RU2731651C1 - Method and system of user authorization - Google Patents

Abstract

FIELD: computer equipment.

SUBSTANCE: invention relates to the computer equipment. User authentication method performed by at least one computing device comprises steps of: receiving a request for user authentication; obtaining data on type of authentication selected by user, and single user account identifier (ID); recording user authentication operation and generating an operation identifier; generating QR-code, which includes information on operation identifier, and assigning corresponding status to it; tracking QR code status; based on the QR code status data determining that the user authentication operation is confirmed by the user, after which operation ID of single user account is stored in operation parameters and user is authenticated by ID of single user account.

EFFECT: technical result is enabling tracking QR-code status.

5 cl, 2 dwg

Description

FIELD OF TECHNOLOGY

[1] This technical solution generally relates to the field of computer technology, and in particular to the method and system for authorizing a user on a website using a QR code.

LEVEL OF TECHNOLOGY

[2] Currently, users who enter their credentials to log in to a website using unsecured devices face the risk of disclosing their credentials to unauthorized persons. Therefore, a user input method is required to log in to websites that does not require input of confidential information. Also, in some cases, users may find it difficult to manually enter credentials, for example, on devices with limited input capabilities.

[3] The closest technical solution to the claimed solution is the system and method disclosed in the application US 2015089610 (A1), publ. 03/26/2015 allowing the user to use a trusted device to provide confidential information to the identity provider using a QR code (Quick Response) so that the identity provider can access the website or collect information for the website. In the known solution, a user can securely authorize a website from an unsecured device by entering confidential information into a trusted device. An identity provider can generate a QR code to display on a website on an unsecured device. A user can scan a QR code using an application from an ID provider installed on a trusted device to transmit the QR code to the ID provider. An identity provider can validate a QR code and obtain credentials to authenticate a user, or can collect information for a website. Advantageously, a user can securely log into a website from untrusted devices using a trusted device.

[4] The disadvantage of the known solution is its limited functionality, for example, the known solution lacks the function of tracking the status of the QR code, and therefore reduces the reliability of the system.

ESSENCE OF THE TECHNICAL SOLUTION

[5] The technical problem or task posed in this technical solution is the creation of a simple and reliable method and system for authorizing a user in a resource system through authentication using a QR code.

[006] The technical result achieved when solving the above technical problem is to provide the ability to track the status of the QR code to determine the confirmation by the user of the authentication operation and its authentication. An additional technical result is the ability to cancel the login from an unreliable device after scanning the QR code.

[7] The specified technical result is achieved due to the implementation of the method of user authentication, performed by at least one computing device, containing the stages, which are: receive a request for user authentication; get data on the type of authentication selected by the user, and the identifier (ID) of a single user account; register an authentication operation and generate an operation identifier; generate a QR code, which includes information about the operation identifier and assign it a corresponding status; track the status of the QR code; based on the data on the status of the QR code, it is determined that the operation is confirmed by the user, and the ID of the single user account is stored in the operation parameters; authenticate the user by the ID of a single user account.

[8] In one of the particular examples of implementation of the method, the steps are additionally performed, at which: based on the data on the status of the QR code, it is determined that the QR code has been scanned by the user; send a request to the user to confirm the authentication operation.

[9] In another particular embodiment of the method, the following steps are additionally performed, at which: a request for an authorization code is received from a partner device, the request parameters of which include the resource system account ID; generate authorization code data and send it to the resource system; receive an access code request from the resource system, the parameters of which include the authorization code data and the resource system account ID; authorizing the resource system based on the results of checking the authorization code data sent to the resource system and the authorization code data received from the resource system; send to the resource system an access code containing the ID of a single user account.

[10] In another particular embodiment of the method, the steps are additionally performed, which include: include in the authorization code request parameters a parameter for preventing cross-site request forgery, generated by the resource system device, and the generated authorization code data is redirected to the user along with the parameter for preventing cross-site request forgery; obtaining authorization code data and a parameter for preventing cross-site request forgery from the user through the resource system device; Based on the comparison results of the cross-site request forgery prevention parameter generated by the resource system device and the said parameter received from the user, a request for obtaining an access code is formed, in which authorization code data is included.

[11] In another preferred embodiment of the claimed solution, a user authentication system is provided comprising at least one computing device and at least one memory device containing machine-readable instructions that, when executed by at least one computing device, perform the above method.

BRIEF DESCRIPTION OF DRAWINGS

[12] Features and advantages of the present invention will become apparent from the following detailed description of the invention and the accompanying drawings, in which:

FIG. 1 shows an example of a user authorization system.

FIG. 2 is an example of a general view of a computing device.

DETAILED DESCRIPTION OF THE INVENTION

[1] Below will be described the concepts and terms necessary to understand this technical solution.

[2] In this technical solution, a system means, including a computer system, a computer (electronic computer), CNC (numerical control), PLC (programmable logic controller), computerized control systems and any other devices capable of performing a given , a well-defined sequence of operations (actions, instructions).

[3] A command processing device means an electronic unit, a computing device, or an integrated circuit (microprocessor) that executes machine instructions (programs).

[4] A command processor reads and executes machine instructions (programs) from one or more storage devices. Data storage devices can include, but are not limited to, hard drives (HDD), flash memory, ROM (read only memory), solid state drives (SSD), optical drives.

[5] Program - a sequence of instructions intended for execution by a computer control device or a command processing device.

[6] Referring to the diagram in FIG. 1, the user authorization system 100 comprises: user devices 10, a resource system 20 (eg, a partner device or other automated system (AS)), a user authentication device 30, and a user authentication request processing device 40.

[7] User devices can be: device 11 interaction with the site and device 12 of the mobile application. In a particular implementation of the solution, the device 11 for interacting with the site can be, for example, a laptop or stationary computer, a mobile phone or a smartphone, a tablet, etc., equipped with an application software-browser, which provides the ability to: view web pages, the content of web documents , computer files and their catalogs; web application management; as well as for solving other problems. The mobile application device 12 is a computing device that is configured to work with various types of mobile applications, for example, the Sberbank-online mobile application, and is equipped with means, for example, a photo and / or video camera, to capture images, in particular QR images. code. For example, mobile application device 12 may be a mobile phone, smartphone, or tablet. To use the application on the said device 12, the user needs to be authorized by the identifier (ID) of a single user account. The user can obtain said ID of a unified account by registering through said application or others known from the prior art from the provider of this application, which generates (ID) of a unified user account and sends it to said storage device 12.

[8] The resource system 20 integrates information, financial, material, labor resources with the necessary fixed assets that ensure the life cycle of products: materials - products - goods. The purpose of the resource system 20 is to process materials into a product that is required by the user. The task of this system is to ensure decision-making regarding the development of a managed object - an integrated resource based on new computer technologies (see O.S. Grigorov et al., MANAGEMENT OF BUSINESS POTENTIAL OF PRODUCTION SYSTEMS, Novosibirsk 2002, 56 pp., Http: // window .edu.ru / resource / 799/37799 / files / m bus1.pdf). The resource system 20 can be implemented on the basis of at least one server configured to provide the user with the device 11 through a website of various types of services. The resource system 20, in the particular case of its implementation, contains: a module 21 for processing user requests and a routing module 22. These modules can be implemented on the basis of the software and hardware of the resource system 20, modified in the software part in such a way as to perform the functions assigned to these modules below.

[9] The user authentication device 30 and the user authentication request processing device 40 may also be implemented on the basis of at least one server, the user authentication device 30 may comprise a user communication module 31 and an authentication module 32, and the request processing device 40 for user authentication may include: database 41 (DB) and module 42 processing requests for authentication. These modules can also be implemented on the basis of the firmware of the device 30 and the device 40, respectively, modified in the software part in such a way as to perform the functions assigned to these modules below.

[10] Accordingly, the user, through the device 11 for interacting with the website, in particular with the help of a browser, can go to the resource system 20, for example, by visiting the website of the resource system 20 or installing an appropriate application, to view its contents, information about which is sent to the device 11 by the resource system 20. For example, the user can be displayed information about the services provided by the resource system 20 (obtaining a mortgage, a catalog of goods, providing information about the status of accounts and cards, making payments, etc.), and the user can device 11 to send a request to receive at least one service provided by the resource system 20.

[11] In the process of generating a request for a service, or at any other time, for example, when entering the resource system 20 (ie, authorization), the user can send an authorization request to the resource system 20 for presentation to him (the user) additional functions provided for authorized users of the resource system 20. To enter the resource system 20, the user can use a single account for authentication on a plurality of unrelated Internet resources, information about which is contained in the database 41 of the user authentication device 40, for example, as a UID. For this, the user through the device 11 interacts with the resource system 20 by sending a corresponding command / request for authorization, which is sent to the module 21 for processing user requests of the resource system 20.

[12] For example, in the case of logging into the website of the resource system 20 using the OIDC (Open ID Connect) protocol upon receipt of an authorization request, the request processing module 21 sends a request to the routing module 22 to obtain a parameter that protects against cross-site forgery (State) and a parameter that protects against copying requests (Nonce). The routing module 22 generates the specified parameters using methods known from the prior art, creates an authorization operation, stores the State and Nonce values in the operation parameters, and then returns the specified parameters and the authorization operation identifier to the module 21. Module 21 stores in memory, which it can be additionally equipped with , the identifier of the authorization operation and sends the request for the authorization code (AUTHCODE) to the module 31 of communication with the user, sending in the request State, Nonce, the URI reference to which the user should be returned after successful authentication (REDIRECT_URI), and the identifier (ID) of the resource system. Also, the resource system ID, the resource system password and REDIRECT_URI can be pre-entered into the database 41 when registering the resource system 20 in the device 40 for processing requests for user authentication.

[13] The authentication module 31 validates the parameters of the authorization code request (AUTHCODE) by methods known from the prior art and, in case of successful verification, sends an authentication form to the site interaction device 11, which is displayed to the user. When the user selects authentication using a QR code, the authentication module 31 receives data about the type of authentication - authentication using a QR code (PAT_QR) from the device 11, after which the said module 31 generates and sends a user authentication request to receive a QR code to the module 42 processing requests. In the request, the aforementioned module 31 sends data about the type of authentication (PAT_QR), State, Nonce, resource system ID, REDIRECT_URI (hereinafter referred to as OIDC parameters), as well as the IP address, browser name and operating system of the user's computer, collected by methods known from the prior art. The module 42 for processing requests upon receipt of the user's authentication request registers the authentication operation in the database 41, generates the operation identifier (QRID), stores the data received from the module 31 together with the operation identifier and assigns the status to the operation "New", after which the module 42 generates a QR code, which includes information about the operation identifier.

[14] The generated QR code and the operation identifier are sent by the request processing unit 42 to the user communication unit 31 for transmission and output on the website interaction device 11. Also, the module 31, in accordance with the firmware algorithm installed by the user of the device 30, periodically accesses the database 41 through the request processing module 42 to obtain the current status of the authentication operation by sending an operation identifier (QRID) in the status check request.

[15] Further, for authorization in the resource system 20, the user needs to run the application on the device 12 of the mobile application, using methods known from the prior art, to authorize in the application using the ID of a single user account, after which, using the mobile application and device 12 of the mobile application, the user needs to scan the image displayed on the website interaction device 11. Upon receiving an image of a QR code, the device 12 extracts the operation identifier (QRID) from it and sends it to the request processing module 42, which upon receiving the operation identifier (QRID) changes the "New" status for the given operation identifier (QRID) in the database 41 to the status "Scanned", after which the module 42 extracts from the database 41 information about the operation, including its identifier (QRID), and returns it to the module 12 of the mobile application.

[16] Next, through the mobile application device 12, the user confirms the operation by sending an authentication confirmation request to the request processing unit 42 with an operation identifier (QRID) and an operation status of “Confirmed”. Additionally, in the request for confirmation of authentication, said device 12 includes the ID of a single user account. Also, additionally, the user known from the prior art can sign the said request with his digital signature, information about which is stored in the said device 12.

[17] The module 42 for processing requests changes the status for the given operation identifier (QRID) in the database 41 to the status "Confirmed" and saves the ID of the single user account in the parameters of the authentication operation. Accordingly, when the user communication module 31, when accessing the database 41 through the request processing module 42, determined that the operation identifier (QRID) has the "Confirmed" status, the user communication module 31 sends an operation identifier (QRID) in the request to the module 42 for receiving authorization code AUTHCODE, REDIRECT_URI and State saved for the given operation identifier (QRID) in the database 41.

[18] Upon receipt of the authorization code request from the user communication module 31, the module 42 authenticates the user from whom the authentication request was previously received with the same operation identifier (QRID), and returns by means of the module 31 to the device 11 for interacting with the website AUTHCODE, REDIRECT_URI and State. According to REDIRECT_URI, the device 11 for interacting with the website is redirected to the resource system 20 of the partner's site, after which the device 11 sends AUTHCODE and State to the module 21 for processing user requests.

[19] Module 21 processing user requests, having received AUTHCODE and State, transmits them to module 22 routing in conjunction with the value of the current user authorization in the resource system. The routing unit 22 compares the State value received from the unit 21 with the State value stored in the previously generated authorization operation data. If the values match, then the user request processing module 22 sends a request to the authentication module 32 to obtain an access code, which includes: the obtained AuthCode value, the resource system ID, the resource system password, REDIRECT_URI (the same URI that was sent in the request for authorization code).

[20] Authentication module 32 verifies AuthCode by comparison with AuthCode, which was previously sent by module 31 to website interaction device 11, resource system identifier and resource system password, and then authorizes the resource system based on the results of verification of authorization code data directed resource system, and authorization code data received from the resource system, and issues Access_Token (access code) and ID_TOKEN (a set of user data that is necessary to identify a user in the resource system, including the external user ID of the bank AS (sub) transmitted by the external consumers, generated based on the single user account ID extracted from the parameters of the authentication operation, as well as the Nonce parameter). The routing module 22, having received the ID_TOKEN, checks the Nonce value, which is stored in the parameters of the user operation with the one received in ID_TOKEN. If the values match, then the routing module 22 identifies the client by the external user ID of the AC bank (sub) obtained in ID_TOKEN. Next, the routing module 22 authorizes the user and returns to the module 21 a page for displaying to the user, which is redirected to the device 11 for interacting with the website. Thus, the user of the device 11 for interacting with the website gets authorized access to the resource system 20.

[21] In general (see Fig. 2), the computing device contains one or more processors (201), combined by a common data exchange bus, memory means such as RAM (202) and ROM (203), input / output interfaces (204 ), input / output devices (205), and a device for networking (206).

[22] The processor (201) (or multiple processors, multi-core processor, etc.) can be selected from a range of devices currently widely used, for example, manufacturers such as: Intel ™, AMD ™, Apple ™, Samsung Exynos ™, MediaTEK ™, Qualcomm Snapdragon ™, etc. Under the processor or one of the processors used in the system (200), it is also necessary to take into account a graphics processor, for example, an NVIDIA GPU with a CUDA compliant programming model, or Graphcore, the type of which is also suitable for full or partial execution of the method, and can also be used for training and application of machine learning models in various information systems.

[23] RAM (202) is a random access memory and is intended for storing machine-readable instructions executed by the processor (201) for performing the necessary operations for logical data processing. RAM (202), as a rule, contains executable instructions of the operating system and corresponding software components (applications, software modules, etc.). In this case, the available memory of the graphics card or graphics processor can act as RAM (202).

[24] ROM (203) is one or more persistent storage devices, such as a hard disk drive (HDD), solid state data storage device (SSD), flash memory (EEPROM, NAND, etc.), optical storage media ( CD-R / RW, DVD-R / RW, BlueRay Disc, MD), etc.

[25] Various types of I / O interfaces (204) are used to organize the operation of system components (200) and to organize the operation of external connected devices. The choice of the appropriate interfaces depends on the specific version of the computing device, which can be, but are not limited to: PCI, AGP, PS / 2, IrDa, FireWire, LPT, COM, SATA, IDE, Lightning, USB (2.0, 3.0, 3.1, micro, mini, type C), TRS / Audio jack (2.5, 3.5, 6.35), HDMI, DVI, VGA, Display Port, RJ45, RS232, etc.

[26] To ensure user interaction with the computing system (200), various means (205) of I / O information are used, for example, a keyboard, display (monitor), touch display, touch-pad, joystick, mouse manipulator, light pen, stylus, touch panel, trackball, speakers, microphone, augmented reality, optical sensors, tablet, light indicators, projector, camera, biometric identification (retina scanner, fingerprint scanner, voice recognition module), etc.

[27] The networking tool (206) provides data transmission via an internal or external computer network, for example, Intranet, Internet, LAN and the like. One or more means (206) can be used, but not limited to: Ethernet card, GSM modem, GPRS modem, LTE modem, 5G modem, satellite communication module, NFC module, Bluetooth and / or BLE module, Wi-Fi module, and dr.

[28] Additionally, satellite navigation aids can be used as part of the system (200), for example, GPS, GLONASS, BeiDou, Galileo.

[29] The specific choice of elements of the device (200) for the implementation of various software and hardware architectural solutions can vary while maintaining the required functionality provided.

[30] Modifications and improvements to the above-described embodiments of the present technical solution will be apparent to those skilled in the art. The foregoing description is provided by way of example only and is not intended to be limiting. Thus, the scope of the present technical solution is limited only by the scope of the attached claims.

Claims (21)

1. A method for user authentication performed by at least one computing device, comprising the steps of: - receive a request for user authentication; - receive data on the type of authentication, selected by the user, and the identifier (ID) of a single user account; - register the user authentication operation and form the operation identifier; - generate a QR code, which includes information about the operation identifier, and assign it the corresponding status; - track the status of the QR code; - based on the data on the status of the QR code, it is determined that the user authentication operation is confirmed by the user, after which the ID of the unified user account is stored in the operation parameters and the user is authenticated by the ID of the unified user account. 2. The method according to claim 1, characterized in that the steps are additionally performed, at which: - based on the data on the status of the QR code, it is determined that the QR code has been scanned by the user; - send a request to the user to confirm the authentication operation. 3. The method according to claim 1, characterized in that after receiving the request for the authorization code, the following steps are additionally performed: - receive from the partner device a request for an authorization code, the request parameters of which include the resource system account ID; - generate authorization code data and send it to the resource system; - receive an access code request from the resource system, the parameters of which include the authorization code data and the resource system account ID; - authorize the resource system based on the results of checking the authorization code data sent to the resource system and the authorization code data received from the resource system; - send to the resource system an access code containing the ID of a single user account. 4. The method according to claim 3, characterized in that the steps are additionally performed at which: - include in the request parameters of the authorization code a parameter for preventing cross-site request forgery, generated by the resource system device, and the generated authorization code data is redirected to the user together with the parameter for preventing cross-site request forgery; - receiving authorization code data and a parameter for preventing cross-site request forgery from the user via the resource system device; - based on the results of the comparison of the parameter for preventing cross-site requests forgery, generated by the resource system device and the said parameter received from the user, a request for obtaining an access code is formed, in which the authorization code data is included. 5. User authentication system containing at least one computing device and at least one memory device containing machine-readable instructions that, when executed by at least one computing device, perform the method according to any one of claims. 1-4.

Images