Secure authentication systems and methods
View Patent ↗Systems and methods are provided for authentication by combining a Reverse Turing Test (RTT) with password-based user authentication protocols to provide improved resistance to brute force attacks. In accordance with one embodiment of the invention, a method is provided for user authentication, the method including receiving a username/password pair associated with a user; requesting one or more responses to a first Reverse Turing Test (RTT); and granting access to the user if a valid response to the first RTT is received and the username/password pair is valid.
1. A method for authenticating a user for access to an electronic resource managed by a system, the system comprising a processor and a non-transitory computer-readable storage medium storing instructions that, when executed by the processor, cause the system to perform the method, the method comprising:
receiving personal information associated with a user attempting to access the electronic resource;
determining whether the personal information is valid;
requesting, after and in response to receiving the personal information from the user, one or more responses to a first Reverse Turing Test (RTT), regardless of whether the personal information is valid;
receiving one or more responses to the first RTT;
determining whether the one or more responses to the first RTT are valid; and
selectively granting the user access to the electronic resource only if the personal information is valid and the one or more responses to the first RTT are valid.
2. The method of claim 1 , wherein the personal information is provided by the user manually.
3. The method of claim 1 , wherein the personal information is provided automatically.
4. The method of claim 1 , wherein the first RTT is independent of the personal information.
5. The method of claim 1 , wherein the first RTT is based on a non-deterministic or random function that depends on the personal information.
6. The method of claim 1 , wherein the method further comprises presenting the first RTT only after receiving the personal information.
7. The method of claim 1 , wherein the personal information comprises a username/password pair, and wherein a time between receiving the username/password pair and requesting the one or more responses to the first RTT is not increased in response to a determination that the username/password pair is invalid.
8. The method of claim 1 , wherein the first RTT comprises at least one of:
a deterministic function;
a non-deterministic function; and
a random function.
9. The method of claim of claim 1 , wherein the first RTT comprises an audible sound.
10. The method of claim 1 , wherein the electronic resource comprises at least one of:
a bank account;
an Internet auction;
a stock trading account; and
an email account.
11. The method of claim 1 , wherein the system comprises at least one of:
an Internet-enabled personal digital assistant (PDA);
a cellular telephone;
a personal computer;
a server-side computer;
a client-side computer; and
a television set-top box.
12. The method of claim 1 , wherein the method further comprises notifying the user if the user gives an invalid response to the first RTT.
13. The method of claim 12 , wherein the method further comprises preventing the user from accessing the electronic resource for a predetermined period of time after receiving an invalid response to the first RTT.
14. The method of claim 12 , wherein the method further comprises determining that the response to the first RTT is invalid based on determining that a number of incorrect characters of the response exceeds a threshold number of incorrect characters.
15. The method of claim 1 , wherein the first RTT is a deterministic function of the valid personal information.
16. The method of claim 15 , wherein a function used to generate the first RTT is publicly known.
17. The method of claim 1 , wherein the first RTT comprises an image on which the user is instructed to locate certain characters.
18. The method of claim 17 , wherein the user is instructed to locate the certain characters using a cursor control device.
19. The method of claim 17 , wherein the user is instructed to locate the certain characters using a touch screen display.
20. The method of claim 1 , wherein the instructions are further configured to select the first RTT based on a number of received invalid personal information entries.