Granted Patent B2

US 12,470,543 · App. 18/065,040 · Granted Nov 11, 2025

Inventors: Harold Todd Chapman (Howell, MI); Robert Jacob Linial Small (Ann Arbor, MI); Michael G. Brown (Portland, OR); Adam Vincent Patruno (Canton, MI); Dylan Miles Kite (Ann Arbor, MI); Zachary Oliver Weglarz (Ann Arbor, MI); Erdenebat Gantumur (Ann Arbor, MI)

Assignee: CISCO TECHNOLOGY, INC.

H04L63/083G06Q20/3821G06Q20/40

Abstract

Claims (56)

1 . An authentication server, comprising:

one or more processors; and

one or more computer-readable non-transitory storage media comprising instructions that, when executed by the one or more processors, cause one or more components of the authentication server to perform operations comprising:

generating a transaction identifier associated with an authentication request received from an external device, wherein the authentication request is part of a multi-factor authentication procedure;

in response to verifying a first authentication factor of the authentication request, transmitting a prompt and the transaction identifier to the external device, wherein the prompt is an HTTP link associated with a browser comprising a generated cookie that is generated at the authentication server and wherein the generated cookie comprises a random value corresponding to the transaction identifier;

receiving a signal comprising the transaction identifier and an instruction to process the HTTP link;

instructing an instance of an application installed on the external device to open the browser in a webview in response to processing the instruction, wherein a cookie is stored in the browser;

identifying the generated cookie based on verifying the transaction identifier;

determining if the cookie is equivalent to the generated cookie; and

in response to determining that the cookie is not equivalent to the generated cookie, determining that the prompt and the transaction identifier transmitted to the external device was subsequently forwarded by the external device to a trusted endpoint device, wherein the trusted endpoint device is associated with a user having previously established authentication with the authentication server, wherein the generated cookie was not transmitted to the trusted endpoint device when the external device forwarded the prompt and the transaction identifier to the trusted endpoint device.

2 . The authentication server of claim 1 , the operations further comprising:

performing a first multi-factor authentication procedure by authenticating the first authentication factor, wherein authentication of the first authentication factor is based on verifying a login credential of the user with the received authentication request.

3 . The authentication server of claim 1 , the operations further comprising:

denying access to a resource associated with the authentication request.

4 . The authentication server of claim 1 , the operations further comprising:

in response to determining that the cookie is equivalent to the generated cookie, determining that the received signal was transmitted by a trusted endpoint device; and

receiving an authentication decision associated with a second authentication factor from the trusted endpoint device via the prompt.

5 . The authentication server of claim 4 , the operations further comprising:

permitting the trusted endpoint device to access a resource associated with the authentication request based on determining that the trusted endpoint device successfully completed a second multi-factor authentication procedure.

6 . The authentication server of claim 1 , wherein the authentication request is a request to perform a multi-factor authentication procedure to verify the first authentication factor and a second authentication factor.

7 . A method to prevent second factor phishing, comprising:

generating a transaction identifier associated with an authentication request received from an external device, wherein the authentication request is part of a multi-factor authentication procedure;

in response to verifying a first authentication factor of the authentication request, transmitting a prompt and the transaction identifier to the external device, wherein the prompt is an HTTP link associated with a browser comprising a generated cookie that is generated at the authentication server, and wherein the generated cookie comprises a random value corresponding to the transaction identifier;

receiving a signal comprising the transaction identifier and an instruction to process the HTTP link;

instructing an instance of an application installed on the external device to open the browser in a webview in response to processing the instruction, wherein a cookie is stored in the browser;

identifying the generated cookie based on verifying the transaction identifier;

determining if the cookie is equivalent to the generated cookie; and

in response to determining that the cookie is not equivalent to the generated cookie, determining that the prompt and the transaction identifier transmitted to the external device was subsequently forwarded by the external device to a trusted endpoint device, wherein the trusted endpoint device is associated with a user having previously established authentication with an authentication server, wherein the generated cookie was not transmitted to the trusted endpoint device when the external device forwarded the prompt and the transaction identifier to the trusted endpoint device.

8 . The method of claim 7 , further comprising:

performing a first multi-factor authentication procedure by authenticating the first authentication factor, wherein authentication of the first authentication factor is based on verifying a login credential of the user with the received authentication request.

9 . The method of claim 7 , further comprising:

denying access to a resource associated with the authentication request.

10 . The method of claim 7 , further comprising:

in response to determining that the cookie is equivalent to the generated cookie, determining that the received signal was transmitted by a trusted endpoint device; and

receiving an authentication decision associated with a second authentication factor from the trusted endpoint device via the prompt.

11 . The method of claim 10 , further comprising:

permitting the trusted endpoint device to access a resource associated with the authentication request based on determining that the trusted endpoint device successfully completed a second multi-factor authentication procedure.

12 . The method of claim 7 , wherein the authentication request is a request to perform a multi-factor authentication procedure to verify the first authentication factor and a second authentication factor.

13 . A non-transitory computer-readable medium comprising instructions that are configured, when executed by a processor, to:

generate a transaction identifier associated with an authentication request received from an external device, wherein the authentication request is part of a multi-factor authentication procedure;

in response to verifying a first authentication factor of the authentication request, transmit a prompt and the transaction identifier to the external device, wherein the prompt is an HTTP link associated with a browser comprising a generated cookie that is generated at the authentication server, and wherein the generated cookie comprises a random value corresponding to the transaction identifier;

receive a signal comprising the transaction identifier and an instruction to process the HTTP link;

instruct an instance of an application installed on the external device to open the browser in a webview in response to processing the instruction, wherein a cookie is stored in the browser;

identify the generated cookie based on verifying the transaction identifier;

determine if the cookie is equivalent to the generated cookie; and

in response to determining that the cookie is not equivalent to the generated cookie, determining that the prompt and the transaction identifier transmitted to the external device was subsequently forwarded by the external device to a trusted endpoint device, wherein the trusted endpoint device is associated with a user having previously established authentication with an authentication server, wherein the generated cookie was not transmitted to the trusted endpoint device when the external device forwarded the prompt and the transaction identifier to the trusted endpoint device.

14 . The non-transitory computer-readable medium of claim 13 , wherein the instructions are further configured to:

perform a first multi-factor authentication procedure by authenticating the first authentication factor, wherein authentication of the first authentication factor is based on verifying a login credential of the user with the received authentication request.

15 . The non-transitory computer-readable medium of claim 13 , wherein the instructions are further configured to:

deny access to a resource associated with the authentication request.

16 . The non-transitory computer-readable medium of claim 13 , wherein the instructions are further configured to:

in response to determining that the cookie is equivalent to the generated cookie, determine that the received signal was transmitted by a trusted endpoint device; and

receive an authentication decision associated with a second authentication factor from the trusted endpoint device via the prompt.

17 . The non-transitory computer-readable medium of claim 16 , wherein the instructions are further configured to:

permit the trusted endpoint device to access a resource associated with the authentication request based on determining that the trusted endpoint device successfully completed a second multi-factor authentication procedure.

18 . The non-transitory computer-readable medium of claim 13 , wherein the authentication request is a request to perform a multi-factor authentication procedure to verify the first authentication factor and a second authentication factor.

Assignments (1)

Continuity (1)

References Cited (26)