Secure authentication systems and methods

• US 7,383,570 B2
• Filed: 04/25/2003
• Issued: 06/03/2008
• Est. Priority Date: 04/25/2002
• Status: Expired due to Term

• Current Assignee: Intertrust Technologies Corporation (Fidelio Acquisition Co LLC)
• Original Assignee: Intertrust Technologies Corporation (Fidelio Acquisition Co LLC)
• Inventors: Sander, Tomas, Pinkas, Binyamin
• Primary Examiner(s): Kindred; Alford
• Assistant Examiner(s): FRANKLIN, RICHARD B
• Application Number:
  US10/423,531
• Publication Number:
  US 20040059951A1
• Time in Patent Office: 1,866 Days
• Field of Search: 713/183, 713/184, 713/200, 713/202
• US Class Current: 726/2
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

Systems and methods are provided for authentication by combining a Reverse Turing Test (RTT) with password-based user authentication protocols to provide improved resistance to brute force attacks. In accordance with one embodiment of the invention, a method is provided for user authentication, the method including receiving a username/password pair associated with a user; requesting one or more responses to a first Reverse Turing Test (RTT); and granting access to the user if a valid response to the first RTT is received and the username/password pair is valid.

Claims

1. A method for user authentication, the method comprising:

receiving a username/password pair associated with a user;

determining whether the username/password pair is valid;

requesting one or more responses to a first Reverse Turing Test (RTT), regardless of whether the username/password pair is valid; and

selectively granting the user access to a resource only if the username/password pair is valid, and the one or more responses to the first RTT is valid.

2. The method of claim 1, wherein the first RTT is a deterministic function of the username/password pair.

3. The method of claim 1, wherein the first RTT is a non-deterministic or random function that depends on the username/password pair with a predetermined probability.

4. The method of claim 1, wherein the first RTT is independent of the username/password pair.

5. The method of claim 1, wherein the first RTT is of a first type, and wherein the first type is selected from one or more types of RTTs.

6. The method of claim 5, wherein for each type of RTT, a time between (a) performing the step of receiving a username/password pair and (b) performing the step of requesting one or more responses to a first RTT is the same.

7. The method of claim 1, further comprising:

providing the user with a cookie, wherein the cookie indicates the user provided a valid response to the first RTT.

8. The method of claim 1, wherein the resource comprises at least one of:

an account associated with the user;

an electronic content item;

an Internet web site;

or an online service.

9. A method for user authentication, the method comprising:

sending to a user a request for a username/password pair;

receiving a username/password pair from the user;

determining whether the username/password pair is valid;

receiving one or more responses to a first Reverse Turing Test (RTT), regardless of whether the username/password pair is valid; and

selectively granting the user access to a resource only if the username/password pair is valid, and the one or more responses to the first RTT is valid.

10. A method as in claim 9, further comprising:

providing the user with a cookie, wherein the cookie indicates the user was authenticated.

11. A method as in claim 10, further comprising:

checking for the cookie stored on a computer associated with the user, prior to performing said sending step.

12. A computer-readable medium, the computer-readable medium storing programming instructions which, if executed by a computer system, are operable to cause the computer system to perform operations comprising:

determining whether a received username/password pair is valid;

requesting one or more responses to a first Reverse Turing Test (RTT) regardless of whether the received username/password pair is valid; and

selectively granting a user access to electronic goods and/or services if a valid response to the first RTT is received and the username/password pair is valid.

13. A computer-readable medium as in claim 12, wherein the first RTT is a deterministic function of the username/password pair.

14. A computer-readable medium as in claim 12, wherein the first RTT is a non-deterministic or random function that depends on the username/password pair.

15. A computer-readable medium as in claim 12, wherein the first RTT is independent of the username/password pair.