发明名称 |
Performing client authentication using onetime values recovered from barcode graphics |
摘要 |
Techniques are disclosed for authenticating users accessing computing applications, e.g., applications hosted in a cloud environment accessed using a variety of computing systems. As disclosed, an authentication process is performed using a certificate and private key installed on a mobile device and a nonce generated on the server. To authenticate a user, a server generates a nonce, encrypts the nonce with a public key associated with the user, and encodes the encrypted nonce in a barcode graphic (e.g., a QR code). The resulting barcode graphic is displayed to the user, and a mobile device scans the barcode graphic to recover the encrypted nonce. The encrypted nonce is decrypted using a private key stored on the mobile device. The clear text nonce is then displayed on the screen of the mobile device and used as a one-time password (OTP) for authentication. |
申请公布号 |
US9363259(B2) |
申请公布日期 |
2016.06.07 |
申请号 |
US201313900929 |
申请日期 |
2013.05.23 |
申请人 |
SYMANTEC CORPORATION |
发明人 |
Chenna Srinivas |
分类号 |
H04L29/06;H04L9/32;G09C5/00 |
主分类号 |
H04L29/06 |
代理机构 |
Patterson & Sheridan, LLP |
代理人 |
Patterson & Sheridan, LLP |
主权项 |
1. A method for authenticating a client device requesting access to a computing application, the method comprising:
in response to receiving a request to access the computing application:
encrypting a first nonce using a public key associated with the user, andencoding the encrypted nonce in a barcode graphic; sending the barcode graphic to the client device as a second factor authentication challenge, wherein the client device renders the barcode graphic on a display to be scanned by a mobile device and wherein the mobile device is configured to generate a second nonce by:
scanning the barcode graphic to recover the encrypted first nonce,accessing a private key from a certificate store on the mobile device,decrypting the encrypted first nonce, andpresenting, on a display of the mobile device, as the second nonce, the decrypted first nonce; receiving, from the client device, a response to the challenge which includes the second nonce; and upon determining the second nonce matches the first nonce, granting the client device access to the computing application. |
地址 |
Mountain View CA US |