Patent ID: 8667280
Filing Date: 2014-03-04
Classification: G06F,H04L

Abstract:
1. A server-based authentication method for use with a multi-factor authentication scheme, the method comprising: storing, via a server, a user ID and a full Password of a user; establishing a network connection between the server and a client device after storing the user ID and full Password; receiving only the user ID, via the server, from the client device over the established network connection; randomly generating a Secret PIN (SPIN) via the server; determining, via the server, each partial password contained in the full Password; computing a set of encrypted SPINs (ESPINs), including encrypting the SPIN with each of the Partial Passwords; locking an Additional Factor using the SPIN, including encrypting a private key with the SPIN; challenging a user of the client device, via the established network connection, with corresponding positions of individual characters of a randomly selected one of the Partial Passwords and a corresponding ESPIN for the randomly selected Partial Password, including prompting the user to enter the corresponding characters of the randomly selected Partial Password via the client device; computing the SPIN from the ESPIN, via the client device, in response to a correct entry of the individual characters of the Partial Password; unlocking the private key via the client device using the computed SPIN; and authenticating the identity of the user of the client device via the server using the unlocked private key.