Secure authentication systems and methods
View Patent ↗Systems and methods are provided for authentication by combining a Reverse Turing Test (RTT) with password-based user authentication protocols to provide improved resistance to brute force attacks. In accordance with one embodiment of the invention, a method is provided for user authentication, the method including receiving a username/password pair associated with a user; requesting one or more responses to a first Reverse Turing Test (RTT); and granting access to the user if a valid response to the first RTT is received and the username/password pair is valid.
1. A method for user authentication utilizing a system comprising a processor and a memory encoded with program instructions that, when executed by the processor, cause the processor to perform the method, the method comprising:
receiving a username/password pair associated with a user;
determining whether the username/password pair is valid;
requesting one or more responses to a first Reverse Turing Test (RTT), regardless of whether the username/password pair is valid; and
selectively granting the user access to a resource only if the username/password pair is valid and one or more responses to the first RTT is valid.
2. The method of claim 1 , wherein the user enters the username/password pair manually.
3. The method of claim 1 , wherein the username/password pair is automatically entered.
4. The method of claim 1 , wherein the first RTT is independent of the username/password pair.
5. The method of claim 1 , wherein the first RTT is a non-deterministic or random function that depends on the username/password pair.
6. The method of claim 1 , wherein the first RTT is presented only after receiving a username/password pair.
7. The method of claim 1 , wherein a time between (a) performing the step of receiving a username/password pair and (b) performing the step of requesting one or more responses to a first RTT is substantially the same regardless of whether the username/password pair is valid.
8. The method of claim 1 , wherein the first RTT comprises at least one of:
(a) a deterministic function of the username/password pair;
(b) a non-deterministic function; or
(d) a random function.
9. The method of claim 1 , wherein the first RTT comprises an audible sound.
10. The method of claim 1 , wherein the resource comprises at least one of:
a bank account;
an Internet auction;
a stock trading account; or
an email account.
11. The method of claim 1 , wherein the user accesses the resource using any combination of:
an Internet-enabled personal digital assistant (PDA);
a cellular telephone;
a personal computer;
a server-side computer;
a web browser;
a client-side computer; and/or
a television set-top box.
12. The method of claim 1 , wherein the username/password pair comprises personal information of the user.
13. The method of claim 1 , further comprising:
notifying the user if the user gives an invalid response to the first RTT.
14. The method of claim 13 , further comprising preventing the user from accessing the resource for a predetermined period of time after an invalid username/password entry and/or an invalid response to the first RTT.
15. The method of claim 13 , further comprising determining that the response is invalid if it is not within a predetermined margin of error of a valid response.
16. The method of claim 1 , wherein the first RTT is generated as a deterministic function of the username/password pair.
17. The method of claim 16 , wherein when a particular username/password pair is received, the RTT selected is always the same for each authentication attempt.
18. The method of claim 16 , wherein a new RTT is generated only when a user provides an invalid response to the first RTT.
19. The method of claim 16 , wherein a function used to generate the first RTT is publicly known.
20. The method of claim 1 , wherein the first RTT comprises an image on which the user is instructed to locate certain characters.
21. The method of claim 20 , wherein the user enters a password by clicking the appropriate characters on the first RTT.
22. The method of claim 20 , wherein the user uses a touch screen to respond to the first RTT.
23. The method of claim 1 , further comprising monitoring a ratio of failed login attempts for each of a plurality of users.
24. The method of claim 23 , further comprising increasing the difficulty of the first RTT for a user if a ratio of failed login attempts for the user reaches a predetermined limit.
25. The method of claim 1 , further comprising monitoring an aggregate ratio of failed login attempts for a plurality of users.
26. A non-transitory computer-readable medium, the computer-readable medium storing programming instructions which, if executed by a computer system, are operable to cause the computer system to perform operations comprising:
receiving a username/password pair associated with a user;
determining whether the username/password pair is valid;
requesting one or more responses to a first Reverse Turing Test (RTT), regardless of whether the username/password pair is valid; and
selectively granting the user access to a resource only if the username/password pair is valid, and one or more responses to the first RTT is valid.
27. The computer-readable medium of claim 26 , further comprising programming instructions which, if executed by a computer system, are operable to cause the computer system to perform operations comprising:
selectively notifying the user that authentication has failed if the user gives an invalid response to the first RTT.
28. The computer-readable medium of claim 27 , further comprising programming instructions which, if executed by a computer system, are operable to cause the computer system to perform operations comprising: preventing the user from accessing the resource for a predetermined period of time after a failed authentication.
29. The computer-readable medium of claim 27 , further comprising programming instructions which, if executed by a computer system, are operable to cause the computer system to perform operations comprising: determining that the response is invalid if it is not within a predetermined margin of error of a valid response.
30. The computer-readable medium of claim 26 , wherein the first RTT comprises an image on which the user is instructed to locate certain characters to answer the first RTT.
31. The computer-readable medium of claim 26 , further comprising programming instructions which, if executed by a computer system, are operable to cause the computer system to perform operations comprising: monitoring a ratio of failed login attempts for each of a plurality of users.
32. The computer-readable medium of claim 26 , further comprising programming instructions which, if executed by a computer system, are operable to cause the computer system to perform operations comprising: monitoring a global ratio of failed login attempts for a plurality of users.