted device, wherein the challenge comprises a first timestamped cryptographic key that is generated by the IHS using the timestamp token.
6. The system as recited in claim 5 , wherein the response generated by the at least one trusted device is communicated back to the IHS for validation, decryption and authentication.
7. The system as recited in claim 6 , wherein the first set of program instructions are further executed by the processing device of the IHS to:
validate the response received from the at least one trusted device, wherein the response comprises a second timestamped cryptographic key, which is generated by the at least one trusted device using the timestamp token sent by the IHS to the at least one trusted device;
decrypt the second timestamped cryptographic key using the timestamp token stored within the IHS to obtain a second timestamp;
compare the second timestamp to the first timestamp;
authenticate the user and log the user into the protected resource, if the second timestamp matches the first timestamp; and
perform one or more security related actions, if the second timestamp does not match the first timestamp.
8. The system as recited in claim 5 , further comprising a cloud-based server communicatively coupled to the IHS and the at least one trusted device via a wide area network, wherein the response generated by the at least one trusted device is communicated back to the cloud-based server for validation, decryption and authentication.
9. The system as recited in claim 8 , wherein the cloud-based server comprises a second set of program instructions, which are stored within a computer-readable medium and executed by a processing device of the cloud-based server to:
validate the response received from the at least one trusted device, wherein the response comprises a second timestamped cryptographic key, which is generated by the at least one trusted device using the timestamp token sent by the IHS to the at least one trusted device;
decrypt the second timestamped cryptographic key using the timestamp token stored within the IHS to obtain a second timestamp;
compare the second timestamp to the first timestamp; and
authenticate the user only if the second timestamp matches the first timestamp.
10. The system as recited in claim 9 , wherein the first set of program instructions are further executed by the processing device of the IHS to:
log the user into the protected resource, if the cloud-based server authenticates the user; and
perform one or more security related actions, if the cloud-based server fails to authenticate the user.
11. A computer implemented method performed by an information handling system (IHS) to securely authenticate a user attempting to login to a protected resource, the computer implemented method comprising:
generating a challenge after an initial authentication factor has been used by the IHS to successfully verify a presence or identity of the user, wherein the challenge includes an authentication request to collect, access and/or use sensor data obtained by a plurality of trusted devices communicatively coupled to the IHS;
communicating the challenge synchronously to each of the plurality of trusted devices; and
receiving a response to the authentication request from each of the plurality of trusted devices, wherein each trusted device uses sensor data obtained from one or more sensors included within the trusted device to generate the response;
wherein the challenge and the response provide an additional authentication factor, which is used to further verify the presence or identity of the user, and wherein the challenge and the response are generated without user input or intervention.
12. The computer implemented method as recited in claim 11 , wherein after an initial authentication factor has been used by the IHS to successfully verify a presence or identity of the user and prior to generating the challenge, the computer implemented method further comprises:
generating a timestamp token to capture a timestamp of the user's login time;
storing the timestamp token within the IHS; and
sending the timestamp token to the plurality of trusted devices.
13. The computer implemented method as recited in claim 12 , wherein the response received from each trusted device includes, or is encrypted with, a timestamped cryptographic key that was generated by the trusted device using the timestamp token sent from the IHS to the trusted device.
14. The computer implemented method as recited in claim 13 , further comprising:
validating the responses received from the plurality of trusted devices;
decrypting the timestamped cryptographic key using the timestamp token stored within the IHS to obtain a timestamp;
comparing the timestamp obtained from the timestamped cryptographic key to the timestamp of the user's login time;
authenticating the user and logging the user into the protected resource, if the timestamp obtained from the timestamped cryptographic key matches the timestamp of the user's login time; and
performing one or more security actions, if the timestamp obtained from the timestamped cryptographic key does not match the timestamp of the user's login time.
15. The computer implemented method as recited in claim 14 , wherein the one or more security actions comprise: preventing the user from logging in, asking the user to re-attempt login, and/or flagging the login attempt as abnormal user behavior or a security threat.
16. A computer implemented method to securely authenticate a user attempting to login to a protected resource, wherein the computer implemented method is performed by at least one trusted device communicatively coupled to an information handling system (IHS), the computer implemented method comprising:
receiving a timestamp token from the IHS after an initial authentication factor has been used by the IHS to successfully verify a presence or identity of the user, wherein the timestamp token comprises a timestamp of the user's login time;
receiving a challenge from the IHS, wherein the challenge includes: (a) an authentication request to collect, access and/or use sensor data obtained by the at least one trusted device, and (b) a first timestamped cryptographic key that was generated by the IHS using the timestamp token;
using the sensor data obtained by the at least one trusted device and the timestamp token received from the IHS to generate a second timestamped cryptographic key; and
sending a response to the authentication request back to the IHS, wherein the response includes, or is encrypted with, the second timestamped cryptographic key.
17. The computer implemented method as recited in claim 16 , wherein upon receiving the challenge, the computer implemented method further comprises:
decrypting the first timestamped cryptographic key using the timestamp token received from the IHS to obtain a timestamp; and
comparing the timestamp obtained from the first timestamped cryptographic key to the timestamp included within the timestamp token.
18. The computer implemented method as recited in claim 17 , wherein said sending a response to the authentication request back to the IHS comprises sending the response to the authentication request back to the IHS only if the timestamp obtained from the first timestamped cryptographic key matches the timestamp included within the timestamp token.
19. The computer implemented method as recited in claim 17 , wherein if the timestamp obtained from the first timestamped cryptographic key does not match the timestamp included within the timestamp token, the computer implemented method further comprises:
sending a timeout to the IHS, wherein the timeout causes the IHS to perform one or more security actions; or
sending a message back to the IHS requesting another challenge be sent to the at least one trusted device.
20. The computer implemented method as recited in claim 19 , wherein the one or more security actions comprise: preventing the user from logging in, asking the user to re-attempt login, and/or flagging the login attempt as abnormal user behavior or a security threat.