WO2020172134A1

WO2020172134A1 - Mobile device on-line account authentication hardware and method for authentication

Info

Publication number: WO2020172134A1
Application number: PCT/US2020/018587
Authority: WO
Inventors: Angus RITTENBURG; Casey PARZYCH; Michael K. BOYER
Original assignee: One Gallon, Llc
Priority date: 2019-02-18
Filing date: 2020-02-18
Publication date: 2020-08-27

Abstract

A means for securely accessing an internet connected account using a mobile device with isolated hardware is disclosed. The isolated hardware is able to generate a response that only the account provider knows to authenticate on-line accounts. The disclosure includes passwordless means for authenticating user accounts using a mobile device with the isolated hardware. The isolated hardware can be directly or indirectly connected to the internet connected device and can be attached, embedded or otherwise functionally associated with articles used with the mobile device.

Description

Mobile Device On-line Account Authentication Hardware And Method For

Authentication

FIELD OF THE INVENTION

[0001] The present invention is directed to the field of authentication, and in particular, to authenticating on-line accounts.

BACKGROUND OF THE INVENTION

[0002] Many on-line accounts authenticate users’ accounts using passwords that are strings of letters, numbers, and/or symbols. Users create a unique password associated with their account and are required to provide the passwordin order to access information deemed private. Encrypted versions of passwords are stored in account provider databases to stop malicious agents from stealing and using the raw form of an account provider’s stored password database to access private information. Encryption is done using one-way hashing algorithms which convert the raw password into an encrypted fixed length string of text. Since the hashing algorithms are one-way, malicious agents who gain access to an account provider’s database cannot convert the encrypted strings back into passwords using the hash functions backwards.

[0003] Conventional password authentication methods have several shortcomings. For example, the security of passwords decreases as computing power increases and becomes more widely available (processing power has roughly doubled every 18 months since 1970 as disclosed by https://www.electronicsweekiv.com/news/moores-law-still- law-2017-09/ ; hereby incorporated by reference). With faster computing speeds, malicious agents can use trial and error to guess passwords at a higher rate. Users and account providers both incur costs in the effort to combat malicious agents. Users must create different randomized passwords for each account and use random strings of letters, numbers, and symbols that are difficult to remember. Account providers must invest in both processing power to hash passwords and secure systems to store hashed passwords. Businesses incur additional costs from lost employee efficiency associated with forgotten passwords as disclosed by https://www.esecuritvplanet.com/network- securitv/forgotten-passwords-cost-companies-200000-a-vear.html; hereby incorporated by reference .

[0004] Public key cryptography offers one password-free alternative. The FIDO (“Fast Identity On-line") universal 2nd factor (U2F) authentication protocol uses public/private key pairs generated and stored on isolated hardware to establish a secure password-free means of authentication between a user and an account provider. For the purposes of this disclosure,“isolated hardware” refers to at least one of scanner, fob, external hard drive, among other physically separated hardware that is not connected to the internet and can only receive and send specific information when activated by the user. Instead of using a password, the user must carry the isolated hardware with them that has a means of communicating with the internet. When an account is initially configured or set up, the isolated hardware generates a public and private key pair for the account. The public key is shared with the account server, and the private key is not shared or never leaves the isolated hardware. Information encrypted with the public key can only be decrypted with the private key, and vice versa. In this way, the account server can send an encrypted request to the user’s isolated hardware which can decrypt, re-encrypt, and send a response that authenticates the user. Additional pieces of information serve to increase the security by eliminating“man in the middle” attacks and making it impossible for someone to use a cloned piece of isolated hardware. These additional pieces of information include: a request origin, a challenge code, a key id which communicates which private key to use, a hardware increment, and a user button press on the isolated hardware.

[0005] Current systems for implementing public key cryptography have three major convenience limitations: 1. a user must carry an additional piece of isolated hardware and connect it to an internet connected device at each authentication event, 2. the protocol is typically used as a secondary form of authentication which means the user is required to enter an account password, and 3. the protocol only works with select participating online accounts. Examples of current systems are disclosed in CA 2813108; US 8,260, 199; USPN 8,511 ,547; and US 2013/0309966; each of these disclosures are hereby incorporated by reference.

[0006] There is a need in the art for an authentication method that is secure and independent of malicious agent’s level of computer power, does not require user memorization, and does not require an independent or isolated hardware device.

SUMMARY OF THE INVENTION

[0007] The instant invention solves problems associated with conventional authentication devices and methods by providing various embodiments.

[0008] One embodiment of the present invention is directed to a cover having at least one surface configured to engage at least a portion of a mobile computing device, and a passwordless and isolated apparatus for authenticating a user of the mobile computing device and wherein the isolated apparatus is connected to the cover.

[0009] Another embodiment of the invention relates to the foregoing cover wherein the isolated apparatus is connected by being positioned within a feature defined on a surface (for example, an interior surface) of the cover.

[0010] Another embodiment of the invention relates to any of the foregoing covers wherein the isolated apparatus is permanently connected to a surface (for example, an interior surface) of the cover.

[0011] Another embodiment relates to any of the foregoing covers wherein the isolated apparatus comprises an NFC.

[0012] A further embodiment relates to any of the foregoing covers wherein the isolated apparatus is accessible by the user from an exterior surface of the cover.

[0013] A further embodiment relates to any of the foregoing covers wherein the exterior surface comprises an opening that permits the user to engage the isolated apparatus. [0014] A yet further embodiment relates to any of the foregoing covers wherein the isolated apparatus comprises an NFC and the user engages the NFC by a tactile surface.

[0015] A yet further embodiment relates to any of the foregoing covers further comprising electronic identification of the user.

[0016] One embodiment of the invention relates to an identification badge further comprising electronic identification of the user and isolated apparatus.

[0017] Another embodiment of the invention relates to any of the foregoing embodiments wherein the electronic identification operates at a frequency that is different than the isolated apparatus.

[0018] A further embodiment of the invention relates to any of the foregoing embodiments wherein the mobile computing device includes any of the foregoing covers.

[0019] Another embodiment of the invention relates to a mobile computing device including an electronic identification badge.

[0020] One embodiment of the invention relates to a mobile computing device comprising any combination of the foregoing covers and at least one member selected from the group consisting of wearable electronics, phone, tablet and personal computer.

[0021] Another embodiment of the invention relates to a mobile computing device comprising any combination of the foregoing covers and an isolated device for accessing at least one physical asset.

[0022] Another embodiment of the invention relates to combination of the foregoing mobile computing devices wherein the physical asset comprises at least one member selected from the group consisting of a vehicle, residence and safe.

[0023] One embodiment of the invention relates to a method for accessing an internet connected account using a mobile computing device comprising any of the foregoing mobile computing devices comprising: i) a user interacting with the mobile computing device wherein the mobile computing device contacts a server hosting the internet connected account ii) the server sends an authentication request to the mobile computing device and the mobile computing device in turn receives the authentication request and instructs the user to unlock the mobile computing device, iii) after unlocking the mobile computing device, the mobile computing device requests the user to engage an isolated hardware device thereby permitting authentication between the isolated hardware device and the server, iv) completing the authentication protocol between the isolated hardware device and the server thereby granting the user access to an on-line account.

[0024] Another embodiment relates to the foregoing method wherein the isolated hardware device comprising an NFC.

[0025] Another embodiment relates to any of the foregoing methods wherein the user engages the NFC by depressing a button on the NFC.

[0026] The various embodiments of the present invention can be used alone or in combinations with each other.

[0027] Other features and advantages of the present invention will be apparent from the following more detailed description of various embodiments, taken in conjunction with the accompanying drawings which illustrate, by way of example, certain principles of the invention.

BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 is a schematic diagram illustrating interactions among a user, server, mobile device and the inventive hardware.

[0029] Figures 2A through 2C are drawings of one embodiment of the invention comprising hardware embedded within a mobile device cover in accordance with one embodiment of the invention. [0030] Figures 3A through 3C are drawings of another embodiment of the invention comprising hardware embedded within a mobile device cover wherein the hardware is accessible through the mobile device cover.

[0031] Figures 4A through 4C are drawings of a further embodiment of the invention comprising hardware embedded within a mobile device cover along with an identification badge.

[0032] Figure 5 is a drawing of another embodiment of the invention wherein the isolated hardware is used to access a physical asset such as a vehicle.

[0033] Wherever possible, the same reference numbers will be used throughout the drawings to represent the same parts.

DETAILED DESCRIPTION

[0034] This invention provides a means for securely accessing an internet connected account using a mobile computing device or mobile device with isolated hardware. The isolated hardware is able to generate a response that only the account provider knows to authenticate on-line accounts. This invention is novel in that it provides a passwordless means for authenticating user accounts using a mobile device with the inventive isolated hardware. Unlike existing solutions, the inventive authentication hardware and method does not require users to enter a password. In addition, this authentication hardware and method does not require users to carry an additional or extra independent piece of hardware (such as wireless fob, usb device, OTP (“one time password”) code generator, among other storage or generator devices). Instead, the inventive isolated hardware can be directly or indirectly connected to the internet connected device and, for example, can be attached, embedded or otherwise functionally associated with articles used with the mobile device. The isolated hardware is then always in range of the mobile device which in turn is internet connected. While any suitable hardware can be employed in the instant invention, examples of suitable hardware including active and passive RFID (“radiofrequency identification”), NFC (“near-field communication”), powered wireless radio, among others. The inventive hardware can be functionally associated with any suitable article for use with the internet connected mobile device. Examples of suitable attachments include mobile phone covers, laptop or display device carriers, peripherals, among other physical articles associated with the internet connected device.

[0035] The hardware and method are also novel in that both authentication on a computer account and mobile device account can be handled using the isolated hardware associated with the mobile device.

[0036] While any suitable account could be securely accessed using this invention, cryptocurrency wallets are one specific application of the invention. A crypto wallet is a type of account that is typically accessed by passwords as well as second factor methods. In some cases, the wallets themselves are kept on physical assets such a USB drives. The present invention improves security of these assets as well as convenience.

[0037] In one embodiment, the invention relates to a mobile device with a protective carrying case containing a near-field communication (NFC) chip able to generate and store public/private key pairs. In this embodiment, the NFC chip in the carrying case comprises the isolated hardware (e.g., NFC chip is embedded or connected to the carrying case or cover). The mobile device would communicate to the account provider through the internet, and to the carrying case through NFC. In this embodiment, the NFC chip is only activated with an interaction with the user (e.g., a button press by the user, biometric scanner, among user specific interactions). In this way, the device cannot be challenged, hacked, or otherwise digitally tampered with by devices in close proximity. In addition, malicious agents cannot access the isolated hardware by remotely hacking the mobile device.

[0038] In one aspect of the first embodiment, when an on-line account is initially configured or set up, the user registers their mobile device. The mobile device receives an initialization package and requests that the user to press an NFC activation button on the side or back of the mobile device case. Upon button press, the NFC chip generates a public and private key pair for the account. The public key is shared with the account provider, and the private key is stored on the NFC chip. Information encrypted with the public key can only be decrypted with the private key, and vice versa. In this way, the account server can send an encrypted request to the user’s NFC chip which can decrypt, re-encrypt, and send a response that authenticates the user. Additional pieces of information serve to increase the security by eliminating“man in the middle” attacks and making it impossible for another to use a cloned piece of isolated hardware. These additional pieces of information include: request origin, challenge phrase, key id, hardware increment, and a user button press to activate the isolated hardware.

[0039] In another aspect of the first embodiment, when the user attempts to access an on-line account after initial registration, a public key encrypted code is sent to the registered mobile device. The registered phone then notifies the user that they must unlock the phone. If the user is not expecting a notification, the user could have the option to report it as a false authentication attempt. When the user unlocks their phone, they are notified to press the button on the protective carrying case to enable the isolated hardware. The phone then passes the encrypted message to the isolated hardware via (NFC) where the message will be unencrypted, signed, and re-encrypted using the private key. The re-encrypted message will then be passed back to the phone via NFC then sent to the server to authenticate the user.

[0040] The invention is novel and useful because it solves two of the major problems with existing authentication methods. First, it solves the convenience problem of carrying additional independent isolated hardware. Many internet connected users already carry a secured mobile device with a protective carrying case. Second, it solves the convenience problem of remembering multiple account passwords. The user is only required to unlock their phone and press a button to complete the account authentication. The phone can be unlocked by using a memorized passcode (pin, swipe, among other physical interactions), a biometric authentication using cell phone hardware (facial, fingerprint), among other user specific non-physical interactions).

[0041] Protective carrying cases can be made without making significant changes to the aesthetic of the phone for those who prefer no protective carrying case. The replaceable nature of the protective carrying case is important because hardware can be replaced inexpensively and quickly in the case of security compromise. The isolation of hardware from the phone until a button on the isolated hardware makes it difficult to hack without having the device in physical possession.

[0042] A second embodiment of the invention relates to linking a specific piece of isolated hardware to a specific mobile phone such that the two can only be used together within a short distance via near-field communication (NFC).

[0043] A third embodiment of the invention relates to using an NFC sticker with a pressure sensitive button that can sandwiched between the phone and the case.

[0044] A fourth embodiment of the invention relates to using the instant invention to verify one’s identity during a phone call, for example, when requesting access to personal information. For example, the account provider sends the authentication request and the user authenticates by unlocking the mobile device and pressing the button on the case. In one aspect of the fourth embodiment, the user permits temporary access of another party into their on-line account by authenticating the access request from their device.

[0045] A fifth embodiment of the invention relates to a method wherein the authentication method changes every time or on a random basis. For example, the NFC can issue varying signals, user interaction with mobile device varies (e.g., varying among password and biometric authentication).

[0046] A sixth embodiment of the invention relates to retrofitting an existing device by adding a Yubico™ U2F key to a phone case. Yubico™ U2F keys can be purchased presently with NFC hardware and activation buttons already installed https://www.vubico.eom/product/vubikev-5-nfc/#vubikev-5-nfc; hereby incorporated by reference. In one aspect of the sixth embodiment, a mobile device carrier or cover (e.g., a phone case), is manufactured without the inventive hardware and includes features and other geometries that enable the device carrier (e.g., phone case) to be adapted by the user to include the inventive hardware.

[0047] A seventh embodiment of the invention relates to embedding the isolated hardware along with a wireless ID badge (e.g., an employee identification badge). In one aspect of the seventh embodiment, the wireless ID badge is manufactured with both traditional RFID chip for wireless badge communication and the isolated hardware required to be used in conjunction with a wireless device (e.g., a mobile phone) for account authentication. For example, the ID badge could have an NFC antenna and chip embedded with the ability to generate and store public and private key pairs. In another aspect of the seventh embodiment, a push button could be implemented to activate the NFC communication only as required.

[0048] An eighth embodiment of the invention relates to embedding the isolated hardware into any suitable device for accessing (e.g., unlocking) software or hardware. In one aspect of the eighth embodiment, the isolated hardware is paired with a cellular device and used to unlock a vehicle. The vehicle has an antenna that can communicate with the isolated hardware, which can further communicate with a cellular device. In this embodiment, a user would approach a locked vehicle, press a button on the isolated hardware, and the cellular device would perform authentication then communicate to the vehicle to unlock and allow entry. As an added security measure, a user could opt to require the cellular device to be unlocked before allowing entry. This eighth embodiment is secure because it requires multiple levels of authentication. 1. The use must have the specific cellular device and isolated hardware in physical close proximity to the vehicle,

2. The user would need to know which vehicle can be unlocked by the isolated hardware,

3. The user would need to know the password to unlock the phone. In addition, the eighth embodiment would be useful because multiple users could be assigned to a vehicle such that each user could use their own cellular device and isolated hardware to unlock the vehicle, and users could be added or removed at any time by an administrator. While a vehicle is used as a piece of hardware to be unlock in this aspect, any suitable hardware or software could be accessed employing this invention.

[0049] Referring now to Figure 1 , Figure 1 illustrates the interaction among the user, server, mobile device (in this embodiment a phone) and the inventive isolated hardware (in this embodiment a mobile phone cover or case). In particular, Figure 1 illustrates how a user can employ the instant invention for accessing an on-line account. The user interacts with an internet or web-connected mobile device that contacts a server hosting the on-line account wherein the server sends an authentication request to the mobile device and the mobile device in turn receives the authentication request and instructs the user to unlock the mobile phone (for example, by pass word or biometric). After successfully unlocking the mobile device, the mobile device requests the user to engage the inventive isolated hardware device (for example, a button on a phone case that activates the isolated hardware device) thereby permitting authentication between the isolated hardware device and the server. After the authentication protocol between the isolated hardware device and the server is completed, the user is granted access to an on-line account.

[0050] Referring now to Figures 2A-C, Figures 2A-C illustrate an embodiment of the invention wherein the mobile device comprises a mobile phone. While a mobile phone is shown in this embodiment, it is to be understood that any suitable device including a smartwatch, tablet, personal computer, smart ring, among other devices, could be employed. Figures 2A-C illustrate a mobile device (1) that engages a protective cover (2) such as the mobile device (1 ) being at least partially placed into a protective cover (2) containing a button (3) and an NFC chip (4). The button (3) is in communication with the NFC chip (4) by way of connection means (5). Examples of connection means include electrically conductive surfaces or wires. Whereas when a user wishes to access an online account, a request is received by the mobile device (1) over cellular network or WIFI (for example, the system illustrated in Figure 1). The user is then requested by the mobile device (1) to unlock the mobile device such as with a passcode or biometric. Once unlocked, the user is requested by the mobile device (1 ) to press the button (3) enabling the NFC chip (4) by way of the connection means (5) to begin the authentication process with the server containing the on-line account.

[0051] Referring now to Figures 3A-C, Figures 3A-C illustrate another embodiment of the invention wherein the mobile device comprises a mobile phone and a cover for the mobile device having an isolated hardware device. Figures 3A-C illustrate an isolated hardware device (6) that is placed into an inventive receptacle (7) in a protective cover (8). The isolated hardware device can comprise any suitable device such as an NFC device commercially available as Yubico™ U2F keys. The mobile device (1) is then placed into the protective cover (8) which constrains the isolated hardware device (6). A hole, slot or other exterior access feature including a flexible film or layer (10) in the protective cover (8) permits the user to interact with the isolated hardware device (6) (e.g., an opening that exposes a push button (9)). The isolated hardware device can be compression fit, glued or otherwise connected to the cover and, if desired, the isolated hardware device can be removably connected to the cover thereby permitting the device to be replaced with another device. Whereas when a user wishes to access an on-line account, a request is received by the mobile device (1) over cellular network or WIFI (for example, the system illustrated in Figure 1). The user is then requested by the mobile device (1) to unlock the mobile device such as with a passcode or biometric. Once unlocked, the user is requested by the mobile device (1) to press the button (9) enabling the isolated hardware device (6) to begin the authentication process with the server containing the on-line account.

[0052] Referring now to Figures 4A-C, Figures 4A-C illustrate another embodiment of the invention where the isolated hardware is embedded into an ID badge (11) (e.g., an electronic employee identification badge). While any suitable electronic ID badge can be employed, examples of suitable badges are available from HID (e.g., https://www.hidqlobal.com/product-displav/cards-and-credentials; hereby incorporated by reference). The ID badge (11) can employ conventional hardware (13) as well as an isolated hardware system comprising an NFC chip and antenna (15), a connection means (14), and a button such as a push button (12). While any suitable frequency can be employed in the ID badge or the isolated hardware, it is necessary that the frequencies are distinct and not interfering. Whereas when a user wishes to access an on-line account, a request is received by the mobile device (1) over cellular network or WIFI (for example, the system illustrated in Figure 1 ). The user is then requested by the mobile device (1) to unlock the mobile device such as with a passcode or biometric. Once unlocked, the user is requested by the mobile device (1) to present the ID badge (1 1 ) and press the button (12) enabling the isolated hardware device (15) by way of the connection means (14) to begin the authentication process with the server containing the on-line account. Combining the isolated hardware device and an employee badge enhances security as well as ease of use.

[0053] Referring now to Figure 5, Figure 5 illustrates the device of Figure 3 being used to unlock a physical hardware asset such as a vehicle (16). A mobile device (1 ) has a cover (8) which houses an isolated hardware device (6). A vehicle (16) has an antenna (20) which can be used to communicate (18) with an isolate hardware device (6). When a user approached the vehicle (16) with the isolated hardware device (6), the button (10) can be pressed to begin authentication. After authentication is complete, a signal (17) is broadcast from the isolated hardware device (6) which instructs the vehicle (16) to access the vehicle (e.g., to unlock the doors). The user can then enter the vehicle by opening a handle (19). While a mobile device is used to access a vehicle in this embodiment, it is to be understood that any suitable device including a smart watch, tablet, personal computer, among other devices, could be used to access (e.g., unlock) any hardware asset including a vehicle, safe, house, among other assets. It is also to be noted that a single isolated hardware device can be linked to multiple software or hardware assets and used to access each. For example, the isolated hardware device (6) could be used to unlock a vehicle, an online bank account, a safe, as well as a house, among other assets and devices and combinations thereof. This serves to reduce the number of security devices needed by an individual. For example, the combination of passwords, physical lock keys, 2^nd factor authentication devices, key cards, retina scanners, facial recognition devices, among other hardware and combinations thereof, can all be replaced by a single inventive isolated hardware device.

[0054] In a further embodiment of the invention, the foregoing embodiment is combined with the cover of Figure 1. That is, an ID badge and isolated hardware are temporarily or permanently connected to, embedded within or otherwise functionally associated with a mobile device cover.

[0055] The term“passwordless” is intended to mean that no password is required after the associated mobile device or isolated hardware has been initially configured or set up to work together as described herein. [0056] As used herein, the terms“comprises,”“comprising,”“includes,”“including,” “has,” “having” or any other variation thereof, are intended to cover a non-exclusive inclusion. For example, a method, an article, or apparatus that comprises a list of elements is not necessarily limited to only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Further, unless expressly stated to the contrary, “or” refers to an inclusive or and not to an exclusive or. For example, a condition A or B is satisfied by any one of the following: A is true (or present) and B is false (or not present), A is false (or not present) and B is true (or present), and both A and B are true (or present).

[0057] The transitional phrase "consisting of' excludes any element, step, or ingredient not specified. If in the claim such would close the claim to the inclusion of materials other than those recited except for impurities ordinarily associated therewith. When the phrase "consists of appears in a clause of the body of a claim, rather than immediately following the preamble, it limits only the element set forth in that clause; other elements are not excluded from the claim as a whole.

[0058] The transitional phrase "consisting essentially of' is used to define an article, method that includes materials, steps, features, components, or elements, in addition to those literally disclosed provided that these additional included materials, steps, features, components, or elements do materially affect the basic and novel characteristic(s) of the claimed invention, especially the mode of action to achieve the desired result of any of the processes of the present invention. The term 'consisting essentially of occupies a middle ground between“comprising” and 'consisting of.

[0059] Where applicants have defined an invention or a portion thereof with an open- ended term such as“comprising,” it should be readily understood that (unless otherwise stated) the description should be interpreted to also include such an invention using the terms“consisting essentially of or“consisting of.”

[0060] Also, use of “a” or“an” are employed to describe elements and components described herein. This is done merely for convenience and to give a general sense of the scope of the invention. This description should be read to include one or at least one and the singular also includes the plural unless it is obvious that it is meant otherwise.

[0061] Although certain aspects, embodiments and principals have been described above, it is understood that this description is made only way of example and not as limitation of the scope of the invention or appended claims.

Claims

Claims 1 ) A cover having at least one surface configured to engage at least a portion of a mobile computing device, and a password less and isolated apparatus for authenticating a user of the mobile computing device and wherein the isolated apparatus is connected to the cover. 2) The cover of claim 1 wherein the isolated apparatus is connected by being positioned within a feature defined on a surface of the cover. 3) The cover of claim 1 wherein the isolated apparatus is permanently connected to a surface of the cover. 4) The cover of claim 2 wherein the isolated apparatus comprises an NFC. 5) The cover of claim 1 wherein the isolated apparatus is accessible by the user from an exterior surface of the cover. 6) The cover of claim 5 wherein the exterior surface comprises an opening that permits the user to engage the isolated apparatus. 7) The cover of claim 5 wherein the isolated apparatus comprises an NFC and the user engages the NFC by a tactile surface. 8) The cover of claim 1 further comprising electronic identification of the user. 9) An identification badge comprising electronic identification of the user and isolated apparatus. 10) The identification badge of claim 9 wherein the electronic identification operates at a frequency that is different than the isolated apparatus. 11) A mobile computing device including the cover of claim 1. 12) A mobile computing device comprising an identification badge and the cover of claim

1.

13) A mobile computing device comprising the cover of claim 1 and at least one member selected from the group consisting of wearable electronics, phone, tablet and personal computer. 14) A mobile computing device comprising the cover of claim 1 and an isolated device for accessing at least one physical asset.

15) The mobile computing device of claim 14 wherein the physical asset comprises at least one member selected from the group consisting of a vehicle, residence and safe.

16) A method for accessing an internet connected account using a mobile computing device comprising the mobile computing device of claim 1 1 comprising:

i) a user interacting with the mobile computing device wherein the mobile computing device contacts a server hosting the internet connected account ii) the server sends an authentication request to the mobile computing device and the mobile computing device in turn receives the authentication request and instructs the user to unlock the mobile computing device, iii) after unlocking the mobile computing device, the mobile computing device requests the user to engage an isolated hardware device thereby permitting authentication between the isolated hardware device and the server, iv) completing the authentication protocol between the isolated hardware device and the server thereby granting the user access to an on-line account.

17) The method of claim 16 wherein the isolated hardware device comprising an NFC.

18) The method of claim 13 wherein the user engages the NFC by depressing a button on the NFC.