User credentials

• US 9,269,358 B1
• Filed: 06/10/2013
• Issued: 02/23/2016
• Est. Priority Date: 07/11/2012
• Status: Active Grant

• Current Assignee: Microstrategy Incorporated
• Original Assignee: Microstrategy Incorporated
• Inventors: Chen, Gang, Vazquez, Hector, Saylor, Michael J.
• Primary Examiner(s): Chawan, Vijay B
• Assistant Examiner(s): Chavez, Rodrigo
• Application Number:
  US13/914,373
• Time in Patent Office: 988 Days
• Field of Search: 340/5.8, 704/231, 704/246, 704/273, 707/781, 726/2, 726/4, 726/27
• US Class Current: 1/1
• CPC Class Codes: G06F 16/58 Retrieval characterised by using metadata, e.g. metadata not derived from the content or metadata generated manually
• CPC Class Codes: G06F 16/5854 using shape and object relationship
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: G06F 21/46 by designing passwords or checking the strength of passwords
• CPC Class Codes: G06K 7/10544 by scanning of the records by radiation in the optical part of the electromagnetic spectrum
• CPC Class Codes: G10L 17/00 Speaker identification or verification techniques
• CPC Class Codes: G10L 17/24 the user being prompted to utter a password or a predefined phrase
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/77 Graphical identity
• CPC Class Codes: H04W 4/12 Messaging; Mailboxes; Announcements

Abstract

Obtaining and/or validating user credentials at client devices is described. A phrase may be generated based on one or more index values determined according to a function of time and a credential identifier identifying a user credential. The phrase may be output by the client device for validating the user credential.

Claims

1. A non-transitory computer-readable medium storing instructions executable by one or more computers which, upon such execution, cause the one or more computers to perform operations comprising:

obtaining, at a client device, a credential identifier for a credential that is associated with a user;

periodically, at a predetermined time period;

obtaining, at the client device, a time derived from a timing device of the client device;

determining, at the client device, at least one index value using the credential identifier and the time derived from the timing device of the client device;

accessing, at the client device, a predetermined set of associations between index values and words;

generating, at the client device, a phrase corresponding to the credential, the phrase being generated to include words that are associated with the at least one index value in the predetermined set of associations;

receiving, at the client device, a user command to output the phrase; and

responsive to the user command, rendering, at the client device, the phrase corresponding to the credential.

2. The non-transitory computer-readable medium of claim 1 wherein rendering the phrase comprises outputting an audio signal corresponding to the phrase to a speaker at the client device, the audio signal having a frequency greater than 20 KHz.

3. The non-transitory computer-readable medium of claim 1, wherein the operations further comprise outputting, to a display of the client device, a graphical representation of a timer associated with the phrase, wherein the timer displays an amount of time remaining until the phrase expires and a new phrase corresponding to the credential is generated.

4. The non-transitory computer-readable medium of claim 1, wherein the operations further comprise:

obtaining an image of the user; and

outputting, to a display of the client device, the image of the user.

5. The non-transitory computer-readable medium of claim 4, wherein obtaining the image of the user comprises:

(i) retrieving, from a memory of the client device, the image of the user;

or

(ii) querying a server via a network connection, and receiving, from the server over the network connection, the image of the user.

6. The non-transitory computer-readable medium of claim 1, wherein obtaining, at the client device, the credential identifier for the credential that is associated with the user comprises:

establishing a secure connection with a server;

sending, to the server, an identifier associated with the user; and

receiving, from the server, the credential identifier for the credential that is associated with the user.

7. The non-transitory computer-readable medium of claim 1, wherein generating, at the client device, the phrase corresponding to the credential comprises:

(i) retrieving, from a memory of the client device, at least a portion of the phrase corresponding to the credential based on the at least one index value;

or

(ii) communicating the at least one index value to a server, and receiving at least a portion of the phrase corresponding to the credential from the server.

8. The non-transitory computer-readable medium of claim 1,

wherein determining the at least one index value using the credential identifier and the time comprises determining a first index value and a second index value using the credential identifier and the time;

wherein generating, at the client device, the phrase corresponding to the credential comprises;

retrieving, from a memory of the client device, a first portion of the phrase corresponding to the credential based on the first index value;

communicating the second index value to a server; and

receiving a second portion of the phrase from the server.

9. The non-transitory computer-readable medium of claim 1,

wherein determining the at least one index value using the credential identifier and the time comprises determining a first index value and a second index value using the credential identifier and the time;

wherein generating, at the client device, the phrase corresponding to the credential comprises;

obtaining a first word according to a value of the first index value;

obtaining a second word according to a value of the second index value; and

combining the first word and the second word to generate the phrase corresponding to the credential.

10. The non-transitory computer-readable medium of claim 1 wherein generating, at the client device, the phrase corresponding to the credential comprises obtaining, from among a collection of words stored in the client device, based on the at least one index value, at least one word to be included in the phrase corresponding to the credential.

11. The non-transitory computer-readable medium of claim 1 wherein, responsive to the user command, rendering, at the client device, the phrase corresponding to the credential comprises responsive to the user command, displaying, on a screen of the client device, the phrase corresponding to the credential.

16. The non-transitory computer-readable medium of claim 1, wherein generating, at the client device, the phrase corresponding to the credential comprises selecting, from a data structure that is stored at the client device and that maps the words to the index values, one or more words that the data structure maps to the determined at least one index value.

17. The non-transitory computer-readable medium of claim 1, wherein generating, at the client device, the phrase corresponding to the credential comprises generating, independently of actions performed by a validation server, a phrase that matches a phrase the validation server generates for the credential.

18. The non-transitory computer-readable medium of claim 1, wherein content of phrase depends on one or more values of the at least one index value.

19. The non-transitory computer-readable medium of claim 1, wherein determining, at the client device, the at least one index value comprises generating the at least one index value as a function of the credential identifier and the time derived from the timing device of the client device.

20. The non-transitory computer-readable medium of claim 1, wherein generating, at the client device, the phrase corresponding to the credential comprises:

identifying, using a first index value of the at least one index value, one of a plurality of data collections, the identified data collection storing words and the associations between the words and the index values;

identifying, using a second index value of the at least one index value, one or more words stored in the identified data collection; and

generating the phrase corresponding to the credential based on the one or more words that are stored in the identified data collection and identified using the second index value of the at least one index value.

12. A mobile device including a non-transitory computer-readable storage medium that includes executable instructions which, when executed by a processing device, cause the processing device to perform operations comprising:

obtaining, at a client device, a credential identifier for a credential that is associated with a user;

periodically, at a predetermined time period;

obtaining, at the client device, a time derived from a timing device of the client device;

determining, at the client device, at least one index value using the credential identifier and the time derived from the timing device of the client device;

accessing, at the client device, a predetermined set of associations between index values and words;

generating, at the client device, a phrase corresponding to the credential, the phrase being generated to include words that are associated with the at least one index value in the predetermined set of associations;

receiving, at the client device, a user command to output the phrase; and

responsive to the user command, rendering, at the client device, the phrase corresponding to the credential.

13. A computer-implemented method of generating a user credential for validation comprising:

obtaining, at a client device, a credential identifier for a credential that is associated with a user;

periodically, at a predetermined time period;

obtaining, at the client device, a time derived from a timing device of the client device;

determining, at the client device, at least one index value using the credential identifier and the time derived from the timing device of the client device;

accessing, at the client device, a predetermined set of associations between index values and words;

generating, at the client device, a phrase corresponding to the credential, the phrase being generated to include words that are associated with the at least one index value in the predetermined set of associations;

receiving, at the client device, a user command to output the phrase; and

responsive to the user command, rendering, at the client device, the phrase corresponding to the credential.

14. The computer-implemented method of claim 13,

wherein determining, at the client device, the at least one index value using the credential identifier and the time derived from the timing device of the client device comprises determining, at the client device, a first index value using the credential identifier and the time derived from the timing device of the client device;

wherein generating, at the client device, the phrase corresponding to the credential comprises obtaining, based on the first index value, a first phrase corresponding to the credential;

wherein receiving, at the client device, the user command to output the phrase comprises receiving, at the client device, the user command to output the first phrase;

wherein responsive to the user command, rendering, at the client device, the phrase corresponding to the credential comprises responsive to the user command, rendering, at the client device, the first phrase corresponding to the credential, and

the method further comprising;

synchronizing the timing device of the client device with a clock of at least one server;

synchronizing a timing device of a processing system with the clock of the at least one server, the processing system being associated with the credential authority;

obtaining, at the processing system, the credential identifier associated with the user;

obtaining, at the processing system, a time derived from the timing device of the processing system;

determining, at the processing system, a second at least one index value using the credential identifier and the time derived from the timing device of the processing system;

based on the second at least one index value, selecting, at the processing system, a second phrase corresponding to the credential associated with the user; and

outputting, at the processing system, a visual representation of the selected second phrase corresponding to the credential associated with the user, such that the visual representation of the selected phrase corresponding to the credential associated with the user matches the selected first phrase rendered at the client device.

15. The computer-implemented method of claim 13, further comprising outputting, to a display of the client device, a graphical representation of a timer associated with the phrase, wherein the timer displays an amount of time remaining until the phrase expires and a new phrase corresponding to the credential is generated.