Establishing a secure channel with a human user

• US 9,356,929 B2
• Filed: 04/19/2012
• Issued: 05/31/2016
• Est. Priority Date: 04/25/2002
• Status: Expired due to Fees

• Current Assignee: Intertrust Technologies Corporation (Fidelio Acquisition Co LLC)
• Original Assignee: Intertrust Technologies Corporation (Fidelio Acquisition Co LLC)
• Inventors: Pinkas, Binyamin, Haber, Stuart A., Tarjan, Robert E., Sander, Tomas
• Primary Examiner(s): Dinh, Minh
• Application Number:
  US13/451,369
• Publication Number:
  US 20120204246A1
• Time in Patent Office: 1,503 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/4097 using mutual authentication between devices and transaction partners
• CPC Class Codes: G07C 9/33 by means of a password
• CPC Class Codes: G07F 7/10 together with a coded signal , e.g. in the form of personal identification information, like personal identification number [PIN] or biometric data
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: G07F 7/1025 Identification of user by a PIN code
• CPC Class Codes: G09C 5/00 Ciphering apparatus or methods not provided for in the preceding groups, e.g. involving the concealment or deformation of graphic data such as designs, written or printed messages
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/77 Graphical identity

Abstract

A method of establishing a secure channel between a human user and a computer application is described. A secret unique identifier (“PIN”) is shared between a user and an application. When the user makes a request that involves utilizing the PIN for authentication purposes, the application renders a randomly selected identifier. The randomly selected identifier is in a format that is recognizable to a human but is not readily recognizable by an automated agent. The randomly selected identifier is then presented to the human user. The user identifies the relationship between the randomly selected identifier and the PIN. If the user'"'"'s input reflects the fact that the user knows the PIN, then the user is authenticated.

Claims

1. A secure, computer implemented, and non-cryptographic method of authenticating a user over an insecure communication channel, the method comprising:

receiving, at a first computing device associated with the user, an image sent from a second computing device over the insecure communication channel, the image comprising randomly chosen alphanumeric characters, the randomly chosen alphanumeric characters being encoded in the image such that when the image is displayed to the user, at least some of the randomly chosen alphanumeric characters at least partially intersect;

displaying the image to the user on the first computing device;

receiving, at a user interface from the user, a number of clicks on a sequence of up and down buttons associated with the randomly chosen alphanumeric characters, the number of clicks based on a relationship between each character of the randomly chosen alphanumeric characters and a corresponding character of a predefined password, and collecting the number of clicks on the sequence of up and down buttons as first input data;

sending the first input data to the second computing device over the insecure communication channel, the first input data enabling, at least in part, the second computing device to derive the predefined password from the randomly chosen alphanumeric characters; and

receiving, from the second computing device, authorization to access a service provided by the second computing device.

2. The method of claim 1, wherein the first computing device is selected from the group consisting of:

personal computer, automated teller machine, set-top box, laptop computer, cellular phone, personal digital assistant, and workstation.