Patent ID: 12259959

DETAILED DESCRIPTION

In the following detailed description, numerous specific details are set forth in order to provide a thorough understanding of the disclosed example embodiments. However, it will be understood by those skilled in the art that the principles of the example embodiments may be practiced without every specific detail. Well-known methods, procedures, and components have not been described in detail so as not to obscure the principles of the example embodiments. Unless explicitly stated, the example methods and processes described herein are not constrained to a particular order or sequence, or constrained to a particular system configuration. Additionally, some of the described embodiments or elements thereof can occur or be performed simultaneously, at the same point in time, or concurrently.

The various implementations described herein overcome the deficiencies in usability, security performance, and speed associated with prior security techniques. In particular, as discussed below, disclosed techniques allow for users of client computing devices to authenticate themselves in a seamless, passwordless manner, and without compromising security or the user experience.

Reference will now be made in detail to the disclosed embodiments, examples of which are illustrated in the accompanying drawings.

FIG.1is a block diagram of an example system100for passwordless authentication of users consistent with disclosed embodiments. As shown, system100includes a plurality of client computing devices101that may communicate through a network102with one or more access-restricted target resources107-109, such as a secure database107, websites or pages enabling users to interact with remotely hosted secure applications108, and secure servers109. Access to access-restricted target resources107-109may be controlled, at least in part, by security server103. As discussed further below, in some embodiments security server103may also communicate with an access service104, DNS server105, and secure credential vault106.

Client computing devices101may be a variety of different types of computing devices with network communications capabilities. Examples include personal computers, laptops, mobile computing devices (e.g., smartphones), tablets, IoT devices, wearable computer devices (e.g., smart clothing, smart watches, smart jewelry, etc.), automotive computer devices, smart home appliances, etc. As discussed further below, such client computing devices101may include hardware processors and memories for storing data and/or software instructions, as well as communications interfaces for exchanging data with remote servers (e.g., security server103and target resources107-109). As discussed further below, client computing devices101may also have software and hardware (e.g., cameras, fingerprint sensors, heartrate monitors, accelerometers, etc.) configured to perform physical authentication of a user of a client computing device101, audio recording and playback capabilities, and graphics capabilities for rendering visual content on a display screen.

Network102may be based on any type of computer networking arrangement used to exchange data, such as the Internet, a wired Wide Area Network (WAN), a wired Local Area Network (LAN), a wireless WAN (e.g., WiMAX), a wireless LAN (e.g., IEEE 802.11, etc.), a mesh network, a mobile network, a private data network, a virtual private network using a public network, a nearfield communications technique (e.g., Bluetooth, infrared, etc.) that enables the system100to send and receive information between the components in the system100. In some embodiments, network102may include two or more of these forms of communications. As an example, client computing devices101may communicate with security server103via Bluetooth or RFID, while security server103communicates with access service104, DNS server105, or vault106via WiFi or the Internet. Of course, different combinations are possible as well.

Target network resources107-109may include one or more access-restricted resources, such as secure database107, sites or pages108that allow a user to interact with a remote application, or a secure server109. An access-restricted target resource107-109may be any secure device, application, database, server, and/or network that requires a user (e.g., user of client computing device101) to be authenticated before accessing the resource. As examples of access-restricted target resources107-109, secure database107may hold confidential corporate data, such as financial or technical information. Sites and pages108may be, for example, virtualized instances of applications running in a cloud-computing environment, such as a cloud platform based on MICROSOFT AZURE, AMAZON WEB SERVICES (AWS), GOOGLE CLOUD PLATFORM, IBM CLOUD, or similar systems. Such applications may thus be accessed on-demand by users through the techniques discussed below. Secure server109may be a secure web hosting server, web development server, cybersecurity server, human resources server, competitive intelligence server, or various other types of secure servers capable of communicating with client computing devices101.

Access service104may be a portal or proxy server configured to provide access to access-restricted target resources107-109. For example, access service104may be a web-based portal, an intranet portal, or another type of access point that client computing devices101may connect to before being able to access access-restricted target resources107-109. Similarly, access service104may be a proxy server to which client computing devices107-109send some or all of their outgoing communications. As discussed further below, access service104may be configured to analyze outgoing communications from client computing devices101and determine whether they should be intercepted and processed by security server103. In addition, DNS server105may be used to intercept and reroute communications (e.g., by IP address resolution) from client computing devices101. Various different forms of such interception and rerouting are possible, as discussed further below.

In some embodiments, access service104functions to discover identities (e.g., machines, applications, virtualized application instances, and other resources) associated with access-restricted target resources107-109or the broader network in which they operate. In many instances, access-restricted target resources107-109may be invisible to the public internet, since they are access-protected and secured. Thus, in order for security server103to facilitate access between client computing devices101and access-restricted target resources107-109, access service104may develop a list or mapping of access-restricted target resources107-109(e.g., in terms of their IP address, MAC address, unique resource name, virtual machine identifier, cloud container identifier, serverless code identifier, etc.). In some embodiments, access service104may perform this investigation through a directory service (e.g., MICROSOFT ACTIVE DIRECTORY), through a discovery tool (e.g., CYBERARK DNA), through a cloud orchestration application (e.g., AWS CONSOLE, AZURE PORTAL, etc.), or through other techniques.

In some embodiments, a vault106may be accessed by security server103in establishing secure connections between client computing devices101and access-restricted target resources107-109. For example, as discussed further below, in situations where a user of a client computing device101has been successfully authenticated, security server103may fetch a secret (e.g., authentication key, credential, token, password, etc.) from vault106for authentication of the user (or a corresponding identity or account) to the appropriate access-restricted target resource107-109. Further, in some embodiments, security server103also logs the user or identity into a session at the appropriate access-restricted target resource107-109, and such a log-in process may involve a secret obtained from vault106. In other embodiments, vault106is not used or communicated with by security server103. Further, where vault106is utilized by security server103, the secrets stored within vault106may not be provided to the user or their client computing device101. Accordingly, the user of a client computing device101may still be able to be authenticated in a passwordless manner to access access-restricted target resources107-109.

FIG.2is a block diagram of an example client computing device200consistent with disclosed embodiments. As discussed above, client computing device200may be various different types of network-enabled devices, such as the various client computing devices101described in connection withFIG.1.

Client computing device200may include one or more applications201. Examples of applications include business applications (e.g., an ORACLE database application, AMAZON AWS cloud management application, VMWARE virtual machine application, CISCO remote access application, MICROSOFT OUTLOOK email application, proprietary business applications, etc.) and personal applications (e.g., GOOGLE GMAIL, FACEBOOK, TWITTER, LINKEDIN, etc.). Some such applications may have a dual business-personal purpose. In some embodiments, the actual application software resides on the client computing device200itself. In other embodiments, the actual applications reside on a remote server (e.g., access-restricted target resources107-109). In such situations, the application may execute remotely from the client computing device200, and the application may be selectable by the user via a graphical icon or other representation on the client computing device. Selecting the icon or other representation may instruct client computing device200to send a request to access the selected application (e.g., from access-restricted target resources107-109). As discussed further below, such requests may be intercepted through various techniques before they directly reach access-restricted target resources107-109.

In some embodiments, applications201also include a security application configured to communicate with security server103or access service104. This security application may act as a proxy agent, monitoring outgoing communications from client computing device200and determining when a communication is seeking access to access-restricted target resources107-109. Further, the security application may be configured to route all outgoing communications from client computing device200to security server103or access service104. In embodiments where applications201include a security application, the security application may also be configured to store a user profile or account associated with one or more users of the client computing device. This profile or account may contain non-confidential information, such as the user's name, title, email address, or other contact information. In some embodiments, the user of the security application is required to authenticate themselves in order to access the application (e.g., using a corporate username and ID, biometrics, security question prompts, etc.). Nevertheless, other embodiments permit the user to access the security application and build their profile or account without authentication.

The security application running on client computing device200may further be configured to participate in or facilitate a process of dual-mode, passwordless authentication of the user, as discussed further below in connection withFIGS.3-10. For example, as discussed below, the security application may provide instructions to the client computing device200to perform a physical (e.g., biometric, biological, movement-based, etc.) authentication of the user. Further, the security application may be configured to instruct the client computing device200to return to security server103or access service104a unique session identifier that has been received by the client computing device200. In the process of facilitating the dual-mode, passwordless authentication of the user, the security application may also instruct the client computing device200to use other hardware or software residing on the client computing device200, such as a camera, fingerprint sensor, accelerometer, gyroscope, etc., as discussed further below.

As shown inFIG.2, client computing device200may also include a memory202, which may be one or more discrete memory hardware devices. Memory202may include one or more hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or Flash memory), static random access memory (SRAM), or other forms of memory. Memory202may store the applications201(or icons thereof) residing on the client computing device200, an operating system of the client computing device200(e.g., ANDROID OS, SAMSUNG BADA, MICROSOFT WINDOWS, APPLE OS, (PHONE OS, LINUX/UNIX, BLACKBERRY OS, etc.), the user profile or account information discussed above, and various types of biometric software204.

Biometric software204may be one or more applications for authenticating a user in terms of physical traits or characteristics. For example, biometric software204may be configured to authenticate a user's face, eye retina, voice, saliva, blood, hair, or fingerprint, among other physical features. Further, biometric software204may be configured to authenticate a user in terms of patterns or averages of other physical attributes, such as the user's heartrate, walking cadence or speed, typing or clicking activity, cursor movement, gaze detection or eyeball monitoring, chemical (e.g., pheromone) production, application usage frequency or timing, or environmental characteristics, among other factors. In some embodiments, artificial intelligence or machine learning may be used to determine reliable and distinctive physical attributes of a user that may be observed, analyzed, and used for authentication of the user.

Client computing device200may further include input/output device203, which may include one or more interfaces for physical connections to external devices, sensors, visual rendering devices, or auditory rendering devices. Examples of input/output device203include a USB connection (e.g., Type A, Type B, Type C, etc.), Ethernet (e.g., CAT-5) connection, VGA connection, HDMI connection, display screen, touchscreen display, loudspeaker, microphone, camera, gyroscope, accelerometer, GPS, proximity sensor, magnetometer, luxmeter, etc. In some embodiments, some of these forms of input/output devices203may also function as biometric hardware205. For example, a microphone, camera, gyroscope, accelerometer, etc., may be used in the types of physical authentication of a user discussed above.

Communications interface206may enable the client computing device200to communicate wirelessly with one or more external devices, such as security server103, access service104, access-restricted target resources107-109, and other network resources. Examples of communications interface206may include a WiFi transceiver, Bluetooth transceiver, RFID transceiver, infrared transceiver, cellular transceiver, mesh network transceiver, etc. In some embodiments, one or more applications201(e.g., a security application, as discussed above) may instruct communications interface206to communicate with an external resource (e.g., security server103, etc.).

FIG.3is an illustration of exemplary forms of information300that may be used in dual-mode, passwordless authentication consistent with disclosed embodiments. In particular, as discussed below in connection with processes400,500, and600ofFIGS.4-6, dual-mode, passwordless authentication of a user may involve a physical authentication process and a return of a unique session identifier that was provided to a client computing device.

As described above, various forms of physical authentication of a user are possible. Utilizing biometric software204and hardware205of client computing device200, for example, a user may be authenticated in terms of various physical traits (e.g., biometrics, biological traits, etc.) or characteristics that are observed and analyzed. Further, as discussed below in greater detail, when a client computing device receives a unique session identifier (e.g., from security server103), the user may operate the client computing device to return the unique session identifier back to the security server103. In this way, two different forms of authentication of the user may be performed. The physical authentication may validate the presence of the user at the client computing device, and the return of the unique session identifier may validate the particular client computing device that they are currently using. Notably, users may authenticate themselves in this manner without having to supply a password or other secret to security server103.

As illustrated inFIG.3, the dual-mode, passwordless authentication may involve a physical identification based on facial recognition301and a unique session identifier in the form of a barcode302. As an alternative, the dual-mode, passwordless authentication may involve a physical identification based on facial recognition303and a unique session identifier in the form of a QR code304. Further, the dual-mode, passwordless authentication may involve a physical identification based on a retinal scan305of the user and a unique session identifier in the form of a graphical image or icon306(depicted as a balloon). In other embodiments, the dual-mode, passwordless authentication may involve a physical identification based on voice recognition307and a unique session identifier in the form of a unique string of characters308(e.g., numerical, alphabetical, or alphanumeric). Still further, the dual-mode, passwordless authentication may involve a physical identification based on heart rate analysis309(e.g., through pattern detection, AI, machine learning, etc.) and a unique session identifier in the form of a unique graphical pattern310. As another option, the dual-mode, passwordless authentication may involve a physical identification based on fingerprint recognition311and a unique session identifier in the form of a particular color312(e.g., red, blue, purple, etc.).

Consistent with the above description of the software and hardware capabilities of a client computing device, other forms of physical authentication of a user may be used in addition or as alternatives to the examples shown inFIG.3. Similarly, the unique session identifier may be various different types of symbols, graphics, or text that can be returned by a user to security server103, either with or without decoding by the client computing device. In some embodiments, the user of a client computing device uses a component of the client computing device (e.g., the camera) to scan the unique session identifier and return it to security server103. Alternatively, the user may read the unique session identifier as displayed on the client computing device and enter it via the client computing device to be returned to the security server103.

FIG.4is a flowchart of a process400for passwordless authentication of a user consistent with disclosed embodiments. Process400may be performed in the system environments described herein (e.g., system100ofFIG.1, system700ofFIG.7, system800ofFIG.8, system900ofFIG.9, or system1000ofFIG.10).

Process400may include an operation401of determining that a user of a client computing device is attempting to navigate to an access-protected target resource. For example, a security application running on the client computing device may monitor outgoing communications from the client computing device, and detect when the address of such a communication (e.g., based on a domain name, IP address, MAC address, resource name, etc.) matches a list or mapping of access-protected target resources. Additional techniques of identifying that a user of a client computing device is attempting to navigate to an access-protected target resource are described below in connection with operations402-405. Any of these techniques, or others, may be used to intercept and reroute requests from client computing devices.

In an operation402, the user's request to navigate to an access-protected target resource may be received and redirected through DNS resolution. For example, in system100, outgoing requests from a client computing device101may be received at a DNS server105. The DNS server may maintain a listing of addresses (e.g., based on domain name, IP address, MAC address, resource name, etc.) associated with access-protected target resources107-109. When a request from a client computing device101matches such an address, the DNS server105may reroute the request to an address associated with security server103to perform authentication of the user, as discussed further below. For other requests that are not addressed to access-protected target resources, DNS server105may resolve the corresponding network address in the regular manner and permit the client computing device101to access them. In this manner, DNS server105may perform address resolution and rerouting functions in a manner transparent to the user and to their client computing device101.

Operation403may involve redirecting requests from a client computing device through a proxy server. For example, in system100, when a user of a client computing device101requests access to an access-protected target resource107-109, access service104may be configured as a proxy server that receives such requests, determines whether they match a list or mapping of access-protected target resources107-109, and if they do match, reroutes them to security server103. For requests not addressed to access-protected target resources107-109, the proxy server may pass the communications through to their intended network address without redirection. This technique thus may also provide a transparent rerouting solution from the standpoint of users and their client computing devices.

Operation404may involve redirecting requests from a client computing device using a software agent integrated onto the client computing device itself (e.g., as part of a security application) or onto a particular access-protected target resource. In either type of configuration, the software agent may operate in a manner similar to the proxy server discussed above. For example, the agent may monitor outgoing communications from the client computing device or communications received at the target resource, determine whether the communications are addressed to an access-protected target resource, and if a communication is so addressed, the agent may reroute the communication (e.g., through address modification or other forms of packet modification) to the security server103. In some embodiments, the agent may use a filtering or intercepting technique such as WINDOWS FILTERING PLATFORM, or similar application programming interface techniques adapted for other operating systems.

Operation405involves receiving requests from client computing devices at a portal, and determining at the portal whether they should be directed, or redirected, to security server103or passed through to their specified address. For example, in some embodiments, an enterprise seeking to implement disclosed techniques of dual-mode, passwordless authentication may deploy a web-based portal that provides links to various different applications. Some or all of the applications may be access-protected target resources that require authentication before a user can access them. Users may click on links corresponding to the target resources they wish to access. The portal may manage the links using Lightweight Directory Access Protocol (LDAP), may provide hyperlinks (e.g., HTTP links), or use other techniques. In some embodiments, the portal may execute through a server remote to the client computing device, while in other embodiments the portal may be an application running on the client computing device (e.g., a security application, as discussed above).

In operation406, process400may further generate a unique session identifier for the user. As discussed above in connection withFIG.3, the unique session identifier may be a variety of different types of identifiers that the client computing device can receive and relay back to the security server103. Examples include barcodes302, QR codes304, images or icons306, text strings308, graphical patterns310, colors312, and more.

In some embodiments, the generated unique session identifier is selected from a database of already-created unique session identifiers. In other embodiments, the unique session identifier is created on-the-fly, in response to the request from the client computing device. For example, the entire unique session identifier may be newly created, or a portion of it (e.g., beginning characters, ending characters, etc.) may be uniquely modified on-the-fly. In some embodiments, the unique session identifier is unique to the user, unique to the request from the client computing device, or unique to both. For example, the unique session identifier may be a one-time use identifier that expires and is not reused.

In operation407, the unique session identifier may be provided to the user. For example, the unique session identifier may be sent from the security server103to the client computing device101that transmitted the request identified in operation401. Once the unique session identifier is received by the client computing device101, it may be reproduced to the user through hardware and software components of the client computing device101. For example, the unique session identifier may be displayed on a display screen (e.g., as part of a JavaScript file, HTML page, as part of the security application, etc.), rendered via a loudspeaker, or otherwise presented to the user.

In operation408, a prompt may be issued for a physical (e.g., biometric, biological, etc.) identification of the user. As discussed above, the physical authentication of the user may be performed using software and hardware components of the client computing device. Examples discussed above in connection withFIG.3include facial recognition301/303, retinal scan recognition305, voice recognition307, heart rate recognition309, fingerprint identification311, or other similar physical authentication techniques. In some embodiments, the physical authentication is performed entirely on the client computing device. For example, the client computing device may store a reference copy (or hash) of physical identification data associated with the user, and once the user attempts to physically authenticate themselves, the attempt may be compared with the reference data. For example, a stored representation of the user's face may be used as a reference, and a newly captured image of the user's face (e.g., captured via a camera) may be compared to it for authentication. A result of the physical authentication on the client computing device (e.g., expressed as “yes,” “no,” or a probability of authentication) may be transmitted to the security server103, as discussed below. In embodiments where reference physical information of the user is stored on the client computing device, it may be stored in a secure memory (e.g., APPLE SECURE ENCLAVE, ANDROID SECURE ELEMENT, etc.). In other embodiments, part of the physical authentication may be performed remotely (e.g., at security server103). For example, security server103may store the reference physical information, and the client computing device may send it captured physical data for comparison purposes.

In operation409, the user may return the unique session identifier that they received to the security server103. For example, if the unique session identifier is a QR code, the user may optically scan the received QR code (e.g., using a camera), and send back to the security server a copy of the QR code, a decoded version of its contents, or an encrypted version of its contents. In some embodiments, operations408and409occur close in time (e.g., simultaneously, nearly simultaneously, within a timed period subject to a timeout, within a time-limited session connection, etc.). That is, the user of the client computing device may be required to perform the physical authentication of themselves substantially at the same time that they receive the unique session identifier from the security server103or are prompted to return the unique session identifier back to the security server103.

In some embodiments, as part of operation409the user may also transmit to the security server103a user identifier or user identification information. For example, in situations where the user creates a profile or account with personal information on the client computing device (e.g., in the security application), some or all of that identifying information may also be transmitted to the security server103to facilitate the authentication of the user. In such situations, the authentication of the user may be based on the physical authentication, the returned unique session identifier, and the transmitted identifying information about the user. These three forms of authentication information may be transmitted individually in separate communications or collectively in a single communication to security server103.

Further, in some embodiments, the client computing device also transmits to the security server103a network address (e.g., domain name, IP address, MAC address, resource name, etc.) that the user was requesting access to. For example, the address may be associated with the access-restricted target resources107-109to which the user is seeking secure access. As discussed below, this address information may then be used to facilitate a secure connection between the client computing device101and the requested access-restricted target resource107-109.

In operation410, if the dual-mode, passwordless authentication of the user is successful, security server103may further facilitate or establish a secure connection between the client computing device101and the requested access-restricted target resource107-109. In some embodiments, a security policy at the security server103may determine what operations to perform based on the successful authentication. For example, based on the successful authentication, the policy may decide to establish a secure tunnel (e.g., based on Secure Shell, IPSec, SSTP, etc.) between the client computing device101and the requested access-restricted target resource107-109. The requested access-restricted target resource107-109may be running or instantiated on demand in a virtualized environment, as described above, such as through a virtual machine, container instance, or serverless code instance. In some embodiments, the client computing device101may thus obtain a direct connection to the requested access-restricted target resource107-109without having to connect to the network hosting the requested access-restricted target resource107-109. Of course, the client computing device101may be connected to the requested access-restricted target resource107-109through techniques other than tunnels as well. In further embodiments, the security policy considers other factors (e.g., the user's geographical location) to determine whether the user is permitted to access the access-restricted target resource107-109.

In some embodiments, the security server103both performs the passwordless authentication of the user and also logs the user in to the requested access-restricted target resource107-109. Thus, for example, if the requested access-restricted target resource107-109is an ORACLE database server or a FACEBOOK account, the user may be logged in to the account automatically and transparently by the security server103. If such techniques involve obtaining a secret for the log-in process, the security server103may obtain the required secret on the user's behalf (e.g., from vault106). The log-in process on behalf of the user may be performed, for example, through a Security Assertion Markup Language (SAML) authentication process.

FIG.5is another flowchart of a process500for passwordless authentication of a user consistent with disclosed embodiments. Similar to process400, process500may be implemented in accordance with the systems ofFIG.1or7-10.

In an operation501, process500may identify a request by a user to access an access-restricted target resource. For example, the user may be operating on a client computing device101and the request may be associated with a network address for an access-restricted target resource107-109. As discussed above in connection withFIG.5, operations401-405, the request from the user may be identified in various different ways (e.g., communications monitoring, receipt at a DNS server, receipt at a proxy server, receipt at an agent, receipt at a portal, etc.).

In an operation502, process500may include intercepting the request before the request can reach the access-restricted target resource. For example, as discussed above in connection with operations402-405ofFIG.4, the request may be intercepted in various different ways (e.g., DNS redirection, proxy server redirection, agent-based redirection, portal-based redirection, etc.).

In an operation503, process500may include generating a unique session identifier for the user. For example, in connection with operation406ofFIG.4, a unique session identifier may be generated, accessed from a database, or partially manipulated to make it unique. The unique session identifier may be unique to the user, unique to the request from the user, or both. Further, in some embodiments, the request specifies the address of the requested access-restricted target resource (e.g., IP address, MAC address, domain name, resource name, etc.).

In an operation504, process500may include making available the unique session identifier to the user of the client computing device. For example, as discussed above in connection withFIG.4, operation407, the unique session identifier may be visually displayed to the user (e.g., via a display screen), audibly rendered (e.g., via a loudspeaker), or through other techniques.

In an operation505, process500may include performing dual-mode, passwordless authentication of the user. The authentication may include confirming a result of a physical authentication of the user based on one or more unique physical characteristics of the user. For example, as discussed above in connection withFIGS.2-4, this may include performing a biometric or biological authentication of the user, or an analysis of physical characteristics of the user or their behavior. The dual-mode, passwordless authentication may further include receiving, from the client computing device, the unique session identifier that was made available to the user. For example, if the unique session identifier is scanned by the client computing device (e.g., using a camera), it (or a representation of it) may be returned back to the security server103.

Further, the dual-mode, passwordless authentication may further include an operation506of validating the received unique session identifier with respect to the result of the physical authentication. Thus, for example, the identity of the user may be confirmed both in terms of their physical authentication and also in terms of their ability to return a received unique session identifier. Further, as discussed above, the authentication may also include providing personal identification information (e.g., as stored on the client computing device) to the security server103, which is further used to authenticate the user. As discussed above, the dual-mode, passwordless authentication may perform each component of the authentication of the user simultaneously or close-in-time. In this manner, the user is authenticated in terms of their physical presence, and also their current presence in front of (or operation of) the client computing device. Accordingly, in an operation508, process500confirms, based on the dual-mode, passwordless authentication of the user, the identity of the user and the user's current use of the client computing device.

As illustrated inFIG.5, if either or both of operations505and506are not successful for authenticating the user of the client computing device, access may be denied in an operation507. In other words, the security server103may determine not to facilitate or establish a connection between the client computing device and the requested access-restricted target resource107-109.

On the other hand, if the authentication in operations505and506is successful, operation509may include permitting, based on the confirmation, the user to access the access-restricted target resource. For example, as discussed above in connection with operation410ofFIG.4, the security server103may establish a secure tunnel between the client computing device101and the requested access-restricted target resource107-109, and may further log the user into an account associated with the requested access-restricted target resource107-109.

FIG.6is a further flowchart of a process600for passwordless authentication of a user consistent with disclosed embodiments. Similar to processes400and500, process600may be implemented in accordance with the systems ofFIG.1or7-10.

In an operation601, process600may include sending a request, from the client computing device, for a user of the client computing device to access an access-restricted target resource. For example, as discussed above in connection with operation401of process400, and operation501of process500, the request may be associated with a network address (e.g., IP address, MAC address, resource name, etc.) for the access-restricted target resource.

Process600may also include an operation602of receiving, from a security server and in response to the request, a unique session identifier for the user. For example, as discussed above regarding operation406of process400, and operation503of process500, the unique session identifier may be created or accessed by security server and sent to the client computing device for display or rendering to the user.

In an operation603, process600may include performing steps to enable dual-mode, passwordless authentication of the user. As discussed above in connection with operations408and409of process400, and operations505-508of process500, the steps may include performing a physical authentication of the user based on one or more unique physical characteristics of the user, and returning, to the security server for validation with respect to a result of the physical authentication, the received unique session identifier. Further, as discussed above, the client computing may also send to the security server personal information associated with the user (e.g., name, title, contact information, etc.) and the network address of the access-restricted target resource the user is attempting to access. As illustrated in process600, the physical authentication may occur in operation604(e.g., based on physical authentication hardware and software on the client computing device) and the unique session identifier may be returned in operation605.

In operation606, conditional on a successful dual-mode, passwordless authentication of the user by the security server, process600may also include accessing the access-restricted target resource. For example, the client computing device may directly access the requested access-restricted target resource, may access the access-restricted target resource through a secure tunnel established by the security server, or may connect to the requested access-restricted target resource through other techniques (e.g., REMOTE DESKTOP PROTOCOL (RDP), APPLE REMOTE DESKTOP, CHROME REMOTE DESKTOP, etc.). The user may then interact with the requested access-restricted target resource in a secure, seamless manner, and without having been required to provide a password for such access.

In several of the above embodiments, the described techniques used as an example implementation an enterprise with network resources, where users (e.g., employees or account holders) may seek access to the resources. Nevertheless, as discussed below in connection withFIGS.7-10, other implementations are possible as well.

FIG.7is an illustration of an exemplary system700for passwordless authentication of a user at a building security location consistent with disclosed embodiments. For example, a user of client computing device701may seek access to an access-restricted building through a security perimeter703(e.g., turnstiles, elevator, secure door, escalator, etc.). In such an implementation, the client computing device701may be, for example, a smartphone, wearable device, employee identification device, etc. When the user approaches the security perimeter703, the client computing device701may transmit to (or receive from) the security perimeter703a communication indicating that the user is seeking access beyond the security perimeter703.

Consistent with the embodiments described above, the request from the client computing device701may include personal information associated with the user (e.g., name, title, contact information, etc.) and an address (e.g., IP address, MAC address, Bluetooth ID, resource name, etc.) of the security perimeter703device it is communicating with. Alternatively, the request may be addressed to security server702. If the request is not addressed to security server702, it may be intercepted through various different techniques, as discussed above, and rerouted to security server702.

Once the request is received at security server702, a process of dual-mode, passwordless authentication of the user may be performed. As discussed above, this may involve a physical authentication of the user (e.g., using a camera or fingerprint function on the client computing device701or similar components integrated into security perimeter703itself) and the user returning a unique session identifier (e.g., barcode, QR code, image, color, etc.) that it receives from security server702. As discussed above, the authentication may also be based on the user's identity, as confirmed through personal information sent from client computing device701to security server702. If the dual-mode, passwordless authentication of the user is unsuccessful, access beyond the security perimeter703may be denied, while a successful authentication may result in security server702permitted the user access beyond the security perimeter703.

FIG.8is an illustration of an exemplary system800for passwordless authentication of a user at a vehicle consistent with disclosed embodiments. For example, a user of a client computing device801may seek access to operate a vehicle803(e.g., turn the vehicle on) or to perform a function within the vehicle (e.g., download a software update, access navigation software, make an in-vehicle purchase, etc.). In such embodiments, the client computing device801may be, for example, a smartphone, wearable device, key fob device, part of the vehicle803's infotainment system, etc.

When the user of client computing device801seeks to operate the vehicle803, or a function within the vehicle803, the client computing device801may send to (or receive from) the vehicle a communication indicating that the user is seeking such access. As discussed above, the request may be addressed to the vehicle803or to security server802. If the request is not addressed to security server802, it may be intercepted and rerouted to security server802, consistent with above embodiments.

Once the request is received by security server802, a process of dual-mode, passwordless authentication of the user may be performed. For example, this may include a physical authentication of the user (e.g., using a camera or sensor built into the client computing device801or into the vehicle803). The authentication may also involve the user returning a unique session identifier that it receives from the security server and/or validating personal information received from the client computing device801regarding the user's identity. If the dual-mode, passwordless authentication is successful, the user may be permitted access to the requested operation of the vehicle803. Otherwise, such access may be denied.

FIG.9is an illustration of an exemplary system900for passwordless authentication of a user at a computing device consistent with disclosed embodiments. In such embodiments, a user of a client computing device901may be seeking to log into a computing device903, such as a laptop, tablet, personal computer, etc. The computing device903and client computing device901may the same machine or different machines.

Rather than require the user to provide a password to log in to the operating system on computing device903, the user may be authenticated in a dual-mode, passwordless technique, as discussed above. For example, the user may send a request to log in to the computing device903, which may be received at the security server902or computing device903. If received at the computing device903, the request may be intercepted and rerouted to the security server902, as discussed above.

A process of dual-mode, passwordless authentication of the user may then occur, including a physical authentication of the user (e.g., using a camera, sensor, or other component of client computing device901) and prompting the user to return a unique session identifier that security server902sent to the client computing device. For example, the user may perform the physical authentication on their client computing device901, while substantially at the same time receiving a QR code from security server902, optically scanning the QR code using the client computing device901, and returning the decoded QR code (or a representation of it) to security server902. As discussed above, the authentication may also be based on personal information regarding the user's identity (e.g., received from a profile stored on the client computing device901). If the authentication of the user is successful, the user may be logged in to the operating system on computing device903. Otherwise, access to the operating system may be denied.

FIG.10is an illustration of an exemplary system1000for passwordless authentication of a user performing a secure transaction consistent with disclosed embodiments. For example, the user may be operating on a client computing device1001and seeking to perform a transaction with a third-party1003requiring authentication of the user. The transaction may involve, for example, an e-commerce purchase, personal loan, mortgage, credit application, etc.

When the user of client computing device1001seeks to participate in a transaction with third-party1003, it may send a request to third-party1003(e.g., a request to a particular server, a request to participate in a transaction, a request to complete a transaction, etc.). The request may be received by security server1002, or intercepted and rerouted to security server1002.

A process of dual-mode, passwordless authentication of the user may then occur, including a physical authentication of the user, and the user returning a unique session identifier that it received from the security server1002. Illustrations of how the dual-mode authentication may occur and provided, in exemplary form, inFIG.3above. In some embodiments, the user is further authenticated in terms of their identity, as confirmed based on personal information provided from client computing device1001to security server1002. If the authentication of the user is successful, the user may be permitted to engage in the requested transaction with third-party1003. Otherwise, permission may be denied.

It is to be understood that the disclosed embodiments are not necessarily limited in their application to the details of construction and the arrangement of the components and/or methods set forth in the following description and/or illustrated in the drawings and/or the examples. The disclosed embodiments are capable of variations, or of being practiced or carried out in various ways.

The disclosed embodiments may be implemented in a system, a method, and/or a computer program product. The computer program product may include a computer readable storage medium (or media) having computer readable program instructions thereon for causing a processor to carry out aspects of the present invention.

The computer readable storage medium can be a tangible device that can retain and store instructions for use by an instruction execution device. The computer readable storage medium may be, for example, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of the computer readable storage medium includes the following: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanically encoded device such as punch-cards or raised structures in a groove having instructions recorded thereon, and any suitable combination of the foregoing. A computer readable storage medium, as used herein, is not to be construed as being transitory signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission media (e.g., light pulses passing through a fiber-optic cable), or electrical signals transmitted through a wire.

Computer readable program instructions described herein can be downloaded to respective computing/processing devices from a computer readable storage medium or to an external computer or external storage device via a network, for example, the Internet, a local area network, a wide area network and/or a wireless network. The network may comprise copper transmission cables, optical transmission fibers, wireless transmission, routers, firewalls, switches, gateway computers and/or edge servers. A network adapter card or network interface in each computing/processing device receives computer readable program instructions from the network and forwards the computer readable program instructions for storage in a computer readable storage medium within the respective computing/processing device.

Computer readable program instructions for carrying out operations of the present invention may be assembler instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state-setting data, or either source code or object code written in any combination of one or more programming languages, including an object oriented programming language such as Smalltalk, C++ or the like, and conventional procedural programming languages, such as the “C” programming language or similar programming languages. The computer readable program instructions may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, programmable logic circuitry, field-programmable gate arrays (FPGA), or programmable logic arrays (PLA) may execute the computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry, in order to perform aspects of the present invention.

Aspects of the present invention are described herein with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and/or block diagrams, and combinations of blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer readable program instructions.

These computer readable program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks. These computer readable program instructions may also be stored in a computer readable storage medium that can direct a computer, a programmable data processing apparatus, and/or other devices to function in a particular manner, such that the computer readable storage medium having instructions stored therein comprises an article of manufacture including instructions which implement aspects of the function/act specified in the flowchart and/or block diagram block or blocks.

The computer readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other device to produce a computer implemented process, such that the instructions which execute on the computer, other programmable apparatus, or other device implement the functions/acts specified in the flowchart and/or block diagram block or blocks.

The flowcharts and block diagrams in the Figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present invention. In this regard, each block in the flowcharts or block diagrams may represent a software program, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems that perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

The descriptions of the various embodiments of the present invention have been presented for purposes of illustration, but are not intended to be exhaustive or limited to the embodiments disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The terminology used herein was chosen to best explain the principles of the embodiments, the practical application or technical improvement over technologies found in the marketplace, or to enable others of ordinary skill in the art to understand the embodiments disclosed herein.

It is expected that during the life of a patent maturing from this application many relevant virtualization platforms, virtualization platform environments, trusted cloud platform resources, cloud-based assets, protocols, communication networks, security tokens and authentication credentials will be developed and the scope of these terms is intended to include all such new technologies a priori.

It is appreciated that certain features of the invention, which are, for clarity, described in the context of separate embodiments, may also be provided in combination in a single embodiment. Conversely, various features of the invention, which are, for brevity, described in the context of a single embodiment, may also be provided separately or in any suitable subcombination or as suitable in any other described embodiment of the invention. Certain features described in the context of various embodiments are not to be considered essential features of those embodiments, unless the embodiment is inoperative without those elements.

Although the invention has been described in conjunction with specific embodiments thereof, it is evident that many alternatives, modifications and variations will be apparent to those skilled in the art. Accordingly, it is intended to embrace all such alternatives, modifications and variations that fall within the spirit and broad scope of the appended claims.