Resource access management and secure authorization systems and methods
Systems and methods for secure user authentication are described. In certain embodiments, a client device such as a smartphone may be provisioned with a secure key and/or other secret information. The client device may be used to generate unique secure tokens and/or other credentials used in connection with an authentication process. A user may provide the generated tokens and/or other credentials to a service provider in connection with a request to access a managed service. The validity of the generated tokens and/or other credentials may be verified by an authentication service in communication with the service provider.
1. A method performed by a client device for authenticating a right of a user of the client device to access a resource managed by a service provider system, the method comprising:
receiving a first secure key;
receiving, from an authentication service system, at least one of a shared secret value common to the authentication service system and the client device and information that may be used to generate the shared secret value;
securely storing the first secure key and at least one of the shared secret value and the information that may be used to generate the shared secret value in a protected processing environment of the client device;
receiving a request from the user to access the resource managed by the service provider system;
generating, in response to the request, a first secure token using, at least in part, the first secure key and the shared secret value;
sending, to the authentication service system, an authentication request requesting authentication for access to the resource managed by the service provider system, the authentication request comprising one or more authentication credentials, the one or more authentication credentials comprising the first secure token; and
receiving access to the resource managed by the service provider system based on successful authentication of the one or more authentication credentials by the authentication service system.
2. The method of claim 1 , wherein the first secure key is received from the authentication service system.
3. The method of claim 1 , wherein the method further comprises generating the shared secret value using the information that may be used to generate the shared secret value.
4. The method of claim 1 , wherein generating the first secure token comprises performing a computation using the first secure key and the shared secret value as inputs to the computation.
5. The method of claim 1 , wherein the shared secret value comprises at least one of a pseudorandom value and a random value.
6. The method of claim 1 , wherein the managed resource comprises an online service.
7. The method of claim 1 , wherein the managed resource comprises an inventory resource and the service provider system comprises an inventory control system.
8. The method of claim 1 , wherein the managed resource comprises a protected area and the service provider system comprises a physical access control system.
9. The method of claim 1 , wherein the one or more authentication credentials further comprise at least one of user identification information and a password.
10. The method of claim 4 , wherein the computation comprises at least one of a cryptographic hash computation, a digest computation, a time-based one-time password computation, and a HMAC-based one-time password computation.
11. A computer readable storage medium storing instructions that, when executed by a client device comprising a processor, cause the client device to engage in an authentication process of a right of a user of the client device to access a resource managed by a service provider system comprising:
receiving a first secure key;
receiving, from an authentication service system, at least one of a shared secret value common to the authentication service system and the client device and information that may be used to generate the shared secret value;
securely storing the first secure key and at least one of the shared secret value and the information that may be used to generate the shared secret value in a protected processing environment of the client device;
receiving a request from the user to access the resource managed by the service provider system;
generating, in response to the request, a first secure token using, at least in part, the first secure key and the shared secret value;
sending, to the authentication service system, an authentication request requesting authentication for access to the resource managed by the service provider system, the authentication request comprising one or more authentication credentials, the one or more authentication credentials comprising the first secure token; and
receiving access to the resource managed by the service provider system based on successful authentication of the one or more authentication credentials by the authentication service system.
12. The computer readable storage medium of claim 11 , wherein the first secure key is received from the authentication service system.
13. The computer readable storage medium of claim 11 , wherein the authentication process further comprises generating the shared secret value using the information that may be used to generate the shared secret value.
14. The computer readable storage medium of claim 11 , wherein generating the first secure token comprises performing a computation using the first secure key and the shared secret value as inputs to the computation.
15. The computer readable storage medium of claim 11 , wherein the shared secret value comprises at least one of a pseudorandom value and a random value.
16. The computer readable storage medium of claim 11 , wherein the managed resource comprises an online service.
17. The computer readable storage medium of claim 11 , wherein the managed resource comprises an inventory resource and the service provider system comprises an inventory control system.
18. The computer readable storage medium of claim 11 , wherein the managed resource comprises a protected area and the service provider system comprises a physical access control system.
19. The computer readable storage medium of claim 11 , wherein the authentication credentials further comprise at least one of user identification information and a password.
20. The computer readable storage medium of claim 14 , wherein the computation comprises at least one of a cryptographic hash computation, a digest computation, a time-based one-time password computation, and a HMAC-based one-time password computation.