Patent Document

PRIORITY 
     This application claims priority to U.S. patent application Ser. No. 14/143,659 filed on Dec. 30, 2013, and U.S. Provisional Application Ser. No. 62/163,380 dated May 19, 2015 the entire contents of which are all relied upon and fully incorporated herein by reference. 
    
    
     INCORPORATION BY REFERENCE 
     Applicant incorporates by reference herein United States publication no. 2012-02402G4-A1, entitled “System, Design and Process for Strong Authentication using Bidirectional OTP and Out-of-Band Multichannel Authentication.” 
     FIELD OF THE INVENTION 
     The field of invention relates to network and Internet security. The present invention relates to an authentication system and authentication method and in particular to a process and design for a multi-factor, out-of-band multi-channel authentication process to protect all documents or other data objects. 
     BACKGROUND OF THE INVENTION 
     Authentication of a user and his credentials is the first line of defense. User authentication involves confirming the identity of a user and validating that a user is trusted and can use a computer resource based on his credentials. Most people protect their online accounts using some form of passwords. On an average a typical user has about 20 accounts for which they need to remember passwords. Most users utilize the same password for most accounts just to make it easier to remember. This practice makes all accounts vulnerable and makes it easier for a hacker to break into all other accounts if one of the accounts is compromised. 
     ID&#39;s can be lost or stolen during transactions (whether its login, payment, or other transactions), and ID&#39;s must be presented in many places explicitly. For example, in the process of electronic payment, one&#39;s credit card details must be presented to a counter party. Although an ID in a transaction may be encrypted, there are still many possibilities that an ID can be lost or stolen. 
     Static or fixed password is a common form of authentication method in use today. 
     In the static password authentication method, the user enters static user id and password on a client site and submits. Then the request is sent to the authentication server to validate the credentials of the user. If the credentials are valid the user is traversed to the next page. 
     With static password, keeping the accounts secure and hack proof is a difficult task. To keep his accounts from being compromised, the user must select long, difficult to predict passwords. Most users use some of their personal information to create their password thus making it easier to remember. In addition, users have a tendency to use the same password for most of their accounts as remembering multiple passwords can be quite a challenge. 
     Protecting documents is several orders of magnitude more difficult due to (a) the much larger number of objects to be protected, (b) the difficulty of applying multi-factor authentication, and (c) the need to distribute the passwords among multiple recipients of the document(s). 
     An object of the present invention is to provide an authentication system, authentication method, and key distribution method which permit improvement in the security of the document storage and distribution process while making it easier to use than existing methods. The invention utilizes bi-directional, asynchronous, out-of-band authentication. 
     One embodiment according to the invention is based on a multi-dimensional QR Code which provides a vehicle for strong authentication, ease of use, minimal switching cost and lower total cost of ownership. 
     In addition, or in the alternative, an embodiment uses Bluetooth in place of the QR Code. 
     In addition, or in the alternative, an embodiment uses NFC in place of the QR Code. 
     In addition, or in the alternative, an embodiment uses computer generated sound in place of the QR Code. 
     By utilizing the multi-dimension bar code, NFC, Bluetooth, or Audio, the invention, as described herein, improves usability and eliminates key security issues. 
     The method, according to the invention, uses shared keys protected with each recipient&#39;s private key (e.g from a public/private key pair) distributed via a central point to a key store on a personal device, such as a smartphone. The device communicates with various document rendering and manipulation tools via the aforementioned QR code, Bluetooth, NFC, or Audio, and out-of-band communications to decrypt the document(s) on demand. A document may be protected with multiple keys to permit different recipients to view different subsets of the document. This method also provides for partial or total document invalidation or redaction after delivery. 
     SUMMARY OF THE INVENTION 
     The instant invention provides an easy to use authentication and credential management mechanism for multi-factor out-of-band multi-channel authentication process to protect all documents. This invention provides a strong method for document authors or distributors to protect the documents they store or deliver to others. This system authenticates access to the documents based on an out-of-band authentication mechanism. 
     The authentication seeker or system user scans the multi-dimensional barcode or via other embodiments, such as Bluetooth, NFC, computer generated sound, etc., validates the client, and triggers the out of band outbound mechanism. The portable mobile device invokes the client server for authentication. The client server authenticates the user based on a shared secret key and facilitates the transmission of the relevant document password, permissions, and/or other credentials to the document tool, which then unlocks the document. 
     This invention protects the users from Key logger, Dictionary attacks, Replay attacks, and Phishing attacks, as well as a multitude of attacks against the uncontrolled storage of the document password at rest. 
     The process of the invention includes: a Secure Document Application, comprising of either a single application incorporating this invention, or two applications, one for manipulating documents, and a second one for creating a connector between the document application, the authentication server, and the authentication server application. The authentication server application communicates with the client device and the Secure Document Application (e.g. multi-dimensional barcode or SSL), handling incoming requests, secret keys, and a portable communication device with an online application. 
     A preferred embodiment of the present invention utilizes a client/server system, which comprises an authentication server, a Secure Document Application, and a user hand held mobile device equipped with a camera or reader all of which are connected via a network. The Secure Document Application and the authentication server achieve mutual secure connection based on secure sockets layer (SSL). The handheld device is also connected to the network and can connect to the authentication server in a secure manner using SSL. 
     In an embodiment, a user who wants to view a document using this invention opens a protected document on his/her computer using the Secure Document Application. This application detects that the document requires user credentials and generates a multi-dimensional dynamic barcode, or invokes another transmission mechanism, such as Bluetooth, NFC, or computer generated sound, based on the online service client/server information including, but not limited to a document identifier, a dynamically generated key, and a unique session ID. These credentials are then presented to the user. 
     The Secure Document Application, at that point, contacts the authentication server and informs it that the secure document application is waiting for user credentials for this specific document with a specified session ID. The user starts the online application on the hand-held device that includes the authentication client application and camera. The user provides its authentication information, such as a PIN or Gesture, and/or additional biometric signatures, such as face match, voice print match, etc. 
     The handheld device then establishes an independent secure connection over a carrier network wireless connection or Wi-Fi connection to the authentication server using SSL. The online application validates the user PIN/Gesture, as well as the biometric profile, with the authentication server. The online application on the hand held device decrypts/decodes the barcode and ensures the validity of the request. This unique client validation mechanism ensures there are no phishing attacks. 
     Once the validity of the secure document application is ensured, the online application takes the extracted data from the bar code, looks up the password of the document in a secure credentials database by extracting the document identifier from the request. If the credentials for that secured document are not found in the secure credentials database, the online application presents a screen to the user to provide the credentials for that login portal. Once the user provides the credentials, the online application saves the credentials on the secure credentials database on the hand held device for future use. 
     The online application then sends user credentials for the document along with the unique session ID to the authentication server directly using this secure out-of-band channel. If the authentication server finds the user and the session ID valid, it contacts the waiting Secure Document Application using the session ID and passes the user credentials, as well as user roles/privileges. Based on the user roles/privileges, the Secure Document Application can automatically provide specified access to the allowed service components for which the user has been authorized. 
     In this embodiment, the user experience is simplified and only requires the user scanning the barcode presented on the screen or just be in close proximity to the computer in the case of using NFC, Bluetooth, or computer generated sound. From the user&#39;s perspective, once the scanning of the barcode is done, if the user credentials are valid, the process of opening the document proceeds based on the user rights. 
     It is to be understood that both the foregoing description and the following description are exemplary and explanatory only and are not restrictive of the invention, as claimed. Specific examples are included in the following description for purposes of clarity, but various details can be changed within the scope of the present invention. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWING 
       A preferred embodiment of the invention has been chosen for detailed description to enable those having ordinary skill in the art to which the invention appertains to readily understand how to construct and use the invention and is shown in the accompanying drawing in which: 
         FIG. 1  is a block diagram describing the various components of an embodiment invention and depicting an example of an out-of-band outbound multi-channel authentication. 
         FIG. 2  is a schematic block diagram of an embodiment of a handheld portable communication device. 
         FIG. 3  is a schematic block diagram of embodiment of an authentication application that may reside in the handheld portable communication device described in  FIG. 2 . 
         FIG. 4  is a sequence diagram describing the authentication flow based on an embodiment of a method and/or process based on the invention. 
         FIG. 5  is a sequence diagram describing the authentication flow based on an embodiment of a method and/or process based on the invention. 
         FIG. 6  is a block diagram illustrating one example of two separate communication channels in an embodiment of the present invention. 
         FIG. 7  is a block diagram showing various components of an embodiment of a system according to the invention and depicting an example of an out-of-band outbound multi-channel authentication process specifically adapted to protect electronic documents in accordance with the invention. 
         FIG. 8  is a schematic block diagram of embodiment of an online authentication application in accordance with the invention that may reside in a handheld portable communication device such as described in  FIG. 2 . 
         FIG. 9  is a block diagram depicting an embodiment of an authentication server. 
         FIG. 10  is a schematic block diagram of an embodiment of a secure document application. 
         FIG. 11  is a sequence diagram describing an authentication flow based on an embodiment of a method and/or process based in accordance with the invention. 
         FIG. 12  is a block diagram illustrating one example of two separate communication channels in an embodiment of the present invention. 
     
    
    
     DETAILED DESCRIPTION OF THE INVENTION 
     Referring to the drawing,  FIG. 1  illustrates an embodiment of a system and process according to the invention. In particular,  FIG. 1  shows an authentication system  10  that utilizes out-of-band outbound multi-channel authentication using a client/server system comprising an authentication server  12 , browser having client processing  14 , such as plug-ins or extensions, and a user hand held mobile device  16  equipped with a camera and with online authentication client, all of which are connected via a communications network  116  to access an online account server. 
     The browser plug-in and the authentication server can achieve mutual secure connection, based on a connection such as Secure Sockets Layer (SSL). The handheld device is also connected to the network and can connect to the authentication server in a secure manner using a connection such as SSL. 
       FIG. 6  illustrates one example of the two separate communication channels in present invention that are used for authentication process. The handheld device  16  communicates with the authentication server  12  over a first communications channel  18  which is separate from a second communications channel  20  over which the browser having the client processing application  14  and authentication server  12  communicate. In one embodiment of a system and process according to the invention, at least the out-bound portions of communications from the handheld device to the authentication server are provided in a separate communications channel  18  and are out-of-band from the communication channel  20  over which the authentication server  12  and client processing application  14  communicate. 
     The authentication server  12  compares the user information and the third party server credentials to a database of user information and a database of third party server credentials. The authentication server  12  authenticates the user information and the third party server credentials to obtain authentication results. The authentication server  12  transmits E 1  the authentication results to the client processing application  14  and can also transmit E 2  the authentication results to the portable communications device  16 . The client processing application  14  also transmits E 3  the authentication results to the hand held device  16 . If the authentication results are positive, a secure communication may be established between the user and the client processing application  14 , and the user  15  may be granted access by the client processing application  14 . Alternatively, if the authentication results are negative, the user is denied further access to the client processing application  14 . 
       FIG. 2  illustrates the components of an embodiment of a portable communication device  16  according to the invention, such as a handheld device like a mobile phone or an iPad. The portable communications device can include various components, including a processor  30 , memory  32 , power unit  34 , keyboard  36 , camera  38 , a near field communication (“NFC”) unit  40 , LCD Display  42  and a communications unit  44 . The device also has an operating system  50  which includes programming for the processes utilized by the device, including programming for secure communication  52 , a data storage  54  as well as a sandbox  56 , containing an authentication application  58  and other supplemental applications  59  to supplement the processes of the authentication application  58 . The sandbox provides a security mechanism for separating running programs and thereby enhances the security of a device according to the invention. Incorporation of an NFC unit  40  in a device according to the invention facilitates use of a device according to the invention by a user in a manner which can make the underlying processes appear seamless. It can be appreciated by a person of ordinary skill in the art to use known processes for the device Including processes for providing secure communication  50  by the device  16  to provide for secure receipt and transmission of information. Other applications  59  include software (and there may be hardware capabilities/applications/libraries on the phone) that provide capabilities like picture taking and touch sensitive activity detection. 
       FIG. 3  illustrates an embodiment of an authentication application having processes that may reside in the handheld portable communication device described in  FIG. 2 . It can be appreciated by a person of ordinary skill in the art that various programming can be provided to effect the processes of a device  16  according to the invention. The processes can be programmed into one or more separately discrete units. Among other things, a secure data storage  60  process can be provided to effect secure storage and retrieval of information from memory  32  on the device  16 . Among other things, the secure data storage  62  and credentials  63  can include one or more shared secret keys associated with one or more client processing applications  14 . In addition, a user face profile  64  can be provided for a face profile for use with the processes performed by the device  16 . The authentication application  14  can also include separate processes for managing and storing other information, such as user credentials  66 , a user pin  68 , user secret key  70 , and an authentication server shared secret key  72  which can be stored in the secure data storage  62  or in other portions of the memory  62 . Furthermore, the device  16  includes processes for a barcode scanner and decoder  74  and a barcode encoder  76 , which processes can be provided separately or as part of the authentication application  58  process software. The components and arrangements of  FIGS. 2 and 3  may be varied within the principles of the present application. 
     Referring to  FIGS. 1 and 4 , client user starts E 1  a client processing application  14  with laptop or PC, which can be automatically started once a user desires to login to an associated online account or portal. For example, the user can open a browser to log in to a password-protected website. Thereafter, the browser can load the URL. 
     The client processing  14  checks the URL E 2  to determine whether or not the associated website requires credentials. The client processing  14  can do this by checking a secure database. If the website requires credentials, the client processing extension can request the browser to show an icon on the browser address bar to show availability of the instant invention to provide secure connection and the needed credentials. In this embodiment, the browser displays the icon, and if the user clicks on the icon the browser detects the extension icon selection to proceed and the browser extension and/or client processing  14  generates a session ID, a temporary public/private key pair and creates a payload for a QR Code with the session ID, temporary public key URL, client IP, and any other relevant information. Thereafter, the browser client processing  14  contacts E 2  the authorization server  12  to start a new authorization session and the server generates a session ID  80  to send E 3  to the client processing application. The client processing application  14  creates  82  a multi-dimensional barcode with dynamic encryption keys, server portal information, session and a unique key and displays the barcode in a popup. The client processing application waits for notification. 
     Further, or in the alternative, the client extension processing  14  can create the QR code with the payload created earlier and updates the pop-up contents. Thereafter the browser can bring up a pop-up containing a QR code for the user to scan. 
     In addition to or in the alternative, the client processing application  14  and/or browser extension contacts the authentication server with the session ID, and the authentication server can add the session ID to a list of pending authentication requests. 
     In addition, or as an alternate, the client processing application  14  creates an RSA key and embeds public key in bar code along with portal information, and displays barcode on laptop or PC screen. 
     User starts authentication  86  by using a smart phone and starting the handheld authentication application  59 , or automate power application and entering E 4  PIN or gesture on handheld device  16  to access the application. The alternate phone application prompts and accepts the PIN and then sends the device ID (which can be set up upon initialization of services), phone number and device ID/passcode to the authentication server  12 . 
     Authentication server  12  receives the PIN/passcode with the device ID and checks against a secure database for a match for the device to login to the authentication server. If the match is successful, the authentication server returns notification and/or a password to the handheld device application  59  indicating success, and accordingly completes a process which validates the PIN and can, alternatively, or in addition, display one or more scan options  88 . 
     User holds  90  handheld device to laptop or PC login screen and clicks scan option E 5 . Device scans barcode and validates the client processing application  92 . On notification E 6 , the handheld device  16  finds  94  the encrypted user credentials with encryption key from barcode and sends E 7  the encrypted credentials and session ID to authentication server  12 . Authentication server  12  checks  96  in provisioned user database, validates session, and sends E 8  encrypted payload to waiting client processing application  14 . The client processing application decrypts  98  payload using the keys it generated and extracts the credentials. The client processing application  14  then uses the decrypted credentials to provide access to login to the online account and/or web portal and proceed to use those services of the online account. 
     Handheld device  16  displays result received E 9  from the authentication server. 
     The out-of-band outbound mechanism provides an additional level of security due to the original request being different than the outgoing push from the portable device to the service provider server. 
     The usability issue is addressed by utilizing the scanning functionality of the hand held device. This eliminates erroneous typing and user frustration. 
       FIG. 5  shows a high level, less detailed and alternative embodiment of a method according to the invention shown in  FIG. 4 . A further embodiment, includes one or more variation of the methods and steps described above, and can include one or more of the following. 
     A method for authentication typically resides in a system comprising a user, a browser extension or plugin, a portable communications devices, and an authentication server having a provisioned user database and encrypted payload. 
     The method can begin by detecting user intent to login to an online portal (like, gmail, yahoo, ebay, etc) using a browser, and then establishing contact between browser extension or plugin and authentication server wherein a new authentication session is started. 
     Thereafter, a session ID can be generated at the authentication server, wherein the session ID is communicated to the browser plugin through at least a first communications channel. 
     A multi-dimensional barcode can be created at the browser extension or plugin, wherein the barcode has dynamic encryption keys, portal information, session ID, and a unique key, and wherein the barcode is displayed in the browser. 
     In one embodiment, the browser can be held in a waiting state pending authentication server notification of session validation, whereupon once positive notification is received the user starts the authentication by entering credentials on the portable communications device, wherein the portable communications device validates the credentials and displays one or more scan options. 
     In one embodiment, a portable communications device can be used to scan barcode displayed at login screen and validate browser extension or plugin. However other techniques of coded transmission including, but not limited to NFC, RFID, and Bluetooth, can be used within the scope of the invention. 
     Once the encrypted user credentials are located on the portable communications device with encryption key from barcode (or an alternative technique of transmission), the encrypted credentials are sent with the session ID from the portable communications device to authentication server via an outbound out-of-band communications channel. 
     Then, a matching of information is checked in the provisioned user database of authentication server, and the session is validated. Once validated, the encrypted payload is sent to the waiting browser extension or plugin, and validation result can be sent from the authentication server to the portable communication device where the result can be displayed. 
     The payload can be decrypted at the browser extension or plugin using encryption keys; and credentials can be extracted and decrypted at the browser extension as well. 
     Using decrypted credentials the login form on the login page of the online portal in the browser can be populated or transmitted directly to initiate and/or complete the login requirements of the online portal, such as by sending the login form to the online portal using the browser extension or plugin. 
     Similarly, as shown in  FIGS. 4 and 5 , a method according to the invention can include a number of steps. One possible variation of a method according to the invention is set forth as follows. A user  118  interacts  130  with a client processing application  117 . 
     The client processing application  117  contacts  131  and authorization server  113  to start a new session. The authorization server  113  starts a new session and generates  132  a session ID. 
     The authorization server  113  communicates with the secure client processing  117  and provides information, including among other things, session ID information. 
     The client processing application  117  creates  133  a multi-dimensional barcode with barcode information. Including dynamic encryption keys, server/portal information, session ID and a unique key. The client processing application can display the generated barcode. 
     The client processing application waits  134  for receipt of a notification from the authorization server to proceed. 
     The barcode that has been generated by the client processing application  117  is displayed by the application. The user  118  can scan the barcode with the handheld device  1 . The handheld device scans the barcode and validates  138  the service server. 
     The handheld device finds  139  encrypted the user credentials with encryption key from the barcode and sends validation information including the encrypted credentials and the session ID to the authentication server. 
     The authorization server receives the validation information, including the encrypted credentials and the session ID and checks  140  the provisioned user database and validates and sends encrypted payload to the waiting client processing application as notification. 
     The client processing application  117  decrypts  141  the payload from the authorization server using the keys it generated and extracts the credentials. The client processing application then uses the decrypted credentials to provide access to the login portal of the online account or service. 
     Accordingly, the handheld device can also display and/or access  142  the online account or service. In addition, the handheld device then displays  142  the results which it receives from the authorization server. 
     Referring to the drawing,  FIG. 7  illustrates an embodiment of a system and process according to the invention. In particular,  FIG. 7  shows an authentication system that utilizes an out-of-band outbound multi-channel authentication system to protect electronic documents using a client/server system comprising an authentication server  200  having a server application  210 , a client system  230 , a secure document application  240  or plugin which decrypts credentials and can use a private key to open a document with the decrypted credentials, and a portable communications device  260  with an online authentication application  280  which are connected, at least intermittently, via a communications network. 
     As used herein, “documents” the several embodiments include various types of messages, such as emails, instant messages, pictures, encrypted files, videos, video messages, audio files, audio messages, even discrete data packets, among other things. Accordingly, the several of the embodiments of the authentication system herein are described as specifically adapted for one or more such elements, and a person of ordinary skill in the art can adapt such embodiments for use with other forms of documents. 
     In this particular embodiment of the invention, the process illustrated in  FIG. 7  begins with the user opening the secure document application F 1 . The secure document application creates F 2  a public/private key pair, embeds a public key in the barcode along with document identifying information and displays the QR code. The user then opens the online application on the handheld device. The authentication server, with the authentication server application, authenticates F 6  the user. The client device  230  captures F 3  the credentials request. The handheld device  260  with the online application  280  looks up F 7  the credentials from a local secure repository and decodes F 4  the credentials for the secure document application. The credentials are transmitted to the secure document application directly or via the authentication application  210 . As the user authentication is a success  10 , the secure document application decrypts  11  the credentials using a private key and opens the document. 
     The secure document application  240  and the authentication server achieve mutual secure connection, such as a connection based on SSL. 
     The handheld device  260  is also connected to the network and can connect to the authentication server in a secure manner, such as by using SSL. 
     It can be appreciated by a person of ordinary skill in the art that other methods of establishing a secure connection can be used without departing from the scope of the invention. 
       FIG. 8  illustrates an embodiment of an online authentication application  280  specifically adapted for secure document authentication and having processes that may reside in a handheld portable communication device  130  such as described in  FIG. 2 . The online authentication application  280  includes a secure credentials data store  231  that can store document credentials  282 , user face profile  283 , user Authomate credentials  284 , user PIN,  285 , user secret key  286 , authentication server shared secret key  287 , barcode scanner and decoder  288 , and a barcode encoder  289 . It can be appreciated by a person of ordinary skill in the art that various programming can be provided to effect the processes of a device  230  according to the invention. The processes can be programmed into one or more separately discrete units. 
     A secure data credential data store  281  can be provided to effect secure storage and retrieval of information from memory on the device, including document credentials  282 . The secure data storage  281  and document credentials  282  can include one or more shared secret keys associated with one or more secure document applications  240 . 
     In addition, a user face profile  283  can be provided for a face profile for use with the processes performed by the device. The online application  280  can also include separate processes for managing and storing other information, such as user credentials  284 , a user pin  285 , user secret key  286 , and an authentication server shared secret key  287 , which can be stored in the secure credentials data storage  281  or in other portions of the memory  30 . Furthermore, the device can include processes for a barcode scanner and decoder  288  and a barcode encoder  289 , which processes can be provided separately or as part of the online application  280  process software. The components and arrangements of  FIGS. 2 and 8  may be varied within the principles of the present application. 
       FIG. 9  illustrates an embodiment of the authentication server  200  comprising of an authentication server application  210 . The authentication server application comprises of a user database  250 , authentication manager, encryption, validation, and communication processes, and a RSA Key  246 . The authentication server can be adapted to begin a new authentication system and generate a session ID. The authentication server can also be adapted to receive encrypted credentials, process the encrypted credentials, and send an encrypted payload to the secure document application. The authentication server can also be adapted to transmit and/or store encrypted credential between instances of the online application  280  for purposes of credential distribution and control. It can be appreciated by a person of ordinary skill in the art that the server can be provided as a general purpose computer or designed with the use of Application Specific Integrated Circuits (ASICS). 
     The user database  250  can be adapted to store previous user information, current user information, previous user interaction with the authentication server  200 , unencrypted and encrypted credentials, public and private keys, device ID, Session ID, PIN, device RSA key  246 , current user interaction with the authentication server  200 , among other things. The Authentication server application includes processes for encryption, validation, and communication allowing the server  200  to validate a new session with an incoming validation request. The authentication server application also includes processes for managing the distribution of credentials between instances of the online application  280  and managing and enforcing user permissions for those credentials, as well as tracking the use of those credentials. The components and arrangements of  FIG. 9  may be varied within the authentication server. 
       FIG. 10  illustrates an embodiment of a secure document application, i.e., client document application  240  comprising of an interface  242 , such as the Multi-dimensional QR Code, Bluetooth, NFC, or Computer generated Sound, which can be adapted for various types of devices, such as a handheld communication device or a desktop computer; and an adapter  244  that can also be embedded in other applications to adapt various types of documents and messages, such as emails or audio messages, and process various such documents into encrypted files. 
     The interface  242  allows the user to interact with the client document application  240  to begin the process of authenticating a document or payload. The interface is also adapted to allow the user to interact with the authentication server  200  and online application  280  during the authentication process, as well as provide use of the document adapter  244 . A typical embodiment might be a software library including components such as a QR code generator and public/private key encryption. It can be appreciated by a person of the ordinary skill in the art that the interface can be provided by different operating systems and interact with other processes within the client document application  240 . 
     The document adapter  244  is provided within the secure document application  240  as additional programming to permit a user to access various types of documents encrypted by the system. Accordingly, it can be appreciated by a person of ordinary skill in the art that such software can be pre-installed or installed upon use. 
     For example, one embodiment of an adapter according to the Invention is an adapter to access a document in Portable Document Format (PDF) that has been decrypted by the secure document application  240 . 
     In addition, or in the alternative, an embodiment with an adapter according to the invention is an adapter to access an email that has been decrypted by the secure document application. 
     In addition, or in the alternative, an embodiment with an adapter according to the invention is an adapter to access an instant message (IM) that has been decrypted by the secure document application. 
     In addition, or in the alternative, an embodiment with an adapter according to the invention is an adapter to access a picture that has been decrypted by the secure document application. 
     In addition, or in the alternative, an embodiment with an adapter according to the invention is an adapter to access an originally encrypted file, re-encrypted by the system and then decrypted by the secure document application. 
     In addition, or in the alternative, an embodiment with an adapter according to the invention is an adapter to access a video or video message that has been decrypted by the secure document application. 
     In addition, or in the alternative, an embodiment with an adapter according to the invention is an audio file or audio message that has been decrypted by the secure document application. 
     In addition, or in the alternative, an embodiment with an adapter according to the invention is a data packet adjuster, which has been decrypted by the secure document application. 
       FIG. 11  shows an embodiment of a method according to the invention. A method for authentication can be provided with programming in a system comprising a user, client device, such as a browser extension or plugin having a secure document application, a portable communications device having an online application, and an authentication server and authentication server application having a provisioned user database and encrypted payload. 
     The method includes a plurality of steps, and can begin by the user starting  130  the secure document application by activating the secure document application on a client device, such as a laptop, and opening a secured document that requires credentials for access. The secure document application detects the need for credentials and contacts  131  the authentication server application to start a new authentication session for the user to begin accessing the document. Thereafter, the authentication server application generates  132  a session ID for the user whereby such session ID will be used through the process to track and ensure proper decryption and authentication. This session ID is transmitted back to the secure document application. 
     The secure document application  240  creates  133  a multi-dimensional barcode  10  wherein the barcode has dynamic encryption keys, server/portal information, a session ID, and a unique key. The multi-dimensional barcode can be displayed  133  in a separate popup or window. 
     In one embodiment, the user can enable the online application device  260  to cause the device to scan  137  the barcode displayed. However, it can be appreciated that other techniques of coded transmission including, but not limited to NFC, RFID, Bluetooth, and computer generated sound, can be used without departing from the scope of the invention. 
     The secure document application is put on hold  134  as it waits for a notification from the authentication server that the session started  130  has been completed and the relevant credentials provided by the online application  135 - 130 . 
     The user then starts authentication  135  by entering a PIN on the handheld device  260 . The online authentication application  280  on the handheld device then validates  136  the PIN and displays a scan option. The user points  137  the handheld device to the barcode generated by the secure document application, clicking the scan option on the handheld device. The user scans the barcode  138  thereby acquiring the credentials request from the secure document application. 
     The online application or the handheld device finds  139  the encrypted user credentials with the encryption key from the barcode and sends  139  the encrypted credentials and session ID to the authentication server and the authentication server application. 
     The authentication server checks  140  in the provisioned user database  250 , validates the session, and sends the encrypted payload to the waiting secure document application. 
     After validation, the device displays  142  the result as received from the authentication server. The secure document application decrypts and extracts  141  the credentials from the payload received from the authentication server. The secure document application uses  141  the decrypted credentials to decrypt the document or payload. The encrypted document is now open  143 . 
       FIG. 12  provides an illustration of the separate communication channels in an embodiment of the present invention that can be used for an authentication process. The online application of the handheld device  260  communicates with the authentication server over a first communications channel  90 . This channel is separate from a second communications channel  92 , over which the secure document application  240  and authentication server  200  communicate. It is contemplated in the art that the invention includes other configurations. For example, communication channels can be different types of communication channels, including systems typically digital, such as phone, internet, and wifi, but also some forms of analog communications. In addition, the applications described herein can communicate through different devices, such as mobile phone to mobile phone, mobile phone to computer, computer to laptop, or mobile phone to tablet, among other things. 
     Specifically, in one further embodiment of a system and process according to the invention, at least the out-bound portions of communications from the handheld device  260  to the authentication server  200  are provided in a separate communications channel  90  and are out-of-band from the communication channel  92  over which the authentication server  200  and secure document application  240  communicate. 
     In another embodiment of a system and process according to the invention, at least the out-bound communications channel  90  from the second channel device application  280  to the authentication server are provided in a separate communications channel and are out-of-band from the communication channel  92  over which the authentication server and first channel document application  240  communicate. 
     Furthermore, another embodiment of a system and process according to the invention, at least the out-bound communications channel from the first channel document application  240  to the authentication server are provided in a separate communications channel  90  and are out-of-band from the communication channel  92  over which the authentication server and second channel device application  280  communicate. 
     Various changes may be made to the system and process embodying the principles of the invention. The foregoing embodiments are set forth in an illustrative and not in a limiting sense. The scope of the invention is defined by the claims appended hereto.

Technology Category: 3