GB2379040A - Controlling user access to a remote service by sending a one-time password to a portable device after normal login - Google Patents
Controlling user access to a remote service by sending a one-time password to a portable device after normal login Download PDFInfo
- Publication number
- GB2379040A GB2379040A GB0120391A GB0120391A GB2379040A GB 2379040 A GB2379040 A GB 2379040A GB 0120391 A GB0120391 A GB 0120391A GB 0120391 A GB0120391 A GB 0120391A GB 2379040 A GB2379040 A GB 2379040A
- Authority
- GB
- United Kingdom
- Prior art keywords
- user
- password
- network
- service
- time password
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Withdrawn
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0853—Network architectures or network communication protocols for network security for authentication of entities using an additional device, e.g. smartcard, SIM or a different communication terminal
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
- G06F21/31—User authentication
- G06F21/40—User authentication by quorum, i.e. whereby two or more security principals are required
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
- G06F21/31—User authentication
- G06F21/42—User authentication using separate channels for security data
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/42—Confirmation, e.g. check or permission by the legal debtor of payment
- G06Q20/425—Confirmation, e.g. check or permission by the legal debtor of payment using two different networks, one for transaction and one for security confirmation
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/18—Network architectures or network communication protocols for network security using different networks or channels, e.g. using out of band channels
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
- H04L63/0838—Network architectures or network communication protocols for network security for authentication of entities using passwords using one-time-passwords
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Theoretical Computer Science (AREA)
- General Engineering & Computer Science (AREA)
- Computer Hardware Design (AREA)
- General Physics & Mathematics (AREA)
- Physics & Mathematics (AREA)
- Business, Economics & Management (AREA)
- Accounting & Taxation (AREA)
- Computing Systems (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Software Systems (AREA)
- General Business, Economics & Management (AREA)
- Strategic Management (AREA)
- Finance (AREA)
- Telephonic Communication Services (AREA)
- Information Transfer Between Computers (AREA)
Abstract
A method is described for controlling user access to a remote service over a network, such as the Internet. In an initial log-in procedure, the user enters a user name and user password over the network, and the service validates the combination of the user name and user password. If validation of the combination of the user name and user password is successful, the service sends a one-time password to the user via a wireless messaging service, to a portable device personal to the user. The portable device may be the user's mobile phone and the message may be an SMS message. A supplementary log-in procedure is then performed, in which the user enters the received one-time password over the network, and the service validates the one-time password. If validation of the one-time password is successful, the user is allowed to access the service over the network.
Description
<Desc/Clms Page number 1>
System for controlling user access to a remote service Background to the invention This invention relates to a method and apparatus for controlling access to a remote service, such as a service provided over the Internet or an in-house intranet.
One common way of controlling access to a remote service is to require the user to log in to the service using a user name and password. However, a problem arises if the user attempts to log in from some non-trusted device, e. g. from some other organisation's site, or from a public device such as a kiosk or an Internet cafe. In this case, there is a danger that the user name/password combination may be intercepted by the device. The actual session can be protected, e. g. using https/SSL, but the password is still vulnerable to software on the device that, for example, may log keystrokes. There is then the danger that the log-in sequence can be subsequently replayed, allowing a nonauthorised user to access the service.
The object of the present invention is to provide a system for log-in to a remote service which overcomes this problem of passwords being intercepted and replayed.
Summary of the invention According to the invention, a method of controlling user access to a remote service over a network comprises: (a) performing an initial log-in procedure, in which the user enters a user name and user password over the network, and the service validates the combination of the user name and user password ;
<Desc/Clms Page number 2>
(b) if validation of the combination of the user name and user password is successful, sending a one-time password to the user via a wireless messaging service to a portable device personal to the user; (c) performing a supplementary log-in procedure, in which the user enters the received one-time password over the network, and the service validates the one-time password; (d) if validation of the one-time password is successful, allowing the user to access the service over the network.
In a preferred embodiment of the invention to be described, the network is the Internet, the portable devices are cellular mobile phones, and the one-time passwords are delivered using the short messaging service (SMS).
It will be seen that, by using this method, even if the log-in sequence of user name, user password and one-time password is intercepted and logged, it cannot be subsequently replayed by an unauthorised user. Security depends on the user both knowing the correct user name and user password, and being in possession of their own portable device.
Brief description of the drawings Figure 1 is a schematic block diagram of a distributed computing environment for providing a secure service to a number of users.
Figure 2 shows a form for entering user name and user password.
Figure 3 is a flow chart of a log-in process.
Figure 4 shows a form for entering a one-time password.
<Desc/Clms Page number 3>
Description of an embodiment of the invention One system for allowing a user to log in to a secure service will now be described by way of example with reference to the accompanying drawings.
Figure 1 shows a server computer 10 which runs conventional webserver software 11, and can be accessed over the Internet 12 (or over an in-house intranet) by a number of user computers 13.
The user computers may be conventional personal computers (PCs), running conventional web-browser software.
The server computer 10 also includes application software 14 for providing a secure service. The exact nature of the secure service forms no part of the present invention and so will not be described in detail. The application software 14 includes authentication software 15, for controlling user log-in. The authentication software uses a secure database 16, containing a user name, user password (typically one-way encrypted), and mobile phone number for each registered user.
The server 10 also includes messaging software 17, which has access to the public cellular telephone network 18, and can send text messages to users'mobile phones 19 using the short messaging service (SMS).
Figure 3 shows the log-in process which occurs when a user wishes to access the secure service.
(Step 30) In response to the user typing in the URL of the server, the server returns an initial log-in page to the user's browser, as illustrated in Figure 2. The log-in page requests the user to enter his or her user name and user password. When
<Desc/Clms Page number 4>
the user clicks on the OK button, these are returned to the server. This dialogue is typically secured by using https/SSL.
(Step 31) When the server receives the user name and user password, it validates the user name/password combination, using the information stored in the secure database. If the validation fails, the server returns an appropriate error message to the user. However, assuming that the validation is successful, the server proceeds as follows.
(Step 32) The server looks up the user's mobile phone number in the secure database.
(Step 33) The server then generates a random one-time password, and stores it memory.
(Step 34) The server then sends an SMS message to the user's mobile phone, containing the one-time password.
(Step 35) The server than sends a form to the user's browser, as illustrated in Figure 4. This form requests the user to enter the one-time password. (Note that this form may be received by the user before the SMS message, in which case the user must wait at this point until the SMS message is received). When the user enters the one-time password from the SMS message, and clicks on the OK button, the one-time password is returned to the server.
(Step 36) The server then validates the one-time password against the stored value. If the validation fails, the server returns an appropriate error message to the user, and initiates a predetermined (configurable) lock-out period, to prevent machine-based attacks on the service.
<Desc/Clms Page number 5>
(Step 37) Assuming that the validation of the one-time password was successful, the server then returns an initial service page (home page) to the user, and the user can now start using the service.
It can be seen that the one-time password is different for each log-in, so that even if the log-in sequence of user name, user password and one-time password is intercepted and logged, it cannot be subsequently replayed by an unauthorised user.
Security depends on the user both knowing the correct user name and user password, and being in possession of their own mobile phone.
Another advantage of the system described above is that if some unauthorised person tries to use a user name and password, the user will receive an unexpected SMS message. This will alert them to the fact that someone is trying to gain access to their account, and allow them to immediately inform the service provider.
Some possible modifications It will be appreciated that many modifications may be made to the system as described above. For example, instead of using SMS messages, other forms of text messaging, or even voice messaging, may be used to deliver the one-time passwords. Also, although the system described above was an Internet-based system, the invention would be equally applicable to networks based on other protocols. In another possible modification, instead of generating the one-time passwords randomly on demand, as described above, a set of one-time passwords may be generated in advance, and stored securely in the server until required.
Claims (12)
- Claims 1. A method of controlling user access to a remote service over a network, the method comprising: (a) performing an initial log-in procedure, in which the user enters a user name and user password over the network, and the service validates the combination of the user name and user password; (b) if validation of the combination of the user name and user password is successful, sending a one-time password to the user via a wireless messaging service to a portable device personal to the user ; (c) performing a supplementary log-in procedure, in which the user enters the received one-time password over the network, and the service validates the one-time password; (d) if validation of the one-time password is successful, allowing the user to access the service over the network.
- 2. A method according to Claim 1 wherein said network is the Internet.
- 3. A method according to Claim 1 or 2 wherein said portable device personal to the user comprises a mobile telephone.
- 4. A method according to Claim 3 wherein said wireless messaging service comprises a text messaging service.
- 5. A method according to any preceding claim wherein said onetime password is generated randomly on demand.
- 6. A method of controlling user access to a remote service over a network, substantially as hereinbefore described with reference to the accompanying drawings.<Desc/Clms Page number 7>
- 7. Computer apparatus for providing a remote service over a network, the apparatus comprising: (a) means for prompting a user to enter a user name and user password over said network; (b) means for validating the combination of the user name and user password entered by the user ; (c) means for sending a one-time password to the user via a wireless messaging service to a portable device personal to the user, if validation of the combination of the user name and user password is successful ; (d) means for allowing the user to enter the received one-time password, over said network ; (e) means for validating the one-time password entered by the user ; (d) means for prompting the user to access the service over the network, if validation of the one-time password is successful.
- 8. Computer apparatus according to Claim 7 wherein said network is the Internet.
- 9. Computer apparatus according to Claim 7 or 8 wherein said portable device personal to the user comprises a mobile telephone.
- 10. Computer apparatus according to Claim 9 wherein said wireless messaging service comprises a text messaging service.
- 11. Computer apparatus according to any of Claims 6 to 10 wherein said one-time password is generated randomly on demand.
- 12. Computer apparatus for providing a remote service over a network, substantially as hereinbefore described with reference to the accompanying drawings.
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
GB0120391A GB2379040A (en) | 2001-08-22 | 2001-08-22 | Controlling user access to a remote service by sending a one-time password to a portable device after normal login |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
GB0120391A GB2379040A (en) | 2001-08-22 | 2001-08-22 | Controlling user access to a remote service by sending a one-time password to a portable device after normal login |
Publications (2)
Publication Number | Publication Date |
---|---|
GB0120391D0 GB0120391D0 (en) | 2001-10-17 |
GB2379040A true GB2379040A (en) | 2003-02-26 |
Family
ID=9920799
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
GB0120391A Withdrawn GB2379040A (en) | 2001-08-22 | 2001-08-22 | Controlling user access to a remote service by sending a one-time password to a portable device after normal login |
Country Status (1)
Country | Link |
---|---|
GB (1) | GB2379040A (en) |
Cited By (23)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
GB2400193A (en) * | 2003-03-29 | 2004-10-06 | Hewlett Packard Development Co | Method of authenticating a log-on request |
WO2004111809A1 (en) * | 2003-06-18 | 2004-12-23 | Telefonaktiebolaget Lm Ericsson (Publ) | An arrangement and a method relating to ip network access |
WO2005081489A1 (en) * | 2004-02-10 | 2005-09-01 | James Andrew Groves | Improved secure web site access method and system |
WO2006013218A1 (en) * | 2004-07-05 | 2006-02-09 | Bankinter S.A. | Method for obtaining cash at cardless teller machines, using a payment order via sms |
WO2006026098A1 (en) * | 2004-08-27 | 2006-03-09 | Electronics For Imaging, Inc. | Methods and apparatus for providing access to content |
GB2428838A (en) * | 2005-08-03 | 2007-02-07 | Agilent Technologies Inc | Synchronization of test data flows |
EP1752900A1 (en) | 2005-07-18 | 2007-02-14 | Capricorp Limited | Website content access control system |
CN100334850C (en) * | 2003-09-10 | 2007-08-29 | 华为技术有限公司 | A method for implementing access authentication of wireless local area network |
EP1868125A1 (en) * | 2006-06-16 | 2007-12-19 | Savernova S.A. | Method for identifying a user of a computer system |
EP2106099A1 (en) | 2008-03-28 | 2009-09-30 | Hitachi Ltd. | Authentication server, authentication system, and authentication method |
WO2010052332A1 (en) * | 2008-11-10 | 2010-05-14 | Sms Passcode A/S | Method and system protecting against identity theft or replication abuse |
WO2011032596A1 (en) * | 2009-09-18 | 2011-03-24 | Bankgirocentralen Bgc Ab | Electronic transfer of money |
EP1914657A3 (en) * | 2006-10-19 | 2011-11-30 | Fuji Xerox Co., Ltd. | Authentication system, authentication-service-providing device, authentication-service-providing method, and program |
US8132230B2 (en) * | 2004-11-09 | 2012-03-06 | Konica Minolta Business Technologies, Inc. | Image processor |
EP2146312A4 (en) * | 2007-04-26 | 2012-04-04 | Logalty Servicios De Tercero De Confianza S L | Method and system for notarising electronic transactions |
EP2512090A1 (en) * | 2011-04-14 | 2012-10-17 | Telefónica Germany GmbH & Co. OHG | Method for authenticating a subscriber |
EP2560340A1 (en) * | 2011-08-16 | 2013-02-20 | Veritrix, Inc. | Methods and system for the secure use of one-time passwords |
US8516562B2 (en) | 2008-05-13 | 2013-08-20 | Veritrix, Inc. | Multi-channel multi-factor authentication |
US8555066B2 (en) | 2008-07-02 | 2013-10-08 | Veritrix, Inc. | Systems and methods for controlling access to encrypted data stored on a mobile device |
WO2014011131A2 (en) | 2012-07-12 | 2014-01-16 | Sestek Ses Ve Iletisim Bilgisayar Teknolojileri Sanayii Ve Ticaret Anonim Sirketi | A method enabling verification of the user id by means of an interactive voice response system |
EP2940619A1 (en) * | 2014-04-28 | 2015-11-04 | Alcatel Lucent | Access control with authentication |
US9311466B2 (en) | 2008-05-13 | 2016-04-12 | K. Y. Trix Ltd. | User authentication for social networks |
US9344419B2 (en) | 2014-02-27 | 2016-05-17 | K.Y. Trix Ltd. | Methods of authenticating users to a site |
Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO1995019593A1 (en) * | 1994-01-14 | 1995-07-20 | Michael Jeremy Kew | A computer security system |
EP1107089A1 (en) * | 1999-12-11 | 2001-06-13 | Connectotel Limited | Strong authentication method using a telecommunications device |
US6259909B1 (en) * | 1997-05-28 | 2001-07-10 | Telefonaktiebolaget Lm Ericsson (Publ) | Method for securing access to a remote system |
-
2001
- 2001-08-22 GB GB0120391A patent/GB2379040A/en not_active Withdrawn
Patent Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO1995019593A1 (en) * | 1994-01-14 | 1995-07-20 | Michael Jeremy Kew | A computer security system |
US6259909B1 (en) * | 1997-05-28 | 2001-07-10 | Telefonaktiebolaget Lm Ericsson (Publ) | Method for securing access to a remote system |
EP1107089A1 (en) * | 1999-12-11 | 2001-06-13 | Connectotel Limited | Strong authentication method using a telecommunications device |
Cited By (41)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
GB2400193A (en) * | 2003-03-29 | 2004-10-06 | Hewlett Packard Development Co | Method of authenticating a log-on request |
WO2004111809A1 (en) * | 2003-06-18 | 2004-12-23 | Telefonaktiebolaget Lm Ericsson (Publ) | An arrangement and a method relating to ip network access |
US8108903B2 (en) | 2003-06-18 | 2012-01-31 | Telefonaktiebolaget Lm Ericsson (Publ) | Arrangement and a method relating to IP network access |
CN100388151C (en) * | 2003-06-18 | 2008-05-14 | 艾利森电话股份有限公司 | An arrangement and a method relating to IP network access |
CN100334850C (en) * | 2003-09-10 | 2007-08-29 | 华为技术有限公司 | A method for implementing access authentication of wireless local area network |
WO2005081489A1 (en) * | 2004-02-10 | 2005-09-01 | James Andrew Groves | Improved secure web site access method and system |
MD3964C2 (en) * | 2004-07-05 | 2010-04-30 | Bankinter А.О. | Method for withdrawal of cash at cash dispensers without a card, by means of a payment order via SMS |
WO2006013218A1 (en) * | 2004-07-05 | 2006-02-09 | Bankinter S.A. | Method for obtaining cash at cardless teller machines, using a payment order via sms |
US8725640B2 (en) | 2004-07-05 | 2014-05-13 | Bankinter | Method for the withdrawal of funds at cash dispensers without a card, by means of a payment order via SMS |
AU2004322079B2 (en) * | 2004-07-05 | 2010-10-07 | Helena Activos Liquidos S.L | Method for obtaining cash at cardless teller machines, using a payment order via SMS |
US8171103B2 (en) | 2004-08-27 | 2012-05-01 | Electronics For Imaging, Inc. | Methods and apparatus for providing access to content |
WO2006026098A1 (en) * | 2004-08-27 | 2006-03-09 | Electronics For Imaging, Inc. | Methods and apparatus for providing access to content |
EP3185150A1 (en) * | 2004-08-27 | 2017-06-28 | Electronics for Imaging, Inc. | Methods and apparatus for providing access to content |
US8484316B2 (en) | 2004-08-27 | 2013-07-09 | Electronics For Imaging, Inc. | Methods and apparatus for providing access to content |
US8132230B2 (en) * | 2004-11-09 | 2012-03-06 | Konica Minolta Business Technologies, Inc. | Image processor |
EP1752900A1 (en) | 2005-07-18 | 2007-02-14 | Capricorp Limited | Website content access control system |
GB2428838A (en) * | 2005-08-03 | 2007-02-07 | Agilent Technologies Inc | Synchronization of test data flows |
GB2428838B (en) * | 2005-08-03 | 2011-06-22 | Agilent Technologies Inc | Multisided synchronization of execution in a wireless test environment |
US7536280B2 (en) | 2005-08-03 | 2009-05-19 | Agilent Technologies, Inc. | Multisided synchronization of execution in a wireless test environment |
DE102006028311B4 (en) * | 2005-08-03 | 2012-08-30 | Agilent Technologies, Inc. (N.D.Ges.D. Staates Delaware) | Multi-page synchronization of a run in a wireless test environment |
EP1868125A1 (en) * | 2006-06-16 | 2007-12-19 | Savernova S.A. | Method for identifying a user of a computer system |
EP1914657A3 (en) * | 2006-10-19 | 2011-11-30 | Fuji Xerox Co., Ltd. | Authentication system, authentication-service-providing device, authentication-service-providing method, and program |
EP2146312A4 (en) * | 2007-04-26 | 2012-04-04 | Logalty Servicios De Tercero De Confianza S L | Method and system for notarising electronic transactions |
EP2106099A1 (en) | 2008-03-28 | 2009-09-30 | Hitachi Ltd. | Authentication server, authentication system, and authentication method |
US8516562B2 (en) | 2008-05-13 | 2013-08-20 | Veritrix, Inc. | Multi-channel multi-factor authentication |
US9311466B2 (en) | 2008-05-13 | 2016-04-12 | K. Y. Trix Ltd. | User authentication for social networks |
US8555066B2 (en) | 2008-07-02 | 2013-10-08 | Veritrix, Inc. | Systems and methods for controlling access to encrypted data stored on a mobile device |
WO2010052332A1 (en) * | 2008-11-10 | 2010-05-14 | Sms Passcode A/S | Method and system protecting against identity theft or replication abuse |
JP2012508410A (en) * | 2008-11-10 | 2012-04-05 | エスエムエス・パスコード・エ/エス | Method and system for protecting against unauthorized use using identity theft or duplication |
US8893243B2 (en) | 2008-11-10 | 2014-11-18 | Sms Passcode A/S | Method and system protecting against identity theft or replication abuse |
WO2011032596A1 (en) * | 2009-09-18 | 2011-03-24 | Bankgirocentralen Bgc Ab | Electronic transfer of money |
EP2512090A1 (en) * | 2011-04-14 | 2012-10-17 | Telefónica Germany GmbH & Co. OHG | Method for authenticating a subscriber |
US8474014B2 (en) | 2011-08-16 | 2013-06-25 | Veritrix, Inc. | Methods for the secure use of one-time passwords |
EP2560340A1 (en) * | 2011-08-16 | 2013-02-20 | Veritrix, Inc. | Methods and system for the secure use of one-time passwords |
WO2014011131A2 (en) | 2012-07-12 | 2014-01-16 | Sestek Ses Ve Iletisim Bilgisayar Teknolojileri Sanayii Ve Ticaret Anonim Sirketi | A method enabling verification of the user id by means of an interactive voice response system |
US9344419B2 (en) | 2014-02-27 | 2016-05-17 | K.Y. Trix Ltd. | Methods of authenticating users to a site |
WO2015165691A1 (en) * | 2014-04-28 | 2015-11-05 | Alcatel Lucent | Access control with authentication |
CN106255971A (en) * | 2014-04-28 | 2016-12-21 | 阿尔卡特朗讯公司 | The access with certification controls |
EP2940619A1 (en) * | 2014-04-28 | 2015-11-04 | Alcatel Lucent | Access control with authentication |
CN106255971B (en) * | 2014-04-28 | 2019-11-29 | 阿尔卡特朗讯公司 | Method and application server for being verified via user of the CD to access ACD |
US10893040B2 (en) | 2014-04-28 | 2021-01-12 | Alcatel Lucent | Access control with authentication |
Also Published As
Publication number | Publication date |
---|---|
GB0120391D0 (en) | 2001-10-17 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
GB2379040A (en) | Controlling user access to a remote service by sending a one-time password to a portable device after normal login | |
US9979719B2 (en) | System and method for converting one-time passcodes to app-based authentication | |
KR101381789B1 (en) | Method for web service user authentication | |
EP3008935B1 (en) | Mobile device authentication in heterogeneous communication networks scenario | |
EP2166697B1 (en) | Method and system for authenticating a user by means of a mobile device | |
CN101495956B (en) | Extended one-time password method and apparatus | |
CA2665832C (en) | Method and system for authenticating a user of a mobile device | |
US8826398B2 (en) | Password changing | |
EP2258094B1 (en) | Devolved authentication | |
US8474014B2 (en) | Methods for the secure use of one-time passwords | |
CA2665961C (en) | Method and system for delivering a command to a mobile device | |
US9635022B2 (en) | Method of allowing establishment of a secure session between a device and a server | |
NZ541711A (en) | Human factors authentication using abstract definitions of viewable or audible objects | |
EP2041913A1 (en) | An authentication system and process | |
US20210234850A1 (en) | System and method for accessing encrypted data remotely | |
JP5085605B2 (en) | Server, method and program for managing logins | |
Aravindhan et al. | One time password: A survey | |
CN112910867A (en) | Double verification method for trusted equipment to access application | |
JP2007516512A5 (en) | ||
EP1387239B1 (en) | Secure messaging | |
KR101537097B1 (en) | Otp certification method using the sms and system thereof | |
JP2010517121A5 (en) | ||
EP1919157A1 (en) | Authentication based on a single message | |
JP2005115743A (en) | Automatic authentication system for information communication terminal using cellular phone and code | |
JP2002251375A (en) | User authentication server in communication network, individual authentication method and program |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
WAP | Application withdrawn, taken to be withdrawn or refused ** after publication under section 16(1) |