WO2011069492A1

WO2011069492A1 - Method for providing a secure and convenient access to online accounts via remote forward

Info

Publication number: WO2011069492A1
Application number: PCT/DE2010/001435
Authority: WO
Inventors: Bernd Borchert; Klaus Reinhardt
Original assignee: Eberhard Karls Universität Tübingen
Priority date: 2009-12-10
Filing date: 2010-12-09
Publication date: 2011-06-16
Also published as: DE102009057800A1

Abstract

The invention relates to a method for providing a secure and convenient access to a document in a computer network, especially to online user accounts (online accounts), these accounts especially being access-restricted user accounts requiring authorization. In addition to a server computer and a client computer which are located in the same computer network, the method requires a mobile communication device having a camera, a processing unit with memory and means for communication (e.g. a mobile phone with Internet access and built-in camera). The method comprises the following steps: upon inquiry (1) of the client computer (B), the server computer (A) transmits information (2) to the client computer (B) which information is displayed on the client display as information (3); information (3) is read and processed by the mobile communication device (C); the result is transmitted to the server computer (A) as information (4); if the result of examination of the data is positive, information (5) is forwarded to the client computer (B) which then provides the local access. The method allows the convenient and secure handling of access information to a plurality of user accounts, such as e.g. passwords, user names, and login addresses. Since no permanent passwords are used but only single-use passwords which are only valid for seconds, the method remedies the problem of password overload and identity theft through electronic eavesdropping by Trojans.

Description

PROCEDURE AND COMPUTER PROGRAM PRODUCTS FOR AUTHENTICATED ACCESS TO ONLINE ACCOUNTS

The present invention relates to a method for providing a secure and convenient access to a document in a computer network, in particular to online user accounts (online accounts).

Many Internet users are aware of the password flood problem, and many users can hardly remember the many passwords (and also the user names and login addresses) for the online user accounts.

There are improvised methods to deal with the password flood. One of them is to save the passwords on your own cell phone. Corresponding mobile phone programs are already available for some types of mobile phones. However, it remains with the manual input of user data on the screen. Also, the problem described below of the security in the password input is not resolved, because it continues to be persistent passwords.

Typing in a password on the computer screen is unsafe to eavesdropping by Trojans ("Identity theft ¹ by so-called" keylogger "): The Trojan observes which keys are pressed when entering the password, even if the password is displayed on a keyboard display with mouse clicks If the password is stored on the computer and automatically entered in the password field, it is even more problematic, because the Trojan can use it at any time from the

Read out computer memory or listen in on input (even if only asterisks or other concealing characters are displayed on the screen, a Trojan can still find the password within the software system).

CONFIRMATION COPY Challenged passwords can be secretly sent by the Trojan through the computer network, such as at headquarters where the stolen identities are collected and then resold for misuse purposes. There are methods against identity theft by Trojans, eg the photo PIN procedure with the camera phone, see patent application DE-2007029759.

However, there is no known method for secure and at the same time user-friendly handling of passwords for online user accounts.

It is an object of the present invention to provide a method for secure yet comfortable access to online documents, e.g.

User accounts to provide, especially for access-restricted

User accounts that require authorization. The method should also be able to provide access information to multiple user accounts, e.g. Passwords, usernames, login addresses, convenient and secure to handle.

This object is achieved by a method in which, in addition to a server computer and a client computer, which are located in the same computer network, in addition a mobile communication device with a camera, a processor with memory and means for communication with a server Calculator is needed. The mobile communication device may in particular be a mobile phone with Internet access and a built-in camera. To gain access to a document, e.g. To create an online user account on the client machine, follow these steps (Fig.1).

First, a request (information 1) is transmitted to the server computer by the user. This can be done, for example, by calling a so-called URL for a

Document (a website) by a so-called. Browser program that runs on the computer of the user (client computer) happen.

After receiving this request by the server computer from this a response message (information 2) is generated and transmitted to the client computer. This response message contains a portion of the authorization data needed to provide access to the document on the server machine. In particular, the response message can be cryptographically encrypted. The

Response message is displayed on the user's screen, e.g. in the form of a bar code, displayed (information 3) and may include an identification of the server computer, the accessed website, and / or an identification of the client computer at the server computer.

The information 3 displayed on the screen of the client computer is now read by the user by means of the camera of the mobile communication device (recorded) and processed in its processor. In this case, the information read in may be decrypted and stored with the information stored by the user in the memory and for the assignment of identification data to certain documents (e.g.

Internet pages) necessary data compared. In this process, the server server requested by the user is identified and authorization data

(Information 4) generated for access to the accessed document on the server computer hay. The newly generated authorization data preferably represents a cryptographic signature. The newly generated authorization data are transmitted from the mobile communication device to the server computer and checked by the latter. If the check of the authorization data is positive and the server computer has identified the client computer based on the authorization data, the server computer transmits the access data (information 5) to the client computer. After receipt of the access data by the client computer, access to the document is granted. This can e.g. can be achieved by displaying a new page with the corresponding document (e.g., user account) on the screen of the client computer. Alternatively, the server computer sends to the client computer the URL of the requested document, possibly including authorization data, so that the user subsequently receives access to the document from the server computer.

All authorization data generated in this procedure

(Information 2, 4, 5, 7, 8, 9 and 10), are preferably only a short time, eg a few seconds valid. If after expiration of this specified time the server computer no Authorization data receives or identifies as matching, the later requests are not answered by the client server. Therefore, the method according to the invention makes it difficult to misuse authorization data. In a computer network protocol such as the World Wide Web (as part of the Internet), the architecture does not provide for a server computer to have sent a document to a client computer, which is displayed by a so-called browser on the screen of the client computer will be able to replace this document directly on the screen of the client computer with another one. Therefore, by so-called "polling" the server is given the opportunity, a document at

Client computer to replace: the new document is sent as a response to a request from the client computer at the server computer. Therefore, according to the invention, the transmission of the access data (information 5) from the server computer to the client computer additionally at least one transmission of

Information 6 from the client computer to the server computer (Fig. 2). The information 5 in this case is a response to information 6.

According to a further embodiment of the invention, the mobile

Communication device with at least one other server computer (here as

Account computer) (Figure 3). There are inquiries

(Information 7) generated by the mobile communication device and to one of

Transfer account computer. The account computer generates information 8 in response and transmits it to the mobile communication device. There they are processed, generating information 4 containing authorization data for accessing a document on the account computer. After receiving the

Information 5 transmits the client computer to the account computer information 9, which preferably also contain authorization data. The account calculator checks the authorization and transmits the information 10 to the

Client computer, which preferably represents the requested document.

According to a further embodiment, the method for protection against the consequences of theft of the mobile communication device can be combined with a password query at the server, either via the usual login web page with Password query, or even via trojan-safe methods, such as the photo-PIN method, as described in DE-2007029759.

The present invention further relates to computer program product for carrying out the method according to the invention on a processor in the server computer.

The present invention further relates to computer program product for carrying out the method according to the invention on a processor in another server computer (account computer).

The present invention further relates to computer program product for carrying out the method according to the invention on a processor in the mobile

Communication device. With the method according to the invention, the user can thus log into an online user account on the computer screen without having to type in the password and the user name.

Another advantage of the invention is that an identity theft by Trojans on the computer of the user is practically impossible, because it will not be used multiple times usable passwords, but only once-passwords that are valid for only a few seconds.

Further advantages, features and possible applications of the invention are described below with reference to the embodiments with reference to the drawings. In the drawings show:

Fig. 1: The server computer A sends after request 1 of the client computer B, the information 2 to the client computer B, the client screen as

Information 3 will be presented. The information 3 is from the mobile

Communication device C read and processed. The result is sent as information 4 to the server computer A. After positive examination of the data, the information 5 is sent to the client computer B, which provides the access there. Fig. 2: If, as in the case of the World Wide Web, the server computer A can not send information 5 directly to the client computer B, the server computer A is sent by a request sent from the client computer to the server computer given the opportunity to transmit the information 5 in response to the information 6 to the client computer B ("polling").

Fig. 3: In the case of the mobile communication device C, a communication procedure can take place with a second server computer (AccOunt computer) D, which consists at least of the transmission of two information 7 (out) and 8 (back). The

Authorization data for access to this second server D arrive as part of the information 4 and 5 at client computer B, which uses this data to establish access to the second server D by sending the authorization data as information 9 to the second server D which then provides the access on the screen of the client computer by transmitting information 10 to the client computer B.

embodiments

The method according to the invention can provide access to online use in the

This can be done in two main ways: either via a direct (Fig. 1 and 2) or via an indirect remote forwarding (Fig. 3).

Method for providing access to online user accounts by means of direct remote forwarding

For an online user account, e.g. a download page or forum, the server name, account name and a secret cryptographic key are stored on the user's photo phone. If the user wants to go into the user account, they go to the login account of the user account provider. There, the account server has presented a 2D code in which the server name and a

Session ID stand. This information is read by the user by photographing in the camera phone. The camera phone will then - completely independently - do the following: it searches for the saved username for this server name; then calculated it from the session ID with the key a codeword (signature); At the end, the mobile phone goes via mobile Internet to a website of the account server and sends the account server the user name, the session ID and the code word calculated from it. The account server checks the information: if the code word is ok, the account server activates the user account, ie the situation on the user's screen is displayed as after logging in.

Method for providing access to online user accounts by means of indirect remote forwarding

The user's camera phone stores multiple user accounts as in the example above. The user invokes a fixed remote redirect web page with their browser. He reads the 2D code on the page with a program on the camera phone. The camera phone then displays a list of user accounts on the display. The user selects a user account. Then the phone sits in the background with the

corresponding account server in order to receive a new session ID ("nonce") that will only be valid for a few seconds The session ID is signed on the mobile phone with the cryptographic key of this user account. Session ID and signature value for remote

Forwarding server, and from there to the browser on the user's screen. The browser calls a login page of the account server and sends server name. Username, session ID and signature value as parameters with. After a positive check of the authorization data, the opened user account appears in the browser window of the user.

Claims

claims

A method for providing access on a client computer

a document in a computer network from a mobile

Communication device, wherein the mobile communication device a

Camera, a processor with memory and means for communicating with a server computer, and the client computer and the server computer are located in the computer network, characterized by the following steps:

(a) generation of information 1 as a request by the client computer and transmission of information 1 to the server computer,

(b) reception of information 1 by the server computer, generation of information 2 on the server computer, transmission of information 2 from the server computer to the client computer,

(c) receiving information 2 and displaying information 3 on the screen of the client computer,

(d) reading the information 3 from the screen of the client computer

through the camera of the mobile communication device,

(e) processing the information 3 on the mobile communication device, generating information 4 and transmitting information 4 from the mobile communication device to the server computer,

(f) receiving and checking information 4 by the server computer, generating and transmitting information 5 for access to the client computer,

(g) providing access on the client computer.

2. The method according to claim 1, characterized in that the document is access limited and requires authorization for providing the access, in particular online user accounts.

3. The method according to any one of the preceding claims, characterized in that at least one of the information 1, 2, 3, 4 and 5 contain authorization data for access to a document on the server computer.

4. The method according to any one of the preceding claims, characterized in that the information displayed on the screen of the client computer 3 include an identification of the server computer and / or the document and / or an identification of the client computer at the server computer.

5. The method according to any one of the preceding claims, characterized in that the memory of the mobile communication device has stored information for the assignment of identification data from server computers to certain documents.

6. The method according to any one of the preceding claims, characterized in that the transmission of the information 5 precedes at least one transmission of information 6 from the client computer to the server computer.

7. The method according to any one of the preceding claims, characterized in that the mobile communication device communicates with a second server computer, wherein information 7 generated by the mobile communication device and transmitted to the second server computer, the

Information 7 is received from the second server computer, information 8 is generated by the second server computer and transmitted to the mobile communication device, information 8 is received and processed by the mobile communication device, generating information 4, and providing access to the client Computer comes about by the fact that the client computer transmits information 9 ah the second server computer, the second server computer generates information 10 and transmits it to the client computer.

8. The method according to any one of the preceding claims, characterized in that at least one of the information 1, 2, 4, 5, 7, 8, 9 and 10th

Authorization data for accessing a document contained on the second server computer.

9. The method according to any one of the preceding claims, characterized in that the authorization data for providing the access a limited time after its generation by the server computer and / or by the second server computer and / or by the mobile communication device are valid.

10. Computer program products for carrying out the method according to one of claims 1 to 9, when the computer programs on a processor in the server computer or in the second server computer or in the mobile

Communication device are running.