Using trusted communication channel to combat user name/password theft

• US 6,938,167 B2
• Filed: 12/18/2002
• Issued: 08/30/2005
• Est. Priority Date: 12/18/2002
• Status: Expired due to Term

• Current Assignee: Meta Platforms, Inc. (f/k/a Facebook, Inc.)
• Original Assignee: America Online Inc. (Warner Bros. Discovery, Inc.)
• Inventors: Roskind, James
• Primary Examiner(s): Song, Hosuk
• Application Number:
  US10/323,230
• Publication Number:
  US 20040123158A1
• Time in Patent Office: 986 Days
• Field of Search: 713/182, 713/191, 713200-202, 713/153, 713/164, 340/5.74, 340/5.8, 235/380, 235/382, 235/382.5, 707/9, 707/10, 707/203, 455/406, 455/405, 455/408, 455/410
• US Class Current: 726/22
• CPC Class Codes: G06F 21/42 using separate channels for security data
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks

Abstract

A technique for defining a system with enhanced trust is disclosed, in which an immediate contact is made with the user on the enhanced trust system when a compromise is first detected, e.g. when there is a second log in attempt from another location. Using these communications channels, the service can often contact the compromised user and ask for confirmation of the results, i.e. to change password or login, from a reduced trust machine. As a result, even if an attacker steals a password, the true user on the enhanced trust machine is able to preclude a login or preclude a password change. In each case, if the user of the enhanced trust machine does not respond within some short period of time, then a less trusted machine can be allowed to proceed. The invention comprehends two definitions of an enhanced trust machine. In a first embodiment of the invention, an enhanced trust machine is a machine where the user is currently logged in at the time that the second, less trusted machine attempts a login. A second embodiment of the invention comprehends an enhanced trust machine where the user has logged in repeatedly over a course of numerous weeks, as compared with a lesser trusted machine that the user has never logged into before and which is now asking for a change of the password. In this case, the system may or may not find the less trusted machine to be just that based on actions that are experientially inconsistent with what is expected.

Claims

1. A method for using a trusted communication channel to combat user name/password theft, comprising the steps of:

detecting an access attempt from an untrusted system;

making an immediate contact with a user of a trusted system when said access attempt from said untrusted system is first detected;

asking said user to confirm whether or not access via said untrusted system should be allowed;

permitting or denying said access via said untrusted system in response to said confirmation; and

developing experience with regard to work patterns of said user, and an expectation that a particular system is used by said user;

wherein a trusted system is a system where said user has been granted access repeatedly over a course of time.

2. The method of claim 1, further comprising the steps of:

recording a history of number of times said user has logged in from a particular system; and

storing evidence of said history, optionally signed by a service to preclude forgery.

3. A method for determining if a system is a trusted system, comprising the steps of:

detecting an access attempt at an untrusted system;

using a messaging system to make immediate contact with a user of a trusted system;

asking said user for confirmation with regard to one or more actions to be taken in connection with said untrusted system; and

precluding said one or more actions if said user refuses to provide affirmative conformation;

wherein said user of said trusted system confirms that said actions at said untrusted system may be permitted by any of entering a password and typing a special password.

4. An apparatus for using enhanced trust to combat user name/password theft, comprising:

a mechanism for detecting an access attempt from an untrusted system;

a messaging system for making an immediate contact with a user of a trusted system when said access attempt from said untrusted system is first detected;

a mechanism for asking said user to confirm whether or not access via said untrusted system should be allowed;

a mechanism for permitting or denying said access via said untrusted system in response to said confirmation; and

a mechanism for developing experience with regard to work patterns of said user, and an expectation that a particular system is used by said user;

wherein a trusted system is a system where said user has been granted access repeatedly over a course of time.

5. The apparatus of claim 4, further comprising:

a mechanism for recording a history of number of times said user has logged in from a particular system; and

a storage means for storing evidence of said history, optionally signed by a service to preclude forgery.

6. An apparatus for determining if a system is a trusted system, comprising:

a mechanism for detecting an access attempt at an untrusted system;

a messaging system for making immediate contact with a user of a trusted system;

a mechanism for asking said user for confirmation with regard to one or more actions to be taken in connection with said untrusted system; and

a mechanism for precluding said one or more actions if said user refuses to provide affirmative conformation;

wherein said user of said trusted system confirms that said actions at said untrusted system may be permitted by any of entering a password and typing a special password.