Using trusted communication channel to combat user name/password theft

• US 20040123158A1
• Filed: 12/18/2002
• Published: 06/24/2004
• Est. Priority Date: 12/18/2002
• Status: Active Grant

• Current Assignee: Meta Platforms, Inc. (f/k/a Facebook, Inc.)
• Original Assignee: America Online Inc. (Warner Bros. Discovery, Inc.)
• Inventors: Roskind, James
• Granted Patent: US 6,938,167 B2
• Time in Patent Office: Days
• US Class Current: 713/202
• CPC Class Codes: G06F 21/42 using separate channels for security data
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks

Abstract

A technique for defining a system with enhanced trust is disclosed, in which an immediate contact is made with the user on the enhanced trust system when a compromise is first detected, e.g. when there is a second log in attempt from another location. Using these communications channels, the service can often contact the compromised user and ask for confirmation of the results, i.e. to change password or login, from a reduced trust machine. As a result, even if an attacker steals a password, the true user on the enhanced trust machine is able to preclude a login or preclude a password change. In each case, if the user of the enhanced trust machine does not respond within some short period of time, then a less trusted machine can be allowed to proceed. The invention comprehends two definitions of an enhanced trust machine. In a first embodiment of the invention, an enhanced trust machine is a machine where the user is currently logged in at the time that the second, less trusted machine attempts a login. A second embodiment of the invention comprehends an enhanced trust machine where the user has logged in repeatedly over a course of numerous weeks, as compared with a lesser trusted machine that the user has never logged into before and which is now asking for a change of the password. In this case, the system may or may not find the less trusted machine to be just that based on actions that are experientially inconsistent with what is expected.

Claims

1. A method for using a trusted communication channel to combat user name/password theft, comprising the steps of:

detecting an access attempt from an untrusted system;

making an immediate contact with a user of a trusted system when said access attempt from said untrusted system is first detected;

asking said user to confirm whether or not access via said untrusted system should be allowed; and

permitting or denying said access via said untrusted system in response to said confirmation.

2. The method of claim 1, wherein if said user of said trusted system does not respond within a predetermined period of time, then said untrusted system is allowed said access.

3. The method of claim 1, wherein a trusted system is a system where said user is currently logged in at a time that said untrusted system attempts to gain access.

4. The method of claim 1, wherein a trusted system is a system where said user has been granted access repeatedly over a course of time.

5. The method of claim 4, further comprising the step of:

tagging a system that is used extensively by said user as a system that is trusted.

6. The method of claim 4, further comprising the step of:

developing experience with regard to said user'"'"'s work patterns, and an expectation that a particular system is used by said user.

7. The method of claim 6, further comprising the steps of:

recording a history of number of times said user has logged in from a particular system; and

storing evidence of said history, optionally signed by a service to preclude forgery.

8. The method of claim 1, wherein a system having current active access is considered relatively more trusted than a system that has either does not have current access, or has not had prior access, by a given user.

9. The method of claim 1, further comprising the steps of:

tagging a system; and

verifying access to prevent forged authentication.

10. The method of claim 1, further comprising the step of:

using a random password generation scheme.

11. The method of claim 1, further comprising the step of:

using current and prior login history to establish a pattern of actions to detect suspicious logins and/or password changes.

12. The method of claim 1, further comprising the step of:

applying experiential information to password authentication; and

tagging a system to identify relative trust of said system.

13. The method of claim 1, further comprising the step of:

capturing system addresses for systems which attempt to use stolen accounts.

14. A method for determining if a system is a trusted system, comprising the steps of:

detecting an access attempt at an untrusted system;

using a messaging system to make immediate contact with a user of a trusted system;

asking said user for confirmation with regard to one or more actions to be taken in connection with said untrusted system; and

precluding said one or more actions if said user refuses to provide affirmative conformation.

15. The method of claim 14, wherein said messaging system comprises any instant two-way communications system comprising:

an instant messaging system, a pager, and a telephone.

16. The method of claim 14, wherein said user of said trusted system confirms that said actions at said untrusted system may be permitted by any of entering a password and typing a special password.

17. The method of claim 14, further comprising the step of:

adding said untrusted system to a filter list which performs any of blocking access by said untrusted system and instituting an investigation.

18. An apparatus for using enhanced trust to combat user name/password theft, comprising:

a mechanism for detecting an access attempt from an untrusted system;

a messaging system for making an immediate contact with a user of a trusted system when said access attempt from said untrusted system is first detected;

a mechanism for asking said user to confirm whether or not access via said untrusted system should be allowed; and

a mechanism for permitting or denying said access via said untrusted system in response to said confirmation.

19. The apparatus of claim 18, wherein if said user of said trusted system does not respond within a predetermined period of time, then said untrusted system is allowed said access.

20. The apparatus of claim 18, wherein a trusted system is a system where said user is currently logged in at a time that said untrusted system attempts to gain access.

21. The apparatus of claim 18, wherein a trusted system is a system where said user has been granted access repeatedly over a course of time.

22. The apparatus of claim 21, further comprising:

a mechanism for tagging a system that is used extensively by said user as a system that is trusted.

23. The apparatus of claim 21, further comprising:

a mechanism for developing experience with regard-to said user'"'"'s work patterns, and an expectation that a particular system is used by said user.

24. The apparatus of claim 23, further comprising:

a mechanism for recording a history of number of times said user has logged in from a particular system; and

a storage means for storing evidence of said history, optionally signed by a service to preclude forgery.

25. The apparatus of claim 18, wherein a system having current active access is considered relatively more trusted than a system that has either does not have current access, or has not had prior access, by a given user.

26. The apparatus of claim 18, further comprising:

a mechanism for tagging a system; and

a mechanism for verifying access to prevent forged authentication.

27. The apparatus of claim 18, further comprising:

a random password generation scheme for generating a random number, wherein an attacker must immediately use a compromised password.

28. The apparatus of claim 18, further comprising:

a mechanism for using current and prior login history to establish a pattern of actions to detect suspicious logins and/or password changes.

29. The apparatus of claim 18, further comprising:

a mechanism for applying experiential information to password authentication; and

a mechanism for tagging a system to identify relative trust of said system.

30. The apparatus of claim 18, further comprising:

a mechanism for capturing system addresses for systems which attempt to use stolen accounts.

31. An apparatus for determining if a system is a trusted system, comprising:

a mechanism for detecting an access attempt at an untrusted system;

a messaging system for making immediate contact with a user of a trusted system;

a mechanism for asking said user for confirmation with regard to one or more actions to be taken in connection with said untrusted system; and

a mechanism for precluding said one or more actions if said user refuses to provide affirmative conformation.

32. The apparatus of claim 31, wherein said messaging system comprises any instant two-way communications system comprising:

an instant messaging system, a pager, and a cellular telephone.

33. The apparatus of claim 31, wherein said user of said trusted system confirms that said actions at said untrusted system may be permitted by any of entering a password and typing a special password.

34. The apparatus of claim 31, further comprising:

a filter list of untrusted systems, which performs any of blocking access by said untrusted system and instituting an investigation.