Secure authentication systems and methods

• US 20040059951A1
• Filed: 04/25/2003
• Published: 03/25/2004
• Est. Priority Date: 04/25/2002
• Status: Active Grant

• Current Assignee: Intertrust Technologies Corporation (Fidelio Acquisition Co LLC)
• Original Assignee: Intertrust Technologies Corporation (Fidelio Acquisition Co LLC)
• Inventors: Sander, Tomas, Pinkas, Binyamin
• Granted Patent: US 7,383,570 B2
• Time in Patent Office: Days
• US Class Current: 713/202
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

Systems and methods are provided for authentication by combining a Reverse Turing Test (RTT) with password-based user authentication protocols to provide improved resistance to brute force attacks. In accordance with one embodiment of the invention, a method is provided for user authentication, the method including receiving a username/password pair associated with a user; requesting one or more responses to a first Reverse Turing Test (RTT); and granting access to the user if a valid response to the first RTT is received and the username/password pair is valid.

Claims

1. A method for user authentication, the method comprising:

receiving a username/password pair associated with a user;

requesting one or more responses to a first Reverse Turing Test (RTT); and

granting access to the user, if a valid response to the first RTT is received and the username/password pair is valid.

2. The method of claim 1, wherein the step of requesting one or more responses comprises:

checking if an entered username/password pair is valid; and

if the username/password pair is valid, requesting one or more responses based on a first RTT.

3. The method of claim 1, the step of requesting one or more responses comprises:

checking if an entered username/password pair is valid; and

if the username/password pair is invalid, requesting one or more responses based on a first RTT.

4. The method of claim 1, the step of requesting one or more responses comprises:

checking if an entered username/password pair is valid; and

if the username/password pair is invalid, not requesting one or more responses based on a first RTT.

5. The method of claim 1, further comprising:

if an invalid response to the first RTT is received;

requesting one or more responses based on a second RTT; and

denying access to the respondent regardless of whether the one or more responses to the second RTT are valid.

6. The method of claim 1, wherein the first RTT is a deterministic function of the username/password pair.

7. The method of claim 1, wherein the first RTT is a non-deterministic or random function that depends on the username/password pair with a predetermined probability.

8. A method as in claim 1, wherein the first RTT is independent of the username/password pair.

9. The method of claim 1, wherein the type of RTT used is selected from one or more types of RTTs.

10. The method of claim 9, wherein for each type of RTT, the time between receiving a username/password pair and requesting one or more responses to a first RTT is the same.

11. A method as in claim 1, further comprising:

providing the user with a cookie, wherein the cookie indicates the user provided a valid response to the first RTT.

12. A method for user authentication, the method comprising:

sending to a user a request for username/password pair and a request for a response to a Reverse Turing Test (RTT);

receiving a valid response to the RTT from the user; and

authenticating user based on a valid user/password pair.

13. A method as in claim 12, further comprising:

providing the user with a cookie, wherein the cookie indicates the user correctly answered the RTT.

14. A method as in claim 12, wherein sending to the user comprising:

checking for a cookie stored on the user computer; and

if the cookie exists, sending to the user a request for username/password pair and not sending the request for a response to the RTT.

15. A computer program package for user authentication, the computer program package providing instructions, which, if executed by a computer system, cause the system to perform operations comprising:

receiving a username//password pair associated with a user;

requesting one or more responses to a first Reverse Turing Test (RTT); and

granting access to the user, if a valid response to the first RTT is received and the username/password pair is valid.

16. A computer program package as in claim 15, wherein the step of requesting one or more responses comprises:

checking if an entered username/password pair is valid; and

if the username/password pair is valid, requesting one or more responses based on a first RTT.

17. A computer program package as in claim 15, wherein the step of requesting one or more responses comprises:

checking if an entered username/password pair is valid; and

if the username/password pair is invalid, not requesting one or more responses based on a first RTT.

18. A computer program package as in claim 15, the computer program package providing instructions, which, if executed by a computer system, cause the system to perform operations further comprising:

if an invalid response to the first RTT is received;

requesting one or more responses based on a second RTT; and

denying access to the respondent regardless of whether the one or more responses to the second RTT are valid.

19. A computer program package as in claim 15, wherein the first RTT is a deterministic function of the username/password pair.

20. A computer program package as in claim 15, wherein the first RTT is a non-deterministic or random function that depends on the username/password pair with a predetermined probability.

21. A computer program package as in claim 15, wherein the first RTT is independent of the username/password pair.