Systems and methods for authenticating a server by combining image recognition with codes

A system and method is provided for authenticating a first device to a second device. This involves providing images to the second device, receiving an indication of selected ones of the images as authenticating images, and identifying an authenticating code associated with the second device. This also involves receiving a transaction request from the second device, the first device providing a display page to the second device, the display page including the authenticating images at locations identified by the authenticating code.

BACKGROUND

1. Technical Field

Disclosed embodiments relate to the field of computer processing and communications. In particular, systems and methods are disclosed for authenticating an electronic communications partner.

2. Description of the Related Art

Communication among electronic devices is widespread and can take many forms. In some cases a client computer communicates with a server computer to enter into a transaction. The transactions may be sensitive in nature and may involve accessing a password protected account on the server. For example, a user may use an electronic device to connect to a server in order to access a bank account and conduct online banking transactions. In other cases, peer devices may communicate with each other to share files, chat, or conduct voice over IP (VoIP) telephone calls.

In electronic communication, a danger exists of a third party impersonating one of the communicating parties. If a third party is able to successfully impersonate one of the communicating parties, then the third party may be able to access private information, such as bank account passwords, credit card information, or any other private information that is electronically communicated.

FIG. 1illustrates a system100, in which a third party is able to access private information in electronic communication. System100includes sender102, intended receiver104, and impersonating receiver106. Sender102, intended receiver104, and impersonating receiver106are computing devices that are electrically or optically connected to each other, for example, by a computer network.

Sender102may be a client computer attempting to login to intended server104, which may be a server at a bank that can perform bank transactions, for example. As such, sender102sends a communication108to intended receiver104. In the absence of impersonating receiver106, intended receiver104would receive intended communication110. Intended communication110is shown as a dotted line inFIG. 1, because it may never reach intended receiver104, and is intercepted by impersonating receiver106.

Impersonating receiver106receives intercepted communication112from sender102. Impersonating receiver106establishes a bidirectional communication link114with sender102by pretending to be intended receiver104. Intended receiver104may not know that sender102attempted to communicate with it.

For example, if a user of sender102was logging into her bank account, she may direct her browser to go to the web address of her bank, which should enable her to access intended receiver104. Impersonating receiver106may intercept that communication, and respond with a webpage, which looks similar to the web page that intended receiver104would normally provide. The user at sender102may then provide her user name and password information to impersonating receiver106, mistakenly thinking that she is providing this information to intended receiver104. Impersonating receiver106may then capture the user name and password information, and then would have full access to the users bank account.

One solution that has been proposed, is for the user and intended receiver104to agree on an authenticating symbol at registration. This way, when the user accesses intended receiver104, intended receiver104sends back the agreed upon authenticating symbol. By contrast, if impersonating receiver106intercepted the communication and sent a webpage to sender102, the webpage would not include the authenticating symbol, because impersonating server106would have no knowledge of the authenticating symbol. If the webpage received at sender102does not include the authenticating symbol, then the user knows that its communication partner cannot be trusted, and she can refrain from providing her sensitive information. In this way, the user can authenticate that she is communicating with intended receiver104and not impersonating receiver106.

There are at least two standard solutions from the Cryptography literature. The first one is based on first setting a public-key infrastructure (PKI) and then using certificates released by a Certification Authority (CA). For instance, when a client visits a website with a computer, the client is often guaranteed that the website she is visiting is authentic (as opposed to being a counterfeit copy from an impostor) by the fact that the client browser verified the website's certificate, released by a trusted CA (e.g., Verisign).

Such techniques are considered very secure but are also well known to rate poorly in terms of usability, as they are hard to deploy (not all networks can afford to setup a PKI), hard to maintain (if not periodically managed, the above verification won't work), and such verifications are often ignored by users who visit the website even after being notified that the verification was not successful (i.e., if the website's certificate expired).

Browser phishing filters detect whether a web site being visited has features similar to known “phish” web site; meaning a web site that are put up by an impostor rather by the entity claimed in the web site. Such method perform relatively well in terms of usability as not much is needed by a user to maintain such filters, but are well-known to rate poorly in terms of security, as skilled impostors understand how to overcome such filters. A well-known example is the E-bay toolbar using the Account Guard method.

Recent techniques making a huge step towards solving the problem include Bank of America's SiteKey system and variants of it, which work as follows: the user provides the server with a shared secret, such as an image or passphrase, in addition to her regular password. The server shows this shared secret to the user, who is asked to recognize it before providing the server with her password. The biggest weakness of this scheme is that the server must display the shared secret in order to authenticate itself to the user. If the secret is observed or captured, the image can be replayed by an impostor which would then be able to fool the user. Still, such schemes are today used by essentially anyone having on-line access to her bank account. Other shortcoming of these schemes are discussed in the paper “Phish and HIPs: Human Interactive Proofs to Detect Phishing Attacks,” by Dhamija et al.

One drawback with the Bank of America solution is the possibility of impersonating receiver106learning of the authenticating symbol. This could happen at sender102, if someone sees the authenticating symbol on a display screen of sender102, known as a “spying attack” or a “shoulder attack,” Alternatively, impersonating receiver106may monitor communication between sender102and intended receiver104over time, to determine the authenticating symbol.

SUMMARY

In accordance with the invention, there is provided a method for authenticating a first device to a second device, the method comprising the steps of: providing images to the second device; receiving from the second device an indication of selected ones of the images as authenticating images; identifying an authenticating code associated with the second device; receiving a transaction request from the second device; and the first device providing a display page to the second device, the display page including the authenticating images at locations identified by the authenticating code.

In accordance with the invention, there is further provided a system for device authentication, the system comprising first and second devices, wherein: the first device including a processor configured to execute program instructions to: provide images to a second device; receive an indication of selected ones of the images as authenticating images; identify an authenticating code associated with the second device; receive a transaction request from the second device; and provide a display page to the second device, the display page including the authenticating images at locations identified by the authenticating code; the second device including a processor configured to execute program instructions to: receive the images from the first device; select the authenticating images from among the images; identify the authenticating images to the first device; send the transaction request to the first device; and receive the display page from the first device.

It is important to understand that both the foregoing general description and the following detailed description are exemplary and explanatory only, and are not restrictive of the invention as claimed.

DESCRIPTION OF THE EMBODIMENTS

In the following description, for purposes of explanation and not limitation, specific techniques and embodiments are set forth, such as particular sequences of steps, interfaces, and configurations, in order to provide a thorough understanding of the techniques presented here. While the techniques and embodiments will primarily be described in the context of the accompanying drawings, those skilled in the art will further appreciate that the techniques and embodiments can also be practiced in other electronic devices or systems.

Reference will now be made in detail to exemplary embodiments of the present invention, examples of which are illustrated in the accompanying drawings. Whenever possible, the same reference numbers will be used throughout the drawings to refer to the same or like parts.

FIG. 2illustrates a flow diagram200of communication between a sender202and a receiver204. Sender202and receiver204may be electronic devices including one or more from the group of: a client, a server, a desktop computer, a laptop computer, a netbook, a PDA, or any other electronic device. Sender202and receiver204may each include at least one processor configured to execute program instructions stored on at least one computer readable medium. Sender202and receiver204may each include input ports and output ports configured to communicate with each other by any type of connection, including directly, indirectly, or via a network. Sender202and receiver204may be individual computing devices, or may be distributed across multiple computing devices. Alternatively, sender202and receiver204may execute on the same device.

At a time sender202may send a registration request to receiver204(step206). The registration request may enable sender202, and/or a user of sender202, to register for a service provided by receiver204. For example, the registration request may enable the user at sender202to register for online banking, which may be a service provided by receiver204.

At a time t2, receiver204may send or provide a plurality of images to sender202(step208). At a time t3, sender202may display the plurality of images to a user of sender202(step210). At a time t4, sender202may receive a selection of or select a subset of the displayed images from the user (step212). For example, from the plurality of displayed images, the user may select three images, a basketball, a pumpkin, and a rabbit. Next, at a time t5, the user may input an authenticating code to sender202(step214). For example, the user may input three integers, 9, 1, and 0 as the authenticating code. The selected images and the authenticating code may be a shared secret between sender202and receiver204, so that sender202may authenticate receiver204in the future.

The authenticating code may be a set of integers entered by a user. The user may enter one integer for each of the images selected by the user. For example, if the user selected 3 of the plurality of images, then the user may also enter 3 integers. Each of the integers may correspond to one of the selected images. In some embodiments, the integers may be selected from the set {0-9}.

At time t6, sender202sends an indication of the selected images and the authenticating code to receiver204(step216). For example, sender202may indicate to receiver204that the user selected images of the basketball, the pumpkin, and the rabbit, and that the user input authentication code of 9, 1, and 0. This may conclude the registration of sender202with receiver204. Later, at time t7, sender202may send a transaction request to receiver204(step218). For example, the user may direct sender202to access a website that is hosted by receiver204. The website may be a homepage for a bank, at which the user may log in to access a bank account and to conduct banking transactions. The transaction request may include an identifier of sender202or the user. For example, the transaction request may include an account ID of the user. Alternatively or additionally, receiver204may read a cookie from sender202to identify an account associated with sender202.

After identifying the user's account, receiver204may identify the images and authorization code sent by the sender previously at the time t6(step216). These images the and authorization code may be a shared secret between sender202and receiver204. At a time t8, receiver204may send a display page to sender202(step220). The display page may include the images previously selected at sender202. The selected images may be placed on the display page among other images. The location of the selected images among the other images may be determined according to the authentication code. In this way, the displayed page reflects the shared secret information previously exchanged between server202and receiver204.

For example, the display page may include images of the basketball, the pumpkin, and the rabbit among other images. The locations of the images of the basketball, the pumpkin, and the rabbit within the display page may be determined according to the authorization code 9, 1, and 0 that were previously entered by the user at sender202. The other images may be fixed images that are displayed in the display page for every authentication attempt by receiver204to sender202. The other images may alternatively be images that are randomly generated or selected by the receiver204. In some embodiments, a first subset of the other images may be fixed, while a second subset of the other images may be randomly generated. Moreover, the other images may be generated or selected by the receiver204according to an algorithm.

At a time t9, sender202may receive and display the display page (step222). The user knows that receiver204is trustworthy if the display page reflects the shared secret information previously exchanged between sender202and receiver204. The user may also be prompted to select the images, from among all of the images displayed, that she had previously selected (e.g., the basketball, pumpkin, and rabbit). Moreover, the user may be required to select the basketball, pumpkin, and rabbit from particular positions on the display page. To determine the appropriate positions, the user may need to reference the authentication code.

At a time t10, sender202sends the user selection to receiver204(step224). At t11, receiver204evaluates the user selection, in order to determine whether or not sender202selected the correct images at the correct locations (step226). For example, receiver204may determine if the user selected images of the basketball, pumpkin, and rabbit at locations corresponding to the authentication code 9, 1, and 0. Receiver204may permit the user to enter a password, or other sensitive information, upon a determination the user correctly selected the images.

In some embodiments the authentication code may be selected by the user only during the registration of server202with receiver204. Alternatively, the user may renew the authentication code periodically. This may be beneficial, in the event that a third party monitors communication between sender202and receiver204, in an attempt to learn the authentication code. Periodically renewing the authentication code may reduce the probability that a third party learns the current authentication code. In some embodiments, the user may enter a new authentication code with each transaction request. Moreover, in some embodiments, receiver204may supply the authentication code, instead of sender202.

Some embodiments may include a static authentication code and a dynamic authentication code. The static authentication code may be determined at registration between server202and receiver204, for example at steps206-216ofFIG. 2. The static authentication code may be provided by either server202or receiver204, and may be active as long as a user of server202is registered with receiver204.

The dynamic authentication code may change frequently. For example, the dynamic authentication code may be updated every time the user seeks to enter into a transaction, and may be valid only for a particular transaction. The dynamic authentication code may be determined when server202requests a transaction with receiver204, for example at steps218-220ofFIG. 2. The dynamic authentication code may be provided by either server202or receiver204.

Sender202may combine both the static authentication code and the dynamic authentication code to determine an authentication code. For example, sender202may perform a mathematical calculation, such as addition, concatenation, or a modulo operation, to the static and dynamic authentication codes to determine the authentication code. After determining the authentication code, the user of sender202may know where the selected images should be located on the display page provided by receiver204in the display page sent at step220ofFIG. 2.

Some embodiments may incorporate biometric data of the user with the authentication code. For example, at registration, the user can speak the numbers 0-9, and sender102may transfer these voice samples to receiver204. At some later time, receiver204may provide server202with a set of authentication codes, either a static authentication code or dynamic authentication code. If receiver204determines the authentication code to be 9, 1, and 0, receiver204may send voice samples of the user for those numbers to sender202. Sender202may then audibly reproduce the numbers 9, 1, and 0, to the user, in the user's own voice. This may add additional assurance to the user that the user is interacting with a trusted communication partner in receiver204.

FIG. 3illustrates an exemplary display page300sent by a receiver (such as receiver204) to a sender (such as sender202), and displayed by the sender. The sender may authenticate the receiver if display page300reflects shared secret information previously exchanged between the sender and the receiver during registration.

It is assumed that during registration, the user initially selected three images from a plurality of images presented by the receiver as a shared secret between the sender and the receiver. For example, the user may have selected a basketball, a pumpkin, and a rabbit. The user may have also selected the authentication code. The authentication code may have included three digits that would each correspond to one of the selected images. For example, the user may have selected the authentication code to be 9, 1, and 0. The selected images of the basketball, the pumpkin, and the rabbit, along with the authentication code of 9, 1, and 0, may have been sent by the sender to the receiver as the shared secret information during registration.

When the sender attempts to enter into a transaction with the receiver, such as by logging into a bank account hosted by the receiver, the receiver may first send display page300to the sender. Display page300may reflect the shared secret information to enable the sender to authenticate that receiver is the same receiver with which the sender previously registered. For example, display page300may include the basketball, pumpkin, and rabbit, among other images, at positions indicated by the authorization code, as the shared secret information.

In particular, display page300includes image sets302,304, and306. Each of image sets302,304, and306take the shape of a telephone dial pad, in which numbers 0-9 are typically arranged. For example, for image set302, image308corresponds to “1,” image310corresponds to “2,” image312corresponds to “3,” image314corresponds to “4,” image316corresponds to “5,” image318corresponds to “6,” image320corresponds to “7,” image322corresponds to “8,” image324corresponds to “9,” and image326corresponds to “0.” Image sets304and306are configured in a similar manner.

The sender may render display page300and prompt the user to select individual images, such as the basketball, pumpkin, and rabbit on the basis of the authentication code. If the basketball, pumpkin, and rabbit are arranged in display page300according to the authentication code, then the sender is able to authenticate the receiver.

Thus, the user may need to map a selected image to a location on display page300associated with a corresponding authentication code. For example, the user may associate the first selected image of a basketball with the first authentication code “9.” Image set302displays an image326of a basketball at the 9thposition, since image set302is arranged as a dial pad would be arranged. Therefore, the user may select image326. The user may also associate the second selected image of a pumpkin with the second authentication code “1.” Therefore, the user may select image328from image set304, which is an image of a pumpkin at the “1” position of a dial pad. The user may also associate the third selected image of a rabbit with the third authentication code “3.” Therefore, the user may select image330from image set306, which is an image of a rabbit at the 0thposition of a dial pad.

The presentation of display page300by the sender to the user, enables the user to authenticate the receiver. Display page300reflects shared secret information as images previously selected by the user, placed at locations that correspond to the authentication code entered by the user. Therefore, the user can confirm that display page300was sent by the receiver, because only the receiver would have knowledge of the selected image and authentication code.

The use of three selected images and the authorization code of length three is exemplary only and not limiting. Any number of images and authorization codes may be used. Moreover, the authorization code does not necessarily include numbers between 0-9, which are graphically mapped to a dial pad. Other types of codes may be used to designate a location on the display page. For example, letters may be used as the authorization code, with each letter corresponding to a location on the display page. Alternatively, numerals in hexadecimal format may be used as authorization code, and may be mapped to locations on the display page.

In some cases, devices may need to communicate with each other without registering beforehand. For example, it may be impractical for peer devices in a Voice over IP (VoIP) network to all register with each other before being able to place phone calls to one another. Accordingly, it may be beneficial to for a sending device to authenticate a receiving device without having to first register with the receiving device.

The foregoing description has been presented for purposes of illustration. It is not exhaustive and does not limit the invention to the precise forms or embodiments disclosed. Modifications and adaptations of the invention can be made from consideration of the specification and practice of the disclosed embodiments of the invention. For example, one or more steps of methods described above may be performed in a different order or concurrently and still achieve desirable results.