Input validation, user and data authentication on potentially compromised mobile devices

• US 9,025,834 B2
• Filed: 05/29/2013
• Issued: 05/05/2015
• Est. Priority Date: 05/29/2013
• Status: Active Grant

• Current Assignee: SAP SE
• Original Assignee: SAP SE
• Inventors: Hang, Isabelle, Kerschbaum, Florian
• Primary Examiner(s): Desire, Gregory M
• Application Number:
  US13/904,222
• Publication Number:
  US 20140359730A1
• Time in Patent Office: 706 Days
• Field of Search: 382/115
• US Class Current: 382/115
• CPC Class Codes: G06F 21/16 Program or content traceability, e.g. by watermarking
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: G06F 2221/2133 Verifying human interaction, e.g., Captcha
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

Methods, systems, and computer-readable storage media for authenticating a user and user input to a back-end system and for validating the user input. In some implementations, actions include receiving a unique user identifier and user input, generating a personalized image recognition challenge based on the unique user identifier and the user input, the personalized image recognition challenge including a plurality of images and a written message, the written message instructing a user to select a particular image of the plurality of images to validate the user input, transmitting the personalized image recognition challenge for display on a device, receiving a response to the personalized image recognition challenge, the response comprising a selection of an image from the plurality of images, and authenticating the user and the user input based on the response.

Claims

1. A computer-implemented method for authenticating a user and user input to a back-end system and for validating the user input, the method being executed using one or more processors and comprising:

receiving, by the one or more processors, a unique user identifier and user input;

generating, by the one or more processors, a personalized image recognition challenge based on the unique user identifier and the user input, the personalized image recognition challenge comprising a plurality of images and a written message, the written message instructing a user to select a particular image of the plurality of images to validate the user input, wherein generating the personalized image recognition challenge comprises;

querying a database based on the unique user identifier to identify a plurality of personalized images associated with the unique user identifier, each personalized image being associated with a catchword, and

selecting one or more personalized images from the plurality of personalized images, the one or more personalized images being included in the personalized image recognition challenge;

transmitting the personalized image recognition challenge for display on a device;

receiving, by the one or more processors, a response to the personalized image recognition challenge, the response comprising a selection of an image from the plurality of images; and

authenticating the user and the user input based on the response.

2. The method of claim 1, wherein respective catchwords associated with the one or more personalized images are included in the written message.

3. The method of claim 1, wherein the one or more personalized images are randomly selected, and respective catchwords of the one or more personalized images are different from one another.

4. The method of claim 1, wherein generating the personalized image recognition challenge further comprises:

querying the database based on one or more catchwords and the unique user identifier to identify a plurality of non-personalized images, each non-personalized image being associated with a respective catchword of the one or more catchwords and not being associated with the unique user identifier; and

selecting one or more non-personalized images from the plurality of non-personalized images, the one or more non-personalized images being included in the personalized image recognition challenge.

5. The method of claim 4, wherein the one or more catchwords comprise respective catchwords associated with one or more personalized images, the one or more personalized images being included in the personalized image recognition challenge.

6. The method of claim 1, wherein generating the personalized image recognition challenge comprises generating a fake input, the fake input being included in the personalized image recognition challenge.

7. The method of claim 6, wherein the fake input is not equal to the user input.

8. The method of claim 1, wherein generating the personalized image recognition challenge further comprises:

generating a watermark based on the user input; and

watermarking images of the plurality of images based on the watermark, such that the watermark is human perceptible in the plurality of images.

9. The method of claim 8, wherein the watermark comprises the user input, a fake input and a timestamp.

10. The method of claim 8, wherein text within the watermark is provided as distorted and/or segmented text.

11. The method of claim 1, wherein text within the written message is provided as distorted and/or segmented text.

12. The method of claim 1, wherein authenticating the user and the user input based on the response comprises determining that the user has correctly selected a personalized image that has been associated with the user input.

13. The method of claim 1, wherein the written message further instructs the user to select another particular image of the plurality of images to select fake input.

14. A non-transitory computer-readable storage medium coupled to one or more processors and having instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to perform operations for authenticating a user and user input to a back-end system and for validating the user input, the operations comprising:

receiving a unique user identifier and user input;

generating a personalized image recognition challenge based on the unique user identifier and the user input, the personalized image recognition challenge comprising a plurality of images and a written message, the written message instructing a user to select a particular image of the plurality of images to validate the user input wherein generating the personalized image recognition challenge comprises;

querying a database based on the unique user identifier to identify a plurality of personalized images associated with the unique user identifier, each personalized image being associated with a catchword, and

selecting one or more personalized images from the plurality of personalized images, the one or more personalized images being included in the personalized image recognition challenge;

transmitting the personalized image recognition challenge for display on a device;

receiving a response to the personalized image recognition challenge, the response comprising a selection of an image from the plurality of images; and

authenticating the user and the user input based on the response.

15. A system, comprising:

a computing device; and

a computer-readable storage device coupled to the computing device and having instructions stored thereon which, when executed by the computing device, cause the computing device to perform operations for authenticating a user and user input to a back-end system and for validating the user input, the operations comprising;

receiving a unique user identifier and user input;

generating a personalized image recognition challenge based on the unique user identifier and the user input, the personalized image recognition challenge comprising a plurality of images and a written message, the written message instructing a user to select a particular image of the plurality of images to validate the user input, wherein generating the personalized image recognition challenge comprises;

querying a database based on the unique user identifier to identify a plurality of personalized images associated with the unique user identifier, each personalized image being associated with a catchword, and

selecting one or more personalized images from the plurality of personalized images, the one or more personalized images being included in the personalized image recognition challenge;

transmitting the personalized image recognition challenge for display on a device;

receiving a response to the personalized image recognition challenge, the response comprising a selection of an image from the plurality of images; and

authenticating the user and the user input based on the response.