Techniques for user authentication

• US 8,925,062 B1
• Filed: 11/14/2013
• Issued: 12/30/2014
• Est. Priority Date: 12/30/2011
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Brezinski, Dominique I., Kirzhner, Benjamin S., Buneci, Emilia S., O'Reilly, Martin M., Durgin, Cyrus J., LaRue, Lane R.
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): Tran, Tongoc
• Application Number:
  US14/080,599
• Time in Patent Office: 411 Days
• Field of Search: 726/2, 726/5, 726/7, 713/168, 713/183, 713/184, 713/186
• US Class Current: 726/7
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/42 using separate channels for security data
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: G07C 9/38 with central registration
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

Techniques for user authentication are disclosed. In some situations, the techniques include receiving, from a client device, an authentication request to access a network resource, the request including a user identifier, obtaining a security credential associated with the user identifier contained in the received request, generating an authorization code based on the obtained security credential, providing to the client device instructions to obtain first information corresponding to the generated authorization code, receiving, from the client device, the first information provided in response to the provided instructions, and, when the first information received from the client device corresponds to at least a portion of the generated authorization code, authorizing the client device to access the network resource.

Claims

1. A computer-implemented method comprising:

receiving, by a configured computing system, an authentication request to access a network resource on behalf of an indicated user;

generating, by the configured computing system, an authorization code based on a security phrase associated with the indicated user, the generating including selecting a first subset of characters in the security phrase to use for the authorization code and including excluding a distinct second subset of the characters in the security phrase from use for the authorization code;

providing, by the configured computing system, instructions to the indicated user regarding obtaining the generated authorization code, the provided instructions including information related to the selected first subset without providing the characters in the selected first subset;

receiving, by the configured computing system, information from the indicated user that includes the generated authorization code, the received information not including the excluded second subset of characters; and

in response to the received information including the generated authorization code, authorizing the access to the network resource.

2. The computer-implemented method of claim 1 wherein the received information from the indicated user is provided to the configured computing system by a client device of the indicated user in response to a verbal communication to the client device by the indicated user, wherein the client device is configured to transform the verbal communication to computer-readable information, and wherein the received information from the indicated user is the computer-readable information.

3. The computer-implemented method of claim 1 further comprising determining that the received information from the indicated user matches the generated authorization code, and providing the indicated user with access to the network resource.

4. The computer-implemented method of claim 1 wherein the characters of the security phrase include a sequence of multiple digits, and wherein the generated authorization code includes two or more of the multiple digits and does not include at least one other of the multiple digits.

5. The computer-implemented method of claim 4 wherein the security phrase is available to the indicated user before the receiving of the authentication request, and wherein the provided instructions to the indicated user include indications of positions of the two or more digits in the sequence.

6. The computer-implemented method of claim 5 further comprising defining, by the configured computing system and before the receiving of the authentication request, the security phrase for the indicated user based on information specified by the indicated user.

7. The computer-implemented method of claim 1 wherein the characters of the security phrase include a sequence of multiple letters, and wherein the generated authorization code includes two or more of the multiple letters and does not include at least one other of the multiple letters.

8. The computer-implemented method of claim 7 wherein the security phrase is available to the indicated user before the receiving of the authentication request, and wherein the provided instructions to the indicated user include indications of positions of the two or more letters in the sequence.

9. The computer-implemented method of claim 1 further comprising defining, by the configured computing system and before the receiving of the authentication request, the security phrase associated with the indicated user based on information specified by the indicated user.

10. The computer-implemented method of claim 1 further comprising, before the authorizing of the access, determining to perform additional authentication procedures based on information specific to the indicated user, and successfully performing the additional authentication procedures.

11. The computer-implemented method of claim 1 further comprising determining an attribute associated with the received authentication request, and wherein the generating of the authorization code includes generating the authorization code to reflect a first level of strength if the determined attribute matches user information associated with the indicated user, and includes generating the authorization code to reflect a second level of strength that is higher than the first level if the determined attribute does not match the user information associated with the indicated user.

12. The computer-implemented method of claim 11 wherein the determined attribute is the indicated user utilizing an internal network associated with the configured computing system.

13. The computer-implemented method of claim 11 wherein the determined attribute is the indicated user being within a defined geographical area associated with the indicated user.

14. The computer-implemented method of claim 11 wherein the determined attribute is information for a client device of the indicated user matching device information associated with the indicated user.

15. A computer system comprising:

at least one processor; and

at least one memory having computer-executable instructions that, when executed on the at least one processor, cause the at least one processor to;

receive, from a client device of an indicated user, an authentication request to access a network resource on behalf of the indicated user;

generate an authorization code based on obtained security information, the generating including selecting a first subset of the security information for the authorization code and including excluding a distinct second subset of the security information from use for the authorization code;

provide, to the client device, instructions regarding obtaining the generated authorization code from the indicated user, the provided instructions including information related to the selected first subset;

receive, from the client device, the generated authorization code; and

in response to the received generated authorization code, authorize the access to the network resource.

16. The computer system of claim 15 wherein the obtained security information is a security phrase with a plurality of characters that was previously specified by the indicated user before the receiving of the authentication request, and wherein the first subset of the security information is multiple characters that are a selected subset of the plurality of characters.

17. The computer system of claim 15 wherein the computer-executable instructions further cause the at least one processor to determine that the generated authorization code received from the client device does not include the excluded second subset of the security information, and to provide the client device with access to the network resource, the network resource being accessible only by authenticated devices.

18. A non-transitory computer-readable medium having computer-executable instructions stored thereon that, when executed by a computer, configure the computer to:

receive, by the configured computer, an authentication request to access a network resource on behalf of a user;

generate, by the configured computer, an authorization code based on an obtained security phrase having a plurality of characters, the generating including using only a selected subset of the characters for the authorization code and excluding a second subset of the characters;

provide, by the configured computer, instructions to the user regarding obtaining the generated authorization code, the provided instructions including information related to the selected subset;

receive, by the configured computer, the generated authorization code from the user;

determine, by the configured computer, that the generated authorization code received from the user does not include the characters of the excluded second subset; and

in response to the received generated authorization code, authorize the access to the network resource, and provide the user with access to the network resource.

19. The non-transitory computer-readable medium of claim 18 wherein the computer-executable instructions further configure the computer to determine one or more attributes associated with the received authentication request, and wherein the generating of the authorization code includes selecting one of multiple levels of strength to use for the generated authorization code based on whether the determined attributes match user information associated with the user, and includes generating the authorization code based on the selected one level of strength.