System and methods for key challenge validation

• US 8,631,503 B2
• Filed: 10/03/2007
• Issued: 01/14/2014
• Est. Priority Date: 10/03/2007
• Status: Active Grant

• Current Assignee: eBay Inc.
• Original Assignee: eBay Inc.
• Inventors: Jastrebski, Grahame Andrew, Patil, Dhanurjay A. S.
• Primary Examiner(s): BROWN, CHRISTOPHER J
• Application Number:
  US11/906,632
• Publication Number:
  US 20090094687A1
• Time in Patent Office: 2,295 Days
• Field of Search: 713/185, 713/18, 705/64, 705/14.26, 726/28
• US Class Current: 726/28
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks

Abstract

This document discusses, among other things, a system and method for detecting an initiation of a transaction and generating a string of characters based on the detection. A first portion of the string of characters may be presented in such a way as to be distinguished from a second portion of the string of characters. In various example embodiments, the transaction is validated based on an identification of the first portion of the string of characters.

Claims

1. A method comprising:

detecting an initiation of a transaction;

in response to the detecting of the initiation, generating a challenge that comprises a continuous string of alphanumeric characters that includes transaction specific information that comprises a detail of the transaction;

presenting the challenge that visually distinguishes a first portion of the continuous string of alphanumeric characters from a second portion of the continuous string of alphanumeric characters along with instructions for responding to the challenge, the first portion being a proper subset of the continuous string of alphanumeric characters that forms a challenge key, the instructions instructing return of the challenge key in response to the challenge by entering the challenge key in a text box;

receiving a response to the challenge; and

validating, using a processor of a machine, the transaction based on the response to the challenge that was entered into the text box including the challenge key formed from the first portion of the continuous string of alphanumeric characters.

2. The method of claim 1, wherein the detecting of the initiation includes detecting an interaction with a Web page.

3. The method of claim 1, wherein the generating of the continuous string of alphanumeric characters includes generating a string of randomly selected alphanumeric characters, the string having a fixed length.

4. The method of claim 1, wherein the transaction specific information comprises a selection from the group consisting of a recipient name, a first e-mail address of the recipient, a sender name, and a second e-mail address of the sender.

5. The method of claim 1, wherein the visually distinguishing of the first portion of the continuous string of alphanumeric characters includes using at least one distinguisher selected from the group consisting of colors, fonts, patterns, and shading.

6. The method of claim 1, wherein the visually distinguishing of the first portion of the continuous string of alphanumeric characters includes presenting alphanumeric characters of the first portion of the continuous string of alphanumeric characters contiguously in the string.

7. The method of claim 1, wherein the visually distinguishing of the first portion of the continuous string of alphanumeric characters includes presenting alphanumeric characters of the first portion of the continuous string non-contiguously in the continuous string.

8. The method of claim 1, wherein the validating of the transaction includes comparing a set of alphanumeric characters entered in the text box with the first portion of the continuous string of alphanumeric characters and confirming that a user is human based on the set of alphanumeric characters matching the first portion.

21. The method of claim 1, further comprising:

accessing information specific to the transaction to identify a piece of the information to be used as the continuous string in the challenge, wherein the generating of the challenge comprises using the piece of information specific to the transaction as the continuous string.

9. A method comprising:

detecting an initiation of a transaction;

in response to the detecting of the initiation, generating transaction specific information that comprises a detail of the transaction to be used as a continuous string of alphanumeric characters of a challenge;

presenting the challenge that visually distinguishes a first portion of the transaction specific information from a second portion of the transaction specific information along with instructions for responding to the challenge, the first portion being a proper subset of the transaction specific information that forms a challenge key, the instructions instructing return of the challenge key in response to the challenge by entering the challenge key into a text box;

receiving a response to the challenge; and

validating, using a processor of a machine, the transaction based on the response to the challenge that was entered into the text box including the challenge key formed from the first portion of the transaction specific information.

10. The method of claim 9, wherein the transaction specific information comprises a selection from the group consisting of a recipient name, a first e-mail address of the recipient, a sender name, and a second e-mail address of the sender.

11. A system comprising:

a challenge string module to generate a challenge that comprises a continuous string of alphanumeric characters in response to a detection of a request to make a transaction, the continuous string of alphanumeric characters comprising transaction specific information that comprises a detail of the transaction;

a key generation module to select a first portion of the continuous string of alphanumeric characters to be visually distinguished from a second portion of the continuous string of alphanumeric characters, the first portion being a proper subset of the string of alphanumeric characters that forms a challenge key;

a challenge generation module to generate an image that visually distinguishes the first portion from the second portion of the continuous string of alphanumeric characters of the challenge and to generate instructions instructing return of the challenge key in response to the challenge by entering the challenge key in a text box; and

a computer processor to validate the transaction based on receiving the challenge key formed from the first portion of the continuous string of alphanumeric characters in response to the challenge.

12. The system of claim 11, further comprising:

an image attribute module to provide a visual attribute to the image to visually distinguish the first portion of the continuous string of alphanumeric characters from the second portion of the continuous string of alphanumeric characters.

13. The system of claim 11, wherein the request to make a transaction includes an interaction with a Web page.

14. The system of claim 11, wherein the transaction specific information comprises a selection from the group consisting of a recipient name, a first e-mail address of the recipient, a sender name, and a second e-mail address of the sender.

15. The system of claim 12, wherein the visual attribute provided by the image attribute module is selected from the group consisting of colors, fonts, patterns, and shading.

16. The system of claim 11, wherein the first portion of the continuous string is a contiguous portion of the continuous string of alphanumeric characters.

17. The system of claim 11, wherein the processor is to validate the transaction by comparing a set of alphanumeric characters entered in the text box with the first portion of the continuous string of alphanumeric characters, and confirming that a user is human based on the set of alphanumeric characters matching the first portion.

18. A system comprising:

a challenge string module to generate a challenge comprising transaction specific information to be used as a continuous string of alphanumeric characters of a challenge in response to a detection of a request to make a transaction;

a key generation module to select a first portion of the transaction specific information to be visually distinguished from a second portion of the transaction specific information, the first portion being a proper subset of the transaction specific information that forms a challenge key;

a challenge generation module to generate an image that visually distinguishes the first portion from the second portion of the transaction specific information of the challenge and to generate instructions instructing return of the challenge key in response to the challenge by entering the challenge key in a text box; and

a computer processor to validate the transaction based on receiving the challenge key formed from the first portion of the transaction specific information in response to the challenge.

19. The system of claim 18, wherein the challenge string module is to generate at least one type of transaction specific information selected from the group of types consisting of a recipient name, a first e-mail address of the recipient, a sender name, and a second e-mail address of the sender.

20. A tangible machine-readable device containing instructions which, when executed by a processing system, cause the processing system to perform operations comprising:

detecting an initiation of a transaction;

in response to the detecting of the initiation, generating a challenge comprising a continuous string of alphanumeric characters that represents information specific to the transaction;

presenting the challenge that visually distinguishes a first portion of the continuous string of alphanumeric characters from a second portion of the continuous string of alphanumeric characters along with instructions for responding to the challenge, the first portion being a proper subset of the continuous string of alphanumeric characters that forms a challenge key, the instructions instructing return of the challenge key in response to the challenge by entering the challenged key into a text box; and

validating the transaction based on receiving the challenge key formed from the first portion of the continuous string of alphanumeric characters as a response to the challenge.

22. The tangible machine-readable device of claim 20, wherein the operations further comprise:

accessing information specific to the transaction to identify a piece of the information to be used as the continuous string in the challenge, wherein the generating of the challenge comprises using the piece of information specific to the transaction as the continuous string.