Dynamically providing algorithm-based password/challenge authentication

• US 8,739,261 B2
• Filed: 08/29/2012
• Issued: 05/27/2014
• Est. Priority Date: 08/31/2011
• Status: Active Grant

• Current Assignee: Taiwan Semiconductor Manufacturing Company Limited
• Original Assignee: International Business Machines Corporation
• Inventors: Chao, Winson CW, Lin, Ta-Wei, Suen, Wei-Shiau, Wu, Ming-Hsun, Yu, Ying-Hung
• Primary Examiner(s): Nalven, Andrew
• Assistant Examiner(s): RUPRECHT, CHRISTOPHER S
• Application Number:
  US13/598,543
• Publication Number:
  US 20130055372A1
• Time in Patent Office: 636 Days
• Field of Search: None
• US Class Current: 726/7
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/0846 using time-dependent-passwords, e.g. periodically changing passwords
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

Provided are a computer program product, method and system for dynamically providing algorithm-based password/challenge authentication. A page is provided to authenticate a presenter of a username including a string and a field for entry of a password. An entered password entered into the page is received. An algorithm associated with the username is applied to the string included in the page to generate a generated password. A determination is made as to whether the entered password matches the generated password. The username is successfully authenticated in response to determining that the entered password matches the generated password.

Claims

1. A computer program product comprising a computer readable storage device having code executed to perform operations for providing password-based challenge authentication using an algorithm, the operations comprising:

providing a page to enable authentication of a presenter of a username, wherein the page includes;

a username field for entry of the username,

a seed string comprising a randomly generated string of characters including at least one of numbers, alphabets, and symbols, and

a password field for entry of a password;

receiving an entered username and an entered password entered into the page;

applying an algorithm associated with the username to the seed string included in the page to generate a generated password including a converted portion of the seed string,

wherein the algorithm specifies at least one selected conversion operator to be applied to at least one selected portion of the seed string, comprising less than all of the seed string,

wherein the at least one selected conversion operator includes at least one of move, append, convert, add, subtract, and square, and

wherein the at least one selected portion of the seed string includes at least one of first, last, and nth of characters, numbers, alphabets, symbols, upper case, or lower case in the seed string;

determining whether the entered password matches the generated password; and

successfully authenticating the presenter of the username in response to determining that the entered password matches the generated password.

2. The computer program product of claim 1, further comprising:

associating with each of a plurality of usernames an algorithm created for the username, wherein each of the algorithms specify operations to perform on a seed string, wherein the algorithm associated with the username comprises one of the algorithms associated with the usernames.

3. The computer program product of claim 1, wherein the operations further comprise:

generating a new seed string different from the seed string included in the page in response to determining that the entered password does not match the generated password; and

presenting a new page including the new seed string to authenticate the presenter of the username.

4. The computer program product of claim 1, wherein the operations further comprise:

receiving the page including the entered username and the entered password after providing the page; and

determining the algorithm associated with the entered username included in the received page, wherein the applied algorithm comprises the determined algorithm created for the entered username.

5. The computer program product of claim 1, wherein the presenter of the username comprises a user that further enters the password into the page, and wherein the algorithm applied was created by the user associated with the username.

6. The computer program product of claim 1, wherein the operations of providing the page, receiving the entered password, applying the algorithm, determining whether the entered password matches the generated password and successfully authenticating the presenter of the username are performed by one of a program executing in a computer to authenticate access to a service in the computer or a server in communication with a client computer over a network to authenticate a user of the client computer to access a service.

7. A system, comprising:

a processor; and

a computer readable storage device having program code executed to perform operations for providing password-based challenge authentication using an algorithm, the operations comprising;

providing a page to enable authentication of a presenter of a username, wherein the page includes;

a username field for entry of the username,

a seed string comprising a randomly generated string of characters including at least one of numbers, alphabets, and symbols, and

a password field for entry of a password;

receiving an entered username and an entered password entered into the page;

applying an algorithm associated with the username to the seed string included in the page to generate a generated password including a converted portion of the seed string,

wherein the algorithm specifies at least one selected conversion operator to be applied to at least one selected portion of the seed string, comprising less than all of the seed string,

wherein the at least one selected conversion operator includes at least one of move, append, convert, add, subtract, and square, and

wherein the at least one selected portion of the seed string includes at least one of first, last, and nth of characters, numbers, alphabets, symbols, upper case, or lower case in the seed string;

determining whether the entered password matches the generated password; and

successfully authenticating the presenter of the username in response to determining that the entered password matches the generated password.

8. The system of claim 7, further comprising:

associating with each of a plurality of usernames an algorithm created for the username, wherein each of the algorithms specify operations to perform on a seed string, wherein the algorithm associated with the username comprises one of the algorithms associated with the usernames.

9. The system of claim 7, wherein the operations further comprise:

generating a new seed string different from the seed string included in the page in response to determining that the entered password does not match the generated password; and

presenting a new page including the new seed string to authenticate the presenter of the username.

10. The system of claim 7, wherein the operations further comprise:

receiving the page including the entered username and the entered password after providing the page; and

determining the algorithm associated with the entered username included in the received page, wherein the applied algorithm comprises the determined algorithm created for the entered username.

11. The system of claim 7, wherein the presenter of the username comprises a user that further enters the password into the page, and wherein the algorithm applied was created by the user associated with the username.

12. The system of claim 7, wherein the operations of providing the page, receiving the entered password, applying the algorithm, determining whether the entered password matches the generated password and successfully authenticating the presenter of the username are performed to authenticate one of a user of the system to access a service provided in the system or a user at a client computer that communicates with the system over a network.

13. A method performed by a processor executing in a computer system for providing password-based challenge authentication using an algorithm, comprising:

providing a page to enable authentication of a presenter of a username, wherein the page includes;

a username field for entry of the username,

a seed string comprising a randomly generated string of characters including at least one of numbers, alphabets, and symbols, and

a password field for entry of a password;

receiving an entered username and an entered password entered into the page;

applying an algorithm associated with the username to the seed string included in the page to generate a generated password including a converted portion of the seed string,

wherein the algorithm specifies at least one selected conversion operator to be applied to at least one selected portion of the seed string, comprising less than all of the seed string,

wherein the at least one selected conversion operator includes at least one of move, append, convert, add, subtract, and square, and

wherein the at least one selected portion of the seed string includes at least one of first, last, and nth of characters, numbers, alphabets, symbols, upper case, or lower case in the seed string;

determining whether the entered password matches the generated password; and

successfully authenticating the presenter of the username in response to determining that the entered password matches the generated password.

14. The method of claim 13, further comprising:

associating with each of a plurality of usernames an algorithm created for the username, wherein each of the algorithms specify operations to perform on a seed string, wherein the algorithm associated with the username comprises one of the algorithms associated with the usernames.

15. The method of claim 13, wherein the operations further comprise:

generating a new seed string different from the seed string included in the page in response to determining that the entered password does not match the generated password; and

presenting a new page including the new seed string to authenticate the presenter of the username.

16. The method of claim 13, wherein the operations further comprise:

receiving the page including the entered username and the entered password after providing the page; and

determining the algorithm associated with the entered username included in the received page, wherein the applied algorithm comprises the determined algorithm created for the entered username.

17. The method of claim 13, wherein the presenter of the username comprises a user that further enters the password into the page, and wherein the algorithm applied was created by the user associated with the username.

18. The method of claim 13, wherein the operations of providing the page, receiving the entered password, applying the algorithm, determining whether the entered password matches the generated password and successfully authenticating the presenter of the username are performed by one of a program executing in a computer to authenticate access to a service in the computer or a server in communication with a client computer over a network to authenticate a user of the client computer to access a service.