WO2021091415A1

WO2021091415A1 - Method and system for authorizing a user

Info

Publication number: WO2021091415A1
Application number: PCT/RU2019/000797
Authority: WO
Inventors: Игорь Владимирович ЗАРУБИНСКИЙ; Алексей Геннадьевич ЧУБЕНКО; Ирина Викторовна ЖИГАЛОВА; Юлия Алексеевна ФИЛИЧЕВА; Яна Олеговна НЕСТЕРОВА; Иван Александрович ГЛЕБОВ; Наталия Юрьевна ЛИМИНА
Original assignee: Публичное Акционерное Общество "Сбербанк России"
Priority date: 2019-11-08
Filing date: 2019-11-08
Publication date: 2021-05-14

Abstract

The present technical solution generally relates to the field of computer technology, specifically to a method and system for authorizing a user on a website using a QR code. The technical result attained in solving the above technical problem is to provide the capability of tracking a QR code status. Said technical result is attained by implementing a method for authenticating a user which is carried out with at least one computing device, which method comprises steps in which: a request for user authentication is received; data on the type of authentication selected by the user and an identifier (ID) of a single account of the user are received; an authentication operation is registered and an operation identifier is formed; a QR code is generated, which includes information about the operation identifier and to which a corresponding status is assigned; the status of the QR code is tracked; on the basis of the data about the QR code status, it is determined that the operation is confirmed by the user, wherein the ID of the single account of the user is stored in the operation parameters; the user is authenticated according to the ID of the single account of the user.

Description

METHOD AND SYSTEM FOR USER AUTHORIZATION

FIELD OF TECHNOLOGY

[001] This technical solution generally relates to the field of computing, and in particular to a method and system for authorizing a user on a website using a QR code.

LEVEL OF TECHNOLOGY

[002] Currently, users who enter their credentials to log in to a website using unsecured devices and face the risk of disclosing their credentials to unauthorized persons. Therefore, a user input method is required to log in to websites that does not require the input of confidential information. Also, in some cases, users may find it difficult to manually enter credentials, for example, on devices with limited input capabilities.

[003] The closest technical solution to the claimed solution is the system and method disclosed in the application US 2015089610 (A1), publ. 03/26/2015 allowing the user to use a trusted device to provide confidential information to the identity provider using a QR code (Quick Response) so that the identity provider can access the website or collect information for the website. In the known solution, a user can securely authorize a website from an unsecured device by entering confidential information into a trusted device. An identity provider can generate a QR code to display on a website on an unsecured device. A user can scan a QR code using an application from an ID provider installed on a trusted device to transmit the QR code to the ID provider. An identity provider can validate a QR code and obtain credentials to authenticate a user, or can collect information for a website. Advantageously, a user can securely log into a website from untrusted devices using a trusted device. [004] The disadvantage of the known solution is its limited functionality, for example, the known solution lacks the function of tracking the status of the QR code, and therefore reduces the reliability of the system.

ESSENCE OF THE TECHNICAL SOLUTION

[005] The technical problem or task posed in this technical solution is to create a simple and reliable method and system for authorizing a user in a resource system through authentication using a QR code.

[006] The technical result achieved by solving the above technical problem is to provide the ability to track the status of the QR code. An additional technical result is the ability to cancel the login from an unreliable device after scanning the QR code.

[007] The specified technical result is achieved by implementing a user authentication method performed by at least one computing device, comprising the steps of: receiving a request for user authentication; get data on the type of authentication selected by the user, and the identifier (ID) of a single user account; an authentication operation is registered and an operation identifier is generated; generate a QR code, which includes information about the operation identifier and assign it a corresponding status; track the status of the QR code; based on the data on the status of the QR code, it is determined that the operation is confirmed by the user, and the ID of a single user account is stored in the operation parameters; authenticate the user by the ID of a single user account.

[008] In one of the particular embodiments of the method, the following steps are additionally performed, at which: based on the QR code status data, it is determined that the QR code has been scanned by the user; send a request to the user to confirm the authentication operation.

[009] In another particular embodiment of the method, after receiving an authorization code request, the following steps are additionally carried out, at which: an authorization code request is received from a partner device, the request parameters of which include the resource system account ID; generate authorization code data and send it to the resource system; receive from resource system request for an access code, the parameters of which include the authorization code data and the resource system account ID; authorize the resource system based on the results of checking the authorization code data sent to the resource system and the authorization code data received from the 5 resource system; send to the resource system an access code containing the ID of a single user account.

[010] In another particular embodiment of the method, the steps are additionally performed, which include: the parameters of the request for the authorization code include a parameter for preventing cross-site request forgery generated by the resource system device, and the generated authorization code data is redirected to the user along with the parameter for preventing cross-site request forgery ; obtaining authorization code data and a parameter for preventing cross-site request forgery from the user through the resource system device; 15, based on the comparison results of the cross-site request forgery prevention parameter generated by the resource system device and said parameter received from the user, a request for obtaining an access code is generated, in which authorization code data is included.

[011] In another preferred embodiment of the claimed 20 solution, a user authentication system is provided comprising at least one computing device and at least one memory device containing machine-readable instructions that, when executed by at least one computing device, perform the above method.

25 BRIEF DESCRIPTION OF DRAWINGS

[012] Features and advantages of the present invention will become apparent from the following detailed description of the invention and the accompanying drawings, in which:

FIG. 1 shows an example of a user authorization system. FIG. 2 is an example of a general view of a computing device.

DETAILED DESCRIPTION OF THE INVENTION

[001] The following will describe the concepts and terms necessary to understand this technical solution. [002] In this technical solution, the system means, including a computer system, a computer (electronic computer), a CNC (numerical control), a PLC (programmable logic controller), computerized control systems and any other devices capable of performing a given , a well-defined sequence of operations (actions, instructions).

[003] By a command processing device is meant an electronic unit, a computing device, or an integrated circuit (microprocessor) that executes machine instructions (programs).

[004] A command processor reads and executes machine instructions (programs) from one or more storage devices. The role of data storage devices can be, but are not limited to, hard disks (HDD), flash memory, ROM (read only memory), solid state drives (SSD), optical drives.

[005] A program is a sequence of instructions for execution by a computer control device or command processing device.

[006] In accordance with the diagram of FIG. 1, a user authorization system 100 includes: user devices 10, a resource system 20 (eg, a partner or other automated system (AS) device), a user authentication device 30, and a user authentication request processing device 40.

[007] User devices can be: device 11 interaction with the site and device 12 of the mobile application. In a private implementation of the solution, the device 11 for interacting with the site can be, for example, a laptop or stationary computer, a mobile phone or a smartphone, a tablet, etc., equipped with application software - a browser that provides the ability to: view web pages, the content of web documents , computer files and their catalogs; web application management; as well as for solving other problems. The mobile application device 12 is a computing device that is configured to work with various types of mobile applications, for example, the Sberbank-online mobile application, and is equipped with means, for example, a photo and / or video camera, for capturing images, in particular QR images. code. For example, the device 12 of the mobile application can be made in the form of a mobile phone, a smartphone or a tablet. To use the application on the said device 12, the user needs to be authorized by the identifier (ID) of a single user account. The user can obtain the said ID of the unified account by registering through the said application or others known from the prior art from the provider of this application, which generates the (ID) of the unified user account and sends it to the said storage device 12.

[008] The resource system 20 integrates information, financial, material, labor resources with the necessary fixed assets, which ensure the life cycle of products: materials - products - goods. The purpose of the resource system 20 is to process the materials into a product that the user needs. The task of this system is to ensure decision-making regarding the development of a managed object - an integrated resource based on new computer technologies (see O.S. Grigorov et al. “MANAGING THE BUSINESS POTENTIAL OF PRODUCTION SYSTEMS, Novosibirsk 2002, 56p., Http://window.edu .ru / resource / 799/37799 / files / rn bus1.pdf). The resource system 20 can be implemented on the basis of at least one server configured to provide a user of the device 11 via a website of a different type of service. The resource system 20, in the particular case of its implementation, contains: a module 21 for processing user requests and a routing module 22. These modules can be implemented on the basis of the firmware of the resource system 20, modified in the software part in such a way as to perform the functions assigned to these modules below.

[009] The user authentication device 30 and the user authentication request processing device 40 may also be implemented on the basis of at least one server, the user authentication device 30 may comprise a user communication module 31 and an authentication module 32, and the request processing device 40 for user authentication may include: database 41 (DB) and module 42 processing requests for authentication. These modules can also be implemented on the basis of the firmware of the device 30 and device 40 respectively, modified in the software part in such a way as to perform the functions assigned further to these modules.

[010] Accordingly, the user, through the device 11 for interacting with the website, in particular using a browser, can go to the resource system 20, for example, by visiting the website of the resource system 20 or installing an appropriate application, to view its contents, information about which is sent to the device 11 by the resource system 20. For example, the user can be displayed information about the services provided by the resource system 20 (obtaining a mortgage, a catalog of goods, providing information about the status of accounts and cards, making payments, etc.), and the user can device 11 to send a request to receive at least one service provided by the resource system 20.

[011] In the process of generating a request for a service, or at any other moment in time, for example, when entering the resource system 20 (ie, authorization), the user can send an authorization request to the resource system 20 for presentation to him (the user) additional functions provided for authorized users of the resource system 20. To enter the resource system 20, the user can use a single account for authentication on a plurality of unrelated Internet resources, information about which is contained in the database 41 of the user authentication device 40, for example, as a UID. For this, the user through the device 11 interacts with the resource system 20 by sending the corresponding command / request for authorization, which is sent to the module 21 for processing user requests of the resource system 20.

[012] For example, in the case of logging into the website of the resource system 20 using the OIDC (Open ID Connect) protocol upon receipt of an authorization request, the request processing module 21 sends a request to the routing module 22 to obtain a parameter protecting against cross-site forgery (State) and a parameter that protects against copying requests (Nonce). The routing module 22 generates the specified parameters using methods known from the prior art, creates an authorization operation, stores the State and Nonce values in the operation parameters, and then returns the specified parameters and the authorization operation identifier to the module 21. Module 21 stores in memory, which it can be additionally equipped with, the identifier of the authorization operation and sends a request for an authorization code (AUTHCODE) to the module 31 of communication with the user, sending in the request State, Nonce, a URI reference to which the user should be returned after successful authentication

(REDIRECTMJRI), and the resource system identifier (ID). Also, the resource system ID, the resource system password and REDIRECT_URI can be pre-entered into the database 41 when registering the resource system 20 in the device 40 for processing requests for user authentication.

[013] The authentication module 31 validates the authorization code request parameters (AUTHCODE) by methods known from the prior art and, if successful, sends an authentication form to the site interaction device 11, which is displayed to the user. When the user selects authentication using a QR code, the authentication module 31 receives data on the type of authentication - authentication using a QR code (PAT_QR) from the device 11, after which the said module 31 generates and sends a user authentication request to receive a QR code to the module 42 processing requests. In the request, the aforementioned module 31 sends data about the type of authentication (PAT_QR), State, Nonce, resource system ID, REDIRECT_URI (hereinafter referred to as OIDC parameters), as well as the IP address, browser name and operating system of the user's computer, collected by methods known from the prior art. The module 42 for processing requests upon receipt of the user's authentication request registers the authentication operation in the database 41, generates the operation identifier (QRID), stores the data received from the module 31 together with the operation identifier and assigns the status to the operation "New", after which the module 42 generates a QR code, which includes information about the operation identifier.

[014] The generated QR code and the operation identifier are sent by the request processing unit 42 to the user communication unit 31 for transmission and output on the website interaction device 11. Also, the module 31, in accordance with the software and hardware algorithm put in it by the user of the device 30, periodically addresses the database 41 through the request processing module 42 to obtain the current status of the authentication operation, sending an operation identifier (QRID) in the status check request. [015] Further, for authorization in the resource system 20, the user needs to launch the application on the device 12 of the mobile application, using methods known from the prior art, to authorize in the application using the ID of a single user account, after which, using the mobile application and device 12 of the mobile application, the user needs to scan the image displayed on the website interaction device 11. Upon receipt of the QR code image, the device 12 extracts the operation identifier (QRID) from it and sends it to the request processing module 42, which, upon receiving the operation identifier (QRID), changes the "New" status for the given operation identifier (QRID) in the database 41 to the status "Scanned", after which the module 42 extracts from the database 41 information about the operation, including its identifier (QRID), and returns it to the module 12 of the mobile application.

[016] Next, through the mobile application device 12, the user confirms the operation by sending an authentication confirmation request to the request processing unit 42 with an operation identifier (QRID) and an operation status of “Confirmed”. Additionally, in the request for confirmation of authentication, said device 12 includes a single user account ID. Also, additionally, the user known from the prior art can sign the said request with his digital signature, information about which is stored in the said device 12.

[017] The module 42 for processing requests changes the status for this operation identifier (QRID) in the database 41 to the status "Confirmed" and saves in the parameters of the authentication operation ID of a single user account. Accordingly, when the user communication module 31, when accessing the database 41 through the request processing module 42, determined that the operation identifier (QRID) has the "Confirmed" status, the user communication module 31 sends an operation identifier (QRID) in the request to the module 42 to receive authorization code AUTHCODE, REDIRECT URI and State stored for this operation identifier (QRID) in the database 41.

[018] Upon receipt of an authorization code request from the user communication module 31, the module 42 authenticates the user from whom the authentication request with the same operation identifier (QRID) was previously received, and returns by means of the module 31 to the website interaction device 11 AUTHCODE, REDIRECT URI and State. By REDIRECT URI device 11 interaction with the website is redirected to the resource system 20 of the partner's site, after which the device 11 directs to the module 21 for processing user requests AUTHCODE and State.

[019] The module 21 processing user requests, having received AUTHCODE and State, transmits them to the module 22 routing in conjunction with the value of the current user authorization in the resource system. The routing unit 22 compares the State value received from the unit 21 with the State value stored in the previously generated authorization operation data. If the values match, then the user request processing module 22 sends a request to the authentication module 32 to obtain an access code, which includes: the obtained AuthCode value, resource system ID, resource system password, REDIRECT URI (the same URI that was sent in the request for the authorization code).

[020] The AuthCode 32 verifies the AuthCode by comparison with the AuthCode previously sent by the module 31 to the website interaction device 11, the resource system identifier and the resource system password, and then authorizes the resource system based on the results of verifying the authorization code data directed resource system, and authorization code data received from the resource system, and issues Access Token (access code) and ID TOKEN (a set of user data that is necessary to identify a user in the resource system, including the external user ID of the bank's AS (sub), transmitted to external consumers, generated based on the ID of a single user account extracted from the parameters of the authentication operation, as well as the Nonce parameter). The routing module 22, having received the ID TOKEN, checks the Nonce value that is stored in the parameters of the user operation with the one received in ID_TOKEN. If the values match, then the routing module 22 identifies the client by the external user ID of the AC bank (sub) obtained in ID_TOKEN. Further, the routing module 22 authorizes the user and returns to the module 21 a page for displaying to the user, which is redirected to the device 11 for interacting with the website. Thus, the user of the device 11 for interacting with the website gets authorized access to the resource system 20.

[021] In general (see Fig. 2), the computing device contains one or more processors (201), memory means such as RAM (202) and ROM (203), input / output interfaces (204), input / output devices (205), and a device for networking (206).

[022] The processor (201) (or multiple processors, multi-core processor, etc.) can be selected from a range of devices currently widely used, for example, such manufacturers as: Intel ™, AMD ™, Apple ™, Samsung Exynos ™, MediaTEK ™, Qualcomm Snapdragon ™, etc. Under the processor or one of the processors used in the system (200), it is also necessary to take into account the graphics processor, for example, NVIDIA GPU with a CUDA-compatible programming model, or Graphcore, the type of which is also suitable for full or partial execution of the method, and can also be used for training and application of machine learning models in various information systems.

[023] The RAM (202) is a random access memory and is intended for storing machine-readable instructions executed by the processor (201) for performing the necessary operations for logical data processing. RAM (202), as a rule, contains executable instructions of the operating system and corresponding software components (applications, software modules, etc.). In this case, the available memory of a graphics card or a graphics processor can act as RAM (202).

[024] ROM (203) is one or more persistent storage devices, such as a hard disk drive (HDD), solid state data storage device (SSD), flash memory (EEPROM, NAND, etc.), optical storage media ( CD-R / RW, DVD-R / RW, BlueRay Disc, MD), etc.

[025] Various types of I / O interfaces (204) are used to organize the operation of the system components (200) and to organize the operation of external connected devices. The choice of the appropriate interfaces depends on the specific version of the computing device, which can be, but are not limited to: PCI, AGP, PS / 2, IrDa, FireWire, LPT, COM, SATA, IDE, Lightning, USB (2.0, 3.0, 3.1, micro, mini, type C), TRS / Audio jack (2.5, 3.5, 6.35), HDMI, DVI, VGA, Display Port, RJ45, RS232, etc.

[026] To ensure the interaction of the user with the computing system (200), various means (205) I / O information are used, for example, a keyboard, display (monitor), touch display, touch-pad, joystick, mouse manipulator, light pen, stylus, Touchpad, trackball, speakers, microphone, augmented reality, optical sensors, tablet, light indicators, projector, camera, biometric identification (retina scanner, fingerprint scanner, voice recognition module), etc. [027] The networking tool (206) provides data transmission via an internal or external computer network, for example, Intranet, Internet, LAN, and the like. One or more means (206) may be used, but not limited to: Ethernet card, GSM modem, GPRS modem, LTE modem, 5G modem, satellite communication module, NFC module, Bluetooth and / or BLE module, Wi-Fi module, and dr.

[028] Additionally, satellite navigation means can be used as part of the system (200), for example, GPS, GLONASS, BeiDou, Galileo. [029] The specific choice of elements of the device (200) for the implementation of various software and hardware architectures can vary while maintaining the required functionality provided.

[030] Modifications and improvements to the above-described embodiments of the present technical solution will be clear to those skilled in the art. The foregoing description is provided by way of example only and is not intended to be limiting in any way. Thus, the scope of the present technical solution is limited only by the scope of the attached claims.

Claims

CLAIM

1. A method for user authentication performed by at least one computing device, comprising the steps of:

- receive a request for user authentication;

- receive data on the type of authentication, selected by the user, and the identifier (ID) of a single user account;

- the authentication operation is registered and the operation identifier is generated; generate a QR code, which includes information about the operation identifier and assign it a corresponding status;

- track the status of the QR code;

- based on the data on the status of the QR code, it is determined that the operation is confirmed by the user, and the ID of a single user account is stored in the operation parameters;

- authenticate the user by the ID of a single user account.

2. The method according to claim 1, characterized in that the steps are additionally performed, at which:

- based on the data on the status of the QR code, it is determined that the QR code has been scanned by the user;

- send a request to the user to confirm the authentication operation.

3. The method according to claim 1, characterized in that after receiving the request for the authorization code, the following steps are performed:

- receive an authorization code request from the partner's device, the request parameters of which include the resource system account ID;

- generate authorization code data and send them to the resource system;

- receive an access code request from the resource system, the parameters of which include the authorization code data and the resource system account ID;

- authorize the resource system based on the results of checking the authorization code data sent to the resource system and the authorization code data received from the resource system; - send to the resource system an access code containing the ID of a single user account.

4. The method according to claim 3, characterized in that the steps are additionally performed, at which: - the parameters of the authorization code request are included in the parameters for preventing cross-site requests forgery, generated by the resource system device, and the generated authorization code data is redirected to the user along with the parameter to prevent cross-site request forgery; - receiving authorization code data and a parameter for preventing cross-site request forgery from the user via the resource system device;

- based on the results of comparison of the parameter to prevent cross-site request forgery generated by the resource system device and the said parameter received from the user, a request for obtaining an access code is formed, in which authorization code data is included.

5. User authentication system containing at least one computing device and at least one memory device containing machine-readable instructions, which, when executed by at least one computing device, perform the method according to any one of claims. 1-4.