Simple Authentication for the Web - SAW

A secure and convenient alternative to the numerous User IDs and passwords used for online accounts. Securely authenticates users through their email accounts to avoid difficulties in managing and remembering site specific User IDs and passwords.

Users can access an online account by simply inputting their email address instead of setting up and remembering User IDs and passwords. The website then generates a random token which is split into two shares, and one of the shares is sent to the user’s email account and the other gets sent back to the account site. After seamlessly retrieving the token from the user’s email account, the system inputs the token and the user is given access to the online account.
General Information

SAW uses email as a primary means of authentication. Use of email for authorizing or re-authorization of users is commonplace in account management today. SAW builds on this accepted practice by using email as a primary source of authentication rather than just delivery of user IDs and passwords.

The Market

SAW can easily be adapted by websites that currently use email accounts to reset passwords. Potential websites include e-commerce sites, blogs, forums, wikis, social networking sites, personal web sites, photo sharing sites, digital libraries, mailing lists, and conference program committee sites. These are typically websites with lower security measures, but it can also be used as one of the authentication measures on sites desiring moderate to high security.
The Product

Advantages:

* More convenient and secure than resetting a password via email
* No need for administrators to create and manage new user accounts and passwords
* Avoids forgotten passwords, reusing or overusing passwords, or writing down passwords
* Thwarts passive attacks by encrypting and splitting a random token
* Complicates active attacks by only allowing access from the computer requesting the login
* Prevents phishing by avoiding the need to enter in sensitive passwords or other information for logins
* Efficient and cost effective, unilateral deployment
* Easily automated with no modification to email providers
* As an alternative to email, it can also work with instant messaging and text messaging (individually or combined)
* Token retrieval can be automated to speed up the login process
* Avoids portability issues of password managers

· Websites reluctant to solely use SAW (e.g. online banks) can still use it as an additional factor for authentication

Inventor(s): Kent Seamons, Tim Van Der Horst

Type of Offer: Licensing



« More Computer Science Patents

---