Method, system and computer program product for preventing illegal user from logging in

• US 20070078985A1
• Filed: 06/16/2006
• Published: 04/05/2007
• Est. Priority Date: 06/16/2005
• Status: Abandoned Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Zhang, Juan, Shao, Ling, Yan, Royd
• Application Number:
  US11/455,143
• Publication Number:
  US 20070078985A1
• Time in Patent Office: Days
• US Class Current: 709/226
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215

Abstract

A method for preventing an illegal user from logging in an online application with an authentic user'"'"'s user log-in information is provided in the present invention. The system associates user log-in information with personal communication device information specified by the authentic user. In response to receiving the user log-in information inputted by a user, the system retrieves the personal communication device information associated with the user log-in information, and sends a short message to the personal communication device to notify the authentic user of the logging operation. If no confirming message is received from the authentic user, log in is rejected.

Claims

1. A method for preventing an illegal user from logging in to an online application with an authentic user'"'"'s user log-in information, the method comprising the steps of:

associating the user log-in information with personal communication device information for at least one personal communication device specified by the authentic user;

in response to receiving the user log-in information inputted by a user, retrieving the personal communication device information associated with the user log-in information;

sending a message to at least one personal communication device with the specified information to notify the authentic user of the logging operation;

inquiring if a confirming message in reply to the message is received from the authentic user; and

if no confirming message is received from the authentic user, refusing logging in to the application with the user log-in information.

2. The method of claim 1, wherein the user log-in information includes user ID and password.

3. The method of claim 1, wherein the personal communication device information includes the number for contacting the at least one personal communication device.

4. The method of claim 1, wherein the message sent to the personal communication device with the specified information includes the user log-in information and some random information.

5. The method of claim 1, further comprising the steps of:

when the confirming message is received from the user, verifying if the confirming message is correct,

if the confirming message is correct, allowing logging in the online application with the user log-in information;

if the confirming message is not correct, rejecting logging in the online application with the user log-in information.

6. The method of claim 1, wherein, the step of inquiring if a confirming message in reply to the message is received from the authentic user further comprises the step of:

inquiring if a confirming message replied by the personal communication device in the form of a predetermined message is received.

7. The method of claim 6, wherein, if the confirming message replied by the personal communication device in the form of a predetermined message is “

YES”

, allowing logging in to the online application with the user log-in information.

8. The method of claim 6, wherein, the confirming message replied by the personal communication device in the form of a predetermined message contains ID information received by the personal communication device.

9. The method of claim 6, further comprising the steps of:

verifying the received confirming message replied by the personal communication device in the form of a predetermined message,

if the confirming message is correct, allowing logging in to the online application with the user log-in information;

if the confirming message is not correct, refusing logging in to the online application with the user log-in information.

10. The method of claim 1, wherein, after sending a message to the personal communication device with the specified information, sending to the user'"'"'s client an indication prompting input of confirming message,

wherein the step of inquiring if a confirming message to the message is received from the authentic user further comprises the step of inquiring if a confirming message inputted from the client is received.

11. The method of claim 10, further comprising the steps of:

verifying the received confirming message inputted from the client,

if the confirming message is correct, allowing logging in to the online application with the user log-in information;

if the confirming message is not correct, rejecting logging in to the online application with the user log-in information.

12. The method of claim 11, wherein, the confirming message inputted from the client comprises the information contained in the message received by the personal communication device.

13. The method of claim 1, wherein, the personal communication device is a mobile telephone.

24. A computer program product, the computer program product containing computer readable program codes embodied in a computer readable storage medium that enables a computer system to implement the method of claim 1.

14. A system for preventing an illegal user from logging in to an online application with an authentic user'"'"'s user log-in information, the system comprising:

processing means for associating the user log-in information with personal communication device information for at least one personal communication device specified by the user and retrieving the associated personal communication device information according to the user log-in information;

storage means for storing the user log-in information and the associated personal communication device information;

first communication means for communicating with a client operated by the user;

second communication means for communicating with at least one personal communication device to send a message to the personal communication device;

wherein, after the first communication means receives the user log-in information inputted from the client by the user, the processing means sends a message to the at least one personal communication device with the information associated with the user log-in information, through the second communication means, to notify the user of the logging operation, and refusing logging in the application with the user log-in information if no confirming message is received from the user by the first communication means or the second communication means.

15. The system of claim 14, wherein the user log-in information includes user ID and password.

16. The system of claim 14, wherein the personal communication device information includes at least one number for contacting the at least one personal communication device.

17. The system of claim 14, wherein the message sent to the personal communication device with the specified information includes user log-in information and some random information.

18. The system of claim 14, wherein the processing means verifies if the confirming message received from the user is correct,

if the confirming message is correct, allowing logging in to the online application with the user log-in information;

if the confirming message is not correct, rejecting logging in to the online application with the user log-in information.

19. The system of claim 14, wherein the processing means inquires if a confirming message replied by the personal communication device in the form of a predetermined message is received.

20. The system of claim 14 wherein, after the second communication means sends a message to the personal communication device with the specified information, the processing means sends to the user'"'"'s client an indication prompting input of a confirming message,

wherein, the processing means inquires if a confirming message inputted from the client is received.

21. The system of claim 20, wherein, the processing means verifies the received confirming message inputted from the client,

if the confirming message is correct, allowing logging in to the online application with the user log-in information;

if the confirming message is not correct, rejecting logging in to the online application with the user log-in information.

22. The system of claim 20, wherein, the confirming message inputted from the client comprises the information contained in the message received by the personal communication device.

23. The system of claim 14, wherein, the personal communication device is a mobile telephone.