专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

1. 发明授权

US09002750B1 Methods and systems for secure user authentication 有权
标题翻译：用于安全用户认证的方法和系统
公开(公告)号：US09002750B1
公开(公告)日：2015-04-07
申请号：US11789054
申请日：2007-04-23
申请人： Ronald King-Hang Chu , Mark Kogen , Warren Tan , Simon Ma , Yosif Smushkovich , Gerry Glindro , Jeffrey William Coyte Nicholas
发明人： Ronald King-Hang Chu , Mark Kogen , Warren Tan , Simon Ma , Yosif Smushkovich , Gerry Glindro , Jeffrey William Coyte Nicholas
IPC分类号： G06Q20/00 , G06Q20/40 , G06F21/12
CPC分类号： G06Q20/4012 , G06F21/123 , G06F21/31 , H04L63/0838 , H04L63/168 , H04L2463/102 , H04W12/04 , H04W12/06 , H04W88/02
摘要： For secure user authentication using a one-time password (OTP) application is pre-stored on a device for generating a OTP value responsive to entry of a valid PIN, no part of the PIN is stored on the device and pre-storing on a server the PIN and a valid shared secret for the user. Upon receiving entry a purported PIN, a purported shared secret is dynamically synthesized on the device by the OTP application based on the purported PIN of the user and a purported OTP value is generated based on the purported shared secret. When entry of the purported OTP value is received by the server in an attempt to log on the server from another device, the server cryptographically calculates a purported shared secret based on the purported OTP value, and log on to the server from the other device is allowed if the calculated purported shared secret corresponds to the pre-stored shared secret.
摘要翻译：对于使用一次性密码（OTP）应用程序的安全用户认证，预先存储在用于响应于输入有效PIN的生成OTP值的设备上，不将PIN的一部分存储在设备上并预存在为用户服务PIN和有效的共享密钥。在接收到输入的声称的PIN后，根据用户的所声称的PIN由OTP应用在设备上动态合成所声称的共享秘密，并且基于所声明的共享秘密生成所声称的OTP值。当服务器接收到所声称的OTP值的输入以尝试从另一设备登录服务器时，服务器根据所声称的OTP值加密地计算出所声称的共享密钥，并且从其他设备登录到服务器如果计算出的所声称的共享秘密对应于预先存储的共享密钥，则允许该数据。

2. 发明授权

US09768963B2 Methods and systems for secure user authentication 有权
公开(公告)号：US09768963B2
公开(公告)日：2017-09-19
申请号：US13019333
申请日：2011-02-02
申请人： Ronald King-Hang Chu , Mark Kogen , Warren Tan , Simon Ma , Yosif Smushkovich , Gerry Glindro , Jeffrey William Coyte Nicholas
发明人： Ronald King-Hang Chu , Mark Kogen , Warren Tan , Simon Ma , Yosif Smushkovich , Gerry Glindro , Jeffrey William Coyte Nicholas
IPC分类号： G06Q20/00 , H04L9/32
CPC分类号： H04L9/3228
摘要： Methods and systems for secure user authentication using a OTP involve, for example, pre-storing a OTP application on a first computing device for generating a valid OTP value for the user responsive to receiving entry of a valid PIN value of the user, no part of the valid PIN value is stored on the first computing device and pre-storing on a back-end server the valid PIN value and a valid shared secret for the user. Upon receiving entry of a purported PIN value of the user, a purported shared secret is dynamically synthesized on the first computing device by the OTP application based on the purported PIN value of the user and a purported OTP value is generated on the first computing device. When entry of the purported OTP value is received by the back-end server in an attempt to log on the back-end server from a second computing device, the back-end server cryptographically calculates a window of OTP values, and log on to the back-end server from the second computing device is allowed if the calculated window of OTP values corresponds to the received OTP value.

3. 发明申请

US20110197266A1 METHODS AND SYSTEMS FOR SECURE USER AUTHENTICATION 有权
标题翻译：确保用户认证的方法和系统
公开(公告)号：US20110197266A1
公开(公告)日：2011-08-11
申请号：US13019333
申请日：2011-02-02
申请人： Ronald King-Hang CHU , Mark Kogen , Warren Tan , Simon Ma , Yosif Smushkovich , Gerry Glindro , Jeffrey William Coyte Nicholas
发明人： Ronald King-Hang CHU , Mark Kogen , Warren Tan , Simon Ma , Yosif Smushkovich , Gerry Glindro , Jeffrey William Coyte Nicholas
IPC分类号： H04L9/32
CPC分类号： H04L9/3228
摘要： Methods and systems for secure user authentication using a OTP involve, for example, pre-storing a OTP application on a first computing device for generating a valid OTP value for the user responsive to receiving entry of a valid PIN value of the user, no part of the valid PIN value is stored on the first computing device and pre-storing on a back-end server the valid PIN value and a valid shared secret for the user. Upon receiving entry of a purported PIN value of the user, a purported shared secret is dynamically synthesized on the first computing device by the OTP application based on the purported PIN value of the user and a purported OTP value is generated on the first computing device. When entry of the purported OTP value is received by the back-end server in an attempt to log on the back-end server from a second computing device, the back-end server cryptographically calculates a window of OTP values, and log on to the back-end server from the second computing device is allowed if the calculated window of OTP values corresponds to the received OTP value.
摘要翻译：用于使用OTP的安全用户认证的方法和系统涉及例如在第一计算设备上预先存储OTP应用，用于响应于接收到用户的有效PIN值的输入而生成用户的有效OTP值，的有效PIN值存储在第一计算设备上，并且在后端服务器上预存储用户的有效PIN值和有效的共享秘密。在接收到用户的所声明的PIN值的输入时，基于所声称的用户的PIN值，OTP应用在第一计算设备上动态地合成所声称的共享秘密，并且在第一计算设备上生成所声称的OTP值。当后端服务器接收到所声称的OTP值的输入以尝试从第二计算设备登录后端服务器时，后端服务器密码地计算OTP值的窗口，并登录到如果所计算的OTP值的窗口对应于接收到的OTP值，则允许来自第二计算设备的后端服务器。

4. 发明授权

US07904946B1 Methods and systems for secure user authentication 有权
标题翻译：用于安全用户认证的方法和系统
公开(公告)号：US07904946B1
公开(公告)日：2011-03-08
申请号：US11636839
申请日：2006-12-11
申请人： Ronald King-Hang Chu , Mark Kogen , Warren Tan , Simon Ma , Yosif Smushkovich , Gerry Glindro , Jeffrey William Coyte Nicholas
发明人： Ronald King-Hang Chu , Mark Kogen , Warren Tan , Simon Ma , Yosif Smushkovich , Gerry Glindro , Jeffrey William Coyte Nicholas
IPC分类号： H04L29/00
CPC分类号： H04L63/067 , H04L63/083 , H04L63/0838 , H04L2463/102 , H04W12/04 , H04W12/06 , H04W88/02
摘要： Methods and systems for secure user authentication utilizes OTP generation and validation techniques in which the shared secret for generating the OTP is not stored in the user's mobile device but instead is dynamically synthesized based on a PIN that activates the OTP generation and the personalized OTP data. The client software has no knowledge of what the correct PIN should be and always generates a normal looking OTP based on whatever PIN is entered, and the only way to learn whether or not the OTP is correct is to submit it during user login. By limiting the number of failed login attempts before the account is locked, brute-force attacks via the online channel will fail, and further, brute-force attacks to uncover the correct PIN for generating the correct OTP offline will also fail even if a hacker steals the user's mobile device and extracts the data inside for offline hacking, because there is nothing on the client that contains the PIN or encrypted by the PIN.
摘要翻译：用于安全用户认证的方法和系统利用OTP生成和验证技术，其中用于生成OTP的共享秘密不存储在用户的移动设备中，而是基于激活OTP生成和个性化OTP数据的PIN来动态合成。客户端软件不知道正确的PIN应该是什么，并且总是基于输入的任何PIN生成正常的OTP，并且了解OTP是否正确的唯一方法是在用户登录期间提交它。通过限制帐户被锁定之前失败的登录尝试次数，通过在线渠道进行的暴力攻击将失败，进一步的是，暴力攻击以发现正确的PIN以生成正确的OTP离线也将失败，即使是黑客窃取用户的移动设备，并提取内部的数据进行脱机黑客攻击，因为客户端上没有包含PIN或PIN码加密的数据。

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式