Using trusted communication channel to combat user name/password theft
View Patent ↗A technique for defining a system with enhanced trust is disclosed, in which an immediate contact is made with the user on the enhanced trust system when a compromise is first detected. The service contacts the compromised user and asks for confirmation of the results. As a result, the true user on the enhanced trust machine is able to preclude a login or preclude a password change. In a first embodiment of the invention, an enhanced trust machine is a machine where the user is currently logged in at the time that the less trusted machine attempts a login. A second embodiment of the invention comprehends an enhanced trust machine where the user has logged in repeatedly over a course of numerous weeks, as compared with a lesser trusted machine that the user has never logged into before and which is now asking for a change of the password.
1. A method for using a trusted communication channel to combat user name/password theft, comprising the steps of:
logging in a user to a trusted instant messaging system via a network connection, said instant message system comprising at least one trusted communication channel;
detecting an access attempt from an untrusted system;
making an immediate contact with said user via said trusted communication channel by way of an instant message when said access attempt from said untrusted system is first detected;
asking said user to confirm whether or not access via said untrusted system should be authorized by way of a return instant message; and
enabling or denying said access via said untrusted system in response to said confirmation.
2. The method of claim 1 , wherein if said user of said trusted instant messaging system does not respond within a predetermined period of time by way of a return instant message, then said untrusted system is enabled with said access.
3. The method of claim 1 , wherein a trusted instant messaging system is a system where said user is currently logged in at a time that said untrusted system attempts to gain access.
4. The method of claim 1 , wherein a trusted instant messaging system is a system where said user has been granted access repeatedly over a course of time.
5. The method of claim 4 , further comprising the step of:
tagging at least one previously untrusted system that is used extensively by said user as a system that is trusted.
6. The method of claim 1 , further comprising the step of:
developing experience with regard to work patterns of said user and an expectation that a particular system is used by said user.
7. The method of claim 6 , further comprising the steps of:
recording a history of number of times said user has logged in from a particular system; and
storing evidence of said history, optionally signed by a service to preclude forgery.
8. The method of claim 1 , wherein a system having current active access is considered relatively more trusted than a system that has either does not have current access, or has not had prior access, by a given user.
9. The method of claim 1 , further comprising the steps of:
tagging a system; and
verifying access to prevent forged authentication.
10. The method of claim 1 , further comprising the step of:
using a random password generation scheme.
11. The method of claim 1 , further comprising the step of:
using current and prior login history to establish a pattern of actions to detect suspicious logins and/or password changes.
12. The method of claim 1 , further comprising the step of:
applying experiential information to password authentication; and
tagging a system to identify relative trust of said system.
13. The method of claim 1 , further comprising the step of:
capturing system addresses for systems which attempt to use stolen accounts.
14. A method for determining if a system is a trusted system, comprising the steps of:
detecting an access attempt at an untrusted system;
using an instant messaging system to make immediate contact with a user of a trusted system;
asking said user for confirmation with regard to one or more actions to be taken in connection with said untrusted system; and
precluding said one or more actions if said user refuses to provide affirmative conformation.
15. The method of claim 14 , further comprising the step of:
adding said untrusted system to a filter list which performs any of blocking access by said untrusted system and instituting an investigation.
16. An apparatus for using enhanced trust to combat user name/password theft in a network, comprising:
a mechanism for detecting an access attempt from an untrusted system;
an instant messaging system for making an immediate contact with a user of a trusted system via a network connection when said access attempt from said untrusted system is first detected;
a mechanism for asking said user to confirm whether or not access via said untrusted system should be authorized; and
a mechanism for enabling or denying said access via said untrusted system in response to said confirmation.
17. The apparatus of claim 16 , wherein if said user of said trusted system does not respond within a predetermined period of time, then said untrusted system is enabled with said access.
18. The apparatus of claim 16 , wherein a trusted system is a system where said user is currently logged in at a time that said untrusted system attempts to gain access.
19. The apparatus of claim 16 , wherein a trusted system is a system where said user has been granted access repeatedly over a course of time.
20. The apparatus of claim 19 , further comprising:
a mechanism for tagging a system that is used extensively by said user as a system that is trusted.
21. The apparatus of claim 16 , further comprising:
a mechanism for developing experience with regard to work patterns of said user, and an expectation that a particular system is used by said user.
22. The apparatus of claim 21 , further comprising:
a mechanism for recording a history of number of times said user has logged in from a particular system; and
a storage means for storing evidence of said history, optionally signed by a service to preclude forgery.
23. The apparatus of claim 16 , wherein a system having current active access is considered relatively more trusted than a system that has either does not have current access, or has not had prior access, by a given user.
24. The apparatus of claim 16 , further comprising:
a mechanism for tagging a system; and
a mechanism for verifying access to prevent forged authentication.
25. The apparatus of claim 16 , further comprising:
a random password generation scheme for generating a random number, wherein an attacker must immediately use a compromised password.
26. The apparatus of claim 16 , further comprising:
a mechanism for using current and prior login history to establish a pattern of actions to detect suspicious logins and/or password changes.
27. The apparatus of claim 16 , further comprising:
a mechanism for applying experiential information to password authentication; and
a mechanism for tagging a system to identify relative trust of said system.
28. The apparatus of claim 16 , further comprising:
a mechanism for capturing system addresses for systems which attempt to use stolen accounts.
29. An apparatus for determining if a system is a trusted system, comprising:
a mechanism for logging a user into a trusted instant messaging system via a network connection, said instant message system comprising at least one trusted communication channel;
a mechanism for detecting an access attempt at an untrusted system;
a means for making immediate contact with a user of a trusted system with the messaging system using the at least one trusted communication channel;
a mechanism for asking said user for confirmation with regard to one or more actions to be taken in connection with said untrusted system; and
a mechanism for precluding said one or more actions if said user refuses to provide affirmative conformation.
30. The apparatus of claim 29 , further comprising:
a filter list of untrusted systems, which performs any of blocking access by said untrusted system and instituting an investigation.
31. A method for using a trusted communication channel to combat user name/password theft, comprising the steps of:
detecting an access attempt from an untrusted system;
making an immediate contact with a user of a trusted system when said access attempt from said untrusted system is first detected;
asking said user to confirm whether or not access via said untrusted system should be allowed; and
permitting or denying said access via said untrusted system in response to said confirmation
developing experience with regard to work patterns of said user and an expectation that a particular system is used by said user,
recording a history of number of times said user has logged in from a particular system; and
storing evidence of said history, optionally signed by a service to preclude forgery.
32. The method of claim 31 , wherein if said user of said trusted system does not respond within a predetermined period of time, then said untrusted system is allowed said access.
33. The method of claim 31 , wherein a trusted system is a system where said user is currently logged in at a time that said untrusted system attempts to gain access.
34. The method of claim 31 , wherein a trusted system is a system where said user has been granted access repeatedly over a course of time.
35. The method of claim 34 , further comprising the step of:
tagging a system that is used extensively by said user as a system that is trusted.
36. The method of claim 31 , wherein a system having current active access is considered relatively more trusted than a system that has either does not have current access, or has not had prior access, by a given user.
37. The method of claim 31 , further comprising the steps of:
tagging a system; and
verifying access to prevent forged authentication.
38. The method of claim 31 , further comprising the step of:
using a random password generation scheme.
39. The method of claim 31 , further comprising the step of:
using current and prior login history to establish a pattern of actions to detect suspicious logins and/or password changes.
40. The method of claim 31 , further comprising the step of:
applying experiential information to password authentication; and
tagging a system to identify relative trust of said system.
41. The method of claim 31 , further comprising the step of:
capturing system addresses for systems which attempt to use stolen accounts.
42. An apparatus for using enhanced trust to combat user name/password theft, comprising:
a mechanism for detecting an access attempt from an untrusted system;
a messaging system for making an immediate contact with a user of a trusted system when said access attempt from said untrusted system is first detected;
a mechanism for asking said user to confirm whether or not access via said untrusted system should be allowed; and
a mechanism for permitting or denying said access via said untrusted system in response to said confirmation;
a mechanism for developing experience with regard to work patterns of said user, and an expectation that a particular system is used by said user;
a mechanism for recording a history of number of times said user has logged in from a particular system; and
a storage means for storing evidence of said history, optionally signed by a service to preclude forgery.
43. The apparatus of claim 42 , wherein if said user of said trusted system does not respond within a predetermined period of time, then said untrusted system is allowed said access.
44. The apparatus of claim 42 , wherein a trusted system is a system where said user is currently logged in at a time that said untrusted system attempts to gain access.
45. The apparatus of claim 42 , wherein a trusted system is a system where said user has been granted access repeatedly over a course of time.
46. The apparatus of claim 45 , further comprising:
a mechanism for tagging a system that is used extensively by said user as a system that is trusted.
47. The apparatus of claim 42 , wherein a system having current active access is considered relatively more trusted than a system that has either does not have current access, or has not had prior access, by a given user.
48. The apparatus of claim 42 , further comprising:
a mechanism for tagging a system; and
a mechanism for verifying access to prevent forged authentication.
49. The apparatus of claim 42 , further comprising:
a random password generation scheme for generating a random number, wherein an attacker must immediately use a compromised password.
50. The apparatus of claim 42 , further comprising:
a mechanism for using current and prior login history to establish a pattern of actions to detect suspicious logins and/or password changes.
51. The apparatus of claim 42 , further comprising:
a mechanism for applying experiential information to password authentication; and
a mechanism for tagging a system to identify relative trust of said system.
52. The apparatus of claim 42 , further comprising:
a mechanism for capturing system addresses for systems which attempt to use stolen accounts.