System and methods for key challenge validation

• US 20090094687A1
• Filed: 10/03/2007
• Published: 04/09/2009
• Est. Priority Date: 10/03/2007
• Status: Active Grant

• Current Assignee: eBay Inc.
• Original Assignee: eBay Inc.
• Inventors: Jastrebski, Grahame Andrew, Patil, Dhanurjay A.S.
• Granted Patent: US 8,631,503 B2
• Time in Patent Office: Days
• US Class Current: 726/6
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks

Abstract

This document discusses, among other things, a system and method for detecting an initiation of a transaction and generating a string of characters based on the detection. A first portion of the string of characters may be presented in such a way as to be distinguished from a second portion of the string of characters. In various example embodiments, the transaction is validated based on an identification of the first portion of the string of characters.

Claims

1. A method comprising:

detecting an initiation of a transaction;

generating a string of characters based on the detecting of the initiation;

presenting a first portion of the string of characters that is visually distinguishable from a second portion of the string of characters; and

validating the transaction based on an identification of the first portion of the string of characters.

2. The method of claim 1, wherein the detecting of the initiation includes detecting an interaction with a Web page.

3. The method of claim 1, wherein the generating of the string of characters includes generating a string of randomly selected characters, the string having a fixed length.

4. The method of claim 2, wherein the generating of the string of characters includes generating transaction specific information.

5. The method of claim 4, wherein the generating of the transaction specific information includes using at least one type of transaction specific information selected from the group of types consisting of a recipient name, a first e-mail address of the recipient, a sender name and a second e-mail address of the sender.

6. The method of claim 1, wherein the presenting of the first portion of the string of characters includes using at least one distinguisher selected from the group consisting of colors, fonts, patterns and shading.

7. The method of claim 6, wherein the presenting of the first portion of the string of characters includes presenting the first portion of the string of characters as characters adjacent to one another.

8. The method of claim 1, wherein the presenting of the first portion of the string of characters includes presenting the first portion of the first string as characters randomly located with respect to one another.

9. The method of claim 1, wherein the presenting of the first portion of the string of characters includes providing instructions to be used to identify the first portion.

10. The method of claim 1, wherein the validating of the transaction includes comparing a set of characters entered in a text box with the first portion of the string of characters and confirming that a user is human if the set of characters and the first portion match.

11. A method comprising:

detecting an initiation of a transaction;

generating transaction specific information based on the detecting of the initiation;

presenting a first portion of the transaction specific information that is visually distinguishable from a second portion of the transaction specific information; and

validating the transaction based on an identification of the first portion of the transaction specific information.

12. The method of claim 11, wherein the generating of the transaction specific information includes using at least one type of transaction specific information selected from the group of types consisting of a recipient name, a first e-mail address of the recipient, a sender name and a second e-mail address of the sender.

13. The method of claim 11, wherein the presenting of the first portion of the transaction specific information includes providing instructions to be used to identify the first portion.

14. A system comprising:

a challenge string module to generate a string of characters in response to a detection of a request to make a transaction;

a key generation module to select a first portion of the string of characters to be visually distinguished from a second portion of the string of characters;

a challenge generation module to generate an image that includes the first and second portion of the string of characters; and

a processor to validate the transaction based on an identification of the first portion of the string of characters.

15. The system of claim 14, further comprising:

an image attribute module to provide a visual attribute to the image, to visually distinguish the first portion of the string of characters from the second portion of the string of characters.

16. The system of claim 14, wherein the request to make a transaction includes an interaction with a Web page.

17. The system of claim 14, wherein the string of characters generated by the challenge string module represents information that is specific to the transaction.

18. The system of claim 17, wherein the challenge string module is to generate at least one type of transaction specific information selected from the group of types consisting of a recipient name, a first e-mail address of the recipient, a sender name, and a second e-mail address of the sender.

19. The system of claim 15, wherein the visual attribute provided by the image attribute module is selected from the group consisting of colors, fonts, patterns, and shading.

20. The system of claim 14, wherein the image generated by the challenge generation module is to generate the first portion of the string as characters randomly located with respect to one another.

21. The system of claim 14, wherein the challenge generation module is to further generate instructions to be used to identify the first portion of the string of characters.

22. The system of claim 14, wherein the processor is to validate the transaction by comparing a set of characters entered in a text box with the first portion of the string of characters, and confirming that a user is human if the set of characters and the first portion match.

23. A system comprising:

a challenge string module to generate transaction specific information in response to a detection of a request to make a transaction;

a key generation module to select a first portion of the transaction specific information to be visually distinguished from a second portion of the transaction specific information;

a challenge generation module to generate an image that includes the first and second portion of the transaction specific information; and

a processor to validate the transaction based on an identification of the first portion of the transaction specific information.

24. The system of claim 23, wherein the challenge string module is to generate at least one type of transaction specific information selected from the group of types consisting of a recipient name, a first e-mail address of the recipient, a sender name, and a second e-mail address of the sender.

25. A machine-readable medium containing instructions which, when executed by a processing system, cause the processing system to perform a method, the method comprising:

detecting an initiation of a transaction;

generating a string of characters based on the detecting of the initiation;

presenting a first portion of the string of characters that is visually distinguishable from a second portion of the string of characters; and

validating the transaction based on an identification of the first portion of the string of characters.