System and methods for weak authentication data reinforcement

• US 9,917,830 B2
• Filed: 02/06/2017
• Issued: 03/13/2018
• Est. Priority Date: 08/20/2007
• Status: Active Grant

• Current Assignee: eBay Inc.
• Original Assignee: eBay Inc.
• Inventors: Lee, Mark C.
• Primary Examiner(s): THIAW, CATHERINE B
• Application Number:
  US15/425,825
• Publication Number:
  US 20170149764A1
• Time in Patent Office: 400 Days
• CPC Class Codes: G06F 21/46 by designing passwords or checking the strength of passwords
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

Systems and methods for weak authentication data reinforcement are described. In some embodiments, authentication data is received in a request to authenticate a user. In response to detecting weak authentication data, the systems and methods determine whether the identifier of the device was previously associated with a human user and whether the authentication data is weak. An example embodiment may include initiating a verification process in response to determining that the authentication data is weak and that the identifier of the device was not previously associated with a human user.

Claims

1. A method comprising:

receiving a request to authenticate a device, the request including authentication data and an identifier of the device, the request being received over a network;

determining that the authentication data is a substring of a user identifier;

determining that the identifier of the device was not previously associated with a human user; and

responsive to determining that the authentication data is the substring of the user identifier and that the identifier of the device was not previously associated with a human user, determining, using one or more hardware processors, that the identifier of the device is associated with a human user by initiating a verification process.

2. The method of claim 1, wherein the verification process includes a challenge-response test that includes a text box to receive alphanumeric characters that appear in an image.

3. The method of claim 1, further comprising:

responsive to determining that the identifier of the device is associated with a human user as a result of the verification process, initiating an authentication process to replace the authentication data.

4. The method of claim 3, wherein the authentication process to replace the authentication data includes providing an option to replace the authentication data with further authentication data.

5. The method of claim 4, wherein the option to replace the authentication data is presented via a web link.

6. The method of claim 1, wherein the identifier of the device includes at least one of:

a device fingerprint;

an Internet Protocol address of the device;

or

a version of an operation system being executed on the device.

7. The method of claim 6, wherein the determining that the identifier of the device is associated with a human user includes determining that the identifier of the device is previously recognized.

8. The method of claim 1, wherein the determining that the identifier of the device is associated with a human user includes accessing a cookie from the device.

9. The method of claim 1, further comprising:

determining a trend for the verification process across multiple users; and

storing a record of the determined trend in a database.

10. The method of claim 1, wherein:

the authentication data includes both a first string and a second string; and

the method further comprises

determining that the first string is a subset of the second string.

11. A system comprising:

one or more processors; and

a memory storing executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising;

receiving a request to authenticate a device, the request including authentication data and an identifier of the device, the request being received over a network;

determining that the authentication data is a substring of a user identifier;

determining that the identifier of the device was not previously associated with a human user; and

responsive to determining that the authentication data is the substring of the user identifier and that the identifier of the device was not previously associated with a human user, determining that the identifier of the device is associated with a human user by initiating a verification process.

12. The system of claim 11, wherein the verification process includes a challenge-response test that includes a text box to receive alphanumeric characters that appear in an image.

13. The system of claim 11, wherein the operations further comprise responsive to determining that the identifier of the device is associated with a human user as a result of the verification process, initiating an authentication process to replace the authentication data.

14. The system of claim 13, wherein the authentication process to replace the authentication data includes providing an option to replace the authentication data with further authentication data.

15. The system of claim 14, wherein the option to replace the authentication data is presented via a web link.

16. The system of claim 11, wherein the identifier of the device includes at least one of:

a device fingerprint;

an Internet Protocol address of the device;

or

a version of an operation system being executed on the device.

17. The system of claim 16, wherein the determining that the identifier of the device is associated with a human user includes determining that the identifier of the device is previously recognized.

18. The system of claim 11, wherein the determining that the identifier of the device is associated with a human user includes accessing a cookie from the device.

19. The system of claim 11, further comprising:

determining a trend for the verification process across multiple users; and

storing a record of the determined trend in a database.

20. A non-transitory machine-readable medium storing instructions that, when executed by one or more processors of a machine, cause the machine to perform operations comprising:

receiving a request to authenticate a device, the request including authentication data and an identifier of the device, the request being received over a network;

determining that the authentication data is a substring of a user identifier;

determining that the identifier of the device was not previously associated with a human user; and

responsive to determining that the authentication data is the substring of the user identifier and that the identifier of the device was not previously associated with a human user, determining that the identifier of the device is associated with a human user by initiating a verification process.