Method and system for managing user login behavior on an electronic device for enhanced security

• US 9,305,150 B2
• Filed: 12/10/2012
• Issued: 04/05/2016
• Est. Priority Date: 12/10/2012
• Status: Active Grant

• Current Assignee: Lookout Incorporated
• Original Assignee: Lookout Incorporated
• Inventors: Buck, Brian James
• Primary Examiner(s): Patel, Ashok
• Assistant Examiner(s): GRACIA, GARY S
• Application Number:
  US13/709,400
• Publication Number:
  US 20140165169A1
• Time in Patent Office: 1,212 Days
• Field of Search: 726/7
• US Class Current: 1/1
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/46 by designing passwords or checking the strength of passwords
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity

Abstract

Security is enhanced for a user of an electronic device by providing a method for managing user login behavior. When an entered password that is different from a defined password is received, the method includes identifying alternative characters for at least one character of the entered password based on a location of a key corresponding to the character of the entered password on a keyboard used to enter the password. When the alternative characters are identified, a variation of the entered password is generated by replacing a character of the entered password with an alternative character of the character. When information relating to the variation matches information relating to the defined password, the entered password is determined to be valid.

Claims

1. A method for managing user login behavior on an electronic device, the method comprising:

receiving, by an electronic device, information relating to an entered password having a plurality of second characters of a plurality of characters, wherein the entered password is different from a first password having a plurality of first characters of the plurality of characters;

identifying for at least one second character, by the electronic device, at least one alternative character of the plurality of characters based on a location of a key corresponding to the at least one second character on a keyboard used to enter the entered password;

generating, by the electronic device, a variation of the entered password using the identified at least one alternative character;

providing, at the electronic device, a first entry error value that defines a number of mistakes allowable in the entered password;

detecting, by the electronic device during a time period related to the entering of the entered password at the electronic device, a degree of movement of the electronic device;

determining that the detected degree of movement is above a threshold degree of movement;

increasing the first entry error value, based on the determination of movement above a threshold degree, to obtain an adjusted entry error value that allows for at least one mistake in the entered password; and

determining, by the electronic device, that the entered password is valid when;

information relating to the generated variation of the entered password matches information relating to the first password, and the number of differences between the entered password and the first password does not exceed the adjusted entry error value; and

after the step of determining, by the electronic device, that the entered password is valid, allowing, using the entered password, access to at least one of a service or a device protected by the first password.

2. The method of claim 1 wherein a first key on the keyboard corresponds to a second character of the entered password and a second key corresponding to an identified alternative character for the second character is located within a defined distance on the keyboard from the first key, and wherein generating, by the electronic device, a variation of the entered password comprises replacing the second character with the identified alternative character.

3. The method of claim 2 wherein the defined distance is one adjacent key, and the second key is located immediately adjacent to the first key on the keyboard.

4. The method of claim 2 wherein the defined distance is one adjacent key or one diagonal key, and the second key is located immediately adjacent to or immediately diagonal to the first key on the keyboard.

5. The method of claim 1 wherein the first entry error value is provided by at least one of the user and an administrator.

6. The method of claim 1 wherein the electronic device is an electronic client device associated with the user, and wherein the electronic client device stores the first password.

7. The method of claim 6 wherein information relating to the variation of the entered password matches information relating to the first password when each of the plurality of first characters of the first password either matches a corresponding second character in a corresponding position of the entered password or matches an identified alternative character of the corresponding second character.

8. The method of claim 7 wherein information relating to the variation of the entered password does not match information relating to the first password when a first character both fails to match a corresponding second character in a corresponding position of the entered password and fails to match all identified alternative characters of the corresponding second character.

9. The method of claim 6 wherein when any variation of the entered password fails to match the first password, the method further comprises:

calculating an edit distance between the first password and the entered password, wherein the edit distance is a sum of edit weights corresponding to at least one error, wherein an edit weight corresponding to a substitution error having no association with an identified alternative character is equal to a first weight greater than one (1), and wherein an edit weight corresponding to each of an insertion error, a transposition error, a deletion error, and a substitution error having an association with an identified alternative character is equal to one (1); and

wherein information relating to the variation of the entered password matches information relating to the first password when the edit distance is at most equal to the first weight.

10. The method of claim 1 wherein a mistake allowable in the entered password is one where an identified alternative character of a second character matches a first character in a corresponding position of the first password.

11. The method of claim 10 wherein the first entry error value is an error ratio of the maximum number of acceptable mistakes to a length of the first password so that the maximum number of acceptable mistakes varies proportionally with the length of the first password.

12. The method of claim 10 wherein information relating to the generated variation of the entered password does not match information relating to the first password when a number of identified alternative characters matching first characters in corresponding positions is greater than the adjusted entry error value.

13. The method of claim 1 wherein the variation is generated by replacing the at least one second character with an identified alternative character of the at least one second character and wherein the replaced at least one second character is a letter, number, or punctuation.

14. A method for managing user login behavior on an electronic client device including a keyboard having a plurality of keys corresponding to a plurality of characters, the method comprising:

storing, on the electronic client device, information relating to a first password, wherein the first password includes a plurality of first characters of the plurality of characters;

receiving, by the electronic device, an entered password having a plurality of second characters of the plurality of characters, wherein the entered password is different from the first password;

identifying for at least one second character, by the electronic client device and for at least one second character, at least one alternative character of the plurality of characters based on a location of a key corresponding to a second character of the at least one second character on a keyboard used to enter the entered password;

generating, by the electronic client device, using the identified at least one alternative character, a variation of the entered password, the variation having a plurality of third characters of the plurality of characters;

providing, at the electronic device, a first entry error value that defines a number of mistakes allowable in the entered password, wherein the first entry error value is initially set at zero mistakes;

detecting, by the electronic client device during a time period related to the entering of the received entered password at the electronic client device, a degree of movement of the electronic client device;

determining that the detected degree of movement is above a threshold degree of movement;

increasing the first entry error value, based on the determination of movement above a threshold degree, to obtain an adjusted entry error value that allows for at least one mistake in the entered password; and

determining, by the electronic client device, that the entered password is valid when the number of differences between the entered password and the first password do not exceed the adjusted entry error value, and when each of the plurality of first characters either;

matches a corresponding second character in a corresponding position of the entered password, or

matches a corresponding third character in a corresponding position of the generated variation; and

after the step of determining, by the electronic device, that the entered password is valid, allowing, using the entered password, access to a service and/or a device protected by the first password.

15. A method for managing user login behavior at a server, the method comprising:

storing, on a server, information relating to a first password, wherein the first password includes a plurality of first characters of a plurality of characters;

receiving, by the server, an entered password from an electronic client device, the entered password having a plurality of second characters of the plurality of characters;

identifying for at least one second character, by the server, at least one alternative character of the plurality of characters based on a location of a key corresponding to the at least one second character on a keyboard used to enter the entered password;

generating, by the server, a variation of the entered password using the identified at least one alternative character;

providing, by the server, a first entry error value that defines a number of mistakes allowable in the entered password;

increasing, by the server, the first entry error value to obtain an adjusted entry error value that allows for at least one mistake in the entered password, the increasing being based on a degree of movement of the electronic client device, wherein the degree of movement was detected by the electronic client device during a time period related to the entering of the entered password at the electronic client and was determined to be above a threshold degree of movement; and

determining, by the server, that the entered password is valid when;

information relating to the generated variation of the entered password matches the information relating to the first password, and the number of differences between the entered password and the first password do not exceed the adjusted entry error value; and

after the step of determining, by the electronic device, that the entered password is valid, allowing, using the entered password, access to at least one of a service or a device protected by the first password.

16. A method comprising:

receiving an entered password input through a keyboard, the entered password comprising a plurality of first characters;

retrieving a first password comprising a plurality of second characters, the first password being different from the entered password based on at least one character of the entered password not matching a corresponding character in a corresponding position of the first password, wherein each such difference is a mistake in the entered password, and wherein a mistake is acceptable when a location on the keyboard for the mistake in the entered password is adjacent to a location on the keyboard for the corresponding character of the first password;

providing a first entry error value that defines a number of acceptable mistakes allowable in the entered password;

increasing the first entry error value to obtain an adjusted entry error value that allows for at least one mistake in the entered password, the increasing being based on a detected degree of movement of the keyboard that was detected during a time period related to the inputting of the entered password through the keyboard, and the degree of movement determined to be above a threshold degree of movement; and

determining that an access should be permitted when the number of acceptable mistakes does not exceed the adjusted entry error value; and

after the step of determining that an access should be permitted, allowing, using the entered password, access to at least one of a service or a device protected by the first password.