Method and apparatus for asynchronous dynamic password

• US 8,832,807 B1
• Filed: 08/02/2011
• Issued: 09/09/2014
• Est. Priority Date: 08/05/2010
• Status: Active Grant

• Current Assignee: Christine E. Kuo, David E. Kuo, Hui-Hsin Wu, Kuo, James S.
• Original Assignee: Christine E. Kuo, David E. Kuo, Hui-Hsin Wu, Kuo, James S.
• Inventors: Kuo, Christine E., Kuo, David E., Wu, Hui-Hsin, Kuo, James S.
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): Tran, Tongoc
• Application Number:
  US13/196,105
• Time in Patent Office: 1,134 Days
• Field of Search: 726/2, 726 4- 6, 726/8, 713183-184
• US Class Current: 726/6
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 2221/2133 Verifying human interaction, e.g., Captcha
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 9/0656 Pseudorandom key sequence combined element-for-element with data sequence, e.g. one-time-pad [OTP] or Vernam's cipher
• CPC Class Codes: H04L 9/0662 with particular pseudorandom sequence generator
• CPC Class Codes: H04L 9/0819 Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) network architectures or network communication protocols for key distribution in a packet data network H04L63/062
• CPC Class Codes: H04L 9/0863 involving passwords or one-time passwords network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067
• CPC Class Codes: H04L 9/12 Transmitting and receiving encryption devices synchronised or initially set up in a particular manner
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key

Abstract

Apparatus and method for computer-based or mobile-device-based electronic generation and verification of dynamic password, or one-time-password (OTP), that does not require initial synchronization, nor re-synchronization, between a client OTP generator and the corresponding OTP server, is provided. It employs the general OTP principles and methods to ensure the single-use of the password credential and the security strength of the OTP, and it utilizes instant dynamic parameter(s) communications for equivalent instant synchronization (EQ-sync). It can also be used to ensure integrity and authenticity of an online transaction request.

Claims

1. A computer implemented method for generation and verification of a dynamic password, also known as one-time-password, providing at least one server, comprising:

Generating a dynamic generation code by the at least one server, store it only for the duration of the verification session, and send it to at least one user;

Receiving the dynamic generation code from the at least one server by the at least one user;

Entering the dynamic generation code and a personal secret into a client dynamic password generator by the at least one user for generating a first dynamic password;

Sending the first dynamic password and an at least one user'"'"'s account identity to the at least one server by the at least one user;

Retrieving the dynamic generation code and the at least one user'"'"'s personal secret by the at least one server for generating a second dynamic password using a server dynamic password generator;

Matching up the second dynamic password with the first dynamic password by the at least one server, and determine if there is a match.

2. The method of claim 1, wherein the computer implemented method further comprising computing device implemented method, or mobile device implemented method, or device implemented method, or computing machinery implemented method.

3. The method of claim 1, further comprising display of the generated first dynamic password on a display of the client dynamic password generator.

4. The method of claim 1, further comprising the dynamic generation code is not stored in the client dynamic password generation device, it is generated anew each time for each dynamic password generation, and it can expire after it'"'"'s generated.

5. The method of claim 1, further comprising the dynamic generation code can be generated by an independent server or servers, by a user or users, by a party or parties, and deliver to the at least one server, to the at least one user, or to the at least one server and the at least one user.

6. The method of claim 1, further comprising the dynamic generation code can be a code of any size with at least one letter, or, a random number of any size with at least one digit.

7. The method of claim 1, wherein entering the dynamic generation code and a personal secret into a client dynamic password generator by the at least one user for generating a first dynamic password further comprising selecting an account by the at least one user;

the account was registered at the at least one server by the at least one user.

8. The method of claim 1, wherein the personal secret is the personal-identification-number (PIN) or password or secret code of the selected account.

9. The method of claim 1, wherein the at least one user'"'"'s account identity is the user identification of the selected account, which can be a username, or a userID, or a user'"'"'s email address, or other user'"'"'s identification.

10. The method of claim 1, wherein receiving the dynamic generation code by the at least one user further comprising receiving the dynamic generation code by a computer, or a computing device, or a mobile device, or other networked device that the at least one user use to connect and communicate with the server.

11. The method of claim 1, wherein the dynamic password generator is a computer, a computer server, a computer server cluster, a computing device, a mobile device, or other online or offline computing device that equipped with dynamic password generation software or hardware which is capable of generating a dynamic password based on a given set of input parameters.

12. The method of claim 11, wherein the input parameters include, but not limited to, a dynamic generation code or codes, a PIN or PINs, a password or passwords, a stored static secret or stored static secrets, a salt or salts, an account number or account numbers, a data item or data items.

13. The method of claim 12, wherein the salt is an algorithmic salt that can be computed according to pre-selected algorithm or algorithms, which are shared between the client dynamic password generator and the server dynamic password generator.

14. The method of claim 12, wherein the salt can be pre-computed and stored.

15. The method of claim 12, wherein one or more stored static secrets can be uniquely linked to an account that is registered at the at least one server by the at least one user.

16. The method of claim 12, wherein one or more stored static secrets can be uniquely linked to the client dynamic password generator used by the at least one user.

17. The method of claim 11, wherein generating a dynamic password based on a given set of input parameters further comprising algorithmically combining the input parameters that are selected from the group consisting of dynamic generation code or codes, PIN or password or PINs or passwords, stored static secret or stored static secrets, salt or salts, account number or numbers, amount or amounts, data item or data items, document or documents or document links, and combinations thereof.

18. A computer implemented method for generation and verification of a dynamic password, also known as one-time-password token, providing at least one server, comprising:

Generating a dynamic generation code or codes by the at least one server, store them only for the duration of the verification session, and send them to at least one user;

Receiving the dynamic generation code or codes from the at least one server by the at least one user;

Entering the dynamic generation code or codes and a personal secret or secrets into a client dynamic password generator by the at least one user for generating a first dynamic password;

Sending the first dynamic password and an at least one user'"'"'s account identity to the at least one server by the at least one user;

Retrieving the dynamic generation code or codes and the at least one user'"'"'s personal secret or secrets by the at least one server for generating a second dynamic password using a server dynamic password generator;

Matching up the second dynamic password with the first dynamic password by the at least one server, and determine if there is a match.

19. A computer implemented method for generation and verification of a dynamic password, also known as one-time-password token, providing at least one party, comprising:

Generating a dynamic generation code or codes by the at least one party, store them only for the duration of the verification session, and send them to a second party;

Receiving the dynamic generation code or codes from the at least one party by the second party;

Entering the dynamic generation code or codes and a personal secret or secrets into a client dynamic password generator by the second party for generating a first dynamic password;

Sending the first dynamic password and a second party'"'"'s account identity to the at least one party by the second party;

Retrieving the dynamic generation code or codes and the second party'"'"'s personal secret or secrets by the at least one party for generating a second dynamic password using a server dynamic password generator;

Matching up the second dynamic password with the first dynamic password by the at least one party, and determine if there is a match.