AUTHENTICATION WITH INFRARED LIGHT FOR DIGITAL KEYS

A method for controlling access to a system based on multi-factor authentication using infrared light. The method receives a request for system authentication via a username and password. The method further detects an infrared light communication capability on a second device, and receives a digital key transmitted via infrared light from the second device. The method identifies the digital key based on a light pattern emitted by the infrared light. The method further validates the received digital key and grants system access based on the validation.

BACKGROUND

The present disclosure relates generally to the field of cognitive computing and more particularly to data processing and controlling access to a computing device based on multi-factor authentication using infrared light.

More than ever before, our lives are tightly intertwined and defined by our electronic footprint. Everything from our financial data to our social media presence is readily accessible and subject to impact electronically. In many instances, all this sensitive information may be accessed from a single touchpoint on personal mobile devices.

In today's digital world, security is a fundamental part of our daily lives. The classic user authentication uses a username/e-mail and password. However, this method is not always secure. For example, if the user types a password on a keyboard and a “shoulder surfing” attacker observes which keys are typed, then the attacker gains knowledge of the user's access information. Another common authentication method for smartphones is drawing a pattern on the screen, but this is also susceptible to a “shoulder surfing” attack.

Nowadays, two-step authentication methods give more security to any access system. However, there is currently no multi-factor authorization that bypasses text messages or e-mail.

BRIEF SUMMARY

Embodiments of the present invention disclose a method, a computer program product, and a system.

According to an embodiment, a method, in a data processing system including a processor and a memory, for controlling access to a system based on multi-factor authentication using infrared light is provided. The method receives a request for system authentication via a username and password. The method further detects an infrared light communication capability on a second device and transmits a digital key via infrared light from the second device. The method further validates the received digital key and grants system access based on the validation.

A computer program product, according to an embodiment of the invention, includes a non-transitory tangible storage device having program code embodied therewith. The program code is executable by a processor of a computer to perform a method. The method receives a request for system authentication via a username and password. The method further detects an infrared light communication capability on a second device and transmits a digital key via infrared light from the second device. The method further validates the received digital key and grants system access based on the validation.

A computer system, according to an embodiment of the invention, includes one or more computer devices each having one or more processors and one or more tangible storage devices; and a program embodied on at least one of the one or more storage devices, the program having a plurality of program instructions for execution by the one or more processors. The program instructions implement a method. The method receives a request for system authentication via a username and password. The method further detects an infrared light communication capability on a second device and transmits a digital key via infrared light from the second device. The method further validates the received digital key and grants system access based on the validation.

DETAILED DESCRIPTION

Cyber-attacks have increased drastically over the past years, and it seems this trend will continue into the near future. Authentication methods are one of the main defenses that help to protect sensitive information.

The classic method of user authentication, using a username/e-mail and password, is not always enough to have secure access. For example, most authentication methods require the user to perform an action, which can be replicated if a potential attacker is present while the action is performed (e.g., shoulder surfing).

However, authentication methods need to be user-friendly to be accepted by the general user base. In other words, authentication secrets should be complex enough to not be figured out by attackers while, at the same time easy to understand by regular users.

The present invention proposes a method of authenticating users with the transmission of data/passwords with infrared (IR) light utilizing a two-step authentication method.

A two-factor authentication (2FA) method, using infrared light, is particularly viable for users that do not rely on other 2FA methods such as Short Messaging Service (SMS) or e-mail. In other words, the system can just send a signal and if it receives the correct IR response from the other system, authentication would be validated.

The present invention is not limited to the exemplary embodiments below, but may be implemented with various modifications within the scope of the present invention. In addition, the drawings used herein are for purposes of illustration, and may not show actual dimensions.

FIG.1depicts a diagram graphically illustrating the hardware components of infrared access computing environment100and a cloud computing environment in accordance with an embodiment of the present invention.

FIG.2illustrates infrared access computing environment200, in accordance with an embodiment of the present invention. Infrared access computing environment200includes host server210, user computing device230, and database server240, all connected via network202. The setup inFIG.2represents an example embodiment configuration for the present invention and is not limited to the depicted setup to derive benefit from the present invention.

In an exemplary embodiment, host server210includes infrared access program220. In various embodiments, host server210may be a laptop computer, tablet computer, netbook computer, personal computer (PC), a desktop computer, a personal digital assistant (PDA), a smart phone, or any programmable electronic device capable of communicating with user computing device230, and database server240, via network202. Host server210may include internal and external hardware components, as depicted, and described in further detail with reference toFIG.1. In other embodiments, host server210may be implemented in a cloud computing environment, as further described in relation toFIG.1herein. Host server210may also have wireless connectivity capabilities allowing it to communicate with user computing device230, and database server240, and other computers or servers over network202.

With continued reference toFIG.2, user computing device230includes user interface232and infrared sensors234. In various embodiments, user computing device230may be a laptop computer, tablet computer, netbook computer, personal computer (PC), a desktop computer, a personal digital assistant (PDA), a smart phone, a server, a wearable device, or any programmable electronic device capable of communicating with host server210and database server240, via network202. User computing device230may include internal and external hardware components, as depicted and described in further detail with reference toFIG.1. In other embodiments, user computing device230may be implemented in a cloud computing environment, as described in relation toFIG.1. User computing device230may also have wireless connectivity capabilities allowing it to communicate with host server210, database server240, and other computers or servers over network202.

In exemplary embodiments, user computing device230includes user interface232, which may be a computer program that allows a user to interact with user computing device230and other connected devices via network202. For example, user interface232may be a graphical user interface (GUI). In addition to comprising a computer program, user interface232may be connectively coupled to hardware components, such as those depicted inFIG.1, for sending and receiving data. In an exemplary embodiment, user interface232may be a web browser, however in other embodiments user interface232may be a different program capable of receiving user interaction and communicating with other devices, such as host server210.

In exemplary embodiments, user interface232may be a touch screen display, a visual display, a remote operated display, or a display that receives input from a physical keyboard or touchpad. In alternative embodiments, user interface232may be operated via voice commands or by any other means known to one of ordinary skill in the art.

Infrared sensors234, in an exemplary embodiment, may be located within user computing device230and used for sending and receiving infrared, sometimes called infrared light. Infrared is electromagnetic radiation (EMR) with wavelengths longer than those of visible light and shorter than radio waves, and therefore invisible to the human eye.

In exemplary embodiments, infrared sensors234allow for a communication (i.e., sending and receiving) between one or more systems (e.g., host server210and user computing device230) utilizing infrared light.

In various embodiments, infrared sensors234may be embedded within user computing device230and contain a computer processing unit (CPU), memory, and power resource, and may be capable of communicating with host server210and database server240over network202.

In exemplary embodiments, database server240includes user database242. In various embodiments, database server240may be a laptop computer, tablet computer, netbook computer, personal computer (PC), a desktop computer, a personal digital assistant (PDA), a smart phone, a server, or any programmable electronic device capable of communicating with host server210and user computing device230, via network202. Database server240may include internal and external hardware components, as depicted and described in further detail with reference toFIG.1. In other embodiments, database server240may be implemented in a cloud computing environment, as described in relation toFIG.1. Database server240may also have wireless connectivity capabilities allowing it to communicate with host server210, user computing device230, and other computers or servers over network202.

In exemplary embodiments, user database242contains one or more sets of defined user profiles and associated access permissions and privileges.

While user database242is depicted as being stored on database server240, in other embodiments, user database242may be stored on user computing device230, host server210, infrared access program220, or any other device or database connected via network202, as a separate database. In alternative embodiments, user database242may be comprised of a cluster or plurality of computing devices, working together or working separately.

With continued reference toFIG.2, host server210includes infrared access program220. Host server210may be a laptop computer, tablet computer, netbook computer, personal computer (PC), a desktop computer, a personal digital assistant (PDA), a smart phone, or any programmable electronic device capable of communicating with user computing device230, and database server240via network202.

With continued reference toFIG.2, infrared access program220, in an exemplary embodiment, may be a computer application on host server210that contains instruction sets, executable by a processor. The instruction sets may be described using a set of functional modules. In exemplary embodiments, infrared access program220may receive input from user computing device230and database server240over network202. In alternative embodiments, infrared access program220may be a computer application on user computing device230, or a standalone program on a separate electronic device.

With continued reference toFIG.1, the functional modules of infrared access program220include receiving module222, detecting module224, transmitting module226, validating module228, and granting module229.

FIG.3is a flowchart illustrating the operation of infrared access program220ofFIG.2, in accordance with embodiments of the present disclosure.

With reference toFIGS.2and3, receiving module222includes a set of programming instructions, in infrared access program220, to receive a request for system authentication via a username and password (step302). The set of programming instructions is executable by a processor.

In exemplary embodiments, a user performs system authentication by entering a username and password. Oftentimes, the username may be the user's e-mail address or a unique string of numbers and letters.

Customarily, a second layer of security authentication is required before granting a user access to a website or secure database. Multi-factor authentication (MFA) is an authentication method that requires the user to provide two or more verification factors to gain access to a resource such as an application, online account, or a Virtual Private Network (VPN).

Various MFA options can include SMS, a phone call to the user, and an e-mail sent to the user. Not all these MFA options are secure. SMS may contain information that is not encrypted and prone to being stolen by another user. A phone call to the user may not be the best option since it is often difficult to understand exactly what the pre-recorded computer message is saying. An e-mail sent to the user is also an insecure layer of authentication since it is visible to the human eye and prone to “shoulder surfing” by attackers in public places (e.g., coffee shops, library, etc.)

With reference to an illustrative example, Joe attempts to log-in to his online banking webpage and is required to have a multi-factor authentication process. Joe enters his unique username and password for the first layer of authentication. Joe's bank provides a few options for the multi-factor authentication which includes SMS and e-mail. However, Joe desires a more secure two-step authentication method.

With continued reference toFIGS.2and3, detecting module224includes a set of programming instructions in infrared access program220, to detect infrared light communication capability on a second device (step304). The set of programming instructions is executable by a processor.

Nowadays, infrared sensors234are embedded in many modern smartphones, such as user computing device230.

In exemplary embodiments, detecting module224can determine whether a user computing device230has infrared capability.

With continued reference to the illustrative example above, Joe's smartphone has infrared capabilities. As such, Joe's smartphone is used as an infrared emitter to be used as a second layer of authentication for his online bank access. This way, Joe has the advantage of not needing an extra device, like a USB key, to authenticate access and not needing to connect to an external authentication service or receiving SMS messages and/or calls.

With continued reference toFIGS.2and3, transmitting module226includes a set of programming instructions in infrared access program220, to transmit a digital key via infrared light (step306). The set of programming instructions is executable by a processor.

The International Commission on Illumination has divided infrared into three (3) categories based on type of infrared wavelength: near, medium, and far.

Near infrared (NIR) is frequently used in electronics to transmit data using pulses of light, since this wavelength does not produce significant quantities of heat. The pulses of light are interpreted by the receiving device as binary data, which in turn is converted into the appropriate format required by software applications.

In exemplary embodiments, the received infrared light is NIR light, and wherein the infrared light is interpreted as binary data and transformed into a security token, secret key, or password using encryption, encoding, or plain text.

In exemplary embodiments, transmitting module226identifies the digital key based on a light pattern emitted by the infrared light and authenticates access based on the light pattern.

In alternative exemplary embodiments, transmitting module226transmits a dynamic token using infrared light.

With continued reference to the illustrative example above, Joe transmits his digital key to the online bank using has infrared device (e.g., smartphone). Joe's digital key includes a unique light pattern emitted by his smartphone, invisible to the human eye but detected by the Joe's online banking system. This second authentication step adds a strong layer of security for Joe's online banking session by preventing any potential attackers from “shoulder surfing” or stealing Joe's private access details.

With continued reference toFIGS.2and3, validating module228includes a set of programming instructions in infrared access program220, to validate the received digital key (step308). The set of programming instructions is executable by a processor.

In exemplary embodiments, validating module228validates the received security token, secret key, or password against a previously stored role or username. For example, a previously stored role or username may be stored in user database242.

In alternative embodiments, stored roles with associated usernames may be stored on infrared access program220or user computing device230, as a separate database.

In exemplary embodiments, validating module228processes the received data from the transmitting device (e.g., user computing device230) and compares/matches the received data with a central database (e.g., user database242) to validate the accuracy of the information. If the received data is validated, then the multi-factor authentication will return a positive authentication, otherwise it will reject the authentication.

With continued reference to the illustrative example above, Joe's access permissions are saved with his online banking user profile. These access permissions may include access to Joe's personal and business credit cards, together with his wife's personal banking account information. Joe's digital key is received and validated by his online banking system.

With continued reference toFIGS.2and3, granting module229includes a set of programming instructions in infrared access program220, to grant system access based on the validation (step310). The set of programming instructions is executable by a processor.

In exemplary embodiments, infrared access program220prompts a multi-factor authentication of a user and transmits an infrared light communication. The receiving system reads the infrared light communication, which is invisible to an unaided eye, and grants access permissions based on the read infrared light communication.

With continued reference to the illustrative example above, Joe is granted access into his online banking session, together with all of the access and privileges associated with his username. Joe's account is safe and secure with the multi-factor authentication using infrared light.

In exemplary embodiments, network202is a communication channel capable of transferring data between connected devices and may be a telecommunications network used to facilitate telephone calls between two or more parties comprising a landline network, a wireless network, a closed network, a satellite network, or any combination thereof. In another embodiment, network202may be the Internet, representing a worldwide collection of networks and gateways to support communications between devices connected to the Internet. In this other embodiment, network202may include, for example, wired, wireless, or fiber optic connections which may be implemented as an intranet network, a local area network (LAN), a wide area network (WAN), or any combination thereof. In further embodiments, network202may be a Bluetooth network, a WiFi network, or a combination thereof. In general, network202can be any combination of connections and protocols that will support communications between host server210, user computing device230, database server240.