RU2786176C2 - Method and system for multichannel user authorization - Google Patents

Abstract

FIELD: communication.

SUBSTANCE: invention relates to a system and methods for provision of user authorization on an access resource. The authorization system contains a user device and an access resource, connected with a data transmission channel, the access resource is connected to an authentication system. The user device forms a request for user authorization on the access resource and receives a response from the authentication system. The access resource receives the user request for authorization and transmits to the authentication system, which contains data on available mobile channels of authorization for access resources, as well as user authorization data for each of available mobile channels. The authentication system provides authorization on the resource, using mobile channels on the mobile user device, wherein the authentication system checks available mobile channels for the user and prioritizes mobile channels for user authorization with subsequent sending of the request to the most priority mobile channel.

EFFECT: simplification of authorization on an access resource.

18 cl, 12 dwg

Description

Technical field

[0001] The present solution relates to a system and methods for providing authorization of users through a computer network, in particular, using mobile authorization, in which a user can be granted access in a variety of mobile channels.

State of the art

[0002] The existing problem is that the user needs to remember their logins and passwords to many different data sources, while the resource costs for user support and login/password recovery are quite high in the implementation of various business systems and products. Moreover, any additional actions on the part of the user to remember or recover passwords lead to a decrease in the level of use of software products, especially when it comes to cases that are not critical for life / work, such as service applications or e-commerce.

[0003] Various implementations of security algorithms exist and are well known, with varying degrees of protection, that solve the problem of having to remember or recover logins/passwords. Starting from the storage of login data in browsers and from authentication through third-party services (for example, through Google or Facebook, VK, Single SignOn (SSO) solutions) and up to separate "password safe" applications. Some of these methods also collect user data, which is often not liked by users. Other known implementations to solve this problem include methods that require the installation of additional software produced and controlled by a third party (for example, Google Authenticator or one of many similar ones) or require expensive technological operations, for example, sending a CMC message with a verification code, e-mail confirmation etc. Moreover, these security methods require many additional actions on the part of the user, which is undesirable for fast and accurate business operations, especially in the case of the aforementioned non-critical software, such as service or e-commerce.

[0004] Another problem is that the existing methods of implementation described above are very different from each other, depending on the form factor of delivering the required data to the user. For example, between a browser on a computer, an application installed on a computer, an application installed on a mobile device, a browser on a mobile device, or other form of delivery factors.

[0005] Thus, each user must know different authentication methods and remember which one he specifically uses on a particular data source (software), which again reduces the usefulness of the data source, since if the user forgets how to log in, he often stops using this source .

[0006] Solutions are also known based on the principle of authorization using the OAuth (Open Authorization) protocol, which is an open authorization protocol that allows you to provide a third party with limited access to protected user resources without having to transfer login and password to it (third party). Such solutions are, for example, disclosed in such sources as: US 20160028737, US20160330199, WO2014130141.

[0007] The disadvantage of existing approaches is the lack of providing multi-channel user authorization through the use of mobile channels, which the user himself can assign to interact with one or more resources interacting within the multi-channel platform (system). Also, the disadvantage is that for each type of access form factor, its own authorization method is used, which increases the laboriousness of authentication processes, in particular, the increase in time to perform the necessary actions for authorization.

Disclosure of invention

[0008] This solution uses only technologies already installed in the technical perimeter of the user (for example, on his mobile device) and solves the same tasks that all the above approaches strive to solve, but with a high level of security and with a minimum number of actions on the user's side, which greatly simplifies the process of its authorization on the access resource.

[0009] The present solution allows the user to use fewer authentication methods for different forms of data access factors, that is, the user can always use the same mobile authentication method for all forms of data access factors, as well as assign a preferred authorization method to various resources access. Also, the claimed solution provides the possibility of using different access channels for a given access resource.

[0010] The authorization mechanism of the present solution can be both part of the first factor authentication for accessing data directly from the mobile device, and the second authentication factor, in which data on one device is accessed through another mobile device or on the same device, but from another authentication channel. The mentioned mechanism can also work as a hybrid of the 1st and 2nd authentication factors on the same or different form factors, in cases where the authorization of the first factor failed or required additional proof (second factor) from another authentication channel.

[0011] The above authorization channels may include, for example, an icon on the screen of a mobile device (installed or in the form of a PWA, with or without permission to push notifications), mobile instant messaging services (messengers and bots in messengers), sms, e-mail , VOIP systems, QR codes and other channels.

[0012] In a preferred embodiment of the claimed solution, a user authorization system is presented, comprising a user device and an access resource associated with an authentication system, connected by a data transmission channel, in which:

a user device configured to generate an authorization request on an access resource using at least one mobile channel that is associated with said device;

the access resource is configured to receive a user request for authorization and send the corresponding request to the authentication system; and

an authentication system that authorizes a user on said resource using at least one mobile channel associated with the user's device.

[0013] In a particular implementation case, a mobile channel is a software application or a graphical user interface element.

[0014] In another particular implementation, the application is a messenger.

[0015] In another particular case of implementation, the authentication system contains data about the available authorization channels for each of the access resources.

[0016] In another particular implementation, the authentication system stores user authorization data for each of the available mobile channels.

[0017] In another particular implementation, the authorization request contains at least information identifying the user.

[0018] In another particular implementation, the request additionally contains the access data of the selected mobile channel.

[0019] In another particular implementation, the authorization request is encrypted on the user's device and decrypted in the authentication system.

[0020] In another particular case of implementation, the authentication system additionally sends an authorization confirmation request to the mobile channel of the user's device.

[0021] In another particular case of implementation, the authentication system authorizes the user on the resource based on receiving a response from the mobile channel of the user's device.

[0022] In another particular implementation, upon receiving a request from the user's device for authorization, the authentication system checks for available mobile channels for the user.

[0023] In another particular implementation, the authentication system prioritizes mobile channels for user authorization.

[0024] In another particular implementation, the authentication system generates a request to the user's mobile channel with the highest priority.

[0025] In another particular implementation, user authorization is performed through additional verification.

[0026] In another particular implementation, the additional verification is a biometric verification, a pin code, a graphic code, an audio code, or combinations thereof.

[0027] In another particular implementation, the data link is selected from the Internet, Intranet, LAN, Ethernet, TCP/IP, WAN, WLAN, MAN, CAN, SAN, PAN, Wi-Fi, Wi-Fi Direct, LPWAN, GSM, GPRS, LTE, 5G, Bluetooth, BLE, IrDa, NFC, satellite, or combinations thereof.

[0028] In another particular implementation, the access resource is a website or software application.

[0029] In another particular implementation, the user's device is a personal computer, smartphone, laptop, tablet, game console, or smart wearable device.

[0030] In another particular implementation case, the smart wearable device is selected from the group: smart watch, smart bracelet, smart ring, augmented reality tools, mixed reality tools, virtual reality tools.

[0031] In another preferred embodiment of the claimed solution, a method for authorizing a user on an access resource using a data transmission channel is presented, comprising the steps of:

form a request for access to the resource using the user's device, which contains the user's authorization data;

wherein the request is made from a mobile channel available on said user's device; transmitting said request for access to the resource to an authentication system associated with said resource;

comparing, by means of the authentication system, the user's authorization data for the selected mobile channel from the received request, with the access data stored in the authentication system; and

provide authorization of the mentioned user on the mentioned resource using the mentioned mobile channel, in case of successful verification of the user request.

[0032] In one particular implementation, the user authorization data includes at least a user ID on an access resource on the selected mobile channel.

[0033] In another particular implementation, the authorization request is encrypted on the user's device.

[0034] In another particular implementation, the authentication system stores available mobile authorization channels for each resource.

[0035] In another particular implementation example, at least one mobile channel is installed for each user in the authentication system for authorization on the resource.

[0036] Another preferred embodiment of the claimed solution is a method for authorizing a user on an access resource using a data transmission channel, comprising the steps of:

form a request for access to the resource using the user's device, which contains the user's authorization data;

transmitting said request for access to the resource to an authentication system associated with said resource;

checking in the authentication system the availability for said user of one or more mobile channels for authorization by comparing the user's authorization data with data stored in the authentication system;

sending to at least one mobile authorization channel available to the user an access confirmation request;

confirming access using a mobile channel on the user's device, which received a request from the authentication system, or receive a negative confirmation of unauthorized access in said mobile channel; and

perform authorization of the user on the mentioned resource, in case of successful confirmation of the access request, or deny access upon receipt of a negative confirmation.

[0037] In one particular implementation, when processing a user authorization request, the authentication system prioritizes available mobile channels for user authorization.

[0038] In another particular implementation example, the authentication system sends an access confirmation request to the mobile channel of the user with the highest priority.

[0039] In another particular implementation example, a confirmation policy associated with the mobile channel is set to confirm an access confirmation request.

[0040] In another particular implementation example, the acknowledgment policy is selected from the group: time interval, acknowledgment of message receipt.

[0041] In another particular implementation example, if the specified confirmation policy is not followed, the authentication system generates a re-request to another available mobile authorization channel, based on channel prioritization.

Description of drawings

[0042] FIG. 1 illustrates the general scheme of operation of the claimed solution.

[0043] FIG. 2 Fig. 3 illustrate a user authorization method.

[0044] FIG. 4A - Fig. 4D illustrate examples of selecting a mobile authentication channel on a user device using a graphical user interface.

[0045] FIG. 5A - Fig. 5D illustrate examples of authentication using two-factor verification.

[0046] FIG. 6 illustrates a general view of a user device.

Implementation of the invention

[0047] In FIG. 1 shows the general system (100) of the interaction of the elements of the claimed solution. Authorization of the user (110) on the access resource (120) is carried out using the user (110) computing device that interacts with the access resource (120) via a data transmission channel. The access resource (120) is connected via an appropriate data link to the authentication system (130), which performs data processing for user (110) authorization.

[0048] The user computing device (110) may be, for example, a smartphone, tablet, personal computer, laptop, game console, March-TV, wearable smart device (ring, bracelet, watch, glasses, etc.), virtual reality tool, augmented reality tool, mixed reality tool, and the like. The device (110) must provide processing of the necessary software logic to perform the user authorization procedure on one or more resources (120). A general description of the main components of the device (10) will be disclosed later in this description.

[0049] The data link can be a variety of principles and protocols for transmitting information and providing information exchange, for example, the Internet, Intranet, LAN, Ethernet, TCP/IP, WAN, WLAN, MAN, CAN, SAN, PAN, Wi-Fi , Wi-Fi Direct, LP WAN, GSM, GPRS, LTE, 5G, Bluetooth, BLE, IrDa, NFC, satellite, etc. Various implementations and embodiments of the data transmission channel depend on the specific implementation of the information exchange network. It is also worth noting that a data transmission channel can be a direct connection of two or more devices to each other.

[0050] An access resource (120) refers to an entity (object, application, device, website, etc.) that a user accesses via a data link, such as the most common case of a website. The access resource (120) in the present implementation of the technical solution implies not only the data itself, for example, accounting data, media data, access information, but also the mechanism for their delivery, for example, an Internet browser window, a mobile application, elements of a graphical user interface. The access resource (120) may also be an application installed on the user's device (110).

[0051] The access resource (120) may also contain a data store (121), such as a database. The data store (121) is a mechanism associated with the access resource (120) that, upon receiving an access request from a user (110), "learns" previously authenticated users (110) to expedite the subsequent authentication process. This mechanism may use, for example, "cookies" for the resource (120) in the browser, or in other technical form that allows the task to be carried out.

[0052] The authentication system (130) is a hardware and software solution for providing multi-channel access control for user authorization (110). The authentication system (130) may be integrated into the access resource (120) and the integration may be complete or partial. The authentication system (130) may be a remote service interacting by exchanging user authorization requests (110) through an access resource (120) to provide access.

[0053] The main elements of the authentication system (130) are a data store (131), an access channel assignment module for authentication (132), a user settings module (133), a mobile channel selection and prioritization module (134), a user notification module, and a notification module access resource (135). The set of modules may differ depending on the final implementation, in particular, notification modules may be an optional solution.

[0054] The data store (131) contains the basic information for providing the user authorization process (110). The module (131) stores channel data selected by each user (110) interacting with the system (130), keys/tokens/ID data corresponding to each user (110) in each mobile channel through which authorization is performed or performed.

[0055] Also, the storage (131) stores the algorithms, procedures and logic for the operation of authorization and notifications for each authorization channel, for example, but not exclusively: operation timeouts, data delivery confirmation methods, trigger rules, re-authentication periods, API (API) calls and other channel details. The number of channels in the system (130) may be greater than the specific access resource (120) chosen to use to solve their own problems of user authorization (110).

[0056] The store (131) contains program logic for managing access keys, in particular, obtaining, storing and transmitting authorization keys and / or identifiers (depending on the authorization channel) for each access resource (120) and for each channel selected access resource (120) for its work.

[0057] The data store (131) also transmits and stores information about all previously authenticated users for each access resource (120). This information may be associated with the stored key data in the data store (131) from the plurality of access resources (120) to provide a centralized authentication service.

[0058] The store (131) may also store all authentication events, including all important technical data about such events, such as user IDs, time and place, channel, user device type, and so on.

[0059] The Authentication Access Channel Assignment Module (132) handles keys/identifiers for a plurality of access resources (120). This module (132) can be implemented, for example, as a cloud service associated with access resources (120). The module (132) is used to configure the authorization channels used on the access resources (132).

[0060] The mobile authorization channel selection module (133) provides authorization channel selection for the user (110). This functionality can be called from inside or outside the perimeter of the access resource (120) (depending on the applied form factor). The module (133) contains data of only mobile authentication channels selected by the owner of the access resource (120) from the set of all mobile channels whose operation logic is available and stored in the storage (131) of the authentication system (130).

[0061] The module for multi-channel selection and prioritization of mobile channels (134) provides the selection and ranking of authentication channels based on the rules established by the logic of the module (134). The module (134), when performing the prescribed functions, can use the user's authentication history (110) and the data on allowed channels by the access resource (120). The channel selection process begins with the selection of one channel (the highest priority) and then iterates through the authorization channels until the authentication result is obtained.

[0062] The user notification module (135) provides notification to the user (110) that authentication is currently in progress (may not be applicable in each implementation of the present solution), including the logic of messages about authentication failure or delay, or the need for additional confirmation. The operation of the logic of this module (135) may require additional actions on the part of the user (110). Most often, such additional steps are required when authenticating the second access factor.

[0063] The access resource notification module (136) notifies the access resource (120) of the authentication result, for example, the module (136) may be implemented based on the OAuth protocol.

[0064] In FIG. 2 shows a method for authorizing a user (110) using a mobile authentication channel on an access resource (120). At step (201), the user initiates an authentication process on the access resource (120). Initiation of a request for access to a resource (120) can be performed, for example, through the activation of a graphical interface (GUI) element on the screen of the device (110), for example, an icon, widget, etc., through a web browser or using a software application. Next, the request from the user's device (110) at step (202) is transmitted to the access resource (120).

[0065] Upon receipt of a user request at step (202), the resource (120) processes it. The request, as a rule, includes a user ID, or a bunch of his authorization data (login / password), the user's device ID and other type of identifying information can also be additionally used. The access resource (120) at step (203) checks whether the user (110) has an established mobile authentication channel based on the received user identifiers by transmitting said identification data to the authentication system (130) (step 203).

[0066] At step (203), the authentication system checks, by comparing the data received in the user request and the data stored in the system memory module (131), for the existence of an authentication channel for the corresponding user (110). If no channel is stored in the system (130) for the user requesting the authentication process, for example, the first access to the resource (120) is performed, then the channel is selected using the module (133) (step 211), in which data is created for the selected channel access, which are stored in the storage (131) of the system (130) for the respective user. Subsequently, the saved data will be used for subsequent authorization using the selected authentication channel.

[0067] At step (204), the source of the request is checked, in particular, whether the user request is from a previously assigned mobile channel for the current user (110) associated with the resource (120) to which the authentication request is being made. If the mobile channel has already been assigned and its data is stored for the current user (110) and the corresponding access resource (120) in the authentication system (130), then further execution of the authentication logic and rules laid down for this mobile channel is carried out (step 205).

[0068] For example, a messenger application (Telegram, WhatsApp, FaceBook Messenger, Slack, Viber, etc.) can be used as a mobile authentication channel. Each channel has its own user identification logic and the principle of data processing using algorithms, for example, the principles of data encryption, the formation and transmission of data packets, the notification algorithm, etc.

[0069] Upon fulfilling the necessary requirements for organizing authentication using the mobile channel logic at step (206), the user is granted access to the resource using his authorization (step 207). Additionally, the data resource (120) may be notified by the system (130) that the user has been positively authenticated (110).

[0070] If at step (206) the authentication procedure is not completed successfully, then the logic of the user authentication algorithm (110) may re-access the authentication system (130) at step (208) to analyze additional mobile authentication channels for the current user (110). If there are additional mobile channels available for the user (110) in the authentication system for authentication, then the authentication process proceeds to step (300), which will be described later in the application materials.

[0071] If at step (208) there are no additional channels for the user (110) to authenticate, then the authentication process may start again (step 209) repeating the process for the currently assigned mobile authentication channel by the user (110). Re-authentication may be performed by generating a message, PUSH notification, or other type of alert displayed by the user's device (110), in response to which the user (110) initiates re-authentication on the access resource (120). When refusing to re-authenticate, at step (210) the authentication system (130) informs the resource (120) about the prohibition of user authorization.

[0072] In FIG. 3 shows a procedure (300) for selecting a mobile channel for user authentication (110). As mentioned above, mobile channel selection can be performed when the user (110) did not assign a mobile authentication channel for authorization on the selected access resource (120), or in the case when the user (110) was unable to authenticate using a pre-established mobile channel. . In this user authentication scenario (110), an additional mobile channel is assigned for authentication.

[0073] At step (301), a check is made of mobile channels available to the user (110) for authentication, information about which is in the authentication system (130). If the user has not yet selected an authentication channel to use on the current access resource (120), then the authentication system (130) checks all authentication channels available to the user (110), as well as the possibility of using available mobile authentication channels for the current access resource (120) .

[0074] After receiving the list of mobile channels available to the user (110) for authorization on the current resource (120), at step (302) the activation of the mobile channel prioritization mechanism installed in the authentication system (130) for the corresponding user (110) is checked. If the prioritization mechanism is not activated, then at step (303) the mobile channel for user authentication (110) is selected, which was used during the last successful authorization on the current access resource (120).

[0075] At step (304), with the mobile authentication channel prioritization mechanism activated, the authentication system (130) performs ranking of available mobile channels to perform the user authorization process (110) on the current access resource (120). Prioritization rules can consist of 1...N number of rules, in particular, how to select the primary (priority) and subsequent channels, how to sequence the use of mobile authentication channels, etc.

[0076] Each access resource (120) may have differently configured authentication rules. The priorities may include, but are not limited to, channel usage cost, access resource preferences (120), user authorization history, user response rate to the channel, channel usage capability at the user's location, and so on. Based on the channel priority, the channel for authentication with the highest priority is selected, and the subsequent queue is built for further use of the authentication channels in the event of a repeated authentication procedure.

[0077] As an example of the application of an authentication channel ranking mechanism, consider an example where the system (130) determines a set of metrics to select the most relevant channel to use as authentication. In particular, the parameters for processing the ranking algorithm can be: the user's location (roaming, availability of 3G / 4G networks), the conditions of the mobile operator (free access to instant messengers, social networks, etc.), the cost of data transmission using each type of mobile channel ( SMS, Internet). Based on the obtained metrics, the parameters inherent in a particular mobile channel are processed by the algorithm of the prioritization module (134) of the authentication system (130).

[0078] Next, at step (305), the authentication logic for the selected mobile channel is applied at steps (303) or (304) using the appropriate user identification data (ID/tokens, etc.) binding (110) for the selected channel, which stored in the system (130). After processing the data at step (305), the sequence of actions described above for step (205) is performed.

[0079] Also, if at step (208) in case of unsuccessful authentication of the user (110) using a given authentication channel or one of the channels that was selected from the set of available authentication channels, the authentication method is executed from step (301). If a mobile channel for authentication has already been selected using the system channel selection mechanism (130), then the authentication parameters for the next priority channel are used.

[0080] Also, the authentication system (130) can check the authorization cycle, for example, its duration in a given period of time, number of iterations, before obtaining a positive/negative result. In such a case, the implementation has a mechanism to set and store these settings in order to apply them after checking the last available channel.

[0081] The resource (120) provides access to the user (110) in a manner that is applicable to a particular implementation. For example, if a user (110) requests authorization in a resource (120) through a desktop browser, then after a mobile confirmation, the user is admitted to the access resource (120). If the user (110) requests authorization on the mobile version of the resource (120), then immediate access may be granted.

[0082] Additionally, for the user device authentication process (110), additional user verification in the mobile access channel, for example, two-factor authentication (2FA - Two factor authentication), can be applied. At step (205) for each of the channels, its inherent policy for implementing the user verification procedure is set, based on the received request for access to the resource (120). If 2FA is used, the method of its implementation used by the corresponding mobile channel is determined, for example, entering a code (PIN code, code from an electronic message, etc.), entering symbols / words, using digital signature tools, entering a user signature on the device screen (110 ), biometric identification (fingerprint, retinal scan, voice input, user images, vein pattern, etc.), fact of viewing a message (PUSH messages), graphic code (for example, QR code, bar code), time interval for message processing, interaction with GUI elements, etc. Various principles known in the art for confirming user access (110) to a selected data channel may be applied.

[0083] When passing a user request to the authentication system (130), one or more encryption algorithms, such as RSA, SHA-256, and the like, may be applied to the request. This approach provides additional security in the exchange of information packets containing user identification data (110) and data for performing the authentication procedure in the user channel.

[0084] In FIG. 4A shows an example of selecting authentication channels using the GUI of the user device (110). The device interface (110) contains an area for displaying information about the access resource (112) and an area (111) for the location of icons (1111)-(1113) of mobile channels. Area (111) may be a popup or widget. When the selected icon is activated with an access channel, a procedure is performed to associate the selected authentication channel with the current access resource or, for example, the resource associated with this icon.

[0085] FIG. 4B illustrates an example of displaying channel options for user authentication, in which, in addition to icons (1111)-(1113), the most preferred authentication channel (1114) for the current access resource (120) can also be displayed. An icon or button for selecting a channel (1114) can be displayed either automatically when accessing a resource (120) or when certain predetermined conditions are met, for example, a certain time period has passed, a channel prioritization mechanism has been activated, and the like.

[0086] In FIG. 4C shows an example of displaying a desktop version of a device (110), such as a personal computer, laptop or all-in-one, in which the user can request authentication using mobile channels. In this case, channel selection is made using the logic of primary mobile channels, a link with which exists on the desktop in the form of installed applications or plug-ins, or a selection link is delivered to the user's mobile device by any acceptable method, such as CMC, push, e-mail, etc. P. The interface window (111) displays both the possible authentication channels (1111)-(1112) and the preferred channels (1114). Element (1115) is an interface element with which a list of icons of mobile channels (111) can be called.

[0087] In FIG. 4D shows an example of authentication channel selection in device locked mode (110). The area (111) with channel icons (1111)-(1113) can be called up by interacting with the display of the device (110), for example, by swiping from the bottom edge of the screen. It should be obvious to one skilled in the art that other options for interacting with the GUI of the device (110) in any possible directions available through the operation of the interface logic or operating system, shell, launcher, and the like can be used.

[0088] FIG. 5A - Fig. 5B illustrates an example of platform operation using two-factor verification between two devices (110 ₁ )-(110 ₂ ), when one of the devices is in locked mode. If it is necessary to authenticate on the access resource (120) on the first device (110 ₁ ), if the resource (120) has an assigned access channel or the user has several available channels to perform the authentication process on the mentioned resource (120), then the user authentication request on resource (120) may be sent to the device (110 ₂ ), which may be in a blocked mode. In this case, the arrival notification on the selected mobile channel for authentication may be displayed as a PUSH notification (111) which also arrives on the corresponding user-selected mobile authentication channel (1111). Activation of the received PUSH notification (111) can be carried out, in particular, when interacting with an interface element that displays this notification, which will be a confirmation of user authentication using the device (110 ₂ ). The confirmation may be an interaction with the PUSH notification area (111). If the confirmation of the notification (111) does not occur at the set time, then it is considered that authentication is not performed and either another channel for authentication is selected or access is denied.

[0089] At the same time, a private authentication confirmation option may be used, in which the system (130) receives a notification from the mobile authentication channel on the device (110 ₂ ) to view the PUSH notification. In this case, the fact of authentication is also considered perfect. The term "view" also means receiving a response from the user's device (110 ₂ ) confirming that the user has seen the PUSH notification (111), for example, by receiving data from the sensors of the mobile device (110 ₂ ) (gyroscope, camera, proximity sensor etc.). The PUSH notification itself (111) can also be purely informational in nature and does not require additional activity on the part of the user.

[0090] Also, one of the particular examples of confirming device user authentication (110 ₂ ) when sending confirmation from another device using a PUSH notification, entering information in the field (111) can be performed using text input using a text string generated by the GUI when interaction with the area (111) of the PUSH notification.

[0091] In FIG. 5B shows an example of interaction with the area (111), for example, using a swipe movement with options displayed to confirm or reject authentication. Also, an option with access on the device (1 South) to the established mobile channel for authentication, for example, Telegram, can be additionally used, in which options will be provided to perform or reject authentication. An example of such applications is the well-known LoginTap solution.

[0092] In various embodiments, the implementation of the authentication process using the device (110) equipped with a biometric sensor in the display area can be performed by transferring, by means of the GUI of the operating system, an icon with a mobile authentication channel to the area of the biometric sensor to confirm the user selection using the biometric verification.

[0093] In FIG. 5C shows an example of performing two-factor user verification (110) by moving the icon (1112) of the selected authentication channel to the area of the biometric sensor (105) located in the display area of the device (110). In such an implementation, user authentication is performed by recognizing that the area finger is in the area of the sensor (105) with a captured GUI element in the form of a channel icon (1112), which provides additional verification and security of access.

[0094] In FIG. 5D shows an example of performing authentication using two-factor authentication, which is performed on the device (110) of the user. When requesting access to a resource (120), such as a website or application (installed on a device (110) or a web application, etc.) from a device (110), an acknowledgment may be sent to a mobile channel (1111), available on the same device (110) e.g. Telegram. The mobile channel (1111) may display a notification, such as a request for a chat session, with options to accept or reject the authentication process. Upon confirmation of the request in the channel (1111), the authentication parameters are transmitted to the access resource (120) (or authentication system ((130)) for execution and subsequent granting of access to the resource (120) using the device (110).

[0095] An alternative case, shown in FIG. 5D of performing two-factor authentication on the device (110) when requesting access to a resource (120), it may be the fact of authentication confirmation in another mobile channel that receives a user authentication request from the authentication system (130), in the case when the first mobile channel (1111 ) that was originally requested from the resource (120) failed to authenticate. Such a case can occur when a user authentication error occurs using the first channel (1111), for example, the response time from the first authentication channel, technical communication problems, incomplete transmission of identification information (keys / tokens, etc.) from the first channel, and etc. In this case, access to the resource (120) will be provided upon receipt of a user confirmation from the second authentication channel, for example, if the first request from the resource (120) was sent to Telegram, then if the user's identification information was not received or incompletely received from this channel, then the request redirects for authentication further to the second mobile channel available to the user, for example, WatsApp, in which, when executing the access confirmation procedure, confirming information is transmitted to the access resource (120) for user authorization.

[0096] In one of the particular examples of the application of the claimed solution, when using intracorporate externally isolated networks, for example, an Intranet type network, each employee for each access device to one or more resources can be assigned a corresponding mobile authentication channel. Such a solution can be organized using appropriate bundles of user identifiers, devices, resources and access channels. Also, using such an implementation, an information loop can be formed to provide access, for example, to one access resource through an associated application through which the participants of the said loop are authenticated.

[0097] In FIG. 6 shows an exemplary implementation of the user device (110). In general, as noted above, device (110) may be selected from a wide variety of electronic devices known in the art. In general, the device (110) contains one or more processors (101) or microcontroller(s), RAM (102), persistent data storage (103), input/output interfaces (104), input/output devices (105) , networking tool (106).

[0098] The processor (101) is the main computing module that provides logical processing of the algorithmic commands necessary for the device (110) to perform the necessary functions.

[0099] RAM (102) is a standard random access memory designed to store instructions executable by the processor that implement the work of the embedded program logic.

[0100] Persistent storage media (103) may include, but are not limited to: hard disk drive (HDD), flash memory (NAND, EEPROM, SD cards, etc.), solid state drive (SSD), optical drives data (CD/DVD/BlueRay discs, etc.).

[0101] The I/O interfaces (104) may be, but are not limited to: ADC/DAC, USB (micro, Type C, mini, etc.), PS/2, PCI, VGA, RS232, RJ45, FireWire, SATA, IDE, COM, LPT, Audio Jack, HDMI, Display Port, Lightning, etc.

[0102] The I/O facilities (105) may be, but are not limited to: a display, a touchscreen, a keyboard (mechanical, touch, projection, etc.), a trackball, a joystick, a touchpad, speakers, a microphone, a projector, indicator light, buzzer, biometric sensor (fingerprint, retina, iris, voice, palm, vein pattern, etc.), camera, optical sensor, accelerometer, gyroscope, light sensor, proximity sensor, gravisensor, etc. P.

[0103] The network communication tool (106) can be, but is not limited to: Bluetooth module, BLE module, NFC, Ethernet card, modem, router, IrDa, GSM modem, GPRS modem, LTE modem, 50 modem, WLAN, Wi-Fi module, satellite modem, GNSS receiver, etc.

[0104] The presented description of the claimed solution discloses only the preferred examples of its implementation and should not be construed as limiting other, particular examples of its implementation that do not go beyond the scope of legal protection that are obvious to a specialist in the relevant field of technology.

Claims (31)

1. A user authorization system containing a user device connected by a data transmission channel and an access resource associated with an authentication system, in which: - the user's device is configured to generate a request for user authorization on the access resource and receive a response on processing the request from the authentication system; - the access resource is configured to receive a user request for authorization and send the corresponding request to the authentication system, which contains data on available mobile authorization channels for access resources, as well as user authorization data for each of the available mobile channels, while the mobile channel represents the application, installed on the user's mobile device and providing user authorization using a given data processing algorithm; and - an authentication system that provides authorization of the user on the mentioned resource using at least one mobile channel installed on the user's mobile device and using which the authorization request is processed, moreover, when receiving a request from the user's device for authorization, the authentication system checks the available mobile channels for this user and performs prioritization of mobile channels for user authorization, followed by sending an access confirmation request to the highest priority mobile channel, through which further user authorization is performed through the user's mobile device. 2. The system according to claim. 1, characterized in that the request additionally contains the access data of the selected mobile channel. 3. The system according to claim 2, characterized in that the authorization request is encrypted on the user's device and decrypted in the authentication system. 4. The system according to claim 3, characterized in that the authentication system additionally sends an authorization confirmation request to the mobile channel of the user's device. 5. The system according to claim. 4, characterized in that the user authorization is performed through additional verification. 6. The system according to claim 5, characterized in that the additional verification is a biometric verification, a pin code, a graphic code, an audio code, or combinations thereof. 7. The system according to claim 1, characterized in that the data transmission channel is selected from: Internet, Intranet, LAN, Ethernet, TCP / IP, WAN, WLAN, MAN, CAN, SAN, PAN, Wi-Fi, Wi-Fi Direct , LPWAN, GSM, GPRS, LTE, 5G, Bluetooth, BLE, IrDa, NFC, satellite, or combinations thereof. 8. The system according to claim 1, characterized in that the access resource is a website or a software application. 9. The system according to claim. 1, characterized in that the user device is a personal computer, smartphone, laptop, tablet, game console or smart wearable device. 10. The system according to claim 9, characterized in that the smart wearable device is selected from the group: smart watch, smart bracelet, smart ring, augmented reality tools, mixed reality tools, virtual reality tools. 11. A method for authorizing a user on an access resource using a data transmission channel, comprising the steps of: - form a request for access to the resource using the user's device, which contains the user's authorization data; - transmitting said request for access to a resource to an authentication system associated with said resource, which contains data on available mobile authorization channels for access resources, as well as user authorization data for each of the available mobile channels, wherein the mobile channel represents an application installed on a mobile user device and providing user authorization using a given data processing algorithm; - using the authentication system to compare the user authorization data for the selected mobile channel from the received request with the access data stored in the authentication system, while the authentication system, upon receiving a request from the user's device for authorization, checks the available mobile channels for this user and prioritizes mobile channels for user authorization with subsequent direction of an access confirmation request to the highest priority mobile channel contained on the user's mobile device; - provide authorization of the mentioned user on the mentioned resource by means of authorization through the selected mobile channel contained on the user's mobile device. 12. The method of claim. 11, characterized in that the user authorization data includes at least a user identifier on the access resource in the selected mobile channel. 13. The method according to claim 11, characterized in that the authorization request is encrypted on the user's device. 14. The method according to claim 11, characterized in that at least one mobile channel is set for each user in the authentication system for authorization on the access resource. 15. A method for authorizing a user on an access resource using a data transmission channel, comprising the steps of: - form a request for access to the resource using the user's device, which contains the user's authorization data; - transmitting said request for access to a resource to an authentication system associated with said resource, which contains data on available mobile authorization channels for access resources, as well as user authorization data for each of the available mobile channels, wherein the mobile channel represents an application installed on a mobile user device and providing user authorization using a given data processing algorithm; - checking in the authentication system the availability for said user of one or more mobile channels for authorization by comparing the user authorization data with data stored in the authentication system, while the authentication system prioritizes the available mobile channels for user authorization; - send to the highest priority mobile authorization channel available to the user and installed on the user's mobile device, an access confirmation request; - carry out access confirmation using the said mobile channel on the user's device, which received a request from the authentication system, or receive a negative confirmation of unauthorized access in the mentioned mobile channel; and - perform authorization of the user on the mentioned resource in case of successful confirmation of the access request or deny access upon receipt of a negative confirmation. 16. The method according to claim 15, characterized in that, in order to confirm the access confirmation request, a confirmation policy associated with the mobile channel is established. 17. The method according to claim 16, characterized in that the confirmation policy is selected from the group: time interval, confirmation of receipt of the message. 18. The method according to claim 17, characterized in that if the specified confirmation policy is not fulfilled, the authentication system generates a repeated request to another available mobile authorization channel based on channel prioritization.

Images