Using trusted communication channel to combat user name/password theft

• US 7,591,004 B2
• Filed: 07/28/2005
• Issued: 09/15/2009
• Est. Priority Date: 12/18/2002
• Status: Active Grant

• Current Assignee: Meta Platforms, Inc. (f/k/a Facebook, Inc.)
• Original Assignee: AOL LLC (Apollo Global Management, Inc.)
• Inventors: Roskind, James
• Primary Examiner(s): Song; Hosuk
• Application Number:
  US11/193,831
• Publication Number:
  US 20050262564A1
• Time in Patent Office: 1,510 Days
• Field of Search: 726 2- 4, 726 8- 10, 726 15- 16, 726 22- 23, 713/176, 713183-186
• US Class Current: 726/2
• CPC Class Codes: G06F 21/42 using separate channels for security data
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks

Abstract

A technique for defining a system with enhanced trust is disclosed, in which an immediate contact is made with the user on the enhanced trust system when a compromise is first detected. The service contacts the compromised user and asks for confirmation of the results. As a result, the true user on the enhanced trust machine is able to preclude a login or preclude a password change. In a first embodiment of the invention, an enhanced trust machine is a machine where the user is currently logged in at the time that the less trusted machine attempts a login. A second embodiment of the invention comprehends an enhanced trust machine where the user has logged in repeatedly over a course of numerous weeks, as compared with a lesser trusted machine that the user has never logged into before and which is now asking for a change of the password.

Claims

1. A method for using a trusted communication channel to combat user name/password theft, comprising the steps of:

logging in a user to a trusted instant messaging system via a network connection, said instant message system comprising at least one trusted communication channel;

detecting an access attempt from an untrusted system;

making an immediate contact with said user via said trusted communication channel by way of an instant message when said access attempt from said untrusted system is first detected;

asking said user to confirm whether or not access via said untrusted system should be authorized by way of a return instant message; and

enabling or denying said access via said untrusted system in response to said confirmation.

2. The method of claim 1, wherein if said user of said trusted instant messaging system does not respond within a predetermined period of time by way of a return instant message, then said untrusted system is enabled with said access.

3. The method of claim 1, wherein a trusted instant messaging system is a system where said user is currently logged in at a time that said untrusted system attempts to gain access.

4. The method of claim 1, wherein a trusted instant messaging system is a system where said user has been granted access repeatedly over a course of time.

5. The method of claim 4, further comprising the step of:

tagging at least one previously untrusted system that is used extensively by said user as a system that is trusted.

6. The method of claim 1, further comprising the step of:

developing experience with regard to work patterns of said user and an expectation that a particular system is used by said user.

7. The method of claim 6, further comprising the steps of:

recording a history of number of times said user has logged in from a particular system; and

storing evidence of said history, optionally signed by a service to preclude forgery.

8. The method of claim 1, wherein a system having current active access is considered relatively more trusted than a system that has either does not have current access, or has not had prior access, by a given user.

9. The method of claim 1, further comprising the steps of:

tagging a system; and

verifying access to prevent forged authentication.

10. The method of claim 1, further comprising the step of:

using a random password generation scheme.

11. The method of claim 1, further comprising the step of:

using current and prior login history to establish a pattern of actions to detect suspicious logins and/or password changes.

12. The method of claim 1, further comprising the step of:

applying experiential information to password authentication; and

tagging a system to identify relative trust of said system.

13. The method of claim 1, further comprising the step of:

capturing system addresses for systems which attempt to use stolen accounts.

14. A method for determining if a system is a trusted system, comprising the steps of:

detecting an access attempt at an untrusted system;

using an instant messaging system to make immediate contact with a user of a trusted system;

asking said user for confirmation with regard to one or more actions to be taken in connection with said untrusted system; and

precluding said one or more actions if said user refuses to provide affirmative conformation.

15. The method of claim 14, further comprising the step of:

adding said untrusted system to a filter list which performs any of blocking access by said untrusted system and instituting an investigation.

16. An apparatus for using enhanced trust to combat user name/password theft in a network, comprising:

a mechanism for detecting an access attempt from an untrusted system;

an instant messaging system for making an immediate contact with a user of a trusted system via a network connection when said access attempt from said untrusted system is first detected;

a mechanism for asking said user to confirm whether or not access via said untrusted system should be authorized; and

a mechanism for enabling or denying said access via said untrusted system in response to said confirmation.

17. The apparatus of claim 16, wherein if said user of said trusted system does not respond within a predetermined period of time, then said untrusted system is enabled with said access.

18. The apparatus of claim 16, wherein a trusted system is a system where said user is currently logged in at a time that said untrusted system attempts to gain access.

19. The apparatus of claim 16, wherein a trusted system is a system where said user has been granted access repeatedly over a course of time.

20. The apparatus of claim 19, further comprising:

a mechanism for tagging a system that is used extensively by said user as a system that is trusted.

21. The apparatus of claim 16, further comprising:

a mechanism for developing experience with regard to work patterns of said user, and an expectation that a particular system is used by said user.

22. The apparatus of claim 21, further comprising:

a mechanism for recording a history of number of times said user has logged in from a particular system; and

a storage means for storing evidence of said history, optionally signed by a service to preclude forgery.

23. The apparatus of claim 16, wherein a system having current active access is considered relatively more trusted than a system that has either does not have current access, or has not had prior access, by a given user.

24. The apparatus of claim 16, further comprising:

a mechanism for tagging a system; and

a mechanism for verifying access to prevent forged authentication.

25. The apparatus of claim 16, further comprising:

a random password generation scheme for generating a random number, wherein an attacker must immediately use a compromised password.

26. The apparatus of claim 16, further comprising:

a mechanism for using current and prior login history to establish a pattern of actions to detect suspicious logins and/or password changes.

27. The apparatus of claim 16, further comprising:

a mechanism for applying experiential information to password authentication; and

a mechanism for tagging a system to identify relative trust of said system.

28. The apparatus of claim 16, further comprising:

a mechanism for capturing system addresses for systems which attempt to use stolen accounts.

29. An apparatus for determining if a system is a trusted system, comprising:

a mechanism for logging a user into a trusted instant messaging system via a network connection, said instant message system comprising at least one trusted communication channel;

a mechanism for detecting an access attempt at an untrusted system;

a means for making immediate contact with a user of a trusted system with the messaging system using the at least one trusted communication channel;

a mechanism for asking said user for confirmation with regard to one or more actions to be taken in connection with said untrusted system; and

a mechanism for precluding said one or more actions if said user refuses to provide affirmative conformation.

30. The apparatus of claim 29, further comprising:

a filter list of untrusted systems, which performs any of blocking access by said untrusted system and instituting an investigation.

31. A method for using a trusted communication channel to combat user name/password theft, comprising the steps of:

detecting an access attempt from an untrusted system;

making an immediate contact with a user of a trusted system when said access attempt from said untrusted system is first detected;

asking said user to confirm whether or not access via said untrusted system should be allowed; and

permitting or denying said access via said untrusted system in response to said confirmation

developing experience with regard to work patterns of said user and an expectation that a particular system is used by said user,

recording a history of number of times said user has logged in from a particular system; and

storing evidence of said history, optionally signed by a service to preclude forgery.

32. The method of claim 31, wherein if said user of said trusted system does not respond within a predetermined period of time, then said untrusted system is allowed said access.

33. The method of claim 31, wherein a trusted system is a system where said user is currently logged in at a time that said untrusted system attempts to gain access.

34. The method of claim 31, wherein a trusted system is a system where said user has been granted access repeatedly over a course of time.

35. The method of claim 34, further comprising the step of:

tagging a system that is used extensively by said user as a system that is trusted.

36. The method of claim 31, wherein a system having current active access is considered relatively more trusted than a system that has either does not have current access, or has not had prior access, by a given user.

37. The method of claim 31, further comprising the steps of:

tagging a system; and

verifying access to prevent forged authentication.

38. The method of claim 31, further comprising the step of:

using a random password generation scheme.

39. The method of claim 31, further comprising the step of:

using current and prior login history to establish a pattern of actions to detect suspicious logins and/or password changes.

40. The method of claim 31, further comprising the step of:

applying experiential information to password authentication; and

tagging a system to identify relative trust of said system.

41. The method of claim 31, further comprising the step of:

capturing system addresses for systems which attempt to use stolen accounts.

42. An apparatus for using enhanced trust to combat user name/password theft, comprising:

a mechanism for detecting an access attempt from an untrusted system;

a messaging system for making an immediate contact with a user of a trusted system when said access attempt from said untrusted system is first detected;

a mechanism for asking said user to confirm whether or not access via said untrusted system should be allowed; and

a mechanism for permitting or denying said access via said untrusted system in response to said confirmation;

a mechanism for developing experience with regard to work patterns of said user, and an expectation that a particular system is used by said user;

a mechanism for recording a history of number of times said user has logged in from a particular system; and

a storage means for storing evidence of said history, optionally signed by a service to preclude forgery.

43. The apparatus of claim 42, wherein if said user of said trusted system does not respond within a predetermined period of time, then said untrusted system is allowed said access.

44. The apparatus of claim 42, wherein a trusted system is a system where said user is currently logged in at a time that said untrusted system attempts to gain access.

45. The apparatus of claim 42, wherein a trusted system is a system where said user has been granted access repeatedly over a course of time.

46. The apparatus of claim 45, further comprising:

a mechanism for tagging a system that is used extensively by said user as a system that is trusted.

47. The apparatus of claim 42, wherein a system having current active access is considered relatively more trusted than a system that has either does not have current access, or has not had prior access, by a given user.

48. The apparatus of claim 42, further comprising:

a mechanism for tagging a system; and

a mechanism for verifying access to prevent forged authentication.

49. The apparatus of claim 42, further comprising:

a random password generation scheme for generating a random number, wherein an attacker must immediately use a compromised password.

50. The apparatus of claim 42, further comprising:

a mechanism for using current and prior login history to establish a pattern of actions to detect suspicious logins and/or password changes.

51. The apparatus of claim 42, further comprising:

a mechanism for applying experiential information to password authentication; and

a mechanism for tagging a system to identify relative trust of said system.

52. The apparatus of claim 42, further comprising:

a mechanism for capturing system addresses for systems which attempt to use stolen accounts.