Information Access Handover

Abstract

A computer-based method of information access handover between a first device and a second device of a user is presented. The method includes displaying a QR code generated by a synchronizer on the first device. The method further includes capturing the QR code with the second device to display a data record, and providing a registration option to associate the data record with the user at a relying party. The method further includes performing a web authentication registration, and performing an information access handover and security protection process in response to successful performance of the web authentication registration flow. The information access handover and security protection process includes sharing a unique user identifier and a device identifier with the first device by the second device, storing them at the first device, and securing access to the data record. Corresponding systems and computer programs are also provided.

Description

[Technical field]

[0001] The present invention relates generally to information access handover, and more particularly to a computer-implemented method, system, and computer program product for information access handover between a first device and a second device of a user. [Background technology]

[0002] Access to information, especially information accessible via the Internet, always involves security risks. Most information or corresponding data is secured by being linked to a user account. A user account is usually defined by credentials such as a username and a password. However, one-factor authentication using only a username and a password still poses a high risk: the username and password can be hacked or guessed by a brute force algorithm on the user's computer, the server on which the credentials are stored can also be hacked, or the credentials can become known to a third party by other means.

[0003] Furthermore, many users do not want to create a user account, but still need access to their data. In such cases, the remotely stored data can be secured by linking it to some other access credentials, such as an identifier and a corresponding key. For example, if the data is related to photos of an event stored on a cloud server, the access credentials can relate to the name of the event and the name of the photographer. Or, if the data is related to a flight / travel reservation, the access credentials can be the reservation number and the last name of the main traveler. However, this is still as insecure as setting up a user account, or even more so than setting up a user account.

[0004] In the last few years, two-factor authentication has been invented and proven to improve security. Two-factor authentication works by adding an extra layer of security. To access a user account, two-factor authentication requires additional login credentials beyond just a username and password. There are three main types of additional login credentials: (1) person-specific additional credentials, such as answers to security questions or PIN numbers; (2) device-specific additional credentials, such as security tokens or application tokens; and (3) biometric additional credentials, such as facial, retinal, voice, and fingerprint identification. The use of such additional credentials still requires the user account to be manually created first.

[0005] An alternative to this two-factor approach is so-called passwordless authentication, which is a one-factor authentication method, but is not based on an insecure username / password combination. With passwordless authentication, a user can log into a computer system without entering a password or any other knowledge-based secret. The user is asked to enter a public identifier, such as a username, phone number, email address, etc., and then completes the authentication process by providing secure proof of identity through a registered device or token. Passwordless authentication methods typically rely on a public key cryptography infrastructure, where a public key is provided upon registration with an authentication service, while a private key is kept on the user's device and can only be accessed by providing a non-knowledge-based biometric signature or another authentication factor. However, passwordless authentication using biometric identification still requires the user's device to have biometric identification capabilities. Summary of the Invention [Problem to be solved by the invention]

[0006] Thus, when a first user device is used, and the first user device does not have biometric identification capability, but a second user device can provide biometric identification capability, there is a need for secure information access handover from such a first device to such a second device. [Means for solving the problem]

[0007] Against this background, methods, systems and computer program products are presented as defined by the independent claims.

[0008] More specifically, a computer-implemented method of information access handover between a first device and a second device of a user is presented. The first device associated with a first device identifier is a device without biometric identification capability, and the second device associated with a second device identifier is a device with biometric identification capability. The method includes displaying a QR code generated by a synchronizer on the first device in response to creating a data record via the first device at a first time. The method further includes capturing the QR code by the second device, initiating a step of displaying the data record on the second device, where access to the data record is granted through access parameters carried by the QR code, and a step of providing the user at the second device with a registration option to associate the data record with the user at a relying party.

[0009] The method further includes, in response to selecting the registration option, performing a web authentication registration flow using a biometric identification function of the second device, where a unique user identifier used to identify the user is automatically created from information provided by the QR code. Furthermore, the method includes, in response to successful performance of the web authentication registration flow to register the user with the relying party using the unique user identifier and the second device identifier, performing an information access handover and security protection process. The information access handover and security protection process includes sharing, by the second device, the unique user identifier and device identifier with the first device, storing the unique user identifier and the second device identifier at the first device, and securing access to the data records at the relying party by disabling access using access parameters and enabling access using the unique user identifier and the second device identifier using the web authentication flow.

[0010] In addition, a system for information access handover is presented, comprising a first device of a user, a second device of the user, a relying party, and a synchronizer, the first device, the second device, the relying party, and the synchronizer being connected via a network and configured to perform the methods described herein.

[0011] Finally, a computer program is presented that includes instructions that, when executed by a computer, cause the computer to carry out the methods described herein.

[0012] Further improvements are described by the dependent claims.

[0013] The above and other objects, embodiments, and advantages will become readily apparent to those skilled in the art from the following detailed description of the embodiments, which proceeds with reference to the accompanying drawings. The present invention is not limited to any particular embodiment.

[0014] The foregoing, as well as further objects, features, and advantages of the present subject matter will become apparent from the following description of illustrative embodiments, which proceeds with reference to the accompanying drawings, in which like numerals are used to represent like elements, and in which: [Brief description of the drawings]

[0015] [Figure 1] FIG. 1 presents a system for information access handover. [Diagram 2] 1 is a flow diagram of an information access handover method between a first device and a second device. [Diagram 3] FIG. 2 is a flow diagram of an embodiment of an information access handover method. [Figure 4] FIG. 13 is a diagram illustrating an example of a web authentication registration flow. [Diagram 5] FIG. 11 is a flow diagram of an example of initiating a web authentication flow with a second device. [Figure 6] FIG. 13 is a flow diagram of an example of initiating a web authentication flow with a first device. [Figure 7] FIG. 13 is a flow diagram of an embodiment of an example of initiating a web authentication flow with a first device. [Figure 8] FIG. 13 is a diagram illustrating an example of a web authentication flow. [Figure 9] FIG. 13 presents an example of using a biometric identification function with a second device. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0016] The present disclosure relates to a method and system for information access handover between a first device and a second device of a user.

[0017] 1 shows an overview of a system 100 for information access handover between a first device and a second device of a user. The system comprises a first device 101, a second device 102, a relying party 103 and a synchronizer 104, which are connected via a network 105. The first device 101 and the second device 102 belong to or are otherwise associated with a user 106.

[0018] The first device 101 is a device without biometric identification capabilities and may be a personal computer, a laptop, a tablet computer, a mobile phone, a public computing system, etc. In a preferred embodiment, the first device 101 is a personal computer or a laptop. The user 106 may be the owner of the first device 101 or may otherwise have access to the first device 101. The first device 101 may be associated with a first device identifier that allows other systems to unambiguously identify the first device 101 and / or establish a connection to the first device 101 over the network 105.

[0019] The second device 102 is a device with biometric identification capabilities and can be a personal computer, laptop, tablet computer, mobile phone, etc. In a preferred embodiment, the second device 102 is a smartphone or tablet computer. The biometric identification capabilities of the second device can include at least one of a fingerprint sensor with or without device association, a camera with facial recognition and / or iris (retina) identification, or a microphone with voice identification. The user 106 may be the owner of the second device 102 or may otherwise have access to the second device 102. The second device 102 may be associated with a second device identifier that allows other systems to positively identify the second device 102 and / or establish a connection to the second device 102 via the network 105.

[0020] The relying party 103 may be a computing system of a service provider such as a cloud storage provider, an airline, a hotel, a reservation provider, an email provider, an energy resource provider, etc. The relying party 103 may relate to any computing system that requires authentication of a user. The relying party 103 may be a single server, a distributed server system, or a virtual or cloud server system.

[0021] The synchronizer 104 may be a third-party computing system or may be included within the computing system of the relying party 103. The synchronizer 104 may relate to any computing system that allows for the synchronization of two devices that provide the features and services described herein. The synchronizer 104 may be a single server, a distributed server system, or a virtual or cloud server system.

[0022] The network 105 may be a wide area network, a global network, the Internet, or a similar network, which may be a public or private network and / or may include multiple interconnected networks, as known in the art.

[0023] The first device 101, the second device 102, the relying party 103, and / or the synchronizer 104 may include at least one processor, memory, and a network interface device that communicate with each other via a bus. Optionally, the first device 101, the second device 102, the relying party 103, and / or the synchronizer 104 may further include a static memory, a disk drive unit, and a user interface. A video display, an alphanumeric input device, and a cursor control device may be examples of the user interface. The memory of the first device 101, the second device 102, the relying party 103, and / or the synchronizer 104 may be a main memory, a random access memory (RAM), and / or any other volatile memory. The memory may store temporary data and program data for facilitating the execution of the face recognition machine learning network. The memory may also comprise one or more caches that store data recently retrieved over the network 105 from a database, for example a database associated with the relying party 103 and / or the synchronizer 104. The caches may be level 1 (L1) caches, level 2 (L2) caches, and / or level 3 (L3) caches. The memory may also store computer program data for implementing the methods described herein.

[0024] Figure 2 presents a flow diagram of an information access handover method according to an embodiment at a first time point. At arrow 201, the first device 101 displays a QR code generated by the synchronizer 104 (not shown in Figure 2). The generation and display of the QR code is performed in response to creating a data record via the first device 101. For example, the user 106 visits a website, for example the website of the relying party 103 or another website related to the relying party 103, such as a provider of a functionality required by the relying party 103, and requests a service and / or product. The service or product is then reserved, purchased or reserved for the user 106.

[0025] As a result, data records are created for the products and / or services and the user 106, which may be stored in a database. The database may be part of a computing system of the relying party 103 or a third party. In a preferred embodiment, the data records may contain personal data of the user 106, such as sensitive data such as name, date of birth, credit card number, etc., and may be stored in a third party database that provides specific functionality to the relying party 103. Access to the stored data records may only be possible by using standardized access parameters related to the data records. For example, access to the data records may be granted in response to entering the name of the user 106 and a specific identifier generated when generating the data record.

[0026] After creating the data record with the relying party 103 or a third party on behalf of the relying party 103, a QR code is generated in the synchronizer 104 and sent to the first device 101 for display. A QR code is a machine-readable optical signature capable of encoding various types of information. QR codes use four standardized encoding modes (numeric, alphanumeric, byte / binary, and Kanji) to efficiently store data. Thus, the QR code can initiate various types of processes in the device that scans the QR code. In a preferred embodiment, the QR encodes at least one of the following: personal information of the user, an identifier associated with the data record, a random number, a timestamp, or a first device identifier. In some embodiments, the QR code is time-dependent and changes periodically after a period of time. Thus, a new QR code is generated every few seconds or minutes to further improve security. In such a case, the QR code can encode a timestamp. For example, if a QR code is generated for a travel reservation, specifically a flight reservation, the QR code may include a link to a website to retrieve the data record, a reservation number (usually six alphanumeric digits), the last name of the primary traveler, and a first device identifier, and a timestamp to limit the validity of the QR code.

[0027] At arrow 202, the second device 102 captures the QR code. For example, a user 106 uses the camera of the second device 102 to scan the QR code with its camera. In response to capturing the QR code, the QR code initiates arrows 203 and 204. At arrow 203, the data record is displayed. For example, the QR code may include a link to a website, such as a website of the relying party 103 or a third party providing services on behalf of the relying party 103, and access parameters for accessing the data record. Thus, the QR code may initiate calling up the website on the second device 102 and retrieving and displaying information of the data record by accessing the data record via the relying party 103.

[0028] At arrow 204, a registration option is provided to the user 106 at the second device 102 to associate the data record with the user 106 to secure access to the data record. For example, the website displayed at arrow 203 may include and provide the registration option to the user 106. Alternatively, the registration option may be a pop-up generated via the website, may come as an SMS, MMS, or instant message, may be provided in a small application or the like.

[0029] When the user 106 selects the registration option, a web-authenticated registration flow is initiated at arrow 205. This web-authenticated registration flow thereby uses the biometric identification capabilities of the second device 102. A web-authenticated registration flow would normally require identifying the user 106 based on a previous registration of the user 106 made in a database of the relying party 103 or otherwise identifying the user 106. However, the present method creates a unique user identifier for identifying the user 106 automatically, i.e., without any necessary interaction of the user 106, from the information carried by the QR code. For example, the name of the user 106 is extracted from the QR code, as well as a random number or a timestamp when the QR code was generated. When these types of information are mixed, appended, or otherwise combined, for example via the creation of a hash, a unique user identifier is generated.

[0030] Once the web authentication flow has been successfully performed, i.e. the user 106 has been registered with the relying party 103 with a unique user identifier and a second device identifier and secured with the biometric information of the user 106, e.g. through a public and private key procedure, the information access handover and security process begins, including arrows 206, 207 and 208. At arrow 206, the unique user identifier and the second device identifier are shared by the second device 102 with the first device 101, e.g. through a synchronization server, or directly between the two devices, e.g. via a web socket technique over the network 105, or via Bluetooth or similar technology.

[0031] At arrow 207, the unique user identifier and the second device identifier are stored at the first device 101. For example, the unique user identifier and the second device identifier are stored in a browser cache associated with a website of the relying party 103. Alternatively or in addition, the unique user identifier and the second device identifier are stored in local storage at the first device 101 associated with the relying party 103.

[0032] Finally, at arrow 208, at relying party 103, access to the data record is secured in such a way that access to the data record is disabled for the access parameters and is only possible by using a unique user identifier and a second device identifier using a web authentication flow. For example, user 106 and anyone else, especially unauthorized people and criminals, can no longer access the data record using the (unsecure) access parameters, but must use a web authentication flow starting from second device 102. This is achieved by not forcing user 106 to create a user account, but by only securing the data record by using a web authentication based on biometric information and a second device identifier.

[0033] It should be noted that although arrows 206 and 208 are shown to be performed in parallel, the respective procedures may be performed sequentially or in another temporal order. The same applies to arrows 203 and 204, which may be performed in parallel, sequentially or even in another temporal order. The present invention provides a secure method for secure handover of access rights to digital resources (data records in this case) and sharing of unique user identifiers between two devices without the need to create user profiles.

[0034] Figure 3 presents a detailed flow diagram of one embodiment of the information access handover method described herein. Arrows 201 to 208 are the same as those described with respect to Figure 2. However, before displaying the QR code at arrow 201, a request for a QR code is sent at arrow 301 from the first device 101 to the synchronizer 104 so that the QR code can be retrieved at the first device 101, and then at arrow 201 the QR code is displayed at the first device 101.

[0035] After capturing the QR code at arrow 202, the QR further initiates arrows 302, 303, and 304. At arrow 302, the synchronizer 104 is provided with a second device identifier. The synchronizer 104 then establishes a secure connection between the first device 101 and the second device 102 by using the first device identifier and the second device identifier.

[0036] For example, the first device identifier and / or the second device identifier can be at least one of an IP address, a MAC address, or another unique device identifier that allows a connection between the respective devices to be established. Arrows 303 and 304 show data exchanges between the second device 102 and the synchronizer 104 (arrow 303) and between the first device 101 and the synchronizer 104 (arrow 304) that are required to set up a secure connection indicated by the dotted line 310. The data exchanges can include, for example, requests from the synchronizer 104 to the first and second devices to set up a secure connection, and responses from the first or second devices to this request. The requests and responses can transfer different information that is required to set up the secure connection 310.

[0037] The secure connection 310 between the first device 101 and the second device 102 can be created as a bidirectional connection using a WebSocket approach, or a one-way connection from the second device to the first device, using polling, or a Server Sent Events SSE approach with Web-RTC. Although the secure connection 310 is shown as being established between the first device 101 and the second device 102, the connection may be routed through various servers and / or supported by a server, such as the synchronizer 104.

[0038] Although the arrows 203 and 204 pointing to the display of the data record and the provision of the registration option are shown to occur in due time after the establishment of the secure connection 310, the order of the processes indicated by the arrows 302, 303, 304, 203 and 204 may be changed in any suitable manner. However, it may be advantageous to first establish the secure connection 310, since this connection may for example be used to transmit information relating to the data record to be displayed on the second device 102 indicated in the arrow 203 directly from the first device 101 to the second device 102. Furthermore, the provision of the registration option in the arrow 204 may also be implemented by providing, for example, a small application or the like, through the secure connection 310.

[0039] The web authentication registration flow of arrow 205 is the same as that described with respect to Fig. 2. Since the secure connection 310 has already been set up before sharing the unique user identifier and the second device identifier with the first device 101 in arrow 206, the unique user identifier and the second device identifier are consequently shared through the secure connection. This further secures the whole information access handover process. Finally, storing these identifiers in arrow 207 and securing the access in arrow 208 are also the same as that described with respect to Fig. 2.

[0040] 4 illustrates how a web authentication registration process can be performed according to one embodiment. At arrow 401, a user agent 102a of a second device 102 requests a first challenge from the relying party 103 to be registered with the relying party 103. The user agent 102a can be a web browser, a lightweight application, or a script running on the second device 102. The request for the first challenge thereby includes a unique user identifier and a second device identifier, which are later used in the relying party 103 to associate the response to the first challenge with the user 106, which can then also be associated with a data record upon registration of the user 106.

[0041] At arrow 402, a first challenge is sent from the relying party 103 and received by the user agent 102a. The first challenge can be a random value or a buffer of cryptographically random bytes generated on the relying party 103. The user agent 102a then forwards the first challenge to the authenticator 102b of the second device 102 along with a new credentials command. The user agent 102a can also add additional information such as an identifier of the relying party 103, e.g. a web address. The new credentials command creates new credentials at the authenticator.

[0042] The user 106 is then prompted by the authenticator 102b for a biometric authorization, indicated by arrow 404. For example, the user 106 is asked to place his finger on a fingerprint sensor, activate a camera for a face scan, etc. Then, at arrow 405, the biometric function of the second device 102 authorizes the user to the authenticator 102b. Following this, at arrow 406, the authenticator 102b sends new credentials and a signed first challenge to the user agent 102a. The new credentials include a private key and a public key, and the first challenge is signed with the private key. Thus, authentication is based on public-private key cryptography.

[0043] Then, as shown at arrow 407, the user agent 102a sends the public key and the signed first challenge to the relying party 103, which may also store the private key in the memory of the second device 102. The relying party 103 then checks the signed challenge, i.e. decrypts it with the public key, and compares the random value of the sent first challenge with the random value received. The relying party 103 may also perform other processes to ensure that the user 106 has been authenticated. If the relying party 103 can ensure that the authentication of the user 106 is successful, the user 106 is registered with the relying party 103 using the unique user identifier and the second device identifier of the second device 102, which is shown at arrow 408.

[0044] 5 presents another flow diagram of an embodiment of an additional process of the information access handover method described herein, which occurs at a time later than the first time the user is registered, for example as shown in FIGS.

[0045] Arrow 501 indicates a login request of the user 106 at the second device 102. For example, the second device 102 may display a button that the user 106 can select to login for the purpose of viewing data records. A new web authentication flow of the relying party 103 with the second device 102 may then be initiated, as indicated at arrow 502. This web authentication flow may authenticate the user 106 using biometric capabilities of the second device 102. In response to a successful execution of the web authentication flow, the user 106 is logged in at the relying party 103, as indicated at arrow 503.

[0046] After the user 106 logs in, the data record is accessed. For example, the data record can be retrieved from a third party 510 that stores the data record on behalf of the relying party 103. Thus, at arrow 503a, the relying party 103 can send a request to the third party 510 to send a data record, identified for example by a record identifier, for example with the credentials of the user 106 and / or its own credentials. Then, at arrow 503b, the third party 510 sends the data record to the second device 102. Alternatively, the third party 510 can also grant access to the data record to the second device 102, which retrieves the data record from the third party 510 or a third party database.

[0047] In another embodiment, the relying party, after acting on the login of the user 106, transmits the data record directly to the second device 102, which is shown at arrow 503c. Alternatively, the relying party 103 may grant the second device 102 access to the data record, which the second device 102 retrieves from the relying party 103 or from a database of the relying party. Thus, the process includes arrows 503a and 503b, or 503c. Finally, as shown with arrow 504, the second device 102 displays information related to the data record to the user 106, for example on a monitor of the second device.

[0048] 6 shows another embodiment of an additional process of the information access method implemented at a time later than the first time. In this case, a login request of the user 106 is received at the first device, which initiates a new web authentication flow of the relying party 103 with the second device 102, as indicated with arrow 601. The web authentication flow, indicated with arrow 602, allows the user 106 to be authenticated using the biometric features of the second device 102. In response to a successful implementation of the web authentication flow, the user 106 logs in at the relying party 103, as indicated with arrow 603. The data record or access to the data record is then provided to the first device 101. Finally, as indicated with arrow 604, the first device 101 displays information related to the data record to the user 106, for example on the monitor of the first device 101.

[0049] Although not shown in Fig. 6, access to the data records may be provided by a third party 510 as shown and described with respect to Fig. 5. Additionally, the relying party 103 may receive the first device identifier during a web authentication flow or when the user selects a login option at the first device 101. The first device identifier may then be used to transmit record data to the first device 101 or enable the first device 101 to access the data records. In that case, the first device identifier may also be transmitted to the third party 510, which may then transmit record data to the first device 101 or enable the first device 101 to access the data records.

[0050] Figure 7 shows a flow diagram of an embodiment of an additional process of the information access handover method at a later time as described with respect to Figure 6. After a login request of the user 106, indicated with arrow 701, the synchronizer 104 is provided with a second device identifier stored in the first device 101 at arrow 702. Of course, via the request, the synchronizer 104 can also receive the first device identifier. The synchronizer 104 then establishes a secure connection between the first device 101 and the second device 102 by using the first device identifier and the second device identifier.

[0051] For example, the first device identifier and / or the second device identifier can be at least one of an IP address, a MAC address, or another unique device identifier that allows a connection between the respective devices to be established. Arrows 703 and 704 show data exchanges between the second device 102 and the synchronizer 104 (arrow 703) and between the first device 101 and the synchronizer 104 (arrow 704) that are required to set up a secure connection indicated by the dotted line 710. The data exchanges can include, for example, requests from the synchronizer 104 to the first and second devices to set up a secure connection, and responses from the first or second devices to this request. The requests and responses can transfer different information that is required to set up the secure connection 710.

[0052] After establishing the secure connection, a web authentication flow can be initiated by the first device 101 at the second device 102, as shown at arrow 601. The process of arrows 601 to 604 is the same as that described with respect to Figure 6. However, establishing a secure connection 710 can ensure that devices other than the first device 101 cannot access the data records by using the biometric features of the second device 102.

[0053] Figure 8 illustrates one embodiment of a web authentication flow at a later point in time. At arrow 801, the user agent 102a of the second device 102 receives a second challenge (i.e., not the first challenge) from the relying party 103 and forwards the second challenge to the authenticator 102b of the second device 102 along with a get-credentials command at arrow 802. The second challenge can be a random value or a buffer of cryptographically random bytes generated on the relying party 103. The user agent 102a can also add additional information such as an identifier of the relying party 103, e.g., a web address. The get-credentials command retrieves the user's credentials.

[0054] The authenticator 102b then sends a second signed challenge to the user agent 102a, which is indicated with arrow 803. Although not shown, the authenticator may or may not prompt the user 106 for biometric identification. An example of how a user may be prompted to authenticate is shown in FIG.

[0055] The signed second challenge is then sent to the relying party 103 via arrow 804. The relying party 103 then checks the signed second challenge, i.e. decrypts it using the already stored public key and compares the random value of the sent second challenge with the received random value. The relying party 103 may also perform other processes to ensure that the user 106 has been authenticated. If the relying party 103 can ensure that the authentication of the user 106 has been successful, the user 106 logs in at the relying party 103, as indicated with arrow 805.

[0056] 9 presents an example of a biometric identification of a user 106 initiated by an authenticator 102b. The authenticator 102b may send a request, as indicated at arrow 901, to a biometric system 910 comprising a biometric device provided by the second device 102 and a biometric application installed on the second device 102. Alternatively, the biometric device may be an external device connected to the second device, for example, via a Bluetooth or USB connection. The biometric device may be a fingerprint sensor, a camera, or a microphone, and the biometric application may be an application specifically adapted to identify and compare biometric information of the user 106.

[0057] At arrow 911, biometric system 910 prompts user 106 for biometric identification. User 106 may be asked to place his / her finger on a fingerprint sensor, activate a camera for face scanning, speak a few words for voice authentication, etc. This is shown with arrow 912. The biometric device, and in particular the biometric application, can then determine whether user 106 is authorized, i.e., whether user 106 is a correct, registered user. If user 106 is a correct, registered user, biometric system 910 authenticates and authorizes user 106 to authenticator 102b.

[0058] In another embodiment, a computer program is provided that includes instructions that, when executed by a computer, cause the computer to perform the methods described herein. The program code embodied in any of the systems described herein can be distributed individually or collectively as a program product that takes a variety of different forms. In particular, the program code can be distributed using a computer readable storage medium having computer readable program instructions thereon for causing a processor to perform aspects of the embodiments described herein.

[0059] Computer-readable storage media that are non-transitory in nature can include tangible media, both volatile and non-volatile, removable and non-removable, implemented in any method or technology for storing information, such as computer-readable instructions, data structures, program modules, or other data. Computer-readable storage media can further include random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other solid-state memory technology, portable compact disc read-only memory (CD-ROM) or other optical storage, magnetic cassettes, magnetic tapes, magnetic disk storage, or other magnetic storage devices, or any other medium that can be used to store the desired information and that can be read by a computer.

[0060] The computer-readable storage medium should not be construed as a transitory signal itself (e.g., radio waves or other propagating electromagnetic waves, electromagnetic waves propagating in a transmission medium such as a waveguide, or electrical signals transmitted through wires). The computer-readable program instructions may be downloaded from the computer-readable storage medium to a computer, another type of programmable data processing device, or another device, or over a network to an external computer or external storage device.

[0061] While particular embodiments and variations have been described herein, it should be understood that further modifications and alternatives will be apparent to those skilled in the art. In particular, examples have been provided for the purpose of illustrating principles and to demonstrate some specific methods and configurations for putting those principles into practice.

[0062] Accordingly, the embodiments described herein should be understood to be provided by way of example, for the purpose of teaching general features and principles, but should not be understood as limiting the scope defined in the appended claims. [Explanation of symbols]

[0063] 100 Systems 101 First Device 102 Second Device 102a User Agent 102b Authenticator 103 Trust Party 104 Synchronizer 105 Network 106 users 310 Dotted Line, Secure Connection 510 Third Party 710 Dotted Line, Secure Connection 910 Biometric System

Claims

1. 1. A computer-implemented method of information access handover between a first device and a second device of a user, the first device associated with a first device identifier being a device without biometric identification capability and the second device associated with a second device identifier being a device with biometric identification capability, the method comprising: at a first time: a. displaying, on the first device, a QR code generated by a synchronizer in response to creating a data record via the first device; b. capturing the QR code by the second device, i. displaying the data record on the second device, where access to the data record is permitted through access parameters provided by the QR code; and ii. providing the user at the second device with a registration option to associate the data record with the user at a relying party. A step to start c. in response to selecting the registration option, performing a web authentication registration flow using the biometric identification capability of the second device, wherein a unique user identifier used to identify the user is automatically created from information carried by the QR code; d. in response to the web authentication registration flow being successfully performed and the user being registered with the relying party using the unique user identifier and the second device identifier, performing an information access handover and security protection process, i. sharing, by the second device, the unique user identifier and the second device identifier with the first device; ii. storing the unique user identifier and the second device identifier at the first device; and iii. securing access to the data record at the relying party by disabling access using the access parameters and enabling access using the unique user identifier and the second device identifier using a web authentication flow. Steps A computer-based method comprising:

2. The method of claim 1 , wherein the QR code encodes at least one of personal information of the user, an identifier associated with the data record, a random number, a timestamp, or the first device identifier.

3. a request for the QR code sent to the synchronizer includes the first device identifier of the first device so that the QR code can be retrieved at the first device, and the step of capturing the QR code comprises: a. providing, from the second device, to the synchronizer, the second device identifier of the second device; b. setting up, via the synchronizer, a secure connection between the first device and the second device server using the first device identifier and the second device identifier; Further start the unique user identifier and the device identifier are shared over the secure connection; 3. The method according to claim 1 or 2.

4. 4. The method of claim 3, wherein the secure connection between the first device and the second device is created as a bidirectional connection using a WebSockets technique or a one-way connection from the second device to the first device, the one-way connection using polling or a Server Sent Events SSE technique using Web-RTC.

5. The web authentication registration flow includes: i. requesting a first challenge from the relying party by a user agent of the second device to be registered with the relying party, the request for the first challenge including the unique user identifier and the second device identifier; ii. receiving, by the user agent of the second device, the first challenge from the relying party; iii. forwarding the first challenge along with a new credentials command to an authenticator of the second device; iv. prompting the user for biometric authorization; v. authorizing the user to the authenticator, the user being authorized by using the biometric identification capability of the second device; vi. sending, by the authenticator, new credentials and a signed first challenge to the user agent, the new credentials including a private key and a public key; vii. sending, by the user agent, the public key and the signed first challenge to the relying party; viii. registering the user with the relying party using the unique user identifier and the second device identifier of the second device; 5. The method according to claim 1 , comprising:

6. 6. The method of claim 1, wherein the biometric identification capability of the second device includes at least one of a fingerprint sensor with or without device association, a camera with facial recognition and / or iris identification, or a microphone with voice identification.

7. 7. The method of claim 1, wherein the first device is a personal computer or a laptop and the second device is a smartphone or a tablet computer.

8. The method according to any one of claims 1 to 7, wherein the QR code is time-dependent and changes periodically after a certain period of time.

9. At a time later than the first time, a. initiating a new web authentication flow with the second device, the web authentication flow being initiated by a login request of the user at the second device; b. in response to successful execution of the web authentication flow resulting in login of the user at the relying party, accessing information related to the data record on the second device and displaying it on the second device; 9. The method of claim 1, further comprising:

10. At a time later than the first time, a. initiating a new web authentication flow with the second device, the web authentication flow being initiated by a login request of the user at the first device; b. in response to successful execution of the web authentication flow resulting in login of the user at the relying party using the first device, accessing information related to the data record on the first device and displaying it on the first device; 10. The method of claim 1, further comprising:

11. 11. The method of claim 10, further comprising: establishing a secure connection between the first device and the second device based on the second device identifier stored in the first device to initiate the web authentication flow with the second device.

12. The web authentication flow initiated with the second device, a. receiving, by the user agent of the second device, a second challenge from the relying party; b. forwarding the second challenge along with a credentials acquisition command to an authenticator of the second device; c. sending, by the authenticator, a signed second challenge to the user agent; d. sending, by the user agent, the signed second challenge to the relying party; e. logging in said user at said relying party; 12. The method of claim 10 or 11, comprising:

13. The web authentication flow initiated with the second device, a. prompting the user for biometric authorization; b. authorizing the user to the authenticator, the user being authorized by using the biometric identification capability of the second device; 13. The method of claim 12, further comprising:

14. a. a first device of a user; b. a second device of the user; and c. A relying party; d. Synchronizer and Equipped with e. the first device, the second device, the synchronizer, and the relying party are connected via a network and configured to perform the method of any one of claims 1 to 12; Information access handover system.

15. A computer program comprising instructions which, when executed by a computer, cause the computer to carry out a method according to any one of claims 1 to 12.

Images