Authentication using multiple mobile devices

Techniques are disclosed relating to a computer system including a first mobile device that stores information that is inaccessible without a value stored on a second mobile device. In some embodiments, the first mobile device stores a plurality of one-time password generation routines executable to generate one-time passwords usable to authenticate user access to an electronic resource, and the second mobile device stores a plurality of supplemental authentication values that correspond to the one-time password generation routines. A particular one-time password generated by the first mobile device using a particular one-time password generation routine is inaccessible without the corresponding particular supplemental authentication value stored on the second mobile device. In embodiments, the particular supplemental authentication value is sent to the first mobile device and the corresponding particular one-time password generated by the first mobile device using the corresponding particular one-time password generation routine becomes accessible.

BACKGROUND

Technical Field

This disclosure relates generally to the authentication of user communication with a computer system.

Description of the Related Art

When a user interacts with a computer system to access an electronic resource, it may be useful to confirm the user's identity to ensure that the user should be granted access to the electronic resource to prevent unauthorized access to, for example, email mailboxes, bank accounts, social network accounts, etc. A user's identity may be authenticated using various factors including knowledge (i.e., something the user knows such as a password), possession (i.e., something the user has physical access to such as a bank card), and inherence (i.e., something that is part of or physically indicative of the user such as biometric indicators). Some computer systems utilize two-step authentication methods that are based on a user inputting one or more of these factors as a first step and using a one-time password that is either sent to the user by the computer system (e.g., a password sent to the user's email inbox) or a one-time password generated by a device to which the user has access (e.g., a code generated with user's cell phone).

SUMMARY

Techniques are disclosed herein to restrict access to information stored on a first mobile device, with the information being accessible with a value stored on a second mobile device (but not the first mobile device) that is sent to the first mobile device. In various embodiments, a first mobile device stores a plurality of one-time password generation routines and a second mobile device stores a plurality of supplemental authentication values that correspond to the various one-time password generation routines. The first mobile device is configured to output a one-time password using both a particular one-time password generation routine and its corresponding particular supplemental authentication value stored on the second mobile device. The resulting one-time password is usable to authenticate user communication with an authentication system. In such embodiments, the second mobile device sends the particular supplemental authentication value to the first mobile device. The first mobile device uses the particular supplemental authentication value and the corresponding particular one-time password generation routine to output a one-time password generated using the particular one-time password generation routine, and the first mobile device does not retain the particular supplemental authentication value thereafter. In various embodiments, the one-time password is sent to the authentication system directly by the first mobile device, sent to the second mobile device which in turns sends the one-time password to the authentication system, or is made available to the user so the user can input the one-time password to the authentication system.

The term “configured to” is not intended to mean “configurable to.” An unprogrammed FPGA, for example, would not be considered to be “configured to” perform some specific function, although it may be “configurable to” perform that function and may be “configured to” perform the function after programming.

As used herein, the terms “first,” “second,” etc. are used as labels for nouns that they precede, and do not imply any type of ordering (e.g., spatial, temporal, logical, etc.) unless specifically stated. For example, references to “first” and “second” mobile devices would not imply an ordering between the two unless otherwise stated.

As used herein, the word “module” refers to structure that stores or executes a set of operations. A module refers to hardware that implements the set of operations, or a memory storing the set of instructions such that, when executed by one or more processors of a computer system, cause the computer system to perform the set of operations. A module may thus include an application-specific integrated circuit implementing the instructions, a memory storing the instructions and one or more processors executing said instructions, or a combination of both.

DETAILED DESCRIPTION

This disclosure describes techniques for authenticating user communication using multiple mobile devices. Embodiments for a computer system including one or more authentication systems, a first mobile device, and a second mobile device wherein the first and second mobile device are used to authenticate user communication with the one or more authentication systems is described in reference toFIG. 1. Further details relating to the first mobile device and second mobile device are discussed with reference toFIG. 2andFIG. 3, respectively. Mobile device authentication methods are described with reference toFIGS. 4 and 5, and a two-mobile device authentication setup method is described with reference toFIG. 6. Finally, an exemplary computer system, which may implement the various components ofFIGS. 1, 2, and 3, is discussed with reference toFIG. 7.

Referring now toFIG. 1, a block diagram of an exemplary embodiment of a computer system100is depicted. In various embodiments, computer system100includes a first mobile device110, a second mobile device120, and one or more authentication systems130. As used herein, the phrase “first mobile device” is used to refer to a device that receives one or more supplemental authentication values (e.g., PINs) that are stored on a “second mobile device,” but not the first mobile device. The terms “first” and “second” do not imply any type of ordering, but rather are used to denote different roles in the paradigms disclosed herein.

In the embodiment depicted inFIG. 1, first mobile device110stores one or more first applications112. First application112is executable to communicate with second application122running on second mobile device120and to perform a plurality of one-time password generation routines114. In various embodiments, first application112may store any of a number of one-time password generation routines114(e.g., first routine114A, nth routine114n). As discussed herein, in various embodiments, first mobile device110uses a particular one-time password generation routine114and a corresponding particular supplemental authentication value124received from second mobile device120to output a particular one-time password. The first mobile device110outputs the particular one-time password without retaining the particular supplemental authentication value124for future one-time password output using the particular one-time password generation routine114. The various components of first mobile device110are discussed in further detail with reference toFIG. 2.

In the embodiment depicted inFIG. 1, second mobile device120stores one or more second applications122. Second application122is executable to store a plurality of supplemental authentication values124in a supplemental authentication value library126. Each of the plurality of supplemental authentication values124is associated with one of the plurality of one-time generation password generations routines114stored on first mobile device110. As discussed herein, the plurality of supplemental authentication values124(e.g., a first supplemental authentication value124A, an nth supplemental authentication value124n) are stored on second mobile device120and not first mobile device110. Second application122is executable to receive (e.g., via a user interface, via communication with an authentication server130) an indication of a particular one of the plurality of one-time password generation routines114. Second application122is executable to select from supplemental authentication value library126, the particular supplemental authentication value124associated with the particular one-time password generation routine114. Second application122is further executable to communicate with first mobile device110and to send an indication140of the particular supplemental authentication value124such that a corresponding one-time password (generated using the particular one-time password generation routine114) can be output. The various components of second mobile device120are discussed in further detail with reference toFIG. 3.

Authentication system130is a computer system that is configured to communicate with users (e.g., user150) and authenticate the user's identity as part of determining whether to grant access to one or more restricted electronic resources. There may be any of a number of authentication systems (e.g., a first authentication system130A, a second authentication system130B, a nth authentication system130n) in computer system100. Authentication system130may be a portion of a system that providers user access to the restricted electronic resources (e.g., by serving a secured website, granting access to a secured network, by granting access to a restricted file) or authentication system130may be a dedicated system that is coupled to such a system (e.g., a server serving a bank website is coupled to authentication system130which authenticates login attempts to the bank's website). In various embodiments, authentication system130authenticates the identity of user150using two-step authentication. In various embodiments, authentication system130confirms a user's claimed identity with two-step authentication method by utilizing information (e.g., a username, a password, a username and a password) known to the user150(and ideally not known by other individuals) and by receiving a one-time password generated according to the techniques discussed herein with connection toFIG. 2-5.

In various embodiments, prior to attempting to authenticate communication with a particular user150using a two-step authentication process as discussed herein, authentication system130generates information for the particular user150that is useable to generate predicable one-time passwords. For example, the information generated by authentication system130may be a secret code used in conjunction with a time-based value to generate a series of predictable one-time passwords over time, and this secret code and the series of predictable one-time passwords are associated with the particular user150(e.g., associated with a particular account of user150). In some of such embodiments, authentication system130retains a first copy of the secret code and sends a second copy of the secret code to a device associated with the particular user150(e.g., a first mobile device110). This kind of arrangement is known in the art as using a “shared secret.” The time-based value may be a simple counter (e.g., the number of seconds that have elapsed since the authentication system130sent the secret code to the first mobile device110) that is used to derive the one-time password. This technique is used in Hash-based Message Authentication Code (HMAC)-based One-Time Password (HOTP) algorithm. In other embodiments, the time-based value may be based on a timestamp. This technique is used in the Time-based One-Time Password (TOTP) algorithm. The series of one-time passwords, then, may be generated according to any cryptographic technique using a shared secret and a time-based value.

For example, if the shared secret is the word “PASSWORD,” the time-based value is an eight-digit counter that is incremented every minute, and the cryptographic techniques used to generate the password is simply appending the time-based value to the shared secret word, then one minute after the shared secret is exchanged the one-time password would be 00000001PASSWORD and two days after the shared secret is exchanged the one-time password would be 00002880PASSWORD and so on. If both the authentication system130and the first mobile device110have this information, both devices are able to independently generate the one-time password without additional communication subsequent to the exchange of the shared secret. It will be understood that this cryptographic technique is simplified and in various embodiments the one-time password may be a long, complex string of characters that is effectively impossible to predict without access to the shared secret and/or the algorithm used to generate the one-time password.

Thus, authentication system130is able to authenticate the purported identity of a user150by first receiving an indication of the identity of the user150(e.g., by receiving a correct username and password combination) and second by receiving the one-time password that is predicated to be generated by a first mobile device110known to be associated with the user150. For example, as discussed herein, if first mobile device110is a particular user's smartphone, after user150inputs their username and password into a social media website that uses an authentication system130to verify login attempts, the social media website asks for a one-time password generated by the first mobile device110. The first mobile device110generates the one-time password. The one-time password is sent to the social media website, which in turn compares the received one-time password to the one-time password that was predicated to be received. If the received one-time password matches the predicted one-time password, the identity of user150is authenticated and the user150is granted access.

Indication140is one or more messages sent by second mobile device120to first mobile device110that includes an indication of a particular supplemental authentication value124. Indication140may include some or all of the supplemental authentication value124itself or one or more values generated using the supplemental authentication value124(e.g., an encrypted version of supplemental authentication value124). Indication140may be sent via a wired connection (e.g., a USB connection) and/or via a wireless connection (e.g., Bluetooth, Wi-Fi, etc.). In embodiments where first mobile device110and second mobile device120are paired together, indication140may be sent using a secured communication channel (e.g., secured using cryptography).

In various embodiments, first mobile device110sends one or more messages142to second mobile device120. In some of such embodiments, first mobile device110sends one or more messages142to second mobile device120prior to generating the one-time password (e.g., to request the particular supplemental authentication value124corresponding to a particular one of the plurality of one-time password generation routines114). In various embodiments, message142includes an indication of a one-time password generated by first mobile device110as discussed herein. In such embodiments, having received the one or more messages142, second mobile device120may be used as part of authentication pathways170or172as discussed herein. The one or more message142may include some or all of the generated one-time password itself or one or more values generated using the one-time password (e.g., an encrypted version of the one-time password). Message142may be sent via a wired connection (e.g., a USB connection) and/or via a wireless connection (e.g., Bluetooth, Wi-Fi, etc.). In embodiments where first mobile device110and second mobile device120are paired together, message142may be sent using a secured communication channel (e.g., secured using cryptography).

User150is an individual who is attempting to access an electronic resource (e.g., a website, a network, a file, etc.) that is restricted. Whether user150should be granted access to the electronic resource is determined (at least in part) by an authentication system130. In various embodiments, user150has access to both first mobile device110and second mobile device120and uses both to authenticate their identity as discussed herein. User150may be a natural person, a group of natural persons, an organization in various embodiments.

Authentication pathways160,162,170, and172are one or more data flow pathways via which a generated one-time password may be sent to an authentication system130. In authentication pathway160, a one-time password is sent from first mobile device110to authentication system130directly. In authentication pathway160, first mobile device110sends one or more messages (via a wired and/or wireless communications medium) to authentication server130containing some or all of the one-time password or one or more values generated using the one-time password (e.g., an encrypted version of the one-time password). For example, in some embodiments, authentication pathway160includes first mobile device110sending an electronic message containing an encrypted version of the one-time password to authentication system130via a wireless network connection, via a wired connection, via a near-field communication (NCF) reader coupled to authentication system130, etc. In other embodiments, authentication pathway160includes first mobile device110playing one or more sounds corresponding to the one-time password (e.g., the one-time password modulated onto a sonic carrier wave, sound of the one-time password expressed in Morse code) that is received via a microphone coupled to authentication system130. In various embodiments, first mobile device110communicates with authentication system130or a LAN and/or the Internet in authentication pathway160.

Authentication pathway170is similar to authentication pathway160, except that the second mobile device120is used to relay the one-time password generated by first mobile device110(and sent to second mobile device120via one or more messages142) to authentication system130via a wired and/or wireless communications medium). For example, in some embodiments, authentication pathway170includes second mobile device120sending an electronic message containing an encrypted version of the one-time password to authentication system130via a wireless network connection, via a wired connection, via a NCF reader coupled to authentication system130, etc. In other embodiments, authentication pathway170includes second mobile device120playing one or more sounds corresponding to the one-time password (e.g., the one-time password modulated onto a sonic carrier wave, sound of the one-time password expressed in Morse code) that is received via a microphone coupled to authentication system130. In various embodiments, second mobile device120communicates with authentication system130or a LAN and/or the Internet in authentication pathway170.

In authentication pathway162, user150access the one-time password using first mobile device110and sends the one-time password to authentication system130in one or more messages. In some of such embodiments, authentication pathway162includes first mobile device110making the one-time password (or information generated using the one-time password) available to user150and user150inputting the one-time password (or information generated using the one-time password) to authentication system130. For example, in various embodiments first mobile device110displays visual information corresponding to the one-time password (e.g., the one-time password represented in alphanumeric characters, the one-time password encoded in a one- or two-dimensional barcode) that the user150inputs to authentication system130(e.g., by typing in a displayed one-time password, by holding the display of the first mobile device110to a visual sensor such that the one-time password encoded in a barcode can be read by the visual sensor). In other embodiments, first mobile device110relays one-time password to user150in other ways such as by sounds (e.g., by a computer-generated voice reading the one-time password) and/or by touch (e.g., via a refreshable braille display, via vibrations corresponding to the one-time password expressed in Morse code), and user150in turn inputs the one-time password to authentication system130. In various embodiments, the one-time password entered by user150is sent to authentication system130via the Internet in authentication pathway162.

Authentication pathway172is similar to authentication pathway162, except that user150uses second mobile device120to input the one-time password generated by first mobile device110(and sent to second mobile device120via one or more messages142) to authentication system130. For example, in various embodiments second mobile device120displays visual information corresponding to the one-time password (e.g., the one-time password represented in alphanumeric characters, the one-time password encoded in a one- or two-dimensional barcode) that the user150inputs to authentication system130(e.g., by typing in a displayed one-time password, by holding the display of the second mobile device120to a visual sensor such that the one-time password encoded in a barcode can be read by the visual sensor). In other embodiments, second mobile device120relays one-time password to user150in other ways such as by sounds (e.g., by a computer-generated voice reading the one-time password) and/or by touch (e.g., via a refreshable braille display, via vibrations corresponding to the one-time password expressed in Morse code), and user150in turn inputs the one-time password to authentication system130. In various embodiments, the one-time password entered by user150is sent to authentication system130via the Internet in authentication pathway172.

Using first mobile device110and second mobile device120, user150is able to authenticate their identity to authentication system130, thereby allowing authentication system130to better protect the various electronic resources the authentication system130is configured to protect. The use of two (or more) separate mobile devices increases the security of system100because access to only one of the two mobile devices is insufficient to authenticate user access. For example, if the first mobile device110were to fall into the hands of an unauthorized user (e.g., by theft from user150), the unauthorized user might have access to the first mobile device110, first application112, and one or more one-time password generation routines114, but these are not sufficient to provide the unauthorized user access to the one-time passwords because the unauthorized user does not have access to the supplemental authentication values124or other components of second mobile device120. Similarly, if the second mobile device120were to fall into the hands of an unauthorized user, the unauthorized user might have access to the second mobile device120, second application122, and one or more supplemental authentication values124, but these are not sufficient to provide the unauthorized user access to the one-time passwords because the unauthorized user does not have access to the one-time password generation routines114or other components of first mobile device110.

Further, even in embodiments where a user150can manually input one or more of the supplemental authentication values124(e.g., because the values124are 4-digit PINs) into first application112(e.g., via a user interface), being able to store the supplemental authentication values124on second mobile device120means user150does not have to memorize a collection of different PINs that are correspond to different one-time password generation routines114and/or the user150does not have to write down various PINs (which would make computer system100less secure). Accordingly, the disclosed techniques allow users150to securely access electronic resources without having to memorize a collection of additional PINs/passwords while adding security to computer system100by storing authentication information on separate devices.

In various other embodiments, techniques discussed herein can be applied in circumstances other than one-time password generation. For example, instead of first mobile device110storing a plurality of one-time password generation routines, first mobile device110may store any type of secured information (e.g., secured applications, secured documents). In such an embodiment, such secured information corresponds to values (e.g., passwords, PINs, keys) stored on second mobile device120. In various embodiments, the secured information cannot be accessed by a user150via first mobile device110without the corresponding value stored on second mobile device120. Upon first mobile device110receiving the corresponding value from second mobile device120, user150is able to access the secured information (e.g., to run a secured application, to view a secured document, etc.).

Referring now toFIG. 2, an expanded block diagram of the first mobile device110ofFIG. 1is depicted in accordance with various embodiments. First mobile device110includes first application112, a display module210, a communications module220, a control module230, and a security module240. First mobile device110may be any of a number of computing devices including but not limited to a desktop computer, laptop computer, tablet computer, smartphone, wearable mobile device (e.g., smartwatch, glasses). In various embodiments, first mobile device110is a smartphone. Various embodiments of first mobile device110may exclude certain components such as security module240or have additional components (e.g., multiple communications modules220).

First application112is an application running on first mobile device110. First application112is executable to cause first mobile device110to perform various tasks associated withFIGS. 4 and 6discussed herein, as well as other tasks. In various embodiments, first application112includes any of a number of one-time password generation routines114(e.g., first routine114A, nth routine114n) and an authentication code generator200. In various embodiments, first application112is an application that has been downloaded from a server coupled to a digital distribution platform (e.g., the Apple® App Store, Google® Play, Microsoft® Store) that stores installation files for first application112. First application112is executable to communicate with second application122as discussed herein. While only a single first application112is shown inFIGS. 1 and 2, in other embodiments first mobile device110includes a set of one or more first applications112, each of which including one or more one-time password generation routines114. For example, in various embodiments, one first application112includes a plurality of one-time password generation routines114associated with authentication systems130coupled protecting electronic resources relating to financial websites (e.g., the website of a bank) and another first application112includes a plurality of one-time password generation routines114associated with authentication systems130coupled protecting electronic resources relating to social network websites (e.g., Facebook®).

One-time password generation routines114are a plurality of routines that are executable to generate one-time passwords as discussed herein. The various routines114are associated with the various authentication systems130, and are executable to generate one-time passwords to be sent to their corresponding authentication systems130. In various embodiments, the routines114are associated with a username and/or password usable to login to an electronic resource (e.g., a username and password used to log into a bank account). In some embodiments, each routine114is associated with a different authentication system130(e.g., routine114A is associated with authentication system130A, routine114B (not shown) is associated with authentication system130B (not shown)). In other embodiments, various sets of routines114are associated with a particular authentication system. For example, a set of routines114may each be associated with a different username, with each of the different usernames usable to login to an electronic resource where login attempts are authenticated using the same authentication system130. The routines114may generate one-time passwords according to any of a number of cryptographic techniques. For example, in various embodiments the routines114may use HTOP and/or TOTP discussed herein. In various embodiments, the routines114use shared secret cryptography to generate a series of one-time passwords and are each associated with a supplemental authentication value124in the supplemental authentication value library126on second mobile device120.

Authentication code generator200runs the various routines114. In some embodiments, first application112includes a single authentication code generator200that executes the routines114. In other embodiments, each routine114may have a dedicated authentication code generator200or sets of routines114may share an authentication code generator200. In various embodiments, authentication code generator200computes a restricted version of a particular one-time password using a particular one-time password generation routine114. In such embodiments, the restricted version of the particular one-time password is inaccessible to user150of the first mobile device110, and first application112prepares an unrestricted version of the one-time password using the restricted version of the one-time password and the supplemental authentication value124corresponding to the one-time password generation routines114that generated the one-time password. In some embodiments, the restricted version of the particular one-time password is encrypted and preparing an unrestricted version of the particular one-time password includes decrypting the restricted version of the particular one-time password using the supplemental authentication value124corresponding to the one-time password generation routines114that generated the particular one-time password. In other embodiments, the restricted version of the particular one-time password is visually obscured by a display element (e.g., on a display of the first mobile device), and wherein preparing an unrestricted version of the particular one-time password includes removing the display element. Having prepared an unrestricted version of the particular one-time password, in various embodiments the unrestricted version of the particular one-time password is output by first mobile device110(e.g., via authentication paths160,162,170, or172).

In other embodiments, the supplemental authentication value124is used by its corresponding one-time password generation routine114to generate the one-time password. For example, if the supplemental authentication value124is “1234,” the number 1234 may be integrated into the generated one-time password (or otherwise used to generate the one-time password). Referring again to the one-time password 00002880PASSWORD discussed above, in embodiments where the supplemental authentication value124is integrated into the one-time password, the generated one-time password might be 00002880P1A2S3S4WORD, for example. Having prepared the particular one-time password, the particular one-time password is output by first mobile device110(e.g., via authentication paths160,162,170, or172).

Display module210includes one or more screens coupled to first mobile device110and hardware (e.g., electronic components, wiring, etc.) and software (e.g., drivers) configured to cause information from first mobile device110to be displayed on the screen. In various embodiments, display module210includes a screen integrated into first mobile device110(e.g., the screen of a smartphone, the screen of a wearable mobile device). In various embodiments, display module210includes screens that are connected to first mobile device110via wired (e.g., a second monitor coupled to a laptop computer) or wireless (e.g., streamed to a display via a Wi-Fi connection) connections. Further, as part of authentication pathway162, display module210may case the generated one-time password to be displayed on one or more screens coupled to first mobile device110as discussed herein.

In various embodiments, display module210includes a user interface212configured to receive information from user150and present information to user150(e.g., via a graphical user interface displayed on a touchscreen). In some of such embodiments, user interface212is configured to display indications of one of more one-time password generation routines114stored on first mobile device110and receive a selection by user150of a particular one-time password generation routine114. Such displayed indications may indicate to which authentication system130the one-time password generation routine114correspond (e.g., first one-time password generation routine114associated with a bank, a second one-time password generation routine114associated with a social network), the username associated with the one-time password generation routine114, or other information. In various embodiments, user interface212receives a user's selection of a particular one-time password generation routine114. Having received the selection, first mobile device110may request the corresponding supplemental authentication value124as discussed herein. In some embodiments, user interface212is also configured to receive supplemental authentication value124directly from the user150(e.g., by user150typing in a PIN, by speaking a password, etc.) in addition first mobile device110being configured to receive supplemental authentication values124from second mobile device120as discussed herein.

In various embodiments, first mobile device110uses communications module220to communicate with other computing devices such as second mobile device120and/or the various authentication systems130. In various embodiments, communications module220is used in connection to authentication pathway160, receiving indication140from second mobile device120, and/or sending any messages142to second mobile device120as discussed herein. In various embodiments, communications module220is configured to communicate using wired connections (e.g., Ethernet, USB, etc.), wireless connections (e.g., Bluetooth, Wi-Fi), or both. Accordingly, in various embodiments, prior to using a particular one-time password generation routine114to generate a one-time password, first mobile device110requests the corresponding supplemental authentication value124in a message142sent via communications module220to second mobile device120. Further, in various embodiments, after generating a one-time password, first mobile device110send the one-time password in a message142sent via communications module220to second mobile device120for display on second mobile device120(i.e., as part of authentication pathway172).

Control module230coordinates the various components of first mobile device110to execute the first application112and perform the various tasks discussed herein. Control module230, for example, causes the one-time password generated by first application112to be output using display module210when authentication pathway162is utilized. Similarly, control module230, causes the one-time password generated by first application112to be output using communications module220and sent to second mobile device120when authentication pathway170or172is utilized.

Security module240is configured to secure aspects of the operation of first mobile device110. In some embodiments, security module240secures communication with various authentication systems130and/or second mobile device120by encrypting outgoing communication and decrypting received communication. In various embodiments, security module240is configured to delete one of more of the one-time password generation routines114when an insecure condition is determined. In some of such embodiments, first mobile device110attempts to communicate with second mobile device120regularly (e.g., every hour, every day, every week, etc.). Based on one or more failures to communicate with the second mobile device120, security module240is configured to delete one of more of the plurality of one-time password generation routines114. For example, if first mobile device110has not been able to communicate with second mobile device120for a month, the security module240may determine an insecure condition and delete the various one-time password generation routines114as a precaution. Similarly, in embodiments where security module240is configured to determine the geographic location of first mobile device110, an insecure condition may be determined if, for example, the first mobile device110has left a certain area (e.g., a secure location), been taken to a certain area, etc.

Accordingly, the first mobile device110is configured to generate one-time passwords using a first application112. In various embodiments, a corresponding supplemental authentication value124is necessary to generate a corresponding one-time password. In other embodiments, first mobile device110is able to generate the one-time password without the corresponding supplemental authentication value124, but the one-time password is inaccessible without the corresponding supplemental authentication value124. In either case, after first mobile device110receives the supplemental authentication value124, the communication by user150may be authenticated using an authentication pathway160,162,170, and/or172.

Referring now toFIG. 3, an expanded block diagram of the second mobile device120ofFIG. 1is depicted in accordance with various embodiments. In various embodiments, second mobile device120includes second application122, a display module310, a communications module320, a control module330, and a security module340. Second mobile device120may be any of a number of computing devices including but not limited to a desktop computer, laptop computer, tablet computer, smartphone, wearable mobile device (e.g., smartwatch, glasses). In various embodiments, second mobile device120is a wearable mobile device (e.g., smartwatch, glasses). Various embodiments of second mobile device120may exclude certain components such as security module350or have additional components (e.g., multiple communications modules340).

Second application is an application running on second mobile device120. Second application122is executable to cause second mobile device120to perform various tasks associated withFIGS. 5 and 6discussed herein, as well as other tasks. In various embodiments, second application122includes a plurality of supplemental authentication values124(e.g., first supplemental authentication values124A, nth supplemental authentication values124n) in a supplemental authentication value library126. In various embodiments, second application122is an application that has been downloaded from a server coupled to a digital distribution platform (e.g., the Apple® App Store, Google® Play, Microsoft® Store) that stores installation files for second application122. Second application122is executable to communicate with first application112as discussed herein. While only a single second application122is shown inFIGS. 1 and 3, in other embodiments second mobile device120includes a set of one or more first applications122, each of which including one or more supplemental authentication values124stored in one or more supplemental authentication value libraries126. For example, in various embodiments, one second application122includes a plurality of supplemental authentication values124associated with authentication systems130coupled protecting electronic resources relating to financial websites (e.g., websites of banks) and another second application122includes a plurality of supplemental authentication values124associated with authentication systems130coupled protecting electronic resources relating to social network websites (e.g., Facebook®).

The various supplemental authentication values124may be any of a number of strings of characters. As discussed herein, in various embodiments supplemental authentication values124are PINs or passwords. Such PINs or passwords may be set by user150and/or generated by second mobile device120or authentication system130. Supplemental authentication values124may be a decryption key usable to decrypt encrypted one-time password as discussed herein. In various embodiments, the one-time password generation routines114may incorporate the supplemental authentication values124into the generation of the one-time password.

Supplemental authentication value library126is configured to store a plurality of supplemental authentication values124. In various embodiments, library126is also configured to store additional information such as indications showing to which respective one-time password generation routines114each of the supplemental authentication values124corresponds. Additionally, in some embodiments, library126stores account information300(e.g., username, pointer to particular authentication system130associated with username) corresponding to each supplemental authentication value124(e.g., first account information300A corresponding to supplemental authentication value124A, nth account information300ncorresponding to supplemental authentication value124n). In various embodiments, the contents of supplemental authentication value library126may be indexed. For example, in various embodiments, supplemental authentication value library126is indexed such that a particular supplemental authentication value124corresponding to a particular authentication system130can be accessed using a set of lookup values assigned to the various authentication systems130.

Display module310includes one or more screens coupled to second mobile device120and hardware (e.g., electronic components, wiring, etc.) and software (e.g., drivers) configured to cause information from second mobile device120to be displayed on the screen. In various embodiments, display module310includes a screen integrated into second mobile device120(e.g., the screen of a smartphone, the screen of a wearable mobile device). In various embodiments, display module310includes screens that are connected to second mobile device120via wired (e.g., a second monitor coupled to a laptop computer) or wireless (e.g., streamed to a display via a Wi-Fi connection) connections. Further, as part of authentication pathway172, display module310may case the generated one-time password to be displayed on one or more screens coupled to second mobile device110as discussed herein.

In various embodiments, display module310includes a user interface312configured to receive information from user150and present information to user150(e.g., via a graphical user interface displayed on a touchscreen). In some of such embodiments, user interface312is configured to display indications of account information300(e.g., display one or more indications of a plurality of user accounts associated with user150that correspond to supplemental authentication values124stored on second device120), and receive a selection by user150of a particular user account on the user interface312. In various embodiments, this selection of a particular user account triggers the corresponding supplemental authentication value124being sent to first mobile device110and the subsequent outputting of the generated one-time password as discussed herein.

In various embodiments, second mobile device120uses communications module320to communicate with other computing devices such as first mobile device110and/or the various authentication systems130. In various embodiments, communications module320is used in connection to authentication pathway170, sending indication140to first mobile device110, and/or receiving any messages142from first mobile device110as discussed herein. In various embodiments, communications module320is configured to communicate using wired connections (e.g., Ethernet, USB, etc.), wireless connections (e.g., Bluetooth, Wi-Fi), or both. Accordingly, in various embodiments, second mobile device120sends indication140to first mobile device110such that the generated one-time password may be output by first mobile device110and used to authentication user communication with authentication system130. In various embodiments, first mobile device110requests, via message142, that a particular supplemental authentication value124be sent to first mobile device110. Further, in some embodiments, indication140includes an indication of a particular supplemental authentication value124as well as particular account information300associated with the particular supplemental authentication value124. Further, in various embodiments, after first mobile device110generates a one-time password, second mobile device120receives the one-time password in a message142received via communications module320for display second mobile device120(i.e., as part of authentication pathway172) or for subsequent transmission (e.g., by communications module320) to authentication system130(i.e., as part of authentication pathway170).

Control module330coordinates the various components of second mobile device120to execute the second application122and perform the various tasks discussed herein. Control module330, for example, causes the one-time password generated by first application112to be output using communications module320when authentication pathway170is utilized and/or display module310when authentication pathway172is utilized. In various embodiments, security module240is configured to delete one of more of the supplemental authentication routines when an insecure condition is determined. In some of such embodiments, second mobile device120attempts to communicate with first mobile device110regularly (e.g., every hour, every day, every week, etc.). Based on one or more failures to communicate with the first mobile device110, security module340is configured to delete one of more of the plurality supplemental authentication values124. For example, if second mobile device120has not been able to communicate with first mobile device110for a month, the security module340may determine an insecure condition and delete the various supplemental authentication values124as a precaution. Similarly, in embodiments where security module240is configured to determine the geographic location of second mobile device120, an insecure condition may be determined if, for example, the second mobile device120has left a certain area (e.g., a secure location), been taken to a certain area, etc.

Accordingly, second mobile device120is configured to store a plurality of supplemental authentication values124and send them to first mobile device110as part of an authentication process to verify user communication. Second mobile device120may be used to initiate the process in response to a user selection of a particular one-time password generation routine114(or selection of a particular user account associated with the particular one-time password generation routine114). In various embodiments, second mobile device120receives the generated one-time password and displays it for the user150and/or sends the one-time password to the appropriate authentication system130. But because the second mobile device120does not include the one-time password generation routines114themselves, the second mobile device120does not include all of the information necessary to authenticate user communication by itself, increasing the security of computer system110.

FIGS. 4, 5, and 6illustrate various flowcharts representing various disclosed methods implemented with computer system100. Referring now toFIG. 4, a flowchart illustrating an embodiment of a first portion of a two-mobile device authentication method400is shown. In various embodiments, the various actions associated with method400are performed with first mobile device110and second mobile device120. At block402, a first mobile device110stores a first set of one or more applications112executable to communicate with a second application122running on a second mobile device120of the user150. The first set of applications112is executable to perform a plurality of one-time password generation routines114, each of which outputs one-time passwords using a respective supplemental authentication value124stored electronically only in a supplemental authentication value library126on the second mobile device120. The supplemental authentication value library126is accessible by the second application122. At block404, the first mobile device110receives, from the supplemental authentication value library126, a particular supplemental authentication value124corresponding to a particular one of the plurality of one-time password generation routines114stored on first mobile device110. At block406, first mobile device110outputs, using the particular one-time password generation routine114, a particular one-time password using the particular supplemental authentication value124. The particular one-time password is output without the first mobile device110retaining the particular supplemental authentication value124for future one-time password output using the particular one-time password generation routine114.

Referring now toFIG. 5, a flowchart illustrating a second portion of a two-mobile device authentication method500is shown. In various embodiments, the various actions associated with method500are performed with second mobile device120and first mobile device110. At block502, a second mobile device120, that is in communication with a first mobile device110, stores a plurality of supplemental authentication values124in a supplemental authentication value library126. In various embodiments, each of the plurality of supplemental authentication values124is associated with one of a plurality of one-time password generation routines114stored on the first mobile device110. Further, the plurality of supplemental authentication values124are not stored at the first mobile device110. At block504, second mobile device120receives an indication of a particular one of the plurality of one-time password generation routines114. At block506, second mobile device120selects, from the supplemental authentication value library126, the particular supplemental authentication value124associated with the particular one-time password generation routine114. At block508, second mobile device120sends to the first mobile device110, an indication of the particular supplemental authentication value124such that a corresponding one-time password can be output using the particular one-time password generation routine114.

For example, a user150desiring to use two-step authentication to authenticate user communication with an authentication system130uses his smartphone and smartwatch such that the smartphone functions as first mobile device110and the smartwatch functions as second mobile device120as discussed herein. Using his laptop, user150attempts to access an electronic resource (e.g., data files stored in the cloud storage service). He enters his username and password on his storage service's website. The computer system providing access to his storage service accounted is coupled to authentication system130, which will only grant access to the user150if his identity is authenticated (in addition to his providing his username and password). Accordingly, user150is prompted for a one-time password. User150then accesses his smartwatch and selects an icon corresponding to the electronic resource (e.g., the logo of his storage service) on the smartwatch's user interface. The smartwatch in turn, determines which supplemental authentication value124corresponds to the user's selection (e.g., which supplemental authentication value124corresponds to the selected icon) and sends the determined supplemental authentication value124to the smartphone. The smartphone receives the supplemental authentication value124and outputs a one-time password generated using the one-time password generation routine114corresponding to the received supplemental authentication value124. The smartphone sends the one-time password to the smartwatch and does not retain the supplemental authentication value124. The one-time password is displayed on the user interface312of the smartwatch. Alternatively, the one-time password is displayed on the user interface212of the smartphone. User150looks at the smartwatch or smartphone, reads the one-time password, and inputs the one-time password to authentication system130by typing it in on his laptop.

Alternatively, in various embodiments, the two-step authentication method discussed herein may be employed without the user150having to directly access either his first mobile device110or second mobile device120. For example, a user150desiring to use two-step authentication to authenticate user communication with an authentication system130uses his smartphone and smartwatch as discussed herein. Using his laptop, user150attempts to access an electronic resource (e.g., data files stored in his cloud storage service). He enters his username and password on his storage service's website. The computer system providing access to his storage service accounted is coupled to authentication system130, which will only grant access to the user150if his identity is authenticated (in addition to his providing his username and password). Authentication system130issue a command that is received by user's smartwatch and/or smartphone that triggers the second step of the two-step authentication method. Based on the command from authentication system130, the supplemental authentication value124on the smartwatch is identified and sent to the smartphone. The smartphone receives the supplemental authentication value124and uses it and a corresponding one-time password generation routine114to output a one-time password to be sent to authentication system130to authenticate user's identity. In some embodiments, the smartphone sends the one-time password to authentication system130via a network (e.g., the Internet). In other embodiments, the smartwatch sends the one-time password to the authentication system via a wide-area network (e.g., the Internet).

Referring now toFIG. 6, a flowchart illustrating an embodiment of a two-mobile device authentication setup method600is shown. In various embodiments, the various actions associated with method600are performed with first mobile device110, second mobile device120, and authentication system130. At block602, first application112is installed on first mobile device110. At block604, second application122is installed on second mobile device120. As discussed herein, second application122is executable to exchange one or more supplemental authentication values124with first application112. At block606, an entity (e.g., a user150and/or software process setting up first application112and/or second application122) causes first mobile device110to receive a first shared secret (e.g., used as part of a first one-time password generation routine114) from a first authentication system130. As discussed herein, first application112is executable to generate a one-time password using the first shared secret and a first supplemental authentication value124. As discussed herein, the first one-time password is usable to authenticate user communication with the first authentication system130. At block608, an entity (e.g., a user150and/or software process setting up first application112and/or second application122), stores the first supplemental authentication value124at second mobile device120.

For example, a user150desiring to set up two-step authentication using her smartphone (e.g., first mobile device110) and smartwatch (e.g., second mobile device120) installs first application112on her smartphone and second application122on her smartwatch. She accesses installation files for the first application112and second application112from a digital distribution platform (e.g., the Apple® App Store, Google® Play, Microsoft® Store). After installing the first application112and second application112, user150communicates with authentication system130. In particular, she logs into her bank account (which is coupled to authentication system130) and elects to set up two-step authentication using her smartphone and smartwatch. In response to commands by user150, authentication system130sends a shared secret (and in embodiments, the one-time password generation routine114that uses the shared secret to generate one-time passwords) to her smartphone, which stores the shared secret in memory. The user150then sets a PIN to be a supplemental authentication value124to be used with the shared secret to generate one-times passwords and inputs the PIN to her smartwatch (e.g., via a touchscreen interface). Alternatively, during the installation of second application122, the program installing second application122may generate a PIN automatically. Her smartwatch stores the PIN in memory.

Exemplary Computer System

Turning now toFIG. 7, a block diagram of an exemplary computer system700, which may implement the various components of computer system100(e.g., first mobile device110, second mobile device120, authentication systems130) is depicted. Computer system700includes a processor subsystem760that is coupled to a system memory720and I/O interfaces(s)740via an interconnect760(e.g., a system bus). I/O interface(s)740is coupled to one or more I/O devices750. Computer system700may be any of various types of devices, including, but not limited to, a server system, personal computer system, desktop computer, laptop or notebook computer, mainframe computer system, tablet computer, handheld computer, workstation, network computer, a consumer device such as a mobile phone, music player, or personal data assistant (PDA). Although a single computer system700is shown inFIG. 7for convenience, system700may also be implemented as two or more computer systems operating together.

Processor subsystem760may include one or more processors or processing units. In various embodiments of computer system700, multiple instances of processor subsystem760may be coupled to interconnect760. In various embodiments, processor subsystem760(or each processor unit within760) may contain a cache or other form of on-board memory.

System memory720is usable to store program instructions executable by processor subsystem760to cause system700perform various operations described herein. System memory720may be implemented using different physical memory media, such as hard disk storage, floppy disk storage, removable disk storage, flash memory, random access memory (RAM-SRAM, EDO RAM, SDRAM, DDR SDRAM, RAMBUS RAM, etc.), read only memory (PROM, EEPROM, etc.), and so on. Memory in computer system700is not limited to primary storage such as memory720. Rather, computer system700may also include other forms of storage such as cache memory in processor subsystem760and secondary storage on I/O Devices750(e.g., a hard drive, storage array, etc.). In some embodiments, these other forms of storage may also store program instructions executable by processor subsystem760.

I/O interfaces740may be any of various types of interfaces configured to couple to and communicate with other devices, according to various embodiments. In one embodiment, I/O interface740is a bridge chip (e.g., Southbridge) from a front-side to one or more back-side buses. I/O interfaces740may be coupled to one or more I/O devices750via one or more corresponding buses or other interfaces. Examples of I/O devices750include storage devices (hard drive, optical drive, removable flash drive, storage array, SAN, or their associated controller), network interface devices (e.g., to a local or wide-area network), or other devices (e.g., graphics, user interface devices, etc.). In one embodiment, computer system700is coupled to a network via a network interface device750(e.g., configured to communicate over WiFi, Bluetooth, Ethernet, etc.).