System and method for key challenge validation

• US 9,450,969 B2
• Filed: 10/08/2015
• Issued: 09/20/2016
• Est. Priority Date: 10/03/2007
• Status: Active Grant

• Current Assignee: eBay Inc.
• Original Assignee: eBay Inc.
• Inventors: Jastrebski, Grahame Andrew, Patil, Dhanurjay A. S.
• Primary Examiner(s): Brown, Christopher
• Application Number:
  US14/878,907
• Publication Number:
  US 20160028745A1
• Time in Patent Office: 348 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks

Abstract

This document discusses, among other things, a system and method for detecting an initiation of a transaction and generating a string of characters based on the detection. A subset of characters of the string of characters is presented in such a way as to be distinguished from remaining characters of the string of characters. In various example embodiments, the transaction is validated based on an identification of the subset of characters of the string of characters.

Claims

1. A method comprising:

detecting an initiation of a transaction;

in response to detecting the initiation of the transaction, determining a specific detail of the transaction;

generating a challenge that includes a challenge image comprising a string of characters that represents the specific detail of the transaction;

causing presentation of the challenge with an indication to return a challenge key, the challenge key being a visually distinguished subset of characters of the string of characters that represents the specific detail of the transaction;

receiving a response to the challenge, the response including the challenge key; and

validating, by a hardware processor, the transaction based on the challenge key received in the response.

2. The method of claim 1, wherein the transaction comprises an exchange of information or transfer of data.

3. The method of claim 1, further comprising identifying a most relevant detail of the transaction, the most relevant detail of the transaction being the specific detail used in generating the challenge.

4. The method of claim 1, wherein the visually distinguished subset of characters is distinguished from a remainder of the string of characters using at least one of a different color, font, patterns, or shading.

5. The method of claim 1, wherein the subset of characters of the challenge key are non-contiguous in the string of characters.

6. The method of claim 1, wherein the causing the presentation of the challenge comprises causing presentation of a Web client user interface that includes the challenge.

7. The method of claim 1, wherein the determining the specific detail of the transaction comprises retrieving the specific detail from a coupled database.

8. The method of claim 1, wherein the validating the transaction comprises verifying the challenge key received in the response matches a previously stored challenge key.

9. A system comprising:

a string generation module to determine a specific detail of a transaction in response to detecting an initiation of the transaction, and to generate a challenge that includes a challenge image comprising a string of characters that represent the specific detail of the transaction;

a key generation module to determine a challenge key using the string of characters that represent the specific detail of the transaction;

a challenge generation module to generate an image that presents the challenge key as being a visually distinguished subset of characters of the string of characters that represents the specific detail of the transaction; and

a hardware processor configured to validate the transaction based on the challenge key received in response to the challenge.

10. The system of claim 9, further comprising an image attribute module to apply a visual attribute to the image to visually distinguish the subset of characters of the string of characters as the challenge key.

11. The system of claim 9, wherein the challenge generation module generates the image by presenting characters of the challenge key non-contiguously in the string of characters.

12. The system of claim 9, wherein the string generation module is further to identify a most relevant detail of the transaction, the most relevant detail of the transaction being the specific detail used in generating the challenge.

13. A machine-readable medium having no transitory signals and storing instructions which, when executed by one or more processors of a machine, cause the machine to perform operations comprising:

detecting an initiation of a transaction;

in response to detecting the initiation of the transaction, determining a specific detail of the transaction;

generating a challenge that includes a challenge image comprising a string of characters that represents the specific detail of the transaction;

causing presentation of the challenge with an indication to return a challenge key, the challenge key being a visually distinguished subset of characters of the string of characters that represents the specific detail of the transaction;

receiving a response to the challenge, the response including the challenge key; and

validating the transaction based on the challenge key received in the response.

14. The machine-readable medium of claim 13, wherein the transaction comprises an exchange of information or transfer of data.

15. The machine-readable medium of claim 13, wherein the operations further comprise identifying a most relevant detail of the transaction, the most relevant detail of the transaction being the specific detail used in generating the challenge.

16. The machine-readable medium of claim 13, wherein the visually distinguished subset of characters is distinguished from a remainder of the string of characters using at least one of a different color, font, patterns, or shading.

17. The machine-readable medium of claim 13, wherein the subset of characters of the challenge key are non-contiguous in the string of characters.

18. The machine-readable medium of claim 13, wherein the causing the presentation of the challenge comprises causing presentation of a Web client user interface that includes the challenge.

19. The machine-readable medium of claim 13, wherein the determining the specific detail of the transaction comprises retrieving the specific detail from a coupled database.

20. The machine-readable medium of claim 13, wherein the validating the transaction comprises verifying the challenge key received in the response matches a previously stored challenge key.