US 11,962,580 B2
Browser extensionless phish-proof multi-factor authentication (MFA)
Charles E. Gero, Quincy, MA (US)
Assigned to Akamai Technologies, Inc., Cambridge, MA (US)
Filed by Akamai Technologies, Inc., Cambridge, MA (US)
Filed on Nov. 17, 2021, as Appl. No. 17/528,504.
Prior Publication US 2023/0155998 A1, May 18, 2023
Int. Cl. H04L 9/40 (2022.01)
CPC H04L 63/083 (2013.01) 17 Claims
OG exemplary drawing
 
1. Multi-Factor Authentication (MFA) Software-as-a-Service (SaaS) for authenticating a user to a site, the user having a computing machine, and an associated mobile device, the computing machine having a browser and a web storage application programming interface (API) with a local storage component, comprising:
hardware and associated software comprising program code configured to:
during an MFA workflow initiated by the user logging into the site in association with a site page, receive a request, the request having been generated by an invisible iframe associated with the site page, the iframe configured to create the request by (a) catching a message from the site page that passes a random value, (b) retrieving a private key of a browser key pair from the local storage component, and (c) using the private key of the browser key pair to create a signature over an assertion comprising the random value together with a domain name of the site page;
upon verifying the signature using a public key of the browser key pair, forward the assertion to the associated mobile device to facilitate completion of the MFA workflow.