Method and system for user authentication

The present disclosure relates to a method for user authentication. In particular, the present disclosure relates to a computer implemented method for session based one-time authentication of a client operating an electronic device, typically using one of a biometric data relating to the user and/or information provided at a remote electronic device. The disclosure device server also relates to a corresponding authentication system and to a computer program product.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a 371 U.S. National Stage of International Application No. PCT/SE2016/051115, filed Nov. 11, 2016, which claims priority to Swedish Application No. 1551459-9, filed on Nov. 11, 2015. The disclosures of each of the above applications are incorporated herein by reference in their entirety.

TECHNICAL FIELD

The present disclosure relates to a method for user authentication. In particular, the present disclosure relates to a computer implemented method for session based one-time authentication of a client operating an electronic device, typically using one of a biometric data relating to the user and/or information provided at a remote electronic device. The disclosure also relates to a corresponding authentication system and to a computer program product.

BACKGROUND OF THE INVENTION

At present, user information is distributed across many networks, websites and databases. For a user to access the available information, the user must issue separate sign-on commands for each specific system or application. This process is tedious for the user, specifically as to the necessity or remembering different logon procedures, often involving passwords. To keep the information as secure as possible, the passwords must be kept relatively complicated and changed regularly. This places the user under a significant burden to remember and maintain this information.

It would be quite beneficial to provide a single sign-on (SSO) tool to enable authorized users to perform one initial sign-on to access a variety of networks, systems and applications. A single sign-on system should provide secure handling of user passwords as well as support for multiple target logon methods, at least during a particular on-line session.

There today exist SSO tools for improving user access to a variety of networks, systems and applications. However, they are typically based on how to interact with the variety of networks, systems and applications. Accordingly, it would be desirable to also try to improve the general user handling of passwords, in a session environment, further improving the overall usability.

SUMMARY OF THE INVENTION

According to a first aspect of the disclosure, the above is at least partly met by a computer-implemented method for single sign-on of a user operating a client device connected to an authentication server using a network connection, the method comprising the steps of receiving, at the client device, a user specific data element, wherein the user specific data element comprises biometric data relating to the user, forming, at the client device, a key pair based on the user specific data element, a previously selected data element stored at the client device and an ID of the user, wherein the key pair comprises a public and a private key, and wherein the previously selected data element comprises information individually selected by the user, receiving, at the server, a request for authentication, transmitting, from the server to the client device, a challenge data element, signing, at the client device, the challenge data element using the private key, transmitting, from the client device to the server, a signed version of the challenge data element, and authenticating, at the server, the user by validating the signed version of the challenge data element using a previously stored public key relating to the user.

The present inventor has identified that it should be possible to form specific key pairs based on a data element specifically relating to the user. That is, the user is not expected to input a password but rather some form of user related information. The user related information could possibly be provided through a user interface of the client device, alternatively the user specific information could be provided by means of an electronic device connected to the client device as will be further discussed below in relation to the detailed description of the invention.

Furthermore, by means of the invention a user will be authenticated by means of a key pair that has a true connection to the user, wherein biometric data relating to the user connected to the user ID. In addition, the user individually selects a data element that is used for “defocusing” the biometric data. The key pair will be based on said true connection between the users ID and his biometric data, but without having to risk that the biometric data may be “extracted” out from the keys (that in some instances may be communicated in an unsafe environment).

The invention is typically at least partly performed in a web browser, functioning as a sign-on feature for allowing user access to a plurality of websites, at least during a predefined session length. Preferably, the generation of the key pair using the inventive method is re-initiated once the predefined session length has been preceded.

Preferably, the user specific data comprises biometric data relating to the user. The biometric data may for example relate to at least one of information relating to a fingerprint, an iris, a retina, a palm print, a voice print, DNA, and a handwritten signature, and behavioral biometrics for the user.

Advantages with the invention includes that the user does not have to remember any form of password to be allowed multi-site user access. Accordingly, the user related biometric data will be received once from the user, typically per session, to access the mentioned variety of networks, systems and applications.

In a possible embodiment of the present invention, it may be possible to form the key pair based on combination of the biometric data relating to the user and a user password. It may also be possible to introduce means for allowing either of the biometric data and the user password to in the end form an (essentially) identical key pair, meaning that the user may select to use either of the biometric data and the user password in the process of user authentication. Such an implementation will further allow the use biometric data as a “backup” in case of forgetting the user password, or using the biometric data if e.g. the fingerprint sensor is in some way malfunctioning.

Additionally, the disclosed embodiment will also allow for two-factor (or multi-factor if requesting a plurality of different types of biometric data, e.g. both face and fingerprint sensing) authentication to be implemented, whereby an extra layer of security is introduced such that the user has to enter both the user password and provide biometric data for allowing successful user authentication.

According to a second aspect of the disclosure there is provided an authentication system comprising at least a client device and an authentication server connected there-between using a network connection, the authentication system configured for single sign-on of a user operating the client device, the authentication system configured for receiving, at the client device, a user specific data element, wherein the user specific data element comprises biometric data relating to the user, forming, at the client device, a key pair based on the user specific data element, a previously selected data element stored at the client device and an ID of the user, wherein the key pair comprises a public and a private key, and wherein the previously selected data element comprises information individually selected by the user, receiving, at the server, a request for authentication, transmitting, from the server to the client device, a challenge data element, signing, at the client device, the challenge data element using the private key, transmitting, from the client device to the server, a signed version of the challenge data element, and authenticating, at the server, the user by validating the signed version of the challenge data element using a previously stored public key relating to the user. This aspect of the invention provides similar advantages as discussed above in relation to the first aspect of the disclosure.

In line with the above discussions, the server may form part of a client-server system, further comprising the plurality of client devices.

According to a third aspect of the disclosure there is provided a computer program product comprising a computer readable medium having stored thereon computer program means for a user operated client device and an authentication server in network connection there-between, wherein the computer program product comprises code for receiving, at the client device, a user specific data element, wherein the user specific data element comprises biometric data relating to the user, code for forming, at the client device, a key pair based on the user specific data element, a previously selected data element stored at the client device and an ID of the user, wherein the key pair comprises a public and a private key, and wherein the previously selected data element comprises information individually selected by the user, code for receiving a request for authentication, code for transmitting a challenge data element, code for signing the challenge data element using the private key, code for transmitting a signed version of the challenge data element, and code for authenticating the user by validating the signed version of the challenge data element using a previously stored public key relating to the user. Also this aspect of the invention provides similar advantages as discussed above in relation to the first and second aspects of the disclosure.

A software executed by the server for operation in accordance to the invention may be stored on a computer readable medium, being any type of memory device, including one of a removable nonvolatile random access memory, a hard disk drive, a floppy disk, a CD-ROM, a DVD-ROM, a USB memory, an SD memory card, or a similar computer readable medium known in the art.

According to a fourth aspect of the disclosure there is provided a computer-implemented method for single sign-on of a user operating a client device connected to an authentication server using a network connection, the method comprising the steps of forming, at the client device, a key pair based on a user password, a previously selected data element and an ID of the user, wherein the key pair comprises a public and a private key, and wherein the previously selected data element comprises information individually selected by the user, receiving, at the server, a request for authentication, transmitting, from the server to the client device, a challenge data element, signing, at the client device, the challenge data element using the private key, transmitting, from the client device to the server, a signed version of the challenge data element, and authenticating, at the server, the user by validating the signed version of the challenge data element using a previously stored public key relating to the user, wherein the previously selected data element is stored remotely from the client device.

This aspect relates closely to the first to third aspect of the invention. However, in this alternative implementation of the invention, the previously selected data element is stored remotely from the client device. That is, again there is no necessity for the user to remember a password.

Preferably, a hash version of the user password is may be stored at a dedicated electronic device configured specifically for secure connection to the client device. Possibly the secure connection may be wired or wireless. In a preferred embodiment the electronic device may be a mobile phone provided with a software application and/or a sensor for creating and storing the hash version of the password.

It would also be advantageous if the electronic device, e.g. the mobile phone, is further configured to receive (the original) user password from the user. The electronic device should then further be configured to communicate the previously selected data element to the client device upon a request from the client device. Such a request may for example be based on the user accessing a specific website, where the website in combination with the mentioned sign-on feature starts a secure communication link with the electronic device. In some embodiment the user password may be related to the previously selected data element.

According to a fifth aspect of the disclosure there is provided an authentication system comprising at least a client device and an authentication server connected there-between using a network connection, the authentication system configured for single sign-on of a user operating the client device, the authentication system configured for forming, at the client device, a key pair based on a user password, a previously selected data element and an ID of the user, wherein the key pair comprises a public and a private key, and wherein the previously selected data element comprises information individually selected by the user, receiving, at the server, a request for authentication, transmitting, from the server to the client device, a challenge data element, signing, at the client device, the challenge data element using the private key, transmitting, from the client device to the server, a signed version of the challenge data element, and authenticating, at the server, the user by validating the signed version of the challenge data element using a previously stored public key relating to the user, wherein the previously selected data element is stored remotely from the client device. Also this aspect of the invention provides similar advantages as discussed above in relation to the fourth aspect of the disclosure.

According to a sixth aspect of the disclosure there is provided a computer program product comprising a computer readable medium having stored thereon computer program means for a user operated client device and an authentication server in network connection there-between, wherein the computer program product comprises code for forming, at the client device, a key pair based on a user password, a previously selected data element and an ID of the user, wherein the key pair comprises a public and a private key, and wherein the previously selected data element comprises information individually selected by the user; code for receiving a request for authentication; code for transmitting a challenge data element; code for signing the challenge data element using the private key; code for transmitting a signed version of the challenge data element, and code for authenticating the user by validating the signed version of the challenge data element using a previously stored public key relating to the user, wherein the previously selected data element is stored remotely from the client device. Also this aspect of the invention provides similar advantages as discussed above in relation to the fourth and fifth aspects of the disclosure.

DETAILED DESCRIPTION

Referring now to the drawings and toFIG. 1in particular, there is depicted, conceptually, a client-server environment100where the present concept may be applied. The client-server environment100comprises a plurality of client device102,104,106, a first108and a second110server, where the client devices102,104,106and the servers108,110are connected by means of network connection, such as over the Internet112.

As discussed above, the client devices102,104,106may for example include mobile phones, desktop computers, laptops, tablets, etc. each provided with a web browser. During operation the individual users of the of the client devices102,104,106may have a desire to access privileged information requiring. To access the information, a client device such as client device102is authenticated using a challenge-response authentication schema applied in line with the inventive concept.

In accordance to the invention, with further reference toFIGS. 2A and 3A, there is exemplified a first possible implementation of the invention. A client device, such as being a mobile phone200, will be provided with means for acquiring a user specific data element, specifically representing the user of the client device102. The user specific data element preferably comprises biometric data relating to the user. For example, a fingerprint sensor202may be integrated with the mobile phone102and configured to acquire a fingerprint of the user of the mobile phone102, to be received, S1, as an input to a software application performed at the mobile phone102, by a control unit, as will be further elaborated below. Other types of sensor and/or other means are possible and within the scope of the invention, for example sensors and/or other means for acquiring information relating to an iris, a retina, a palm print, a voice print, DNA, a handwritten signature, and behavioral biometrics for the user. The mobile phone200is provided with a graphical user interface (GUI)204for providing instructions to the user.

Once the software application of the mobile phone200has received the fingerprint, a key pair is formed based on the fingerprint, a previously selected data element stored at the client device and an ID of the user. The key pair comprises a public and a private key. The previously selected data element may for example be a preselected random bit string. The ID of the user may for example be an email address preselected by the user.

Following the formation of the key pair, the user of the mobile phone200e.g. navigates to a web address of first server108, with the purpose of accessing the privileged information at the first server108. The first server108receives, S3, the request for authentication and transmits, S4, a challenge data element back to the mobile phone102. The mobile phone200automatically signs, S5, the challenge data element using the private key and transmits, S6, the signed version of the challenge data element to the first server108.

In accordance to the invention, the public key of the key pair and relating to the biometric data for the user has previously been distributed, e.g. to the first108and the second server110. In the first server108with the purpose of accessing the privileged information at the first server108, the first server108uses the public key to determining the validity of the previously received signed version of the challenge data element. If it is determined that the challenge data element is validly signed, the user is authenticated, S7. As understood, the private and public key (of the key pair) may be formed and used according to any known public key algorithm.

As understood from the above, the user will not only be authenticated based on a ID and a password, but rather a “true” connection to the user will be given as the authentication will be based on biometric data relating to the user.

In addition to the above, by means of forming and using a combination of a key pair and a challenge scheme, the user will readily be allowed access also to the second server110, i.e. without having to resort to proceeding through all steps as listed above. Rather, following a further request for authentication received at the second server110, the mobile phone200will sign (using the private key) a received challenge data and provide a signed version of the same back to the second server110. Also the second server110may then authenticate the user using the public key previously provided. Accordingly, it may not even be necessary for the user to once again provide a fingerprint for accessing the second server110, a single sign-on procedure is provided. It should however be understood that the key pair may be formed with a predetermined lifetime, for example using a session based approach as is known in the art.

It should be understood that the sensor202may be arranged differently than what is exemplified in the disclosed embodiment. For example, in case of a client device being a laptop, a fingerprint may be provided using a fingerprint sensor integrated with the laptop, or using a mobile phone e.g. wirelessly connected to the laptop, where instead the mobile phone is provided with the fingerprint sensor. The e.g. wireless connection between the laptop and the mobile phone is preferably arranged in a secure manner such that the information relating to the fingerprint is securely handed from the mobile phone to the laptop.

With further reference toFIGS. 2B and 3B, there is exemplified a second possible implementation of the invention. In this embodiment, a client device, such as a laptop206is used by a user with the purpose of accessing privileged information at the first server108. The second possible implementation of the invention is similar to the description provided above in relation to the first possible implementation of the invention. However, rather than receiving a piece of biometric data representing the user, the user is provided with an electronic device208configured to communicate S1′ the previously selected data element to the client device upon a request from the laptop206. Hence, the electronic device208will be individually provided with the user and used for authentication purposes. The electronic device208may for example be wirelessly connected to the laptop206. However, the electronic device208could be e.g. a USB based device to be inserted in a USB port of the laptop206. In a possible implementation of the invention, the electronic device208may be a mobile phone in the ownership by the user.

The previously selected data element will in this case be a piece of information individually selected by the user. Such information could be based on a random sequence formed for or by the user. The information could possibly relate to biometric information for the user.

The step of communicate S1′ the previously selected data element to the client device is in some sense corresponding to the step S1as presented inFIG. 2A. Accordingly, the following steps S2-S7in the second possible implementation will essentially correspond to the steps S2-S7discussed above and shown inFIG. 2A.

However, as it is advantageous from a security perspective that the user keeps the electronic device208in his own possession at all times, it may be possible to control the laptop206such that authentication is not allowed in case the electronic device208is not connected to the laptop206. That is, in case the electronic device208is a mobile phone e.g. connected to the laptop over a wireless Bluetooth connection, in case the user brings his mobile phone away from the laptop206and hence breaks the wireless Bluetooth connection, further access (e.g. to the first and/or the second server108,110) is no longer allowed. Other types of connections are of course possible, including e.g. an NFC connection, Zig-Bee, Wi-Fi, or any other type of “near” connection.

Although the figures may show a specific order of method steps, the order of the steps may differ from what is depicted. Also two or more steps may be performed concurrently or with partial concurrence. Such variation will depend on the software and hardware systems chosen and on designer choice. All such variations are within the scope of the disclosure. Likewise, software implementations could be accomplished with standard programming techniques with rule based logic and other logic to accomplish the various connection steps, processing steps, comparison steps and decision steps. Additionally, even though the invention has been described with reference to specific exemplifying embodiments thereof, many different alterations, modifications and the like will become apparent for those skilled in the art. Variations to the disclosed embodiments can be understood and effected by the skilled addressee in practicing the claimed invention, from a study of the drawings, the disclosure, and the appended claims. Furthermore, in the claims, the word “comprising” does not exclude other elements or steps, and the indefinite article “a” or “an” does not exclude a plurality.