Image based key deprivation function

• US 10,250,593 B2
• Filed: 08/15/2017
• Issued: 04/02/2019
• Est. Priority Date: 06/13/2013
• Status: Active Grant

• Current Assignee: Visa International Service Association (Visa, Inc.)
• Original Assignee: Visa International Service Association (Visa, Inc.)
• Inventors: Aissi, Selim, Kgil, Taeho, Gaddam, Ajit
• Primary Examiner(s): Brown, Christopher J
• Application Number:
  US15/677,377
• Publication Number:
  US 20170346806A1
• Time in Patent Office: 595 Days
• Field of Search: 726 28, 713184
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G09C 5/00 Ciphering apparatus or methods not provided for in the preceding groups, e.g. involving the concealment or deformation of graphic data such as designs, written or printed messages
• CPC Class Codes: H04L 2463/061 applying further key derivation, e.g. deriving traffic keys from a pair-wise master key
• CPC Class Codes: H04L 2463/062 applying encryption of the keys
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords

Abstract

Embodiments of the invention relate to methods of generating and using an image-based derived key. In various embodiments, the image-based derived key may be used to facilitate user authentication and data encryption. For some embodiments, a method is disclosed comprising determining an image-based derived key, wherein the image-based derived key is generated from a selection of authentication images chosen by a user, encrypting data using the image-based derived key, and transmitting the encrypted data.

Claims

1. A computing device comprising:

a processor; and

a non-transitory computer-readable medium comprising code executable by the processor for implementing operations including;

receiving, from another computing device, an identifier and first encrypted data that was encrypted using an image-based derived key, the identifier being stored with the image-based derived key in an entry of a database;

determining the image-based derived key associated with the identifier,

wherein the image-based derived key is generated from a selection of authentication images, and a combination of image identifiers and pixel properties of the authentication images is used as an image input value to an image-based derived key function, and

wherein the image-based derived key is further generated based on;

an adjustable iteration count value being an input to the image-based derived key function indicating a number of repetitions that the image-based derived key function is performed to generate the image-based derived key;

an adjustable key length indicating a length of the image-based derived key; and

a salt value based on the identifier that is stored with the image-base derived key in the entry of the database; and

decrypting the first encrypted data.

2. The computing device of claim 1, wherein the authentication images are displayed on a user interface as a subset of a plurality of displayed images.

3. The computing device of claim 2, wherein the operations further include receiving the image identifiers of the authentication images.

4. The computing device of claim 2, wherein the plurality of displayed images are randomly arranged in a grid displayed on the user interface.

5. The computing device of claim 1, wherein the operations further include receiving the selection of the authentication images.

6. The computing device of claim 1, wherein the operations further include sending second encrypted data that was encrypted using the image-based derived key.

7. The computing device of claim 1, wherein the operations further include comparing the determined image-based derived key with the image-based derived key stored in the database.

8. The computing device of claim 7, wherein the operations further include authenticating a user when the determined image-based derived key matches the image-based derived key stored in the database.

9. The computing device of claim 7, wherein the image-based derived key being compared was stored in the database during a registration process.

10. The computing device of claim 1, wherein the image-based derived key is used in a payment system.

11. A computer-implemented method comprising:

receiving, from a computing device, an identifier and first encrypted data that was encrypted using an image-based derived key, the identifier being stored with the image-based derived key in an entry of a database;

determining the image-based derived key associated with the identifier,

wherein the image-based derived key is generated from a selection of authentication images, and a combination of image identifiers and pixel properties of the authentication images is used as an image input value to an image-based derived key function, and

wherein the image-based derived key is further generated based on;

an adjustable iteration count value being an input to the image-based derived key function indicating a number of repetitions that the image-based derived key function is performed to generate the image-based derived key;

an adjustable key length indicating a length of the image-based derived key; and

a salt value based on the identifier that is stored with the image-based derived key in the entry of the database and

decrypting the first encrypted data.

12. The computer-implemented method of claim 11, wherein the authentication images are displayed on a user interface as a subset of a plurality of displayed images.

13. The computer-implemented method of claim 12, further comprising receiving the image identifiers of the authentication images.

14. The computer-implemented method of claim 12, wherein the plurality of displayed images are randomly arranged in a grid displayed on the user interface.

15. The computer-implemented method of claim 11, further comprising receiving the selection of the authentication images.

16. The computer-implemented method of claim 11, further comprising sending second encrypted data that was encrypted using the image-based derived key to the computing device.

17. The computer-implemented method of claim 11, further comprising comparing the determined image-based derived key with the image-based derived key stored in the database.

18. The computer-implemented method of claim 17, further comprising authenticating a user when the determined image-based derived key matches the image-based derived key stored in the database.

19. The computer-implemented method of claim 17, wherein the image-based derived key being compared was stored in the database during a registration process.

20. The computer-implemented method of claim 11, wherein the image-based derived key is used in a payment system.