Image based key derivation function

• US 9,769,156 B2
• Filed: 11/22/2016
• Issued: 09/19/2017
• Est. Priority Date: 06/13/2013
• Status: Active Grant

• Current Assignee: Visa International Service Association (Visa, Inc.)
• Original Assignee: Visa International Service Association (Visa, Inc.)
• Inventors: Aissi, Selim, Kgil, Taeho, Gaddam, Ajit
• Primary Examiner(s): BROWN, CHRISTOPHER J
• Application Number:
  US15/359,554
• Publication Number:
  US 20170078267A1
• Time in Patent Office: 301 Days
• Field of Search: 713184, 726 28
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G09C 5/00 Ciphering apparatus or methods not provided for in the preceding groups, e.g. involving the concealment or deformation of graphic data such as designs, written or printed messages
• CPC Class Codes: H04L 2463/061 applying further key derivation, e.g. deriving traffic keys from a pair-wise master key cryptographic mechanisms or cryptographic arrangements for generation of secret information including derivation or calculation of cryptographic keys or passwords H04L9/0861
• CPC Class Codes: H04L 2463/062 applying encryption of the keys cryptographic mechanisms or cryptographic arrangements for key distribution using key encryption key H04L9/0822
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords

Abstract

Embodiments of the invention relate to methods of generating and using an image-based derived key. In various embodiments, the image-based derived key may be used to facilitate user authentication and data encryption. For some embodiments, a method is disclosed comprising determining an image-based derived key, wherein the image-based derived key is generated from a selection of authentication images chosen by a user, encrypting data using the image-based derived key, and transmitting the encrypted data.

Claims

1. A computing device comprising:

a processor; and

a non-transitory computer-readable medium comprising code executable by the processor for implementing operations including;

receiving, from a client computer, a user identifier associated with a user, and first encrypted data that was encrypted using an image-based derived key;

determining the image-based derived key associated with the user identifier,

wherein the image-based derived key is generated from a selection of authentication images chosen by the user, and image identifiers of the authentication images are concatenated to form an image value that is used as an image input value to an image-based derived key function,

wherein each image identifier is unique to the corresponding authentication image, and each image identifier being concatenated has a value that is independent of where the corresponding authentication image is displayed on a user interface for the user, and

wherein the image-based derived key is further generated based on;

an adjustable iteration count value being an input to the image-based derived key function indicating a number of repetitions that the image-based derived key function is performed to generate the image-based derived key;

an adjustable key length indicating a length of the image-based derived key; and

a salt value that includes the user identifier; and

decrypting the first encrypted data.

2. The computing device of claim 1, wherein the authentication images are displayed on the user interface as a subset of a plurality of displayed images.

3. The computing device of claim 2, wherein the operations further include receiving the image identifiers of the authentication images.

4. The computing device of claim 2, wherein the plurality of images are randomly arranged in a grid displayed on the user interface.

5. The computing device of claim 1, wherein the operations further include receiving the selection of the authentication images.

6. The computing device of claim 1, wherein the operations further include sending second encrypted data to the client computer, wherein the image-based derived key is operable to decrypt the second encrypted data.

7. The computing device of claim 1, wherein the operations further include comparing the determined image-based derived key with a derived key stored in a user database.

8. The computing device of claim 7, wherein the operations further include authenticating the user when the determined image-based derived key matches the derived key stored in the user database.

9. The computing device of claim 7, wherein the derived key being compared was stored in the user database during a registration process.

10. The computing device of claim 1, wherein the image-based derived key is used in a payment system.

11. A computer-implemented method comprising:

receiving, from a client computer, a user identifier associated with a user, and first encrypted data that was encrypted using an image-based derived key;

determining the image-based derived key associated with the user identifier,

wherein the image-based derived key is generated from a selection of authentication images chosen by the user, and image identifiers of the authentication images are concatenated to form an image value that is used as an image input value to an image-based derived key function,

wherein each image identifier is unique to the corresponding authentication image, and each image identifier being concatenated has a value that is independent of where the corresponding authentication image is displayed on a user interface for the user, and

wherein the image-based derived key is further generated based on;

an adjustable iteration count value being an input to the image-based derived key function indicating a number of repetitions that the image-based derived key function is performed to generate the image-based derived key;

an adjustable key length indicating a length of the image-based derived key; and

a salt value that includes the user identifier; and

decrypting the first encrypted data.

12. The computer-implemented method of claim 11, wherein the authentication images are displayed on the user interface as a subset of a plurality of displayed images.

13. The computer-implemented method of claim 12, further comprising receiving the image identifiers of the authentication images.

14. The computer-implemented method of claim 12, wherein the plurality of images are randomly arranged in a grid displayed on the user interface.

15. The computer-implemented method of claim 11, further comprising receiving the selection of the authentication images.

16. The computer-implemented method of claim 11, further comprising sending second encrypted data to the client computer, wherein the image-based derived key is operable to decrypt the second encrypted data.

17. The computer-implemented method of claim 11, further comprising comparing the determined image-based derived key with a derived key stored in a user database.

18. The computer-implemented method of claim 17, further comprising authenticating the user when the determined image-based derived key matches the derived key stored in the user database.

19. The computer-implemented method of claim 17, wherein the derived key being compared was stored in the user database during a registration process.

20. The computer-implemented method of claim 11, wherein the image-based derived key is used in a payment system.