Methods, devices and computer program supports for password generation and verification

• US 9,384,343 B2
• Filed: 05/06/2011
• Issued: 07/05/2016
• Est. Priority Date: 05/11/2010
• Status: Expired due to Fees

• Current Assignee: Magnolia Licensing LLC (IP Edge LLC)
• Original Assignee: Thomson Licensing (Vantiva SA)
• Inventors: Alessio, Davide, Eluard, Marc, Maetz, Yves
• Primary Examiner(s): Armouche, Hadi
• Assistant Examiner(s): Zarrineh, Shahriar
• Application Number:
  US13/697,135
• Publication Number:
  US 20130067554A1
• Time in Patent Office: 1,887 Days
• Field of Search: 726/2, 726/7, 726/9, 726/27, 713/182
• US Class Current: 1/1
• CPC Class Codes: G06F 21/46 by designing passwords or checking the strength of passwords
• CPC Class Codes: G06F 3/0236 using selection techniques to select from displayed items
• CPC Class Codes: G06F 3/04895 Guidance during keyboard input operation, e.g. prompting

Abstract

During log-on of a user to an entity protected by a password, the password is verified by iteratively receiving a password character; and verifying that the received character complies with a predefined property (α) that sets at least one requirement for allowable passwords. If this is not the case, then this can indicate a brute force attack and appropriate action may be taken. The property α may be dependent on the user. Also provided are a corresponding device and a computer program product.

Claims

1. A method of verification of an entered password during log-on of a user to an entity protected by a password, the password comprising several characters, and the method comprising in a processor:

receiving at least one character of the password;

verifying that the at least one received character has a parity value different from a parity of the length of the user name;

determining that a brute force attack has been attempted upon detection of a predetermined number of parts of entered passwords having parity values equal to the parity of the length of the user name; and

upon reception of all the characters of the entered password and an indication that the password is complete, the subsequent step of verifying that the complete password corresponds to the password that protects the entity.

2. The method of claim 1, further comprising taking appropriate action upon determination that a brute force attack has been attempted.

3. The method of claim 2, wherein appropriate action comprises at least one of issuing a warning to an administrator, issuing a warning to the user, blocking the system and waiting a predetermined time before accepting further log-on attempts.

4. A device for verifying an entered password during log-on of a user to an entity protected by a password, the password comprising several characters, and the device comprising:

an interface for receiving at least one character of said entered password; and

a processor configured to;

verify that at least one received password character has a parity value different from a parity of the length of a user name;

determine that a brute force attack has been attempted upon detection of a predetermined number of parts of entered passwords having parity values equal to the parity of the length of the user name and

upon reception of all the characters of the password and an indication that the entered password is complete, subsequently verify that the complete entered password corresponds to the password that protects the entity.

5. The device of claim 4, wherein the processor is further configured to take appropriate action upon determination that a brute force attack has been attempted.

6. The device of claim 5, wherein appropriate action comprises at least one of issuing a warning to an administrator, issuing a warning to the user, blocking the system and waiting a predetermined time before accepting further log-on attempts.

7. A computer program product stored on a non-transitory computer readable medium, and having stored thereon instructions of a software program, wherein the instructions, when executed by a processor performs, during log-on of a user to an entity protected by a password comprising several characters:

receiving at least one character of an entered password; and

verifying that the at least one received character has a parity value different from a parity of a length of the user name;

determining that a brute force attack has been attempted upon detection of a predetermined number of parts of entered passwords having parity values equal to the parity of the length of the user name; and

upon reception of all the characters of the entered password and an indication that the entered password is complete, subsequently verifying that the complete password corresponds to the entered password that protects the entity.