WO2008064403A1

WO2008064403A1 - Remote service authentication method

Info

Publication number: WO2008064403A1
Application number: PCT/AU2007/001813
Authority: WO
Inventors: Jason Frederick Bender; Simon Charles Hughes Hewitt
Original assignee: Emue Holdings Pty Ltd
Priority date: 2006-11-27
Filing date: 2007-11-27
Publication date: 2008-06-05

Abstract

A method of authenticating a remote service to a user is disclosed. The method includes receiving a network address having a unique identifier assigned to the user and then using the address to communicate with an authentication service. Authentication information, which enables the user to verify authenticity of the remote service, is then received from the authentication service. The authentication information is obtained by processing the unique identifier. A system for authenticating a remote service to a user is also disclosed.

Description

REMOTE SERVICE AUTHENTICATION METHOD

This international patent application claims priority from Australian provisional patent application no. 2006906601 filed on 27 November 2006, the contents of which are to be taken as incorporated herein by this reference.

FIELD OF THE INVENTION

The present invention relates to authenticating a remote service to a user. The method of the present invention has particular application to authentication of web-based remote services such as on-line banking services, and it will be convenient to hereinafter describe it in this context. It is to be appreciated, however, that the method of the invention is not limited to this application and may be used to authenticate a wide variety of remote services.

BACKGROUND TO THE INVENTION

Conventional authentication methods and devices typically allow authentication of a user to a remote service. Typically, conventional authentication methods entail a remote service authenticating a user simply by requesting a password from the user. However, the user has no way to know whether he or she is really communicating with the desired or correct remote service. Thus, if a remote computer is able to mimic the behaviour of the remote service, the user may be spoofed or "phished" into thinking that he or she is communicating with the correct remote service. As a result, an unsuspecting user may divulge information that they would otherwise only divulge to a legitimate remote service, such as, their user ID and password.

It would be desirable to provide an authentication method that is suitable for at least authenticating a remote service to a user so that the user has some confidence that the remote service is legitimate. The discussion of the background to the invention herein is included to explain the context of the invention. This is not to be taken as an admission that any of the material referred was published, known or part of the common general knowledge as at the priority date of this application. SUMMARY OF THE INVENTION

According to an aspect of the present invention, there is provided a method of authenticating a remote service to a user, the method including the following steps: receiving a network address having a unique identifier assigned to the user; using the address to communicate with an authentication service; receiving from the authentication service authentication information obtained by processing the unique identifier, the authentication information enabling the user to verify authenticity of the remote service.

The authentication service may be part of the remote service or co- located on a single server with the remote service, or may be physically and logically separate from the remote service.

The network address may be selected from one or more of the following address types: a uniform resource indicator; an email address; or a link address.

It is to be appreciated that the above-listed address types are exemplary only, and other types of address types may also be suitable. For example, in one embodiment, a network address may include an Internet Protocol (IP) address.

In an embodiment, the network address may be assigned or provided to the user by the remote service, or by an authentication service. The unique identifier assigned to the user may include, for example, an account number, an account name, a customer number, a one-time usable passcode, or a combination of a first identifier (such as an account number, an account name, a customer number or the like), which is a fixed identifier associated with the user, and a second identifier, which is a variable identifier, in the form of a one-time usable passcode.

Thus, in one embodiment, the network address includes the combination of a uniform resource indicator (URI), including the web address of the authentication service (which may or may not be part of the remote service), and a one-time useable passcode. Alternatively, the network address may include the combination of a uniform resource indicator (URI), a first identifier which is a fixed identifier associated with the user (such as an account number) and a second identifier in the form of a one-time useable pass code which is appended or concatenated to the URI and the first identifier to thereby form a one-time usable network address.

In an embodiment, the authentication information includes one or more of the following types: a character sequence; an image file; or an audio file.

It is to be appreciated that the above-listed types are exemplary only, and other types of authentication information may also be suitable.

The user may receive the authentication information by means of an electronic communication, such a web page, SMS message, a voice mail message, or electronic mail.

The authentication information may be generated by the remote service or the authentication service. Alternatively, the authentication information may be selected by the remote service or authentication service based on information provided to the remote service or authentication service by the user.

Preferably, the authentication information transmitted to the user is varied for at least consecutive requests.

More preferably, the authentication information is one-time useable authentication information. In an embodiment, in using the network address to communicate with the authentication service, the authentication service may detect the address type of the network address, or the user may indicate the type. By way of example, the address type may include an "activated" address type or a user entered address type. In this respect, an activated address type may include, for example, a uniform resource indicator which has been "activated" by a user using an input device (such as a mouse, keyboard, trackerball, touch-screen, joystick or the like) to select or enable the address, such as by clicking a mouse pointer over a hyperlink which activates the uniform resource indicator. On the other hand, a user entered address may include, for example, an address which has been manually entered (such as manually keyed) into the address entry field of a web-browser.

In one embodiment, if the address type is an activated type address, the authentication service rejects the user's communication. In other words, in one embodiment the authentication service will not accept, and thus will not authenticate, a communication which has been initiated by "activating" an address and thus which represents an activated address type.

According to another aspect of the present invention, there is provided a method for generating an authentication response to a communication from a user including a network address having a unique identifier assigned to the user, the method including the following steps: receiving the communication and processing the unique identifier to obtain authentication information based on the unique identifier; communicating the authentication information to the user, the authentication information enabling the user to verify authenticity of the remote service.

According to yet another aspect of the present invention, there is provided a system for generating an authentication response to a communication from a user including a network address having a unique identifier assigned to the user, the system including processor and associated memory device for storing a series of instructions to cause the processor to: receive the communication and process the unique identifier; obtain authentication information based on the unique identifier; communicate the authentication information to the user, the authentication information enabling the user to verify authenticity of the remote service.

According to still another aspect of the present invention, there is provided computer software for use in a system for generating an authentication response to a communication from a user including a network address having a unique identifier assigned to the user, the system including a processor and associated memory device for storing the computer software including a series of instructions to cause the processor to: receive the communication and process the unique identifier; obtain authentication information based on the unique identifier; communicate the authentication information to the user, the authentication information enabling the user to verify authenticity of the remote service.

BRIEF DESCRIPTION OF THE DRAWINGS

The invention will now be described in further detail by reference to the attached drawings illustrating example forms of the invention. It is to be understood that the particularity of the drawings does not supersede the generality of the invention. In the drawings:

Figure 1 is a schematic diagram showing a computer-enabled system for authenticating a remote service to a user in accordance with one or more embodiments of the present invention;

Figure 2 is a flow diagram of a method for authenticating a remote service in accordance with an embodiment of the present invention; and

Figure 3 is a schematic diagram showing various functional elements of the computer-enabled system of Figure 1 in block form.

DETAILED DESCRIPTION OF THE DRAWINGS In the following description, it will be convenient to describe various embodiments of the invention by reference to a typical application wherein the remote service is an e-commerce service, such as an on-line banking service. However, it is envisaged that the proposed method of authenticating a remote service to a user will be applicable to a broad range of remote services, including on-line share trading, electronic messaging services (for example, email), marketing and promotional offers (such as special offer coupons), online retail services and the like.

Referring firstly to Figure 1 , there is shown an example computer enabled system for authenticating a remote service to a user. In a first embodiment, the system 100 includes a client user terminal 1 10 for access by a user 120, in communication with a first server 130 associated with a remote service 140 such as an on-line banking service. Server 130 may be associated with a database 150 for storing authentication information for authenticating the remote service 140 to a user 120. The client user terminal 1 10 and server 130 are interconnected by means of the Internet 160 or any other suitable communications network.

A network address may be assigned to the user 120 by the remote service 140 itself or by another service such as, for example, an independent authentication service 210 that assigns network addresses and unique identifiers for use with different remote services. Independent authentication service 210 may be associated with a second server 170 further associated with a second database 180 for maintaining a record of users 120 and corresponding unique identifiers which are provided to the users by the authentication service 210. In another alternative embodiment, (not shown) the second database 180 may be associated with the first server 130 disposing the need for second server 170. In another embodiment, the authentication service 210 may receive and process the network address having the unique identifier from the user 120 to obtain authentication information and communicate the same to the user 120 to enable the user to verify authenticity of the remote service 140.

Referring now to Figure 2, at step 215, a user 120 associated with client user terminal 1 10 is provided with a network address having a unique identifier which has been assigned to the user 120. The unique identifier may include, for example, an alphabetic, numeric, or alphanumeric identifier.

In the illustrated example, the network address comprises a uniform resource indicator (URI) including the web address of the authentication service 210, which may or may not be part of the remote service 140, and a unique numeric identifier, for example, www.emue.com/12345678. In some embodiments, the unique identifier includes a one-time useable passcode which may comprise the entire unique identifier or a portion of it. For example, in one embodiment the unique identifier may include a number (such as an account or customer number) which is directly associated with user 120 and which is appended to, or concatenated with, the one-time usable passcode. For example, an identifier may include a one-time useable pass code which is appended or concatenated to the URI to thereby form a onetime usable network address. Suitable devices for generating a one-time usable passcode may include, for example, an RSA SecurelD or VASCO token. Another device which is suitable for generating a one-time usable passcode is described in international patent application PCT/AU2005/001923, the contents of which are taken to be incorporated by this reference.

At step 220, the user 120 uses the network address having the unique identifier to send a communication requesting authentication of the remote service. At step 230, the authentication service 210 receives the communication from the user 120, and processes the unique identifier to obtain authentication information corresponding to the user 120. At step 240, the authentication information is received by the user 120 to enable the user 120 to verify authenticity of the remote service 140. In the illustrated example, the authentication information comprises a numeric verification code, for example, 87463968.

The network address may be a uniform resource indicator (URI) that has been uniquely assigned and provided to the user 120 for authenticating the remote service 140. Thus, in one embodiment the remote service 140 or authentication service 210 assigns a unique URI to each user of the remote service 140. The term "uniquely assigned" is intended to convey that the network address is unique to each user 120 in terms of the remote service 140, and thus may be used to distinguish the user from other users of the same remote service 140. For instance, in a typical application, each user 120 is a registered user of the remote service 120 and thus each registered user is assigned a unique URI.

In an embodiment in which the network address is a URI, the unique identifier may include the entire URI or, alternatively, it may include only a part of the URI such as the host, the port, the path, the query or the fragment, or combinations thereof. Alternatively, the network address could comprise an email address or a link address that has been assigned to the user 120 by the remote service 140 specifically for communicating with the authentication service 210. Of course, it will also be appreciated that other forms of addresses may also be used, such as for example, a telephone number (in the case of PSTN or PLMN communication between the user and the remote service) or an IP address (in the case of data packet based communications between the user and the remote service).

The authentication information may include information that has been previously selected and/or entered by the user 120. For example, the authentication information may include an image file (such as an image file for a photograph or symbol), a character sequence (such as a quotation or random sequence of letters and/or numbers), or even an audio or sound file (such as an mpeg file, a .wav file or the like) that has been selected or entered by the user 120. This enables the user 120 to enter or select information that is of significance to the user to enable the user to readily authenticate the remote service 140 if the authentication information provided to the user 120 includes information that has been personally selected by or entered by the user 120. Alternatively, the authentication information may be an image file, a character sequence or an audio file that is dynamically generated in response to receipt of the user communication. In this case the authentication service 210 will also inform the user 120 regarding the authentication information and how to verify that information.

To enhance security, it is preferred that different authentication information be communicated to the user 120 at least each time consecutive user communications are received and processed. Thus, where, for example, the authentication information comprises a web-page, a unique web-page will be generated on the client computer 1 10 for consecutive user requests to access the remote service 140. Similarly, where the authentication information comprises an authentication code, a different authentication code will be generated for each of consecutive requests.

Alternatively, the authentication information may include one-time usable authentication information, such as an authentication code that is generated algorithmically by the remote service 140 or authentication service 210 in response to processing the unique identifier.

Referring back to Figure 1 , in an embodiment in which the network address comprises a URI, the authentication information may include, or at least be contained in, a web-page that is communicated to the user 120 after processing the unique identifier. Accordingly, the authentication information is communicated via a bi-directional communication channel to the same device that was used to make the initial communication with the remote service 140. For example, where the client user terminal 1 10 is used to communicate with the remote service 140 via the Internet 160, the remote service 140 may communicate the authentication information back to the client user computer 1 10 in the form of a web-page. Alternatively, if the network address were to comprise an email address and the user 120 communicated with the remote service 140 via an electronic message or email, the authentication information may be communicated back to the user 120 by email via the Internet 160 or similar communications network.

The web page or email communicated to the user 120 will include one or more features and/or characteristics that are recognizable to the user 120 as verifying authenticity of the remote service 140. For example, the web page or email may include an image file, a symbol, a pattern, a graphic, a sign, an audio file or other object that that has been selected by, or provided to, the remote service 140 or authentication service 210 as corresponding to the unique identifier, and which is recognizable by the user 120 as a valid authentication response. In this respect, "valid authentication response" denotes a response that contains authentication information that the user 120 recognizes as a response which confirms that the remote service 140 is legitimate.

Still referring to Figure 1 , there is shown an alternative embodiment, in which the user 120 communicates with the remote service 140 via the Internet 160 using the client terminal 1 10 using a network address containing a unique identifier. However, in this case, the authentication information is communicated to the user 120 via a second communication channel, such as for example a GSM or similar wireless network 190 to a different device such as, for example, a mobile telephone 200. Accordingly, the authentication information may be transmitted to a mobile telephone associated with the user 120 as a voice message or as a short message service (SMS) message.

The use of the network address to authenticate the remote service 140 may include the user 120 entering the network address into a client computer 1 10 so as to request a web page from a server associated with the remote service 140. Alternatively, use of the network address may include the user 120 activating an address that has been sent to the user 120 in an electronic communication, such as an email message, short message service, multimedia service or the like. In an embodiment, the user communication further includes information classifying how the network address was entered and/or activated by the user. For example, if the network address was entered by activating a link address contained in an email communicated to the user 120, the request information may classify the activation of that address as an activated address type. On the other hand, if the network address was manually entered into a user communications device (such as a client computer equipped with browsing software), the activation of that network address may be classified as a user entered type. An embodiment of the present invention that provides a capacity to classify the network address as an entered or activated address is expected to provide additional advantages in that it may enable the remote service 140 to deny access to the remote service 140 in the event that the network address was not a user entered type. Denying access in this way is expected to provide additional security benefits to the user 120.

Processing of the unique identifier to obtain corresponding authentication information for the user 120 may entail the responsible service (in other words, the remote service 140 or the authentication service 210) conducting a database lookup to retrieve authentication information associated with the unique identifier, and thus the user 120. This process may involve the remote service 140 communicating the unique identifier to an external authentication service and requesting authentication information from that service. Alternatively, the user 120 may communicate directly with an independent authentication service to verify authenticity of the remote service 140.

The system 100 may be implemented using hardware, software or a combination thereof and may be implemented in one or more computer systems or processing systems. In particular, the functionality of the client user terminal 1 10, as well as the server 130, 170 may be provided by one or more computer systems capable of carrying out the above described functionality.

Referring to Figure 3, the computer system 300 includes one or more processors, such as processor 310. The processor 310 is connected to a communication infrastructure 320. The computer system 300 may include a display interface 330 that forwards graphics, texts and other data from the communication infrastructure 320 for supply to the display unit 340. The computer system 300 may also include a main memory 350, preferably random access memory, and may also include a secondary memory 360. The secondary memory 360 may include, for example, a hard disk drive, magnetic tape drive, optical disk drive, etc. The removable storage drive 380 reads from and/or writes to a removable storage unit 390 in a well known manner. The removable storage unit 390 represents a floppy disk, magnetic tape, optical disk, etc. As will be appreciated, the removable storage unit 390 includes a computer usable storage medium having stored therein computer software in a form of a series of instructions to cause the processor 310 to carry out desired functionality. In alternative embodiments, the secondary memory 360 may include other similar means for allowing computer programs or instructions to be loaded into the computer system 300. Such means may include, for example, a removable storage unit 400 and interface 410.

The computer system 300 may also include a communications interface 420. Communications interface 420 allow software and data to be transferred between the computer system 300 and external devices. Examples of communication interface 420 may include a modem, a network interface, a communications port, a PCMIA slot and card etc. Software and data transferred via a communications interface 420 are in the form of signals 430 which may be electromagnetic, electronic, optical or other signals capable of being received by the communications interface 420. The signals are provided to communications interface 420 via a communications path 440 such as a wire or cable, fibre optics, phone line, cellular phone link, radio frequency or other communications channels.

Although in the above described embodiments the invention is implemented primarily using computer software, in other embodiments the invention may be implemented primarily in hardware using, for example, hardware components such as an application specific integrated circuit (ASICs). Implementation of a hardware state machine so as to perform the functions described herein will be apparent to persons skilled in the relevant art. In other embodiments, the invention may be implemented using a combination of both hardware and software.

It is an advantage of the present invention, that the method provides a convenient means for authenticating a remote service to a user. In some embodiments, the authentication information used to verify authenticity of the remote service is selected and/or provided by the user which means that the step of the user verifying authenticity of the service becomes intuitive. Moreover, the method may be used to verify authenticity of the remote service to a large number of users, simply by providing each registered user of the service with an address having a unique identifier as part of the registration process. Use of one-time usable authentication information, or at least varying the authentication information for consecutive communications received from a user, further enhances the level of security provided by the method. In conclusion, it must be appreciated that there may be other various and modifications to the configurations described herein which are also within the scope of the present invention.

Claims

THE CLAIMS:

1. A method of authenticating a remote service to a user, the method including the following steps: receiving a network address having a unique identifier assigned to the user; using the address to communicate with an authentication service; and receiving, from the authentication service, authentication information obtained by processing the unique identifier, the authentication information enabling the user to verify authenticity of the remote service.

2. A method according to claim 1 , wherein the network address is selected from one of the following address types: a uniform resource indicator; an email address; and a link address.

3. A method according to claim 1 or 2, wherein the network address is provided to the user by the remote service, or by an authentication service.

4. A method according to any one of claims 1 to 3, wherein the authentication information includes one or more of the following types: a character sequence; an image file; and an audio file.

5. A method according to any one of claims 1 to 4, wherein the user receives the authentication information by means of one of the following: a web page; an SMS message; a voice mail message; and electronic mail.

6. A method according to any one of claims 1 to 5, wherein the authentication information is generated by the remote service.

7. A method according to any one of claims 1 to 5, wherein the authentication information is generated by the authentication service.

8. A method according to any one of claims 1 to 5 wherein the authentication information is provided to the remote service or authentication service by the user.

9. A method according to any one of claims 1 to 8, wherein the authentication information transmitted to the user is varied for at least consecutive requests.

10. A method according to any one of claims 1 to 9, wherein the authentication information is one-time useable authentication information.

1 1. A method according to any one of claims 1 to 10, wherein in using the network address to communicate with the authentication service, the user indicates an address type to the authentication service, the address type being either an activated address type or a user entered address type.

12. A method according to any one of claims 1 to 10, wherein in using the network address to communicate with the authentication service, the authentication service detects address type of the network address, the address type being either an activated address type or a user entered address type.

13. A method according to claim 11 or 12, wherein if the network address is an activated type address, the authentication service rejects the user's communication.

14. A method for generating an authentication response to a communication from a user, the communication including a network address having a unique identifier assigned to the user, the method including the following steps: receiving the communication and processing the unique identifier to obtain authentication information based on the unique identifier; communicating the authentication information to the user, the authentication information enabling the user to verify authenticity of the remote service.

15. A system for generating an authentication response to a communication from a user, the communication including an address having a unique identifier assigned to the user, the system including a processor and associated memory device for storing a series of instructions to cause the processor to: receive the communication and process the unique identifier; obtain authentication information based on the unique identifier; and communicate the authentication information to the user, the authentication information enabling the user to verify authenticity of the remote service.

16. Computer software for use in a system for generating an authentication response to a communication from a user including a network address having a unique identifier assigned to the user, the system including a processor and associated memory device for storing the computer software including a series of instructions to cause the processor to: receive the communication and process the unique identifier; obtain authentication information based on the unique identifier; and communicate the authentication information to the user, the authentication information enabling the user to verify authenticity of the remote service.

17. A method of authenticating a remote service to a user substantially as herein before described with reference to any one of the embodiments shown in the drawings.

18. A system for generating an authentication response to a user communication substantially as herein before described with reference to any one of the embodiments shown in the drawings.