Authentication using dynamic, client information based PIN

1. A method of authenticating a user, comprising:

providing user-specific authentication information to a client machine by a server that stores a counterpart copy of the user-specific authentication information, the client machine having a file system having multiple folders, the act of providing user-specific authentication information including directing a browser of the client machine to store different elements of user-specific authentication information in different folders of the file system;

receiving an authentication request from the client machine, the authentication request including (i) a user identifier identifying the user from among multiple users and (ii) a set of elements of the user-specific authentication information from at least two folders of the file system;

directing a personal identification number (PIN) to be computed based on the set of elements of the user-specific authentication information; and

performing an authentication operation based on the received user identifier and the PIN.

2. The method of claim 1 , wherein the authentication request further includes a token code obtained from an authentication token, and wherein the act of performing the authentication operation is further based on the token code.

3. The method of claim 1 ,

wherein the elements of the user-specific authentication information include redundant copies of the same information stored in different elements, and

wherein the browser of the client machine is directed to store different redundant copies of the same information in different folders of the client machine.

4. The method of claim 3 , wherein the PIN is computed based on a hash code of the set of elements of the user-specific authentication information.

5. The method of claim 1 , wherein the user-specific authentication information comprises encrypted cookie information.

6. The method of claim 5 , wherein the encrypted cookie information comprises at least one of Flash cookie information or SilverLight cookie information.

7. The method of claim 1 , further comprising:

sending new elements of user-specific authentication information to the client machine on a regular basis; and

maintaining a copy of the new elements of user-specific authentication information in the counterpart copy stored on the server.

8. The method of claim 7 , wherein different subsets of the user-specific authentication information are used to compute different PINs for different authentication requests.

9. The method of claim 8 , wherein the PIN for a given authentication request is computed based on a portion of the respective subset of user-specific authentication information, with a remainder of the respective subset of user-specific authentication information not being used in computing the PIN.

10. The method of claim 7 , further comprising:

obtaining machine-specific information from the client machine, wherein the machine specific information relates to a state of the client machine; and

storing the machine-specific information in the counterpart copy on the server,

wherein the PIN is computed based on both the machine-specific information and the set of elements of the user-specific authentication information.

11. The method of claim 10 , wherein the machine-specific information comprises at least one of cookie information, IP address, location information, type of browser, preferred browser language, or user agent strings.

12. A server, comprising:

a network interface; and

a controller coupled to the network interface, the controller including at least one processor and memory to form a specialized circuit, the controller being constructed and arranged to:

provide, via the network interface, user-specific authentication information to a client machine, wherein the client machine maintains a file system having multiple folders, wherein the user-specific authentication information includes multiple elements, and wherein the controller is constructed and arranged to direct a browser of the client machine to store different elements of user-specific authentication information in different folders of the file system;

maintain a counterpart copy of the user-specific authentication information on the server;

receive, via the network interface, an authentication request from the client machine, the authentication request including (i) a user identifier identifying the user from among multiple users and (ii) a set of elements of the user-specific authentication information from at least two folders of the file system;

compute a personal identification number (PIN) based on the set of elements of the user-specific authentication information; and

perform an authentication operation based on the received user identifier and the PIN.

13. The server of claim 12 ,

wherein different elements of user-specific authentication information include redundant copies of the same information stored in different elements, and

wherein the controller is constructed and arranged to direct the browser of the client machine to store redundant copies of the same information in different folders of the client machine.

14. The server of claim 12 , wherein the controller is constructed and arranged to compute the PIN based on different subsets of user-specific authentication information for different authentication requests.

15. The server of claim 14 , wherein, for each authentication session, the controller is constructed and arranged to compute the PIN based on a hash code of the subset of user-specific authentication information used for that authentication session.

16. The server of claim 12 , wherein the controller is constructed and arranged to provide the user-specific authentication information to the client machine in the form of encrypted cookie information.

17. The server of claim 12 , wherein the controller is further constructed and arranged to:

obtain machine-specific information from the client machine, wherein the machine specific information relates to a state of the client machine; and

store the machine-specific information on the server,

wherein the controller is constructed and arranged to compute the PIN based on the machine-specific information and the set of elements of the user-specific authentication information.

18. A non-transitory computer readable media including instructions which when executed by a processor cause the processor to perform a method of authenticating a client machine, the method comprising:

providing user-specific authentication information to a client machine by a server that stores a counterpart copy of the user-specific authentication information, the client machine having a file system having multiple folders, the act of providing user-specific authentication information including directing a browser of the client machine to store different elements of user-specific authentication information in different folders of the file system;

receiving an authentication request from the client machine, the authentication request including (i) a user identifier identifying the user from among multiple users and (ii) a set of elements of the user-specific authentication information from at least two folders of the file system;

directing a personal identification number (PIN) to be computed based on the set of elements of the user-specific authentication information; and

performing an authentication operation based on the received user identifier and the PIN.

19. An authentication method, comprising:

receiving, by a client machine, user-specific authentication information from a server that stores a counterpart copy of the user-specific authentication information;

storing different elements of the received user-specific authentication information in different folders of a file system of the client machine;

collecting a set of elements of the stored user-specific authentication information from at least two folders of the file system;

computing a personal identification number (PIN) based on the collected set of elements; and

issuing an authentication request to the server, the authentication request including (i) a user identifier to identify the user from among multiple users, (ii) a token code obtained from an authentication token, and (iii) the computed PIN.

20. The method of claim 1 , wherein directing the personal identification number (PIN) to be computed specifies computation of the PIN based on the user-specific authentication information received with the authentication request, and wherein the method further comprises:

storing a counterpart copy of the user-specific authentication information on a server; and

computing a reference PIN based on the user-specific authentication information in the counterpart copy,

wherein performing the authentication operation includes comparing the PIN computed based on the user-specific authentication information received in the authentication request with the reference PIN to determine whether the two PINs match.

21. The method of claim 20 , further comprising, prior to computing the reference PIN:

collecting a set of the user-specific authentication information from the counterpart copy; and

collecting a set of machine-specific information from the counterpart copy,

wherein computing the reference PIN is further based on the set of machine-specific information from the counterpart copy.