System and method for key challenge validation

• US 9,160,733 B2
• Filed: 01/13/2014
• Issued: 10/13/2015
• Est. Priority Date: 10/03/2007
• Status: Active Grant

• Current Assignee: eBay Inc.
• Original Assignee: eBay Inc.
• Inventors: Jastrebski, Grahame Andrew, Patil, Dhanurjay A. S.
• Primary Examiner(s): BROWN, CHRISTOPHER J
• Application Number:
  US14/153,911
• Publication Number:
  US 20140130141A1
• Time in Patent Office: 638 Days
• Field of Search: 713/182, 726/27
• US Class Current: 1/1
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks

Abstract

A system and method for providing key challenge validation is provided. In example embodiments, an initiation of a transaction is detected and a challenge comprising a string of characters is generated based on the detection. The string of characters includes transaction specific information indicating a detail of the transaction. The challenge is presented whereby the string of characters includes a challenge key. A response to the challenge is received that includes the challenge key. In various example embodiments, the transaction is validated based on an identification of the key challenge of the string of characters.

Claims

1. A method comprising:

detecting an initiation of a transaction;

retrieving transaction specific information indicating a detail of the transaction in response to detecting the initiation of the transaction, the detail of the transaction being recognizable as being specific to the transaction;

generating a challenge including a challenge image comprising a string of characters that includes the detail of the transaction;

presenting the challenge with an indication to return a challenge key, the challenge key being a visually distinguished portion of the string of characters that includes the detail of the transaction;

receiving a response to the challenge, the response including the challenge key; and

validating, using a processor of a machine, the transaction based on the response including the challenge key.

2. The method of claim 1, wherein the indication to return the challenge key comprises at least one selection from the group comprising instructions and a text box.

3. The method of claim 1, wherein the detail of the transaction included in the string of characters comprises a selection from a group consisting of a recipient name, a first e-mail address of the recipient, a sender name, a second e-mail address of the sender, a transaction amount, a shipping address, and a portion of a contract.

4. The method of claim 1, wherein the presenting the challenge further comprises visually distinguishing the portion of the string of characters to indicate the challenge key.

5. The method of claim 4, wherein the visually distinguishing includes using at least one visual distinguisher selected from a group consisting of colors, fonts, patterns, and shading.

6. The method of claim 4, wherein the visually distinguishing comprises presenting characters of the challenge key non-contiguously in the string of characters.

7. The method of claim 1, wherein the presenting the challenge comprises presenting characters of the challenge key contiguously in the string of characters.

8. The method of claim 1, further comprising providing instructions to return the challenge key in response to the challenge by entering the challenge key in a text box.

9. The method of claim 1, wherein the validating the transaction comprises comparing a set of characters entered in a text box with the challenge key and confirming that a user is human based on the set of characters matching the challenge key.

10. The method of claim 1, wherein the transaction specific information indicating the detail of the transaction that becomes the challenge key is retrieved from a transaction database.

11. A system comprising:

a string generation module to retrieve transaction specific information indicating a detail of a transaction in response to detecting an initiation of the transaction, and to generate a challenge including a challenge image comprising a string of characters that includes the detail of the transaction, the detail of the transaction being recognizable as being specific to the transaction;

a key generation module to select a challenge key using the string of characters that includes the detail of the transaction;

a challenge generation module to generate an image that presents the challenge key as a visually distinguished portion of the string of characters that includes the detail of the transaction; and

a hardware processor configured to validate the transaction based on a response including the challenge key.

12. The system of claim 11, further comprising an image attribute module to provide a visual attribute to the image to visually distinguish the portion of the string of characters as the challenge key.

13. The system of claim 11, wherein the challenge generation module visually distinguishes by presenting characters of the challenge key non-contiguously in the string of characters.

14. A machine-readable storage medium not having transitory signals and storing instructions which, when executed by the at least one processor of a machine, cause the machine to perform operations comprising:

detecting an initiation of a transaction;

retrieving transaction specific information indicating a detail of the transaction in response to detecting the initiation of the transaction, the detail of the transaction being recognizable as being specific to the transaction;

generating a challenge including a challenge image comprising a string of characters that includes the detail of the transaction;

presenting the challenge with an indication to return a challenge key, the challenge key being a visually distinguished portion of the string of characters that includes the detail of the transaction;

receiving a response to the challenge, the response including the challenge key; and

validating the transaction based on the response including the challenge key.

15. The machine-readable storage medium of claim 14, wherein the indication to return the challenge key comprises at least one selection from the group consisting of instructions and a text box.

16. The machine-readable storage medium of claim 14, wherein the detail of the transaction included in the string of characters comprises a selection from a group consisting of a recipient name, a first e-mail address of the recipient, a sender name, a second e-mail address of the sender, a transaction amount, a shipping address, and a portion of a contract.

17. The machine-readable storage medium of claim 14, wherein the presenting the challenge further comprises visually distinguishing the portion of the string of characters to indicate the challenge key.

18. The machine-readable storage medium of claim 17, wherein the visually distinguishing the challenge key comprises presenting characters of the challenge key non-contiguously in the string of characters.

19. The machine-readable storage medium of claim 14, wherein the presenting the challenge comprises presenting characters of the challenge key contiguously in the string of characters.

20. The machine-readable storage medium of claim 14, wherein the validating the transaction comprises comparing a set of characters entered in a text box with the challenge key and confirming that a user is human based on the set of characters matching the challenge key.