Secure authentication using software application

Abstract

Methods and systems for secure authentication using a software application are provided. A secure application can receive a request to log in to the secure application from a user device associated with a user. The user device can generate an authentication request message including an encrypted device data in a messaging application. The user device can transmit the authentication request to an application server associated with the secure application for authentication of the user device. The user device can receive an authentication response message indicating the user device has been authenticated by the application server.

Description

SECURE AUTHENTICATION USING SOFTWARE APPLICATIONBACKGROUND

[0001] Users can interact with applications to gain access to resources such as data, accounts, services, or goods. For example, a user can use a user device to interact with a resource provider or other entity via a secure application. The user can be authenticated and granted access to the secure application based on, for example, authentication information such as a username / password combination or biometric information. To add security, the secure application can transmit a onetime password (OTP) to a phone number of the user device or another device operated by the user. The OTP needs to be entered into the secure application before it grants access to the user.

[0002] One problem with the above noted authentication process is that it can be possible that an unauthorized person can gain access to the OTP and the user’s other authentication information, thereby impersonating the user. For example, the unauthorized person could be a man-in-the-middle which sniffs the OTP in transit, or they could view the screen on the usei^s user device (e.g. , through remote access or shoulder surfing). Once the OTP is obtained, then the unauthorized person can then use it to access the secure application.

[0003] Embodiments of the present application address these and other problems individually and collectively.SUMMARY

[0004] One embodiment of the invention includes a method. The method includes: receiving, by a user device associated with a user, a request to log in to a secure application; generating, by the user device, an authentication request message comprising an encrypted device data in a messaging application; transmitting, by the user device, the authentication request message in the messaging application to an application server associated with the secure application, wherein the application server receives the authentication requestmessage and decrypts the encrypted device data to obtain the device data and determines that the device data matches previously enrolled device data; and receiving, by the secure application in the user device, an authentication response message indicating that the user device has been authenticated.

[0005] Another embodiment of the invention includes an application server comprising: one or more processors; and a memory storing instructions that, when executed by the one or more processors, cause the one or more processors to perform a method comprising: receiving, by a user device associated with a user, an authentication request message sent via a messaging application in the user device and comprising an encrypted device data in a messaging application, the authentication request message being generated by a secure application in the user device and wherein the authentication request message comprises an encrypted device data; decrypting the encrypted device data to obtain the device data; determining that the device data matches previously enrolled device data; and transmitting, to the secure application in the user device, an authentication response message indicating that the user device has been authenticated.

[0006] Another embodiment of the invention includes a user device comprising: a processor; a memory device; and a computer-readable medium coupled to the processor, the computer-readable medium comprising code executable by the processor for implementing a method comprising: receiving a request to log in to a secure application; generating an authentication request message comprising an encrypted device data in a messaging application; transmitting the authentication request message in the messaging application to an application server associated with the secure application, wherein the application server receives the authentication request message and decrypts the encrypted device data to obtain the device data and determines that the device data matches previously enrolled device data; and receiving an authentication response message indicating that the user device has been authenticated.

[0007] Further details regarding embodiments of the invention can be found in the Detailed Description and the Figures.BRIEF DESCRIPTION OF THE DRAWINGS

[0008] FIG. 1 shows a block diagram of a system according to an embodiment of the invention.

[0009] FIG. 2 shows a block diagram of an exemplary user device according to an embodiment of the invention.

[0010] FIG. 3 shows a block diagram of an exemplary application server according to an embodiment of the invention.

[0011] FIG. 4 shows a flow diagram illustrating a process according to an embodiment of the invention.

[0012] FIG. 5 shows a flow diagram illustrating a method according to an embodiment of the invention.

[0013] FIG. 6 shows an example text message with encrypted device data.DETAILED DESCRIPTION

[0014] Embodiments include systems and methods for authenticating a user device via a secure application in the user device. For instance, the secure application can generate an authentication request message in a messaging application. The authentication request message can include encrypted device data associated with the user device. The secure application can transmit the authentication request message to an application server associated with the secure application via the messaging application. The application server can decrypt the device data and determine whether the decrypted device data matches device data associated with a previously enrolled user device. If there is a match, the application server can generate an authentication response message configured to cause the secure application to grant access to the secure application to the user device.Subsequent to receiving the authentication response message, the secure application can prompt the user to provide secondary authentication information to authenticate the user. Accordingly, disclosed embodiments increase security by enabling authentication of the user as well as of the user device.

[0015] Prior to discussing specific embodiments of the invention, some terms may be described in detail.

[0016] A “user” may include an individual. In some examples, a user may be associated with one or more personal accounts and / or mobile devices. The user may also be referred to as a cardholder, account holder, or consumer in some embodiments.

[0017] A “user device” may be any suitable device that a user can interact with (e.g., a mobile device). User devices may be in any suitable form. Some examples of user devices include mobile devices, cellular phones, PDAs, personal computers (PCs), tablet computers, wearables, and the like. In some embodiments, where a user device is a mobile device, the mobile device may include a display, a memory, a processor, a computer-readable medium, and any other suitable component.

[0018] A “mobile device” (sometimes referred to as a mobile communication device) may include any suitable electronic device that may be transported and operated by a user. A mobile communication device may communicate using a mobile phone (wireless) network, wireless data network (e.g., 3G, 4G or similar networks), Wi-Fi, Bluetooth, Bluetooth Low Energy (BLE), Wi-Max, or any other communication medium that may provide access to a network such as the Internet or a private network. Examples of mobile devices include mobile phones (e.g., cellular phones), PDAs, tablet computers, net books, laptop computers, wearable devices (e.g., watches, rings, glasses), vehicles such as automobiles and motorcycles, personal music players, hand-held specialized readers, etc. A mobile device may include any suitable hardware and software for performing such functions, and may also include multiple devices or components (e.g., when a device has remote accessto a network by tethering to another device - i.e., using the other device as a modem - both devices taken together may be considered a single mobile device).

[0019] An “authentication request message” may be an electronic message that can request authentication of something or someone for an intended purpose. In some embodiments, an authentication request message communicates a request to authenticate a user device to an application server. In some examples, an authentication request message is sent to the application server to cause the application server to authenticate a user device based on device data received in the authentication request message. In some embodiments, the authentication request message may include encrypted device data, such as device model information, an IP address, a serial number, or other identifying information.

[0020] An “authentication response message” may be a reply to an authentication request message. In some embodiments, an authentication request message can be an electronic message that communicates whether or not a user device has been authenticated by the application server based on the device data of the authentication request message. In some examples, an authentication response message is sent to the secure application to cause the secure application to grant or deny access to a user of the user device.

[0021] FIG. 1 shows a system 100 comprising a number of components. The system 100 comprises a user device 115 associated with and operated by a user 110. The system 100 further comprises an application server 130, each of which may be embodied by one or more computers.

[0022] The user device 115 may be capable of interacting with the application server 130. Also, the user device 115 and the application server 130 may be in operative communication with each other through any suitable communication channel or communications network. Suitable communications networks may be any one and / or the combination of the following: a direct interconnection; the Internet; a Local Area Network (LAN); a Metropolitan Area Network (MAN); an Operating Missions as Nodes on the Internet (OMNI); a secured custom connection; a WideArea Network (WAN); a wireless network (e.g., employing protocols such as, but not limited to a Wireless Application Protocol (WAP), l-mode, and / or the like); and / or the like.

[0023] Messages between the computers, networks, servers, and devices may be transmitted using a communications protocols such as, but not limited to, File Transfer Protocol (FTP); HyperText Transfer Protocol (HTTP); Secure Hypertext Transfer Protocol (HTTPS), Secure Socket Layer (SSL), ISO (e.g., ISO 8583) and / or the like.

[0024] An example of the user device 115 is a mobile device such as a smart phone, smart watch, wearable device, etc. capable of executing one or more applications stored thereon. For example, the user device 115 may be configured to execute a secure application 120 and a messaging application 125.

[0025] The secure application 120 may be an application associated with a secure resource such as data, goods or services, accounts, etc. The secure application can be associated with an interactive computing environment hosted by an entity such as a resource provider or issuer. Specific examples of secure applications can include online banking applications, merchant applications, securities trading applications, medical information applications, remote login applications, etc.

[0026] The messaging application 125 may be an application configured to communicate via one or more communication methods or protocols with one or more remote devices or computing systems. The messaging application 125 can be, for example, an email application, an SMS text messaging application, or other communication application.

[0027] The user 110 may be able to use the user device 115 to interact with a secure resource via the secure application 120. For example, the secure application 120 can enable the user 110 to conduct transactions, manage an account, or execute other operations in an interactive network environment.

[0028] To gain access to the secure application 120, the user 110 can open the secure application 120 in the user device 115. In one example, in response to the user 110 opening or otherwise launching the secure application 120, the secure application 120 can automatically generate an authentication request message in the messaging application 125. The authentication request message can include encrypted device data. For example, the device data can be any identifying data associated with the user device 115 such as a serial number, model number, software version, and the like or some combination thereof.

[0029] In some examples, the secure application 120 can automatically transmit the authentication request message to the application server 130 via the messaging application 125. In other examples, the secure application 120 can prompt the user 110 to cause the messaging application 125 to transmit the authentication request message to the application server 130.

[0030] The application server 130 can receive and decrypt the encrypted device data. The application server 130 can use the decrypted device data to query a database storing device data associated with enrolled user devices. The application server 130 can compare the received device data with stored device data to determine whether the user device 115 is enrolled with the secure application 120. The application server 130 can then generate an authentication response message to transmit to the secure application 120. The authentication response message can indicate whether the application server 130 located enrolled device data matching the received device data.

[0031] If the application server 130 does not locate matching enrolled device data, the application server 130 can generate an authentication response message communicating to the secure application 120 to deny the user 110 access to the user application. If the application server 130 does locate matching enrolled device data, the application server 130 can generate an authentication response message communicating to the secure application 120 to grant the user 110 access to thesecure application 120. Granting access to the secure application 120 can refer to enabling access to secure resources or functionality via the secure application 120.

[0032] In another example, subsequent to receiving the authentication response message indicating the user device 115 is authenticated, the secure application 120 can prompt the user 110 to provide a second form of authentication to the secure application 120. The second form of authentication can be, for example, a username / password combination, a PIN, biometric information, and the like. The secure application 120 can determine that the second form of authentication matches stored authentication information associated with the user 110, thereby authenticating the user 110 in addition to authenticating the user device 115.

[0033] An example of the user device 115, according to some embodiments of the invention, is shown in FIG. 2. The user device 115 may include a processor 115A operatively coupled to a computer readable medium 115B (e.g., one or more memory chips, etc.), input elements 115C such as buttons, sensors, accelerometers or the like, an output device 115D (e.g., a display, a speaker, etc.) and a network interface 115E.

[0034] The computer readable medium 115B may include instructions or code, executable by a processor, e.g., processor 115A. The instructions may include instructions for communicating with an application server 130 to authenticate the user device 115 to enable the user 110 to access a secure application 120 of the user device 115.

[0035] For example, the computer readable medium 115B can include a series of instructions that, when executed, cause the processor 115A to communicate with the application server 130 to authenticate the user device 115. The computer readable medium 115B of the user device 115 can include the secure application 120. The secure application 120 can generate an authentication request message for transmittal to the application server 130 via the messaging application 125. The authentication request message can include encrypted device data that can be decrypted by the application server 130 and used to determine if the user device 115has been previously enrolled in the secure application 120, and thereby authenticate the user device 115.

[0036] The computer readable medium 115B can also include instructions stored thereon that, when executed by the processor 115A, cause the user device 115 to perform a method including: receiving a request to log in to a secure application; generating, by the user device, an authentication request message comprising an encrypted device data in a messaging application; transmitting, by the user device, the authentication request message in the messaging application to an application server associated with the secure application, wherein the application server receives the authentication request message and decrypts the encrypted device data to obtain the device data and determines that the device data matches previously enrolled device data; and receiving, by the secure application in the user device, an authentication response message indicating that the user device has been authenticated.

[0037] Referring back to FIG. 1 , the application server 130 may include data processing subsystems, networks, and operations used to support and deliver authentication services. For example, the application server 130 may include a server coupled to a network interface (e.g., by an external communication interface), and databases of information. The application server 130 can be managed, for example, by a transaction processing network, a financial institution, a resource provider, an authentication service, or another entity. The application server 130 may use any suitable wired or wireless network, including the Internet.

[0038] An example of the application server 130 is illustrated in FIG. 3. The application server 130 may include a processor 130A operatively coupled to a computer readable medium 130B (e.g., one or more memory chips, etc.), memory 130C, and a network interface 130D.

[0039] The computer readable medium 130B may include instructions or code, executable by a processor, e.g., processor 130A. The instructions may include instructions for communicating with the user device 115 to authenticate the userdevice 115, and instructions for any other suitable function as described herein. For example, the computer readable medium 130B may store a device authentication application 130E configured to communicate, via a network, with the user device 115 to authenticate the user device 115 in response to a user 110 attempting to launch or access secure functionality or resources of the secure application 120.

[0040] In an example, the device authentication application 130E can receive encrypted device data transmitted from the user device 115 via the messaging application 125. The device authentication application 130E can decrypt the received encrypted device data and determine whether the received device data matches enrolled device data associated with a user device that has been previously enrolled with the secure application 130. In one example, the application server 130 can store enrolled device data in the memory 130C or in a database of the application server 130. The device authentication application 130E can generate a query of the memory 130C or of a database storing enrolled device data to return enrolled device data matching the received device data.

[0041] If the query returns matching enrolled device data, the device authentication application 130E can generate an authentication response message. The authentication response message can include an indication that the user device 115 is authenticated based on the matching enrolled device data. In this example, the authentication response message can cause the secure application 120 to grant access to the secure application 120 to the user 110 via the user device 115.

[0042] In another example, the query may not find enrolled device data matching the received device data. In this example, the device authentication application 130E can generate an authentication response message indicating that the user device 115 has not been authenticated. This authentication response message can cause the secure application 120 to deny the user 110 access to functionality and resources of the secure application 120.

[0043] The computer readable medium 130B can also include an application programming interface (API) 130F allowing for secure connection andcommunication with the user device 115. The API 130F can define the interaction between the user device 115, via the secure application 120 or the messaging application 125, and the processor associated with the application server 130. The API 130F can enhance security of data communicated between user device 115 and the application server 130.

[0044] The memory 130C can be a database, or other memory, physical storage device, or cloud-based storage device. The memory 130C can, for example, store enrollment information associated with user devices enrolled with a secure application (e.g., the secure application 120). The enrollment information can include device data such as a serial number, model number, IP address, and the like, or a combination thereof. The enrolled device data can be used in addition to or in lieu of a username / password combination, biometric information (e.g., a biometric scan), a secret, a physical security key, or other user-specific authentication information. Accordingly, the enrolled device data can be used to authenticate a user device.

[0045] The computer readable medium 130B can also include instructions stored thereon that, when executed by the processor 130A, cause the application server 130 to perform a method including: receiving, by a user device associated with a user, an authentication request message sent via a messaging application in the user device and comprising an encrypted device data in a messaging application, the authentication request message being generated by a secure application in the user device and wherein the authentication request message comprises an encrypted device data; decrypting the encrypted device data to obtain the device data; determining that the device data matches previously enrolled device data; and transmitting, to the secure application in the user device, an authentication response message indicating that the user device has been authenticated.

[0046] A process 400 according to examples of the present application can be described with respect to FIG. 4.

[0047] The process 400 provides authentication, via a user device 115 associated with a user 110, of the user interacting with a secure application 120 in the userdevice 115. In a specific example, the process 400 may be used to authenticate the user device 115, and, optionally, the user 110 attempting to access secure resources or functionality of the secure application 120.

[0048] At step S402, the user 110 can request to log in to a secure application (e.g., the secure application 120) in the user device 115. The request to log in can include the user 110 opening the secure application 120 in the user device 115 or otherwise launching the secure application 120 in the user device 115.

[0049] At step S404, the secure application 120 can generate an authentication request message in a messaging application (e.g., the messaging application 125). The authentication request message can comprise device data associated with the user device 115 that has been encrypted. In this regard, the application server 130 and the user device 115 can have keys in cryptographic key pair. In one example, the application server 130 and the user device 115 can each have a symmetric key of a symmetric key pair. In other embodiment, the user device 115 may have a public key and the application server 130 can have the corresponding private key of a public-private key pair. The user device 115 can retrieve the device data on the user device 115 and encrypt it using an appropriate cryptographic key.

[0050] At step S406, the user device 115 can transmit the authentication request message with the encrypted device data to the application server 130, which is associated with the secure application 120. In some embodiments, automatically or upon the user’s request, the secure application 120 can cause the messaging application 125 on the user device 115 to open and generate the authentication request message with the encrypted device data. The authentication request message may also comprise an address (e.g., a phone number) associated with the application server 130. The user 110 can then cause the messaging application 125 (e.g., a text messaging application) to transmit the authentication request message to the address of the application server 130, e.g., by selecting a “Send” option via the interface of the messaging application. In other embodiments, the secure application120 can cause the messaging application 125 to automatically transmit the authentication request message to the application server 130.

[0051] FIG. 6 shows an example text message with encrypted device data. The message would be sent to a phone number associated with the application server 130. The secure application 120 can generate the message content and open the messaging application 125, in which a new message including the generated message content (e.g., the encrypted device data) is created.

[0052] At step S408, the application server 130 can decrypt the encrypted device data received in the authentication request message. An appropriate cryptographic key (e.g., a symmetric key or private key) can be used by the application server 130 to decrypt the encrypted device data.

[0053] Once the encrypted device data is decrypted by the application server 130, it can then determine whether the received device data matches enrolled device data, e.g., device data associated with a user device enrolled with the secure application 120. For example, the application server 130 can query an enrolled device database to identify a record containing device data matching the received device data. The record can contain at least an identifier for the user device 115 (e.g., an e-mail address or phone number) and the device data. The identifier for the user device 115 (e.g., the phone number or e-mail address) can be used as a lookup to locate the device data for the user device 115 or for a set of user devices associated with the user 110. The record may have been created by the application server 130 during an enrollment process, whereby the application server 130 performs a thorough authentication process.

[0054] In some embodiments, the application server 130 can compare a phone number or e-mail address associated with the authentication request message (e.g., the phone number or e-mail address from which the authentication request message was sent) to an enrolled phone number or e-mail address in determining that the user device 115 has been authenticated. For example, if the device data matches enrolled device data, but the phone number or e-mail address associated with theauthentication request message does not match an enrolled phone number or e-mail address, the user device 115 may not be authenticated. Similarly, if the phone number or e-mail address associated with the authentication request matches an enrolled phone number or e-mail address, but the received device data does not match enrolled device data, the user device 115 may not be authenticated.

[0055] In another embodiment, the authentication request message can include identification information associated with the user 110. The user 110 can be associated with multiple user devices and can authenticate using any enrolled device so long as the device data received by the application server 130 matches enrolled device data.

[0056] In some embodiments, the application server 130 can determine that the user 110 has enrolled a device, but the device data received with the authentication request message does not match enrolled device data associated with the user 110. In such an example, the application server 130 can take one or more actions to deny access to the secure application by the user device originating the authentication request message and / or alert the user 110 that an unenrolled device is attempting to log in to the secure application 120. For example, the application server 130 can transmit a message to an e-mail address, phone number, or other enrolled contact method to the user 110 alerting the user 110 that an unenrolled device attempted to access the secure application 120. Other actions can include locking the account associated with the user 110, such that the user 110 cannot access the secure application 120 via any device until a remedial action and user authentication is completed.

[0057] At step S410, the application server 130 can generate an authentication response message. The authentication response message can include an indication of whether the user device 115 was authenticated based on whether enrolled device data matching the received device data was identified. If the enrolled device data matching the received device data was identified, the authentication response message can indicate that the user device 115 has been authenticated. If enrolleddevice data matching the received device data was not identified, the authentication response message can indicate that the user device 115 has not been authenticated.

[0058] At step S412, the application server 130 transmits the authentication response message to the secure application 120 on the user device 115. In response to receiving the authentication response message, the secure application 120 can either grant or deny access to the secure application 120 to the user 110 of the user device 115. For example, if the authentication response message indicates the user device 115 has been authenticated, the secure application 120 can grant the user 110 access to restricted resources and functionality of the secure application 120. If the authentication response message indicates the user device 115 has not been authenticated, the secure application 120 can deny the user 110 access to restricted resources and functionality of the secure application 120. In some examples, if the user device 115 is not authenticated, the secure application 120 can request the user 110 use an alternative login method, such as by providing biometric information. In other examples, the secure application 120 can suspend access to the secure application 120 by the user device 115 and require the user 110 to contact the provider of the secure application 120 to unlock the user device 115 and restore access.

[0059] In some embodiments, upon receipt of the authentication response message, the secure application 120 can prompt the user 110 to provide a second form of authentication. The secure application 120 can determine that the second form of authentication matches stored authentication information associated with the user 110. The second form of authentication can be a biometric scan completed using one or more components of the user device 115, or can be a physical security key. In another embodiment, the second form of authentication can be a secret, such as a PIN or password. Accordingly, the secure application 120 can further authenticate both the user 110 and the user device 115 prior to granting access to functionality or resources of the secure application 120.

[0060] In some embodiments, the process 400 can include steps for enrolling the user device 115 in the secure application 120. For example, the application server 130 can receive an enrollment request from the secure application 120 in the user device 115. The enrollment request can include information such as device data, user identification information, a phone number, an e-mail address, and the like associated with the user 110 and / or the user device 115. The secure application 120 can transmit the enrollment message to the application server 130 for storage in a memory or enrolled device database of the application server 130. The stored information can then be used to authenticate the user device 115 during future attempts to log in to the secure application 120.

[0061] In some embodiments, the user 110 can be associated with a set of user devices including the user device 115. The user 110 can be authenticated by the application server 130 using device data associated with any of the set of devices. For example, the user 110 can enroll multiple devices, such as a smartphone, a tablet, a laptop, etc. When the user 110 opens the secure application on any of the enrolled devices, the device can automatically generate an authentication request data including encrypted device data. The device data can indicate, for example, a device type (e.g., smartphone, tablet, laptop, smart watch, etc.), a device model, a serial number, an operating system version, and the like. The application server 130 can store device data associated with the set of enrolled devices, such that when an authentication request message is received, the application server 130 can authenticate the user device from which the authentication request message was sent.

[0062] A method 500 according to embodiments of the present application can be described with respect to FIG. 5.

[0063] The method 500 provides authentication of a user device 115 by determining whether the user device 115 from which the user 110 is requesting to log in to a secure application 120 has been enrolled in the secure application 120. In a specific example, the method 500 can include authenticating the user device 115based on encrypted device data included in an authentication request message transmitted from the messaging application 125 of the user device 115 to the application server 130 associated with the secure application 120.

[0064] At step S502, the method 500 includes receiving, by a user device 110 associated with a user 110, a request to log in to a secure application 120. The user 110 can, for example, open the secure application 120 on the user device 115 to attempt to log in and the long in process can be automatically initiated by the secure application 120.

[0065] At step S504, the method 500 includes generating, by the user device 115, an authentication request message including encrypted device data in a messaging application 125. The authentication request message can be generated by the secure application 120 and included as the body of a text message or e-mail opened in the messaging application 125 of the user device 115. In some examples, the encrypted device data can be included in the authentication request message as an attachment, e.g., a file attached to an e-mail. In some examples, the authentication request message can include an e-mail address or a phone number associated with the user 110 or the user device 115, respectively. In another example, the authentication request message could include a user ID, username, account number, or other identifier associated with the user 110 or with an account of the user 110 with a messaging application.

[0066] At step S506, the method 500 includes transmitting, by the user device 115, the authentication request message in the messaging application 125 to an application server 130 associated with the secure application 120. The messaging application can be, for example, an e-mail application, an SMS messaging application, or any other messaging application configured to transmit data over one or more messaging protocols. The application server 130 can receive the authentication request message and decrypt the encrypted device data to obtain the device data. The application server 130 can then determine that the device data matches previously enrolled device data.

[0067] In some embodiments, the application server 130 can compare a phone number or an e-mail address associated with the authentication request message to an enrolled phone number or e-mail address in determining that the user device has been authenticated.

[0068] At step S508, the method 500 can include receiving, by the secure application 120 in the user device 110, an authentication response message indicating that the user device 115 has been authenticated. The authentication response message can be generated by the application server 130 and can include the results of whether the secure application 130 found enrolled device data matching the received, decrypted device data.

[0069] In response to receiving the authentication response message, the secure application 120 in the user device 115 can grant access to the secure application 120 to the user 110. For example, the secure application 120 can grant access thereby allowing the user 110 to access resources or use functionality that is not available to unauthenticated users.

[0070] In some embodiments, upon receipt of the authentication response message indicating the user device 115 is authenticated, the secure application 120 can prompt the user 110 to provide a second form of authentication. The second form of authentication can be, for example, a biometric scan, a secret, or a physical security key. In other examples, the second form of authentication can be a username / password combination, a PIN, or other information unique to the user 110. The secure application 120 can then determine that the second form of authentication matches stored authentication information associated with the user 110

[0071] Subsequent to determining that the second form of authentication matches stored authentication information, the secure application can grant access to the authenticated user 110 via the authenticated user device 115. If the second form of authentication does not match stored authentication data, the secure application 120 can deny access to the user 110 via the user device 115 and take one or moreadditional actions. For example, the secure application 120 can lock the user’s account, notify a fraud department or administrator of the entity providing the secure application 120, prompt the user 110 to reset their log in information, or prompt the user 110 to contact the administrator of the secure application 120.

[0072] In another embodiment, the secure application 120 can receive the second form of authentication and generate a second authentication request message containing an encrypted form of the second form of authentication. The secure application 120 can transmit the second authentication request message to the application server 130. The application server 130 can then decrypt the encrypted form of the second form of authentication and determine if the second form of authentication matches stored authentication data associated with the user 110. The application server 130 can, based on the determination, generate a second authentication response message indicating whether the user 110 has been authenticated. The second authentication response message can be transmitted by the application server 130 to the secure application 120. The secure application 120 can grant or deny the user 110 access to the secure application 120 based on whether the user 110 was authenticated using the second form of authentication.

[0073] Embodiments of the invention have a number of technical advantages. For example, because embodiments of the invention do not use a one-time password, there is no way that a man-in-the-middle or other unauthorized person can obtain it and use it to fraudulently access a secure application. Further, the encryption of the device data protects it from unauthorized persons while the device data is in transit. Lastly, because the user device sends the authentication request message through a messaging application such as a text messaging application, the user device’s communication identifier such as the phone number can be used as further authentication data and can be used to look up enrolled encrypted device data stored at the application server.

[0074] As described, the inventive service may involve implementing one or more functions, processes, operations or method steps. In some embodiments, thefunctions, processes, operations or method steps may be implemented as a result of the execution of a set of instructions or software code by a suitably-programmed computing device, microprocessor, data processor, or the like. The set of instructions or software code may be stored in a memory or other form of data storage element which is accessed by the computing device, microprocessor, etc. In other embodiments, the functions, processes, operations or method steps may be implemented by firmware or a dedicated processor, integrated circuit, etc.

[0075] Any of the software components or functions described in this application may be implemented as software code to be executed by a processor using any suitable computer language such as, for example, Java, C++ or Perl using, for example, conventional or object-oriented techniques. The software code may be stored as a series of instructions, or commands on a computer-readable medium, such as a random access memory (RAM), a read-only memory (ROM), a magnetic medium such as a hard-drive or a floppy disk, or an optical medium such as a CD- ROM. Any such computer-readable medium may reside on or within a single computational apparatus, and may be present on or within different computational apparatuses within a system or network.

[0076] While certain exemplary embodiments have been described in detail and shown in the accompanying drawings, it is to be understood that such embodiments are merely illustrative of and not intended to be restrictive of the broad invention, and that this invention is not to be limited to the specific arrangements and constructions shown and described, since various other modifications may occur to those with ordinary skill in the art.

[0077] As used herein, the use of “a,” “an,” or “the,” is intended to mean “at least one,” unless specifically indicated to the contrary.

Claims

WHAT IS CLAIMED IS:

1. A method comprising: receiving, by a user device associated with a user, a request to log in to a secure application; generating, by the user device, an authentication request message comprising an encrypted device data in a messaging application; transmitting, by the user device, the authentication request message in the messaging application to an application server associated with the secure application, wherein the application server receives the authentication request message and decrypts the encrypted device data to obtain the device data and determines that the device data matches previously enrolled device data; and receiving, by the secure application in the user device, an authentication response message indicating that the user device has been authenticated.

2. The method of claim 1 , further comprising: in response to receiving the authentication response message, granting, by the secure application in the user device, access to the secure application to the user.

3. The method of claim 1 , further comprising: upon receipt of the authentication response message, prompting the user, via the secure application, to provide a second form of authentication; and determining, by the secure application, that the second form of authentication matches stored authentication information associated with the user.

4. The method of claim 3, wherein the second form of authentication comprises a biometric scan, secret, or a physical security key.

5. The method of claim 1 , wherein the messaging application is an e-mail application or SMS messaging application.

6. The method of claim 1 , wherein the application server compares a phone number or e-mail address associated with the authentication request message to an enrolled phone number or e-mail address in determining that the user device has been authenticated.

7. The method of claim 1 , further comprising enrolling the user in the secure application by: receiving, from the user device, an enrollment request to enroll in the secure application; transmitting, from the user device to the application server, the device data of the user device; and storing, by the application server, the device data for future use in authenticating the user device.

8. The method of claim 1 , wherein the user is associated with a set of user devices comprising the user device and the user can be authenticated by the application server using device data associated with any of the set of devices.

9. The method of claim 1 , wherein the device data comprises at least one of: a device model, a serial number, or an IP address.

10. An application server comprising: one or more processors; and a memory storing instructions that, when executed by the one or more processors, cause the one or more processors to perform a method comprising: receiving, from a user device associated with a user, an authentication request message sent via a messaging application in the userdevice and comprising encrypted device data, the authentication request message being generated by a secure application in the user device; decrypting the encrypted device data to obtain the device data; determining that the device data matches previously enrolled device data; and transmitting, to the secure application in the user device, an authentication response message indicating that the user device has been authenticated.

11. The application server of claim 10, wherein the authentication response message is configured to cause the secure application in the user device to grant access to the secure application to the user.

12. The application server of claim 10, wherein the authentication response message is configured to cause the secure application to prompt the user, via the secure application, to provide a second form of authentication, and to determine, by the secure application, that the second form of authentication matches stored authentication information associated with the user.

13. The application server of claim 12, wherein the second form of authentication comprises a biometric scan or a physical security key.

14. The application server of claim 10, wherein the messaging application is an e- mail application or SMS messaging application.

15. The application server of claim 10, wherein the method further comprises: comparing a phone number or e-mail address associated with the authentication request message to an enrolled phone number or e-mail address in determining that the user device has been authenticated.

16. The application server of claim 10, wherein the method further comprises: receiving, from the user device, an enrollment request to enroll in the secure application, the enrollment request comprising the device data of the user device; and storing the device data for future use in authenticating the user device.

17. The application server of claim 10, wherein the user is associated with a set of user devices comprising the user device and the user can be authenticated by the application server using device data associated with any of the set of devices.

18. The application server of claim 10, wherein the device data comprises at least one of: a device model, a serial number, or an IP address.

19. A user device comprising: a processor; a memory device; and a computer-readable medium coupled to the processor, the computer- readable medium comprising code executable by the processor for implementing a method comprising: receiving a request to log in to a secure application; generating an authentication request message comprising an encrypted device data in a messaging application; transmitting the authentication request message in the messaging application to an application server associated with the secure application, wherein the application server receives the authentication request message and decrypts the encrypted device data to obtain the device data and determines that the device data matches previously enrolled device data; and receiving an authentication response message indicating that the user device has been authenticated.

0. The user device of claim 19, wherein the authentication response message is configured to cause the secure application to grant access to the secure application to the user.

Images