Systems and methods for creating a user credential and authentication using the created user credential

• US 10,013,545 B2
• Filed: 09/05/2012
• Issued: 07/03/2018
• Est. Priority Date: 10/27/2011
• Status: Active Grant

• Current Assignee: PayPal, Inc. (PayPal Holdings, Inc.)
• Original Assignee: PayPal, Inc. (PayPal Holdings, Inc.)
• Inventors: Jakobsson, Bjorn Markus
• Primary Examiner(s): Shiferaw, Eleni A
• Assistant Examiner(s): Callahan, Paul E
• Application Number:
  US13/604,307
• Publication Number:
  US 20130111571A1
• Time in Patent Office: 2,127 Days
• Field of Search: 726 6, 726 18, 726 19, 726 21, 726 28, 726 29, 713183, 713184, 713186, 705 72, 705 76
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: H04L 2463/062 applying encryption of the keys cryptographic mechanisms or cryptographic arrangements for key distribution using key encryption key H04L9/0822
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/43 using shared identity modules, e.g. SIM sharing
• CPC Class Codes: H04W 12/77 Graphical identity

Abstract

Systems, methods and devices for creating a user credential are provided. A device for creating a user credential for user authentication includes one or more processors configured to generate a first list of credential components from a second list of credential components and a network interface component coupled to a network. The network interface component is configured to transmit the generated first list of credential components to a user device, receive a user selection of at least one credential component from the transmitted first list of credential components, at least the user selection being selected by the user during user authentication, and receive a user entry. The device also includes a memory, the memory storing a combination of the user selection and the user entry as a created user credential. Systems, methods, and devices for authenticating a user with the created user credential are also provided.

Claims

1. A system comprising:

a non-transitory memory;

a network interface component; and

one or more hardware processors coupled to the non-transitory memory and the network interface component, the one or more hardware processors being configured to execute instructions to cause the system to perform operations comprising;

creating a new authentication credential of a user by;

generating a first list of credential components from a second list of credential components;

transmitting, using the network interface component, the first list of credential components to a user device;

receiving, using the network interface component, a selection of a first credential component from the first list of credential components; and

receiving, using the network interface component, a first user entry that is not a credential component selected from the first list of credential components;

determining whether there is a match between the first credential component and the first user entry; and

in response to the first credential component and the first user entry not matching, storing the first credential component and the first user entry as a new authentication credential for use in a later authentication attempt; and

processing the later authentication attempt by the user after the creating of the new authentication credential by;

generating a third list of credential components from the second list of credential components;

transmitting, using the network interface component, the third list of credential components to the user;

receiving, using the network interface component, an attempted authentication credential from the user, the attempted authentication credential comprising a selection of a second credential component from the third list of credential components and a second user entry; and

authenticating the user when the second credential component matches the stored first credential component and the second user entry matches the stored first user entry.

2. The system of claim 1, wherein the second list of credential components is stored in a credential database.

3. The system of claim 1, wherein the second list of credential components comprises a list of selectable words.

4. The system of claim 1, wherein the second list of credential components comprises a list of selectable images.

5. The system of claim 1, wherein the first user entry comprises a user text entry, a user voice recording, or a combination thereof.

6. The system of claim 1, wherein the new authentication credential can be used in existing authentication systems.

7. The system of claim 1, wherein the operations further comprise salting and hashing the new authentication credential before storing the new authentication credential.

8. The system of claim 1, wherein the operations further comprise storing the new authentication credential when the first credential component does not match an answer to a security question or an employer.

9. The system of claim 1, wherein the operations further comprise storing the new authentication credential when the first credential component does not match information available from a personal web page or a social media page of the user.

10. A non-transitory computer-readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations comprising:

creating a new authentication credential of a user by;

generating a first list of credential components from a second list of credential components;

transmitting the first list of credential components to a user;

receiving a selection of a first credential component from the first list of credential components;

receiving a first user entry that is not a credential component selected from the first list of credential components;

determining whether there is a match between the first credential component and the first user entry; and

in response to the first credential component and the first user entry not matching, storing the first credential component and the first user entry as a new authentication credential for use in a later authentication attempt; and

processing the later authentication attempt by the user after the creating of the new authentication credential by;

generating a third list of credential components from the second list of credential components;

transmitting the third list of credential components to the user;

receiving an attempted authentication credential component from the third list of credential components and a second user entry; and

authenticating the user when the attempted authentication credential component matches the stored first credential component and the second user entry matches the stored first user entry.

11. The computer-readable medium of claim 10, wherein generating a first list of credential components comprises:

generating a list of selectable words.

12. The computer-readable medium of claim 10, wherein generating a first list of credential components comprises:

generating a list of selectable images.

13. The computer-readable medium of claim 10, wherein receiving the first user entry comprises:

receiving at least one of a user text entry, a user voice recording, or a combination thereof.

14. The computer-readable medium of claim 10, wherein the operations further comprise rejecting the new authentication credential when the first credential component and the first user entry match.

15. The computer-readable medium of claim 10, wherein the operations further comprise salting and hashing the new authentication credential before the new authentication credential is stored.

16. The computer-readable medium of claim 10, wherein the operations further comprise storing the new authentication credential when the first credential component does not match a birthday, an answer to a security question, or an employer.

17. The computer-readable medium of claim 10, wherein the operations further comprise storing the new authentication credential when the first credential component does not match information available from a personal web page or a social media page of the user.

18. A non-transitory computer-readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations comprising:

generating a first list of credential components from a second list of credential components;

transmitting the first list of credential components to a user device;

receiving an attempted authentication credential for a user, the attempted authentication credential comprising a first credential component selected from the first list of credential components and a first user entry that is not selected from the first list of credential components;

determining if the attempted authentication credential matches a previously stored authentication credential associated with the user, the previously stored authentication credential comprising a second credential component selected from the second list of credential components during creation of the previously stored authentication credential and a second user entry input by the user during the creation of the previously stored authentication credential and not selected from the second list of credential components, wherein the second credential component and the second user entry have previously been determined by the machine to not match; and

authenticating the user when the first credential component matches the second credential component and the first user entry matches the second user entry.

19. The computer-readable medium of claim 18, wherein the first list of credential components comprises a list of selectable words or images.

20. The computer-readable medium of claim 18, wherein the first user entry comprises:

at least one of a user text entry, a user voice recording, or a combination thereof.

21. The computer-readable medium of claim 18, wherein determining if the attempted authentication credential matches the previously stored authentication credential associated with the user comprises determining if the attempted authentication credential matches the previously stored authentication credential within a predetermined tolerance.

22. The computer-readable medium of claim 18, wherein each credential component in the first list of credential components has a same shape, color, semantic meaning, or visual appearance to the second credential component.

23. The computer-readable medium of claim 18, wherein the operations further comprise:

providing additional information to the user if the attempted authentication credential does not match the previously stored authentication credential associated with the user.

24. The computer-readable medium of claim 23, wherein the additional information comprises a textual hint, a visual hint, a credential recovery option, or a combination thereof.

25. The computer-readable medium of claim 18, wherein determining if the attempted authentication credential matches the previously stored authentication credential comprises determining if the attempted authentication credential partially matches the previously stored authentication credential.

26. The computer-readable medium of claim 18, wherein the second credential component and the second user entry have been previously determined by the machine to not match a birthday, an answer to a security question, or an employer.

27. The computer-readable medium of claim 18, wherein the second credential component and the second user entry have been previously determined by the machine to not match information available from a personal web page or a social media page of the user.