Method and apparatus for applying a partial password in a multi-factor authentication scheme

1. A server-based authentication method for use with a multi-factor authentication scheme, the method comprising:

storing, via a server, a user ID and a full Password of a user;

establishing a network connection between the server and a client device after storing the user ID and full Password;

receiving only the user ID, via the server, from the client device over the established network connection;

randomly generating a Secret PIN (SPIN) via the server;

determining, via the server, each partial password contained in the full Password;

computing a set of encrypted SPINs (ESPINs), including encrypting the SPIN with each of the Partial Passwords;

locking an Additional Factor using the SPIN, including encrypting a private key with the SPIN;

challenging a user of the client device, via the established network connection, with corresponding positions of individual characters of a randomly selected one of the Partial Passwords and a corresponding ESPIN for the randomly selected Partial Password, including prompting the user to enter the corresponding characters of the randomly selected Partial Password via the client device;

computing the SPIN from the ESPIN, via the client device, in response to a correct entry of the individual characters of the Partial Password;

unlocking the private key via the client device using the computed SPIN; and

authenticating the identity of the user of the client device via the server using the unlocked private key.

2. The method of claim 1 , further comprising:

determining if an earlier authentication attempt between the client device and the server was unsuccessful; and

repeating the challenge if an earlier authentication attempt was unsuccessful.

3. The method of claim 2 , further comprising:

randomly choosing a number of variations in a number of the positions in the Partial Password if the earlier authentication attempt was successful.

4. A server-based authentication method for use with a multi-factor authentication scheme, the method comprising:

receiving the User ID over an established network connection between a server and a client device;

randomly generating a secret PIN (SPIN) via the server in response to receiving the User ID;

computing, via the server, all possible Partial Passwords from a full Password of a user of the client device, and also computing a set of encrypted SPINs (ESPINs), including separately encrypting the SPIN with each of the possible Partial Passwords;

storing all computed ESPINs in memory of the server;

locking an Additional Factor using only the SPIN;

challenging the user with one of the ESPINs and with the corresponding positions of the Partial Password encrypted in the ESPIN over the network connection;

receiving, from the client device, an unlocked Additional Factor in response to challenging the user; and

authenticating the user using the unlocked Additional Factor.

5. The method of claim 4 , wherein the Additional Factor is a private key.

6. The method of claim 4 , further comprising removing the full Password from the server after storing all computed ESPINs.

7. A system comprising:

a processor; and

memory on which is recorded instructions for authenticating a user of a client device;

wherein the processor is configured to execute the instructions from the memory and thereby cause the processor to:

establish a network connection with the client device;

randomly generate a Secret PIN (SPIN) in response to receipt of a userID from the client device;

determine each partial password contained in the full Password;

compute a set of encrypted SPINS (ESPINs), including encrypting the SPIN with each of the Partial Passwords;

lock an Additional Factor using the SPIN, including encrypting a private key with the SPIN;

challenge the user of the client device, via the established network connection, with corresponding positions of individual characters of a randomly selected one of the Partial Passwords and a corresponding ESPIN for the randomly selected Partial Password, including prompting the user to enter the corresponding characters of the randomly selected Partial Password via the client device;

receive the private key from the client device in response to a correct entry of the individual characters of the Partial Password by the user; and

authenticate the identity of the user of the client device using the unlocked private key.