Patent ID: 8087092

Claim:
A computer-implemented method for detecting an attempted attack on a security system, comprising: on a computer, retrieving responsive to a first query a first device parameter from a hardware system requesting access to the security system, the first device parameter being allowed to change during useful life of the hardware system within a defined tolerance without exceeding authentication criteria; comparing the retrieved first device parameter to a first stored parameter retrieved responsive to an earlier incidence of the first query; on the computer, retrieving, responsive to a second query made after a random time delay a second device parameter from the hardware system, the second device parameter comprising data that rapidly changes such that the data is different for every query when the hardware system is queried at random time intervals during operation of the hardware system; comparing the retrieved second device parameter with a second stored parameter retrieved responsive to an incidence of the second query made prior to the time delay; and triggering an authentication failure in response to (i) detecting a difference between the retrieved first device parameter and the first stored parameter that exceeds the defined tolerance or (ii) detecting no change between the retrieved second device parameter and the second stored parameter.