Method for improving security in login and single sign-on procedures

• US 8,453,221 B2
• Filed: 12/18/2008
• Issued: 05/28/2013
• Est. Priority Date: 12/19/2007
• Status: Active Grant

• Current Assignee: Microsoft Corporation
• Original Assignee: Microsoft International Holdings BV (Microsoft Corporation)
• Inventors: Leistad, Geirr I., Danielsen, Stein H.
• Primary Examiner(s): Hoffman, Brandon
• Assistant Examiner(s): SONG, HEE K
• Application Number:
  US12/338,939
• Publication Number:
  US 20090165104A1
• Time in Patent Office: 1,622 Days
• Field of Search: 709/227, 709/229, 713/155, 713/183, 713/200, 713/202, 726 5- 8
• US Class Current: 726/6
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G09C 1/00 Apparatus or methods whereby a given sequence of signs, e.g. an intelligible text, is transformed into an unintelligible sequence of signs by transposing the signs or groups of signs or by replacing them by others according to a predetermined system cryptographic typewriters G09C3/00

Abstract

In a method for improving client'"'"'s login and sign-on security in accessing services offered by service providers over shared network resources such as Internet and particularly working within the framework of the www, a password is created for the client at a first attempt to access the service provider. The client'"'"'s password is generated either at an authentication authority in trust relationship with the service provider and transmitted to the client, or the client is allowed to create his or her password on the basis of random character sequences transmitted from the authentication authority. For subsequent access to the service provider the authentication authority presents a client for characters in ordered sequences or in a diagram containing in an appropriate order a single occurrence of each password character. The client performs a selection of the password for validation and transmits the validation back to the authentication authority, which verifies the password and informs the service provider of the verification. In a most preferred embodiment the password characters are never transmitted between the authentication authority and the client in a validation and verification procedure, and the former is wholly disconnected from either the client'"'"'s credentials or any transactions subsequently to be undertaken between the service provider and the client.

Claims

1. A method for authenticating a client, comprising:

initiating a procedure for creating a password for the client in response to a creation of an account in the name thereof by transmitting a request from the service provider to an authentication authority,

determining a password for the client and storing the created password at the authentication authority,

generating at the authentication authority upon a login attempt by the client a number of strings of random characters, the number of strings being at least equal to the number of characters in the password and assigning each password character to a specific string, the strings being ordered following the sequence of characters in the password,

receiving from the authentication authority the strings to the client and presenting each string of the strings in a different column to the client that allows the client to select each character of the password in a correct order from the respective strings,

receiving selections aligning the password characters by displacing or sliding the columns relative to each other without changing an ordering of the characters of the string within its respective column; and

verifying the client'"'"'s password based on the selections aligning the password characters at the authentication authority for the service provider thus enabling upon the verification of the password a sign-on to the account of the client with a service provider.

2. The method of claim 1, wherein creating the password comprises creating the password at the authentication authority, and transmitting the password to the client via a secure electronic mail connection or as an SMS.

3. The method of claim 2, wherein creating the password comprises creating the password at the client by-transmitting from the authentication authority an ordered sequence of strings of random characters such that no string contains the same character twice, and receiving selections from the client that selects one character from each string to form a password of characters ordered in the same sequence as the strings, and receiving the selected password at the authentication client.

4. The method of claim 3, wherein receiving the password at the authentication authority comprises receiving the password via a secure electronic mail connection or as an SMS.

5. The method of claim 3, further comprising presenting the strings for the client as an m·

n array such that each string forms a column of the array, and creating the password by receiving a selection of one character from each column such that password is formed with a number of characters equal to the number of columns.

6. The method of claim 5, wherein creating the password comprises sliding the columns or displacing the columns of the array mutually such that characters of the selected password is aligned on one and the same row in the resulting pattern of displaced columns, and receiving the thus created password at the authentication authority as a positional code or image comprising an indication of the position of at least one character of the password.

7. The method of claim 1, wherein presenting the strings, comprises presenting the strings as an m·

n array, such that each string forms a column of the array, each string or column comprising one and only one occurrence of a character of the password, such that the columns in successive order contains the password symbols as given by this order in the password, and receiving this pattern at the authentication authority as a positional code or image.

8. The method of claim 1 further comprising generating one or more dummy strings with a same number of random characters as the strings comprising the password characters, such that the dummy strings contain no occurrence of a password character, and interspersing said one or more dummy string(s) as dummy columns in an array at arbitrary chosen positions, wherein the one or more dummy string(s) on aligning the columns comprising the password can be arbitrarily displaced relative to each and every other column of the array.

9. The method of claim 1, characterized by performing login and sign-on procedures further comprising using the service provider for relaying any communication between the client and authentication authority.

10. The method of claim 1, further comprising displaying the strings vertically.

11. A system for authenticating a client, comprising:

receiving from an authentication authority a number of strings, the number of strings being at least equal to the number of characters in a password used to authenticate the client, wherein each of the characters of the password are assigned to a specific string, the strings being ordered following the sequence of characters in the password;

displaying each of the strings in one of;

a separate row and a separate column;

receiving a selection of each character of the password from at least a number of displayed strings as the number of characters in the password by changing a relative displayed position of one or more of the displayed strings with regard to the other displayed strings without changing an ordering of the characters in the string; and

transmitting the selected characters of the password to the authentication authority for authentication of the client.

12. The system of claim 11, wherein transmitting the selected characters of the password to the authentication authority comprises transmitting the selected characters of the password as an image to the authentication authority.

13. The system of claim 11, wherein receiving from the authentication authority the number of strings comprises receiving a dummy string having a same number of characters as the other strings but contains no occurrence of one of the characters in the password.

14. The system of claim 13, wherein displaying the strings comprises displaying the strings as an array of strings that includes the dummy string within the array or strings at an arbitrary chosen position.

15. The system of claim 11, wherein displaying the strings comprises displaying the strings such that a relative position of the display of the string is adjusted in response to receiving the selection of each character of the password.

16. The system of claim 11, wherein displaying the strings comprises the authentication authority presenting a login page for a service provider.

17. A computer-readable storage medium, excluding signals, that stores computer-executable instructions for authenticating a client, comprising:

receiving a number of strings being at least equal to the number of characters in a password used to authenticate the client, wherein each of the characters of the password are assigned to a specific string, the strings being ordered following the sequence of characters in the password;

displaying each of the strings in one of;

a separate row and a separate column;

receiving a selection of each character of the password from at least a number of displayed strings as the number of characters in the password by changing a relative position of one or more of the displayed strings with regard to the other displayed strings without changing an ordering of the characters in the string; and

transmitting the selected characters of the password to the authentication authority for authentication of the client.

18. The computer-readable storage medium of claim 17, wherein transmitting the selected characters of the password to the authentication authority comprises transmitting the selected characters of the password as an image to the authentication authority.

19. The computer-readable storage medium of claim 17, wherein receiving from the authentication authority the number of strings comprises receiving a dummy string having a same number of characters as the other strings but contains no occurrence of one of the characters in the password.

20. The computer-readable storage medium of claim 19, wherein displaying the strings comprises displaying the strings as an array of strings that includes the dummy string within the array or strings at an arbitrary chosen position.