Patent Description:
Automated analyser systems for use in clinical diagnostics and life sciences are produced by a number of companies. For example, the STRATEC® Biomedical AG, Birkenfeld, Germany, produces a number of devices for specimen handling and detection for use in automated analyser systems and other laboratory instrumentation.

The use of such biomedical devices is often restricted so that only trained people can work with the device. A quite common method for authentication into biomedical devices is to use the combination of a username and password. When looking from the perspective of the used factors, it appears that this choice implies the usage of only a single factor, the knowledge. Thus, this method is these days considered to be unsafe, because the use of a static combination of username and password is vulnerable to misuse when more than one person is using the system. The probability of misuse increases with the number of persons knowing such a static combination. Field service engineers for instance will all have to know the respective combination of username and password for a single device. Thus, it is likely that username and password will become available to unauthorized persons.

Providing a maximum security for authorized personal becomes even more difficult if it is considered that the system may be located anywhere in the world and login into the systems is performed via remote access. The login data transfer represents another source for necessary login data to become available for unauthorized people.

Published US patent application <CIT> discloses a device that receives an indication that a security code is to be generated; generates the security code based on the indication; generate a message that includes the security code and an identifier associated with a subscriber of the device; outputs the message using the first protocol; encodes the security code based on outputting the message; and outputs a request to access the service. The request is outputted using a second protocol, and includes the encoded security code and the identifier. The device receives a notification that indicates whether the subscriber is authenticated based on the identifier, the security code, and the encoded security code; and accesses the service when the notification indicates that the subscriber is authenticated.

IN published European patent application <CIT> teaches an identification system that uses an additional key for admission, to applications or user programs, to web sites on internet or intranet, and as additional lock beside conventional security devices for restricted premises. The essential feature of the identification system according to this document is in that the user supplies beside his/her regular username and password an additional, randomly generated password, which is sent to his/her mobile phone number by the identification system in the form of an SMS message after the identification systems receives the regular username and password from the user. Additional security is ensured by time-limited usability of the said SMS key and by limited repetition of access attempts.

Published US patent application <CIT> refers to providing a remote computer user authentication service involves providing a reference to a user authentication service in a host server's source code (e.g., website source code). Further, integration code that may be used in an application programming interface (API) on the host server for interaction with a user authentication service can be provided. Additionally, a user interface (UI) for user authentication on the host server, and an authentication-test message on the host server using the UI may be provided. Also, providing authentication can comprise sending an authentication-request message to a mobile device designated by the user; and/or can comprise the user responding with information from the authentication-test message. The host server can be notified of the user's authentication after a correct response is received by the user authentication service.

Published UK patent application <CIT> discloses a method of preventing unauthorised access to a host computer system by a user at a remote terminal is provided using paging system technology. In the method, a user inputs his user identification code input into the terminal which transmits same to the host computer system. The system then generates a random code (Code A) and subjects Code A to a transformation characteristic of a transformation algorithm identified by the input user identification code so as to generate a transformed code (Code B). Code A is transmitted via a paging system, to a receiver held by the user. The receiver comprises transformation means adapted to transform the received Code A to a second transformed code (Code C), and means for displaying Code C to the user. The user then inputs the displayed Code C to the terminal which transmits it to the host system. The input Code C is then compared with Code B and access is only permitted if Code C matches Code B.

It is an object of the present invention to provide a method allowing authorized personal to login easily into a system but providing a maximum security.

The present disclosure relates to a work authorization system comprising a device connected to an automated analyser system for entering a combination of a user ID and password by a person for requesting authentication and authorization to an automated analyzer system, a credential provider which is installed on a data processing unit of an automated analyzer system, wherein the credential provider comprises a device for generating a random number, a public key of an authentication system for encrypting data prior to transmitting, wherein the credential provider is configured (i) to create encrypted data by encrypting the user ID, password and random number with the public key, (ii) to send the encrypted data to a server or to create a 2D barcode comprising an URL to be used for sending the encrypted data to the server, (iii) for comparing whether the random numbers from step b and d are identical, and (iv) for authorizing the person in case that a correct random number has been entered, the server comprising an interface for receiving the data from the credential provider or the created 2D barcode comprising an URL for authentication of a user, wherein the server comprises a private key of the authentication system for decrypting transmitted encrypted data with the public key, a database containing all relevant data necessary for authentication of the user configured for verifying the decrypted data by comparison of the user ID and password with data stored in the database and a device for sending messages comprising the random number to a device of the user following successful verification, a login interface on the automated analyzer system for entering the random number into the device connected to the automated analyzer system.

The automated analyser may comprise a device for displaying messages in another aspect of the invention.

In a further embodiment of the invention the system may comprise a mobile device for receiving messages from the server.

Another object of the present invention is a method for authentication and authorization on an automated analyzer system, comprising the steps of.

The method may further encompass that a message informing about a failure of authentication and authorization may be sent to a mobile phone related to the user ID.

In another aspect of the method according to the invention, the random number can be device specific.

It may furthermore be intended that the encrypted data will be sent directly to the server if the automated analyser is online.

The method of the invention may further encompass that a 2D barcode will be generated is the automated analyser system is offline.

A display of the automated analyser may be used to show the 2D barcode.

It is further intended that a 2D barcode can be read by a mobile phone related to the user ID for transmitting it to the server in step c of claim <NUM>.

For a more complete understanding of the present invention and the advantages thereof, reference is now made to the following description and the accompanying drawings, it shows:.

The technical problem is solved by the independent claims. The dependent claims cover further specific embodiments of the invention.

The present invention describes a system comprising a credential provider, a server and a database were developed in order to address the above discussed problem of security and in order to offer a more secure authentication solution for companies in the biomedical field. In the next sections will be offered more details about the developed system, starting from the beginning, when design decisions had to be taken, and reaching in the end at the installation and configuration process.

The first task relates to the number of authentication factors which shall be required by the system. It has been intended to make a transition from the traditional authentication alternatives requiring only a single factor, the knowledge. Thus, the method of the present invention adds an extra layer of security by requiring an additional possession factor.

The chosen authentication factors are the following:.

In order to design a secure and reliable two-factor authentication system by using a knowledge and possession factor, a decision had to be made what components the final system shall contain and how they will have to interact in order to provide the desired functionality.

The implemented system contains two important parts for communication: A Credential Provider (client) and a Web API (server).

A cryptographic public-key algorithm, called RSA, was incorporated into a two-factor authentication system for obtaining the required security level.

The public-key algorithm implements the usage of a public and a private key. The private key will have be kept secret at the server's side, and the public key shall be freely distributed to any of the biomedical devices on which the authentication system will be used.

It is important to mention that the implemented solution does not restrict the usage of other Public-key algorithms. The system has been designed to allow the incorporation of other algorithms, without affecting the general workflow.

The cryptographic algorithm is used in the developed system as follows:.

This workflow differs from a known standard usage where individuals shall be authenticated at an identical central server, e.g. a server for banking. The present invention refers to a system for login into a medical instrument. The difference is that multiple users shall be authenticated, but always with as the same user on the device (FSE Role) and not as different users having different access.

For safety reasons it is not advisable to store the relevant key on the device, because there are high numbers of devices spread all over the world. Thus, a new workflow has been developed instead of using known workflows.

The invention will now be described in workflows to provide a clear separation between the general perspective, the data sending scenarios, the data receiving scenarios and the authentication and authorization process.

The workflows contain several alternatives to address the problem that not all intended forms of communication may be available, e.g. the instrument may not be connected to the internet.

<FIG> shows a workflow of the present invention from a general perspective including an instrument's perspective, meaning communication with the instrument and the server's perspective regarding communication with the server. <FIG> shows sending scenarios and <FIG> receiving scenarios.

From a general perspective, the instrument's perspective can be summarized by the following sequence of steps:.

The server's perspective can be summarized by the following sequence of steps:.

The instrument perspective may further comprise the steps of.

The last step of the authentication process requires a correct random number to be entered. It is to be noted that a secure random number or password is generated for each device during a login process. So even if someone manages to retrieve a random number or password for a specific device, it will be useless for login on other instruments. The password is highly secured and stored with access rights in the instrument's registry, so only the credential provider and an administrator will be able to access it. The logging process may also be possible by sending the generated random number or password directly to the (laboratory) administrator.

<FIG> illustrates sending scenarios which may be supported by a complex authentication system. The sending scenarios implement sending the data which was encrypted on the instrument's side to the server.

<FIG> shows that after encrypting User ID, PIN and random number, the data is transmitted to the server. The following two scenarios have to be distinguished depending on whether the instrument is online:.

The data that needs to be transmitted to the server is an encrypted text. Depending on the used public-key algorithm, the length of the ciphertext may vary, based on the necessary padding added for security reasons. Since the ciphertext will usually be long, the invention provides alternatives avoiding that the user has to note it manually.

<FIG> shows various alternatives for sending back the random number decrypted by the server to the Field Service Engineer. Scenario 2A will be described in more detail without limiting the invention to this scenario.

After the Field Service Engineer is authenticated and authorized successfully by the server, the decrypted random number will be sent to him by sending an SMS message for instance to the FSE's mobile phone number. The mobile phone represents a second factor, a so-called possession factor, from the two-factor authentication system of the present invention.

Step <NUM> from the general workflow above will now be described in more detail. The authentication and authorization process are performed by the server by using the credentials embedded in the decrypted message. During these processes, the following scenarios may occur.

The first scenario represents the successful situation in which authentication and authorization are performed successfully. In this case, the server sends the random number to the Field Service Engineer via SMS by using the mobile phone number associated to him.

Authentication may fail because one of username or password is incorrect. In both possible cases a message will be generated and sent informing that the combination of user ID and PIN does not match. It remains open whether a correct user ID was used increasing the security.

Using a correct user ID with internet connection available results in sending a warning message to the instrument. Using a wrong user ID but having no internet connection will cause no message to be sent, because the user related data are not valid. Using a wrong password when internet connection is available on the instrument, results in sending a warning message to the instrument. In case there is no internet connection available on the instrument, then the warning message will be sent directly to the FES via SMS by using the mobile phone number associated to the User ID informing the FSE that possibly a third person tries to login using his user ID.

When authorization fails, the authentication was successful, but the authorization process failed because the FSE does not have access permissions granted. In this case, like in the others, internet availability on the instrument's side is taken into consideration.

In case internet is available, then a warning message is sent directly to the instrument. Otherwise, the message will be sent to the FSE via SMS, if the phone number is still valid and available.

<FIG> shows a workflow of the authentication and authorization process summarizing the above explanations.

Several components are necessary to use the described authentication and authorization, each of them contributing to the invented secure two-factor authentication system. The necessary components are:.

The first component will be exemplary described when using a Windows operation system with a credential provider that targets the Windows <NUM> operating system.

This component was implemented as a V2 Credential Provider, which ensures a more user-centric approach by offering the possibility to associate it with a specific user. This choice was influenced by the need to offer a different authentication alternative specifically for the account created for the Field Service Engineers.

Even though Credential Providers are COM-based components, usually written in C++ programming language, the Stratec Credential Provider was developed in C#. This alternative was possible because COM-interop offers the possibility to call. NET code from COM components, and vice-versa.

In order to develop a Credential Provider, there are certain interfaces that need to be implemented. But before using them they have to be exposed to. The Windows SDK contains an IDL file that defines all the interfaces that need to used. What has to be done is to convert the IDL file to a type library and then convert the type library to a. NET assembly.

What is important to mention is that even though multiple Field Service Engineers are responsible with a certain biomedical device, they will use a common device account. With the old authentication alternative, they would have shared the same credentials, which introduced a high risk of password leak. With the authentication alternative offered by the developed two-factor authentication system, that risk does not exist anymore.

By installing a credential provider according to the present invention on a biomedical device, a new option with the label "Credential Provider" will appear under the Sign-in options section of the operating system's account for the Field Service Engineers.

The FSE will have to select the credential provider of the present invention which increases the security, because the Field Service Engineers will have to enter a combination of user ID and PIN only known by the FSE. These credentials do not represent the credentials associated with the operating system's account, but they represent credentials which are stored in a database on the server's side for login to devices and that are verified by the server.

After entering the User ID and PIN, the FSE should click on 'Send Data'. Internet connection availability will be taken into consideration when performing the next steps of the authentication process.

The FSE is required to enter the random number received on the mobile phone, and then press 'Check code', in order to validate the number.

Without internet connection, the encrypted data cannot be sent directly to the server, so a QR code is generated and displayed in the login interface. This QR code has to be scanned by the FSE's mobile phone. The embedded link will result in sending the necessary information to the server.

After successful authentication and authorization on the server's side, the FSE will receive the random number on the mobile phone and will be asked to enter the random number. When the random number is successfully validated, the FSE will be able to enter the account by clicking on an associated login button.

In order to accomplish the desired functionality of the server, an exemplary application was developed that uses an interface that is hosted on the server's infrastructure. This framework was used in order to be able to use the interface which can be accessed by using the HTTP protocol. The 2D barcode is used to transfer data instead of entering codes.

The setup of a system according to the present invention is based on two interacting components: a client represented by the credential provider and a server with an interface for access. Such a separation is necessary to have a central responsible authority for deciding which Field Service Engineer may authenticate.

The server is also connected to the database containing all necessary information for login a Field Service Engineer. The credential provider has to send encrypted data which consists of User ID, PIN and random number to the FSE. When the 2D Barcode will be read by using the mobile phone, the request will be automatically sent to the server.

The service used for data storage purposes shall be a database, which represents a relational database service with complex characteristics, built on the SQL Server technologies, for instance.

A great advantage of a SQL database is represented by the high level of interoperability, allowing to access it by using the majority of the development environments.

The database used for the developed system contains the following data about multiple field service engineers:.

There is no need to have internet connection on the instrument's date processing unit, because the developed system supports also a scenario without internet connection or an online instrument.

The present invention has the advantage that any company which wants to use this authentication system for their instruments, does not have to take into consideration a lot of constraints. The system may be easily implemented. The management of the FSEs and their phone numbers etc. can also be achieved easily on the server in a database using some sort of user interface.

The Credential Provider can be installed on a computer by using an installer. The installer has to be run by a user with administrator privileges, and is responsible for the following:.

From the user's perspective, the installation is an easy process, because he is required to provide just an optional target account name, in case he wants to change the default one. The rest of the steps are done automatically, without unnecessarily involving the user.

The prior art documents cited above describe classical systems using a two-factor authentication system, in which additional security is achieved by the addition of a second authentication factor (Mobile Phone). Quite often, systems known from the prior art send a code to a mobile phone, which is then additionally entered by the user. For this purpose, appropriate messages have to be sent (via the internet, or over a mobile network). The purpose of such measures is always the same: you want to increase the safety by the second authentication factor.

The present invention serves another objective that is to authenticate to a system in which the user is not known at all. This is an important difference to known systems and avoids the previously used (unsafe) method of a 'secret' static passwords, which is known to every Field Service Engineer and is the same on all devices.

In known systems is the user to be authenticated, which carries out the action. The problem that the present invention solves is that a user intends to log on to an instrument, but the system has no information about the user. The authentication is thus completely outsourced. In the end, the central system can decide if access is allowed. Neither the instrument (target system) has to communicate with the control center (authentication system), nor does the control panel have to communicate with the instrument. This allows access to be granted or denied without having to change the target system. Systems from the prior art can directly access the central user database for obtaining information about the user, which they provide as a server.

The differences between known system s from the prior art and the present. Invention can be summarized as:.

Claim 1:
A work authorization system, comprising
a. a device connected to an automated analyser system for entering a combination of a user ID and password by a person for requesting authentication and authorization to the automated analyzer system;
b. a credential provider which is installed on a data processing unit of the automated analyzer system, wherein the credential provider comprises a device for generating a random number, a public key of an authentication system for encrypting data prior to transmitting, wherein the credential provider is configured
i. to create encrypted data by encrypting the user ID, password and random number with the public key;
ii. to send the encrypted data to a server or to create a 2D barcode comprising an URL to be used for sending the encrypted data to the server,
iii. for comparing whether the random numbers from step b and d are identical, and
iv. for authorizing the person in case that a correct random number has been entered,
c. the server comprising
i. an interface for receiving the encrypted data from the credential provider or the created 2D barcode comprising an URL for authentication of a user, wherein the server comprises a private key of the authentication system for decrypting transmitted encrypted data with the public key,
ii. a database containing all relevant data necessary for authentication of the user configured for verifying the decrypted data by comparison of the user ID and password with data stored in the database, and
iii. a device for sending messages comprising the random number to a device of the user following successful verification;
d. a login interface connected with the automated analyzer system for entering by the user the random number into the device connected to the automated analyzer system.