More and more computer systems require its users to provide credentials, such as a username and password, in order to access and use the computer system. These computer systems typically provide an administrator account that may be initially used to access the computer system and to create one or more user accounts.
When creating a user account for the first time, the computer system may request that the user specify a login identifier, or login ID, and an associated password. Generally, the login ID is unique to the computer system such that no two users have the same login ID. The combination of the login ID and the password that is associated with the login ID allows the computer system to authenticate the user during subsequent accesses of the computer system. The password also prevents others who do not know the password from accessing the computer system using the user's login ID. This password protection is particularly important if the computer system allows its users to store private or confidential information about the user, such as financial information, confidential content, etc.
Increasing numbers of computer systems, such as, by way of example, integrated entertainment systems like MICROSOFT WINDOWS Media Center, are being designed with usability by remote control devices as well as the standard computer input devices, such as a keyboard. It is not uncommon for users to use these systems at various locations where the standard keyboard is not readily accessible to the users. For example, a user may be at a location where the user only has access to the remote control device and not the keyboard. In this instance, users are likely to be controlling the system using only the remote control device and not the keyboard. Thus, when users are prompted to generate their own passwords for the user accounts, they often specify a blank password or, in the event the users provide a password, they specify a password that is both easy to remember and one that they can enter using the number pad on the remote control device. This is because users of these systems want to be able to enter the passwords using only the remote control device without having to use the standard keyboard, which may not be readily accessible. Such passwords may be duplicative of their 4-digit bank PIN, or other combinations of numbers, which are cryptographically weak since the password is limited to a combination of numbers.
Techniques for performing two-factor authentication using a remote control device are provided. A remote control device is equipped with components to allow a user of the remote control device to provide two-factor authentication credentials using the remote control device. The remote control device is capable of obtaining both a physical factor, such as a smart card, etc., and a memorized factor, such as a PIN. The remote control device then transmits signals representing both factors to a receiving device, such as a computer system, thus allowing the receiving device to authenticate the user of the remote control device using the submitted physical and memorized factors.
This Summary is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used as an aid in determining the scope of the claimed subject matter.
Various techniques for performing two-factor authentication using a remote control device are described. As is known to those skilled in the art, two-factor authentication generally refers to an authentication protocol that requires two forms of authentication to access a system, as compared to the traditional password authentication, which only requires the submission of a valid password to gain access to a system. The first factor in the two-factor authentication is typically a physical token, such as, by way of example and not limitation, a card, a smart card, an electronic badge, a secure token (e.g., random number generator), or a fingerprint or retinal pattern (also referred to as biometrics). The second factor in the two-factor authentication is something that is memorized, such as a security code or a PIN. In this context, the first factor may be referred to as the physical factor, and the second factor may be referred to as the mental or memorized factor. A common example of two-factor authentication is a bank card (e.g., credit card, debit card, etc.) and the corresponding PIN. The card itself is the physical factor, and the PIN is the memorized factor. In some scenarios, the security code or PIN may be set to “blank” (e.g., PIN==NULL).
In some embodiments, a remote control device is equipped with components to allow a user of the remote control device to provide two-factor authentication credentials using the remote control device. The remote control device is capable of obtaining both factors (i.e., the physical factor and the memorized factor) from its user and transmitting signals representing both factors to a receiving device, such as a computer system. By way of example, one or more smart cards for use with a remote control device may be provided with a computer system. A user can then use the provided smart card and the remote control device to create a user account on the computer system. For example, the user can create the user account by accessing a create user account feature provided on the computer system. The user can then insert the smart card into a slot provided on the remote control device and provide a PIN using the remote control device to create the user account. In the instance where the physical factor is a biometric factor, the remote control device provides a component that is capable of reading the biometric characteristic of the user. Subsequently, the user may detect a need to perform two-factor authentication on the computer system (e.g., to access the user account, to access a feature provided by the computer system, etc.). The user can then use the remote control device to transmit a representation of both the physical factor (e.g., the smart card) and the memorized factor (e.g., the PIN) to the computer system in order to perform the two-factor authentication. For example, the representation may be a hash, subset f(x), etc. of both the physical and memorized factors. The computer system receives both factors transmitted by the remote control device and authenticates the user's credentials using both of the received factors.
In general terms, the processor controls the operation of the components of the remote control device. For example, the processor may executes program instructions stored in memory (not shown) thereby providing the remote control device its functionality, such as processing the input received via the keypad and/or the physical factor reader for transmission by the transmitter. The transmitter transmits signals that represent the input provided via the keypad and/or the physical factor reader for reception by a receiving device, such as a computer system 112. In some embodiments, the transmitter is a Bluetooth-compliant transmitter. In other embodiments, the transmitter may support connectivity and communications via any of a variety of well-known wireless protocols, such as infrared (IR), or wired protocols. For example, assuming that the remote control device is a smart phone with a remote control application, the communication protocol may be TCP/IP.
The aforementioned components of the remote control device are only illustrative and are not intended to suggest any limitation as to the implementation of the illustrated components and/or the scope of use or functionality of the remote control device. For example, in some embodiments where the physical factor reader is a smart card reader, the smart card reader may encrypt the information provided on the smart card using a cryptographic key that is also provided on the smart card. In some embodiments, the remote control device may not include one or more of the illustrated components, or may include other components or logic in addition to those illustrated above. For example, in embodiments where the remote control device is intended for use with a token (e.g., a random number generator), the remote control device may not include the physical factor reader.
In another embodiment, the remote control device may not include a display screen. In these embodiments, the user's input (e.g., the PIN or the memorized factor) is not displayed on the remote control device. In still another embodiment, the remote control device may include a card reader that is configured to read information from a magnetic strip affixed toga card.
In another embodiment, the remote control device transmits the number generated by the token and the user's PIN separately. For example, the user uses the keypad to enter a number that is being generated by the token on the remote control device and commands the remote control device to transmit the user's input. Subsequently, the user uses the keypad provided on the remote control device to enter a PIN and commands the remote control device to transmit the user's input.
One skilled in the art will appreciate that, for this and other processes and methods disclosed herein, the functions performed in the processes and methods may be implemented in differing order. Furthermore, the outlined steps are only exemplary, and some of the steps may be optional, combined with fewer steps, or expanded into additional steps.
In an alternative embodiment, the remote control device is a two-factor authentication-enabled remote control device. In this embodiment, the remote control device includes logic to enable certain functionality provided by the remote control device upon the remote control device authenticating its user using two-factor authentication. For example, in order to use the remote control device, a user inputs to the remote control device both the physical factor and the memorized factor. The remote control device then uses the input factors to authenticate the user using two-factor authentication. Upon authenticating the user, the remote control device enables one or more provided functions for use by the user. For example, the authenticated user may only be authorized to use the TV commands provided by the remote control device. In this instance, upon authenticating the user, the remote control device enables the TV controls and disables all other controls (e.g., VCR controls, DVD controls, computer system controls, etc.) that are provided on the remote control device. The remote control device may further limit the TV stations that are enabled depending on the identity of the user. In this manner, the remote control device is able to provide multiple user accounts that are accessed using two-factor authentication. Moreover, each user account may be provided access to varying degrees of functionality provided by the remote control device.
Although the subject matter has been described in language specific to structural features and/or methodological acts, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Though the remote control device has been described as controlling a computer system, it will be appreciated by those of ordinary skill in the art that other proxy devices or slave device that are capable of supporting two-factor authentication can be similarly be controlled. For example, the remote control device may be used to transmit representations of the physical and memorized factors to a set-top box that is configured to control audio, video, and electronic equipment. As another example, the remote control device and the supported two-factor authentication may be used to provide parental control. Accordingly, the specific features and acts described above are disclosed as example forms of implementing the claims.